fix(deps): limit source-map-js override to the advisory range

Author: tobyhede

pnpm-lock.yaml

@@ -89,7 +89,7 @@ overrides:
   # #243 GHSA-68fv-2mgg-jv7q / CVE-2026-93749 — source-map-js >=1.0.0 <1.2.2,
   # patched 1.2.2 (published 2026-09-30). Reached through postcss and magicast,
   # both of which declare ^1.x, so the pin is in range for every consumer.
-  'source-map-js@<1.2.2': '1.2.2'
+  'source-map-js@>=1.0.0 <1.2.2': '1.2.2'
   # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows)
   'vite@>=7.0.0 <7.3.5': '~7.3.5'
   # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched