chore(deps): security bumps 2026-10-06

[devin-ai-integration]

What and why

Nightly security sweep. Bumps the transitive web dependency source-map-js 1.2.1 → 1.2.2 (only comes in through postcss@8.5.23). This fixes GHSA-68fv-2mgg-jv7q (high: event-loop DoS from indexed source-map section offsets). npm audit --omit=dev in web/ found it.

Alert	Package	Old → New	Manifest
GHSA-68fv-2mgg-jv7q (npm audit, high)	source-map-js	1.2.1 → 1.2.2	web/package-lock.json

Notes:

• Release age: 1.2.2 was published 2026-09-30, so it is 6 days old, short of the preferred 7. It is the only fixed version. I checked the tarball before taking it: same sole maintainer as 1.2.1 (7rulnik), and the diff against 1.2.1 contains only the offset bounds/validation fix (plus a new Function eval-availability guard in quick-sort.js). It adds no new dependencies and no install scripts.
• Lockfile edit: I changed only the node_modules/source-map-js entry (version, resolved, integrity), a 3-line diff. npm update source-map-js with the local npm 10.9.3 also rewrote unrelated metadata (libc, dev/devOptional; 109 deletions), so I didn't use it. npm ci accepted the edited lockfile and left it unchanged.
• Dependabot / CodeQL: I couldn't read either alert list. Both returned HTTP 403 with the default credentials, and GITHUB_CODEWHALE_SECURITY_PAT isn't provisioned. This PR covers only what the audits found. Details are in the security sweep 2026-10-06 issue.

Issue

No-Issue: dependency security bump

How I tested it

• cd web && npm ci → added 891 packages, and audited 892 packages; lockfile unchanged afterward
• npm ls source-map-js → postcss@8.5.23 overridden → source-map-js@1.2.2
• npm audit --omit=dev → found 0 vulnerabilities (before: 1 high severity vulnerability, source-map-js)
• npm run lint → ✖ 1 problem (0 errors, 1 warning), an unused spawnSync in scripts/facts-lib.mjs that was already there
• npm run prebuild && npm run build → ✓ Compiled successfully, ✓ Generating static pages using 7 workers (894/894)
• Rust: no Cargo changes. cargo audit isn't installed locally, so I didn't run it. The CI security-audit.yml cargo-audit job on main ecbf2869a (2026-10-06 02:32Z) passed: Scanning Cargo.lock for vulnerabilities (728 crate dependencies), 0 vulnerabilities, 1 allowed warning (RUSTSEC-2025-0141, bincode unmaintained). https://github.com/codewhale-hq/Codewhale/actions/runs/37404609978

Checklist

• One focused change, rebased on current main
• cargo fmt --all passes, and tests cover new or changed behavior (no Rust changes)
• If this adds or changes a user-facing feature, I updated its docs and its row in docs/features.toml (n/a)

Link to Devin session: https://app.devin.ai/sessions/1a4ed47e62cb4a0f96845bc8bb6d0e25
Open in Devin Desktop: https://app.devin.ai/desktop/session/1a4ed47e62cb4a0f96845bc8bb6d0e25?variant=devin
Requested by: @Hmbown

Current source disposition — 2026-10-14

The complete changed source-map-js version/resolved/integrity entry exactly matches main1.2.2, so no dependency hunk is missing. Carrying commits: 9e68c17a4e. Original commits and source branch are preserved. This is a source-incorporation status, not an actual merge or a relabeling of older failed CI. We will preserve the newer implementations and complete the remaining ancestry/disposition with exact current gates; no downgrade, arbitrary empty rerun commit or branch cleanup. 0.10.2 has not shipped.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[claude]

⚠️ Code review skipped — your organization has no extra usage available to pay for this review.

If your organization's extra usage balance is empty, an organization admin can add extra usage credits at claude.ai/admin-settings/usage. If its monthly spend limit was reached, an admin can raise it on the same page. If neither applies, contact Anthropic support.

Once extra usage is available, someone with write access to this repository can comment @claude review on this pull request to trigger a review.

[Copilot]

🟢 Approval recommended

The focused lockfile update is valid, compatible with PostCSS’s dependency range, and uses verified package metadata.

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• web/package-lock.json: Generated file