diff --git a/CHANGELOG.md b/CHANGELOG.md
index 855537e..0d12494 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes to skillhook, newest first. The format follows [Keep a Chang
 
 ## Unreleased
 
+- Update the development-only `source-map-js` lockfile entry to 1.2.2 to address the indexed source-map denial-of-service advisory.
+
 ## 0.10.3 (2026-10-14)
 
 - Bound decoded Cloud response bodies (4 MiB for machine sync, 64 MiB for other calls), cancel oversized or stalled streams, and normalize/redact body-read errors like connection errors. This hardens transport buffering; it does not establish the cause of the reported native HTTP/2 stall.
diff --git a/package-lock.json b/package-lock.json
index de31431..dcaf1a5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1790,9 +1790,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "peer": true,