[superagent-security]

Superagent dependency review

Dependency change

Package	Change	Age
source-map-js	1.2.1 → 1.2.2	25 days

Question	Result
Is the update vulnerable or malicious?	✅ No issues found
Is this dependency used?	🛠️ Yes, development/CI only — Transitive only; no repository source imports source-map-js or SourceMapConsumer. Reached via postcss@8.5.23 (from next in apps/web), postcss@8.5.26 (tailwind postcss, vite) and @tailwindcss/node (dev chain of apps/web). Used by the Next.js CSS build/dev pipeline; the production Docker image builds only api and worker.

Why this update matters

The current version's repository impact could not be confirmed. See the candidate assessment and its limitations below.

Issue details

• Current version: GHSA-68fv-2mgg-jv7q — Not yet confirmed. No supported repository applicability evidence was provided for this advisory.

What we checked

All shipped files of npm:source-map-js@1.2.2 were read and compared with the 1.2.1 baseline. Changed files: lib/source-map-consumer.js, lib/source-map-generator.js, lib/source-node.js, lib/quick-sort.js, package.json. The source-map-consumer.js change adds MAX_SECTION_OFFSET_LINE = 1e7 and an isValidOffset check (number, non-negative, safe integer) for section offset line and column, bounds nested totals via _maxOffsetLine, and reads the sources getter once per section. The source-map-generator.js change replaces the ';' append loop with ';'.repeat(lineDelta). The source-node.js change stops adding empty lines once the generated code is exhausted. The quick-sort.js change probes eval availability and, when eval is blocked, calls the local SortTemplate instead of new Function; the eval-based path is unchanged from the baseline. No lifecycle scripts, no install hooks, no privilege or persistence logic, no obfuscation, no environment/time/platform gates, no network or process APIs, and no agent-directed text were found in any shipped file. Manifest version is 1.2.2, main is./source-map.js, files list is unchanged. Static review only.

• source-map-js@1.2.2: reviewed files — done; checked installation — not confirmed; ran the package — not confirmed; compared with the current version — done.
  • Static review only: package code was not installed or executed, so installTested and runtimeTested are false by policy.
  • The advisory fix was not exercised at runtime; mitigation was assessed by reading candidate source and diffing it against the baseline.
  • Candidate tarball integrity was matched to the repository lockfile integrity and the supplied artifact sha256, not to the public npm registry (no network access).
  • Unchanged files (same sha256 as baseline) were pattern-scanned and hash-compared rather than read line by line.
  • Repository targets are source-only; usage was derived from the lockfile/manifest graph and source greps, not from a runtime trace.
• Current source: 7bb2c963cfb7; update source: e07fd2c1cd7f.

Release notes

v1.2.2

Compare Source

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openmetal	Ready	Preview	Oct 26, 2026 2:42am UTC

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.