Merge pull request #1150 from cipherstash/fix/cip-4886-source-map-js

fix(deps): patch source-map-js to 1.2.2

Author: tobyhede

pnpm-lock.yaml

@@ -90,6 +90,10 @@ overrides:
   # installed with the entry still sitting here looking like a fix. Keep the
   # ceiling AHEAD of the patched floor, not at it.
   'postcss@<8.5.26': '^8.5.26'
+  # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2,
+  # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast,
+  # both of which declare ^1.x, so the pin is in range for every consumer.
+  'source-map-js@>=1.0.0 <1.2.2': '1.2.2'
   # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows)
   'vite@>=7.0.0 <7.3.5': '~7.3.5'
   # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched