[ManningWorks]

Summary

Fixes the 4 dependabot alerts open on main (flagged during the 1.6.1 release cut, card t_80939be8). All four have fixes available; each bump stays within the existing parent dependency ranges — no direct dependencies, versions, or code changed.

The alerts

Alert	Package	Manifest	Advisory	Range cleared
57	source-map-js 1.2.1 → 1.2.2	pnpm-lock.yaml (transitive, runtime)	GHSA-68fv-2mgg-jv7q (high, event-loop DoS via indexed source-map section offsets)	< 1.2.2
3	toml 4.1.1 → 4.3.0	.opencode/package-lock.json (transitive, runtime)	GHSA-82x6-q7mm-w9cf (high, uncontrolled recursion)	< 4.2.0
2	toml 4.1.1 → 4.3.0	.opencode/package-lock.json (transitive, runtime)	GHSA-v5mp-jgw5-2x6j (high, prototype pollution via __proto__ key-path)	< 4.1.2
1	uuid 13.0.0 → 13.0.2	.opencode/package-lock.json (transitive, runtime)	GHSA-w5hq-g745-h8pq (medium, missing buffer bounds check in v3/v5/v6 with buf)	< 13.0.1

Changes (3 files)

• package.json — root pnpm.overrides: added source-map-js: ^1.2.2, same style as the existing vite override. The transitive path runs through the vite/vitepress dev tooling (@vue/compiler-*, vue/compiler-sfc, postcss), none of which declare a reachable range, so a root override is the clean shape. pnpm why source-map-js confirms no direct importer.
• pnpm-lock.yaml — source-map-js resolves 1.2.1 → 1.2.2 (packages section + 5 snapshot refs); nothing else moved.
• .opencode/package-lock.json — npm update toml uuid in .opencode/: toml 4.1.1 → 4.3.0 and uuid 13.0.0 → 13.0.2, both the latest releases inside the ranges effect@4.0.0-beta.48 declares (^4.1.1, ^13.0.0). No other entries changed.

Alert 57 was legitimately missed by the PR 38 lockfile refresh (706edf2): the source-map-js advisory landed 2026-10-13, after that refresh.

Verification

• Lockfile grep: zero stale references to source-map-js 1.2.1; source-map-js resolves only at 1.2.2; toml 4.3.0, uuid 13.0.2.
• Gate: pnpm install && pnpm build && pnpm typecheck && pnpm lint && pnpm test — all green locally (64 test files, 1051 tests passed).
• Dependabot auto-closes the alerts once the default branch lockfiles resolve past the vulnerable ranges; will re-check the open-alert count after merge and note in the card if GitHub has not re-evaluated yet.

Out of scope (per card constraints)

• No packages/core version bump (pinned at 1.6.1 for the in-flight release PR 54), no tags, no publish.
• .opencode/ is tracked on the default branch and actively monitored by dependabot, so it was secured in place rather than untracked.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
projex-docs	Ready	Preview	Oct 14, 2026 11:38am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 42477296-ae88-434e-99f6-debb1cb60e71

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ManningWorks]

Verdict: APPROVE — PR 55 on ManningWorks/Projex (branch wt/t_f2b039bc, head 67ee6a9, single commit)

Independent review of the diff against base 9f264e1 (origin/main at open), re-verified against current main 29875cf now that PR 54 is merged.

Scope (strict check) — PASS

• Diff is exactly 3 files, +16/-14: package.json, pnpm-lock.yaml, .opencode/package-lock.json. No scope creep.
• package.json: pnpm.overrides gains exactly one entry, source-map-js "^1.2.2", alongside the existing vite "^7.3.6" (same style). Root stays 1.3.0 private.
• pnpm-lock.yaml: packages entry moves 1.2.1 -> 1.2.2 with new integrity hash; overrides block gains source-map-js: ^1.2.2; snapshot refs updated in @vue/compiler-core@3.5.43, @vue/compiler-sfc@3.5.43, magicast@0.5.5, postcss@8.5.28, plus the source-map-js self-snapshot. Grep: zero stale 1.2.1 references. No other package version moved.
• .opencode/package-lock.json: toml 4.1.1 -> 4.3.0 and uuid 13.0.0 -> 13.0.2, resolved URLs + integrity both updated. Grep: zero stale 4.1.1/13.0.0 references. No other entries changed.

Supply chain — PASS

• All three integrity hashes in the diff were independently recomputed from the published npm tarballs (openssl sha512 SRI) and match byte-for-byte.

Alert coverage — PASS

• source-map-js 1.2.2 clears GHSA-68fv-2mgg-jv7q (vulnerable >= 1.0.0 < 1.2.2); toml 4.3.0 clears GHSA-82x6-q7mm-w9cf (< 4.2.0) and GHSA-v5mp-jgw5-2x6j (< 4.1.2); uuid 13.0.2 clears GHSA-w5hq-g745-h8pq (>= 13.0.0 < 13.0.1). All four open alerts (chore(deps-dev): bump vite from 7.3.6 to 7.3.7 in the npm_and_yarn group across 1 directory #57, GitHub type: config is overridden by fetched repo name #3, sortByDate only works for github/hybrid project types #2, Auto-populated live link not overridden by custom links #1 — GHSA ids confirmed live) are covered by the default-branch lockfile state after merge.

Mergeability — PASS

• PR 54 (1.6.1 release) has since landed on main (now 29875cf). Dry-run merge of wt/t_f2b039bc onto current main: clean, no conflicts. No rebase performed.
• CI green on head 67ee6a9: Build, Test, Type Check, Lint all pass (Vercel preview passed too).

Findings: 0 (no CRITICAL/HIGH/MEDIUM/LOW)

One record-accuracy observation, non-blocking and adjacent to the PR: the review card's parenthetical lists @vue/compiler-dom as one of the snapshot references, but in this lockfile the compiler-dom snapshot has no direct source-map-js dependency (it inherits it transitively via compiler-core). The actual updated references are @vue/compiler-core, @vue/compiler-sfc, magicast (the @babel/parser entry), postcss, plus the self-snapshot — five hunks total. The diff itself is complete and minimal; nothing is required of the author.

Formal GH approve not possible (self-authored); posting the verdict per house practice. Next step: ordinary merge, then live-verify alerts #57, #3, #2, #1 auto-close on the default branch.