[P2] main CI red: npm audit high on source-map-js (GHSA-68fv-2mgg-jv7q) #132

Status: confirmed-live, verified 2026-10-11 against GitHub Actions on main.

Test Node SDK → Lint & Type Check fails at the Audit dependencies step on main after the 2026-10-11 dependency merges (#130, #129, #107), run 38138804651: 1 high severity vulnerability.

Advisory: source-map-js — GHSA-68fv-2mgg-jv7q (event-loop DoS via indexed source-map section offsets). Transitive dev dependency.

Not caused by the merges: npm audit --package-lock-only reports the same 1 high on the pre-merge lockfile (682d5d6) and post-merge (9bb9907). New advisory published since the last green run (2026-10-03).

Repro: npm ci && npm audit. Likely fix: npm audit fix or an overrides entry for source-map-js once a patched version exists.