[MelvinBot]

Details

Bumps transitive source-map-js 1.2.1 → 1.2.2 (lockfile only) to fix Dependabot alert CVE-2026-93749: event-loop DoS via malicious indexed source maps.

Usage: Not used by library code. Only pulled in by WebExample via expo → @expo/metro-config → postcss (CSS source maps during Metro bundling). postcss already allows ^1.2.1, so no other packages change.

Change Log

1.2.2

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (7rulnik/source-map-js#79)
• Fix crash in browsers with CSP script-src that disallows unsafe-eval (7rulnik/source-map-js#29)

Related Issues

https://github.com/Expensify/Expensify/issues/695631

Manual Tests

No new tests: lockfile-only patch bump of a transitive dep used only by the example app. npm ci and npm test pass.

1. npm ci, then npm ls source-map-js → shows 1.2.2.
2. cd WebExample && npm run web → app bundles and loads; type Markdown in the input and confirm live formatting works.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[inimaga]

@MelvinBot sign the CLA

[marcaaron]

Does not seem like Melvin responded to that request.

[marcaaron]

I don't really see the point in blocking on that, though. Melvin is not a contributor nor a human and can't really agree to anything 😄

[os-botify]

🚀 Published to npm in 0.1.359 🎉

[melvin-bot]

@marcaaron looks like this was merged without a test passing. These checks had not passed on 98c9e71 when it was merged:

• CLA / CLA (failure)

Please add a note explaining why this was done and remove the Emergency label if this is not an emergency.