Repository navigation
fix(deps): source-map-js 1.2.2 for Dependabot alert 76, open 1.3.0-beta.0 (#1051) - #1052
Conversation
…ta.0 (#1051) Lockfile-only: source-map-js 1.2.1 -> 1.2.2 (GHSA-68fv-2mgg-jv7q), pulled in by @tailwindcss/node, postcss and css-tree; dev tooling, not in the packaged app. Deferred until after v1.2.4 so the tag stayed the smoked build. The same PR opens the next milestone at 1.3.0-beta.0. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to No actionable version or packaging mismatch is evident, so this change appears ready to merge after normal checks. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Linked Issues check |  |
Issue #1051 requires source-map-js@1.2.2, no dependency range changes, passing gates, and a packaged asar with every runtime dependency. The reviewed summary confirms the version change to `1.3.0-be… |
Provide reviewable evidence for the lockfile resolution and the required gate and packaged-asar results. The excluded package-lock.json prevents direct verification of the dependency update and range preservation. |
✅ Passed checks (3 passed)
-
Check name Status Explanation Title check The title clearly identifies both primary changes: updating source-map-js to 1.2.2 for Dependabot alert 76 and opening version 1.3.0-beta.0. It is specific and related to the changeset. Description check The description follows the required template. It includes the linked issue, change summary, change type, smoke-check decision, validation results, checklist status, and screenshot note. It provides s… Out of Scope Changes check The reviewed summary reports only the package version change. Issue #1051explicitly includes opening1.3.0-beta.0, and the reported lockfile update is directly related to the issue's security fix. …
Full details: Linked Issues check
-
Explanation
Issue
#1051requiressource-map-js@1.2.2, no dependency range changes, passing gates, and a packaged asar with every runtime dependency. The reviewed summary confirms the version change to1.3.0-beta.0, butpackage-lock.jsonis excluded from review and no independent evidence establishes its resolved version or the required gate and asar results. The issue's coding requirements cannot be fully assessed.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
![stashpeak-review-bot[bot]](https://avatars.githubusercontent.com/in/4331802?s=60&v=4){kind=small}
There was a problem hiding this comment.
🤖 Review Bot
🏷 config 🕐 ~2-5 min 🐞 0 🔐 0 🧪 0 📏 0
The diff only touches package.json, bumping the version string from 1.2.4 to 1.3.0-beta.0 to open the next milestone. The lockfile upgrade to source-map-js 1.2.2 described in the PR body (and verified present in the checked-out package-lock.json, dev-only dependency) isn't part of the shown diff, but the visible change itself is a trivial, no-logic version bump with no runtime, security, or test impact, and nothing in the repo standards block (process spawning, kill matching, IPC contract) applies to it.
Walkthrough (1 file)
| File | Note |
|---|---|
package.json |
Version bumped 1.2.4 -> 1.3.0-beta.0 to mark the start of the next milestone; only consumer is the release workflow's tag/version match check, which isn't affected. |
Total: $0.0171 (plus subscription)
Full-lane cost
Review bot usage
| mode | engine | model | tokens in | tokens out | cost | time | comments |
|---|---|---|---|---|---|---|---|
| full | claude-code | claude-sonnet-5 | 16 | 2653 | sub | 44234 ms | 0 |
| shadow | api | openai/gpt-5.6-terra | 2630 | 666 | $0.0146 | 6623 ms | 1 |
| shadow | api | deepseek/deepseek-v4-flash | 2693 | 576 | $0.0003 | 7636 ms | 0 |
| shadow | api | xiaomi/mimo-v2.6-flash | 2675 | 793 | $0.0006 | 21013 ms | 1 |
| shadow | api | nvidia/nemotron-3-ultra-550b-a55b:free | 2726 | 823 | $0.0000 | 25077 ms | 0 |
| shadow-verify | api-agentic | xiaomi/mimo-v2.6-flash | 30907 | 2457 | $0.0016 | 53918 ms | 1 |
1 participant
Closes #1051
What does this PR do?
Two lines that each wait on the next PR anyway:
source-map-js1.2.2 instead of 1.2.1 (GHSA-68fv-2mgg-jv7q, high). It is build and test tooling only, pulled in by@tailwindcss/node,postcssandcss-tree(through jsdom). All three already accept^1.2.1, so no range changes. It isdev: trueand not in the packaged app. We deferred it until after v1.2.4, so that tag stayed the exact build the smoke covered.1.2.4→1.3.0-beta.0(github-release step 0). Mid-cycle builds then identify themselves instead of claiming the version that shipped.What the tests prove
No code change. On this branch, after
npm ci:source-map-jsresolves to 1.2.2.electron-builder --dir, unsigned config) has an asar of 882 entries with every runtime dependency.audit:runtimepasses.Type of change
Smoke check
Checklist
npm run buildpasses (packaged withelectron-builder --dir, unsigned config)npm run typecheckpassesnpm run format:checkpassesScreenshots
Not a visual change.
🤖 Generated with Claude Code
Summary by CodeRabbit