Skip to content

fix(ui): pin patched source-map-js resolution - #1035

Merged
intel352 merged 1 commit into
mainfrom
fix/ui-source-map-js-security
Oct 6, 2026
Merged

fix(ui): pin patched source-map-js resolution#1035
intel352 merged 1 commit into
mainfrom
fix/ui-source-map-js-security

Conversation

@intel352

@intel352 intel352 commented Oct 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pin the existing transitive source-map-js resolution to 1.2.2 to address GHSA-68fv-2mgg-jv7q. Only its version, official tarball URL and integrity change in ui/package-lock.json; the compatible css-tree/postcss ranges and every other lockfile field remain unchanged.

Validation recorded on exact head d279a66fbcc4eb9f7f61cc30086d2773ad44e271:

  • Installed graph resolves both parent consumers to 1.2.2; 131 Vitest tests passed, TypeScript/Vite build passed, and the owned preview served byte-identical generated assets.
  • Native OSV evidence contains no source-map-js advisory and retains the original 61 findings. The two existing fixture metadata failures remain disclosed under the approved comparison exception; strict comparison still rejects them.
  • Independent source review and complete selected comparator regression coverage passed. Hosted tests, builds, lint, benchmark, UI, CodeQL, Code Quality and trusted policy passed. The sole candidate CI failure is the unchanged policy fixture EVENT_NAME: unbound variable, retained under its approved temporary harness exception.
  • Hosted OSV differential reporting passed with zero new findings; both scanner phases exited 1 with the same 14 recorded Go toolchain diagnostics. Full post-merge main evidence remains pending.

Doc-reconciliation: clean (no public documentation change).

@github-actions

github-actions Bot commented Oct 6, 2026

Copy link
Copy Markdown

⏱ Benchmark Results

✅ No significant performance regressions detected.

benchstat comparison (baseline → PR) 
## benchstat: baseline → PR
baseline-bench.txt:312: parsing iteration count: invalid syntax
baseline-bench.txt:559996: parsing iteration count: invalid syntax
baseline-bench.txt:1039496: parsing iteration count: invalid syntax
baseline-bench.txt:1569912: parsing iteration count: invalid syntax
baseline-bench.txt:2101399: parsing iteration count: invalid syntax
baseline-bench.txt:2622677: parsing iteration count: invalid syntax
benchmark-results.txt:312: parsing iteration count: invalid syntax
benchmark-results.txt:286114: parsing iteration count: invalid syntax
benchmark-results.txt:571958: parsing iteration count: invalid syntax
benchmark-results.txt:818127: parsing iteration count: invalid syntax
benchmark-results.txt:1108429: parsing iteration count: invalid syntax
benchmark-results.txt:1454237: parsing iteration count: invalid syntax
goos: linux
goarch: amd64
pkg: github.com/GoCodeAlone/workflow/dynamic
cpu: AMD EPYC 7763 64-Core Processor                
                            │ benchmark-results.txt │
                            │        sec/op         │
InterpreterCreation-4                  7.581m ± 59%
ComponentLoad-4                        3.601m ±  0%
ComponentExecute-4                     1.965µ ±  1%
PoolContention/workers-1-4             1.088µ ±  4%
PoolContention/workers-2-4             1.088µ ±  1%
PoolContention/workers-4-4             1.099µ ±  1%
PoolContention/workers-8-4             1.103µ ±  1%
PoolContention/workers-16-4            1.100µ ±  5%
ComponentLifecycle-4                   3.627m ±  1%
SourceValidation-4                     2.283µ ±  1%
RegistryConcurrent-4                   813.0n ±  5%
LoaderLoadFromString-4                 3.625m ±  0%
geomean                                18.89µ

                            │ benchmark-results.txt │
                            │         B/op          │
InterpreterCreation-4                  2.027Mi ± 0%
ComponentLoad-4                        2.180Mi ± 0%
ComponentExecute-4                     1.203Ki ± 0%
PoolContention/workers-1-4             1.203Ki ± 0%
PoolContention/workers-2-4             1.203Ki ± 0%
PoolContention/workers-4-4             1.203Ki ± 0%
PoolContention/workers-8-4             1.203Ki ± 0%
PoolContention/workers-16-4            1.203Ki ± 0%
ComponentLifecycle-4                   2.183Mi ± 0%
SourceValidation-4                     1.984Ki ± 0%
RegistryConcurrent-4                   1.133Ki ± 0%
LoaderLoadFromString-4                 2.182Mi ± 0%
geomean                                15.25Ki

                            │ benchmark-results.txt │
                            │       allocs/op       │
InterpreterCreation-4                   15.68k ± 0%
ComponentLoad-4                         18.02k ± 0%
ComponentExecute-4                       25.00 ± 0%
PoolContention/workers-1-4               25.00 ± 0%
PoolContention/workers-2-4               25.00 ± 0%
PoolContention/workers-4-4               25.00 ± 0%
PoolContention/workers-8-4               25.00 ± 0%
PoolContention/workers-16-4              25.00 ± 0%
ComponentLifecycle-4                    18.07k ± 0%
SourceValidation-4                       32.00 ± 0%
RegistryConcurrent-4                     2.000 ± 0%
LoaderLoadFromString-4                  18.06k ± 0%
geomean                                  183.3

cpu: AMD EPYC 9V45 96-Core Processor                
                            │ baseline-bench.txt │
                            │       sec/op       │
InterpreterCreation-4              1.899m ± 269%
ComponentLoad-4                    2.074m ±   7%
ComponentExecute-4                 1.085µ ±   2%
PoolContention/workers-1-4         593.1n ±   3%
PoolContention/workers-2-4         586.4n ±   3%
PoolContention/workers-4-4         593.1n ±   3%
PoolContention/workers-8-4         608.0n ±   2%
PoolContention/workers-16-4        602.5n ±   2%
ComponentLifecycle-4               2.139m ±   2%
SourceValidation-4                 1.286µ ±   1%
RegistryConcurrent-4               493.2n ±   5%
LoaderLoadFromString-4             2.173m ±   4%
geomean                            9.959µ

                            │ baseline-bench.txt │
                            │        B/op        │
InterpreterCreation-4               2.027Mi ± 0%
ComponentLoad-4                     2.180Mi ± 0%
ComponentExecute-4                  1.203Ki ± 0%
PoolContention/workers-1-4          1.203Ki ± 0%
PoolContention/workers-2-4          1.203Ki ± 0%
PoolContention/workers-4-4          1.203Ki ± 0%
PoolContention/workers-8-4          1.203Ki ± 0%
PoolContention/workers-16-4         1.203Ki ± 0%
ComponentLifecycle-4                2.183Mi ± 0%
SourceValidation-4                  1.984Ki ± 0%
RegistryConcurrent-4                1.133Ki ± 0%
LoaderLoadFromString-4              2.182Mi ± 0%
geomean                             15.25Ki

                            │ baseline-bench.txt │
                            │     allocs/op      │
InterpreterCreation-4                15.68k ± 0%
ComponentLoad-4                      18.02k ± 0%
ComponentExecute-4                    25.00 ± 0%
PoolContention/workers-1-4            25.00 ± 0%
PoolContention/workers-2-4            25.00 ± 0%
PoolContention/workers-4-4            25.00 ± 0%
PoolContention/workers-8-4            25.00 ± 0%
PoolContention/workers-16-4           25.00 ± 0%
ComponentLifecycle-4                 18.07k ± 0%
SourceValidation-4                    32.00 ± 0%
RegistryConcurrent-4                  2.000 ± 0%
LoaderLoadFromString-4               18.06k ± 0%
geomean                               183.3

pkg: github.com/GoCodeAlone/workflow/middleware
cpu: AMD EPYC 7763 64-Core Processor                
                                  │ benchmark-results.txt │
                                  │        sec/op         │
CircuitBreakerDetection-4                     293.2n ± 6%
CircuitBreakerExecution_Success-4             22.53n ± 1%
CircuitBreakerExecution_Failure-4             66.61n ± 0%
geomean                                       76.06n

                                  │ benchmark-results.txt │
                                  │         B/op          │
CircuitBreakerDetection-4                    144.0 ± 0%
CircuitBreakerExecution_Success-4            0.000 ± 0%
CircuitBreakerExecution_Failure-4            0.000 ± 0%
geomean                                                 ¹
¹ summaries must be >0 to compute geomean

                                  │ benchmark-results.txt │
                                  │       allocs/op       │
CircuitBreakerDetection-4                    1.000 ± 0%
CircuitBreakerExecution_Success-4            0.000 ± 0%
CircuitBreakerExecution_Failure-4            0.000 ± 0%
geomean                                                 ¹
¹ summaries must be >0 to compute geomean

cpu: AMD EPYC 9V45 96-Core Processor                
                                  │ baseline-bench.txt │
                                  │       sec/op       │
CircuitBreakerDetection-4                  360.6n ± 2%
CircuitBreakerExecution_Success-4          46.83n ± 0%
CircuitBreakerExecution_Failure-4          67.82n ± 2%
geomean                                    104.6n

                                  │ baseline-bench.txt │
                                  │        B/op        │
CircuitBreakerDetection-4                 144.0 ± 0%
CircuitBreakerExecution_Success-4         0.000 ± 0%
CircuitBreakerExecution_Failure-4         0.000 ± 0%
geomean                                              ¹
¹ summaries must be >0 to compute geomean

                                  │ baseline-bench.txt │
                                  │     allocs/op      │
CircuitBreakerDetection-4                 1.000 ± 0%
CircuitBreakerExecution_Success-4         0.000 ± 0%
CircuitBreakerExecution_Failure-4         0.000 ± 0%
geomean                                              ¹
¹ summaries must be >0 to compute geomean

pkg: github.com/GoCodeAlone/workflow/module
cpu: AMD EPYC 7763 64-Core Processor                
                                 │ benchmark-results.txt │
                                 │        sec/op         │
IaCStateBackend_InProcess-4                 312.3n ± 37%
IaCStateBackend_GRPC-4                      9.129m ±  3%
JQTransform_Simple-4                        670.9n ± 37%
JQTransform_ObjectConstruction-4            1.544µ ±  1%
JQTransform_ArraySelect-4                   3.455µ ±  1%
JQTransform_Complex-4                       39.14µ ±  0%
JQTransform_Throughput-4                    1.865µ ±  1%
SSEPublishDelivery-4                        69.47n ±  1%
geomean                                     3.883µ

                                 │ benchmark-results.txt │
                                 │         B/op          │
IaCStateBackend_InProcess-4                 416.0 ± 0%
IaCStateBackend_GRPC-4                    5.834Mi ± 9%
JQTransform_Simple-4                      1.273Ki ± 0%
JQTransform_ObjectConstruction-4          1.773Ki ± 0%
JQTransform_ArraySelect-4                 2.625Ki ± 0%
JQTransform_Complex-4                     16.31Ki ± 0%
JQTransform_Throughput-4                  1.984Ki ± 0%
SSEPublishDelivery-4                        0.000 ± 0%
geomean                                                ¹
¹ summaries must be >0 to compute geomean

                                 │ benchmark-results.txt │
                                 │       allocs/op       │
IaCStateBackend_InProcess-4                 2.000 ± 0%
IaCStateBackend_GRPC-4                     6.837k ± 0%
JQTransform_Simple-4                        10.00 ± 0%
JQTransform_ObjectConstruction-4            15.00 ± 0%
JQTransform_ArraySelect-4                   30.00 ± 0%
JQTransform_Complex-4                       328.0 ± 0%
JQTransform_Throughput-4                    17.00 ± 0%
SSEPublishDelivery-4                        0.000 ± 0%
geomean                                                ¹
¹ summaries must be >0 to compute geomean

cpu: AMD EPYC 9V45 96-Core Processor                
                                 │ baseline-bench.txt │
                                 │       sec/op       │
IaCStateBackend_InProcess-4               208.1n ± 1%
IaCStateBackend_GRPC-4                    5.906m ± 7%
JQTransform_Simple-4                      398.9n ± 8%
JQTransform_ObjectConstruction-4          896.6n ± 2%
JQTransform_ArraySelect-4                 2.046µ ± 5%
JQTransform_Complex-4                     23.66µ ± 7%
JQTransform_Throughput-4                  1.106µ ± 3%
SSEPublishDelivery-4                      55.30n ± 1%
geomean                                   2.451µ

                                 │ baseline-bench.txt │
                                 │        B/op        │
IaCStateBackend_InProcess-4             416.0 ±  0%
IaCStateBackend_GRPC-4                5.598Mi ± 11%
JQTransform_Simple-4                  1.273Ki ±  0%
JQTransform_ObjectConstruction-4      1.773Ki ±  0%
JQTransform_ArraySelect-4             2.625Ki ±  0%
JQTransform_Complex-4                 16.31Ki ±  0%
JQTransform_Throughput-4              1.984Ki ±  0%
SSEPublishDelivery-4                    0.000 ±  0%
geomean                                             ¹
¹ summaries must be >0 to compute geomean

                                 │ baseline-bench.txt │
                                 │     allocs/op      │
IaCStateBackend_InProcess-4              2.000 ± 0%
IaCStateBackend_GRPC-4                  6.854k ± 0%
JQTransform_Simple-4                     10.00 ± 0%
JQTransform_ObjectConstruction-4         15.00 ± 0%
JQTransform_ArraySelect-4                30.00 ± 0%
JQTransform_Complex-4                    328.0 ± 0%
JQTransform_Throughput-4                 17.00 ± 0%
SSEPublishDelivery-4                     0.000 ± 0%
geomean                                             ¹
¹ summaries must be >0 to compute geomean

pkg: github.com/GoCodeAlone/workflow/schema
cpu: AMD EPYC 7763 64-Core Processor                
                                    │ benchmark-results.txt │
                                    │        sec/op         │
SchemaValidation_Simple-4                      1.090µ ± 22%
SchemaValidation_AllFields-4                   1.687µ ±  3%
SchemaValidation_FormatValidation-4            1.581µ ±  2%
SchemaValidation_ManySchemas-4                 1.794µ ±  1%
geomean                                        1.511µ

                                    │ benchmark-results.txt │
                                    │         B/op          │
SchemaValidation_Simple-4                      0.000 ± 0%
SchemaValidation_AllFields-4                   0.000 ± 0%
SchemaValidation_FormatValidation-4            0.000 ± 0%
SchemaValidation_ManySchemas-4                 0.000 ± 0%
geomean                                                   ¹
¹ summaries must be >0 to compute geomean

                                    │ benchmark-results.txt │
                                    │       allocs/op       │
SchemaValidation_Simple-4                      0.000 ± 0%
SchemaValidation_AllFields-4                   0.000 ± 0%
SchemaValidation_FormatValidation-4            0.000 ± 0%
SchemaValidation_ManySchemas-4                 0.000 ± 0%
geomean                                                   ¹
¹ summaries must be >0 to compute geomean

cpu: AMD EPYC 9V45 96-Core Processor                
                                    │ baseline-bench.txt │
                                    │       sec/op       │
SchemaValidation_Simple-4                   631.9n ±  5%
SchemaValidation_AllFields-4                911.7n ± 14%
SchemaValidation_FormatValidation-4         904.4n ±  3%
SchemaValidation_ManySchemas-4              1.061µ ±  5%
geomean                                     862.3n

                                    │ baseline-bench.txt │
                                    │        B/op        │
SchemaValidation_Simple-4                   0.000 ± 0%
SchemaValidation_AllFields-4                0.000 ± 0%
SchemaValidation_FormatValidation-4         0.000 ± 0%
SchemaValidation_ManySchemas-4              0.000 ± 0%
geomean                                                ¹
¹ summaries must be >0 to compute geomean

                                    │ baseline-bench.txt │
                                    │     allocs/op      │
SchemaValidation_Simple-4                   0.000 ± 0%
SchemaValidation_AllFields-4                0.000 ± 0%
SchemaValidation_FormatValidation-4         0.000 ± 0%
SchemaValidation_ManySchemas-4              0.000 ± 0%
geomean                                                ¹
¹ summaries must be >0 to compute geomean

pkg: github.com/GoCodeAlone/workflow/store
cpu: AMD EPYC 7763 64-Core Processor                
                                   │ benchmark-results.txt │
                                   │        sec/op         │
EventStoreAppend_InMemory-4                   1.167µ ± 29%
EventStoreAppend_SQLite-4                     1.219m ±  3%
GetTimeline_InMemory/events-10-4              15.10µ ±  3%
GetTimeline_InMemory/events-50-4              82.78µ ± 22%
GetTimeline_InMemory/events-100-4             128.9µ ±  1%
GetTimeline_InMemory/events-500-4             667.6µ ±  1%
GetTimeline_InMemory/events-1000-4            1.389m ±  1%
GetTimeline_SQLite/events-10-4                73.25µ ±  1%
GetTimeline_SQLite/events-50-4                211.6µ ±  1%
GetTimeline_SQLite/events-100-4               378.0µ ±  1%
GetTimeline_SQLite/events-500-4               1.699m ±  1%
GetTimeline_SQLite/events-1000-4              3.377m ±  1%
geomean                                       209.5µ

                                   │ benchmark-results.txt │
                                   │         B/op          │
EventStoreAppend_InMemory-4                     838.0 ± 3%
EventStoreAppend_SQLite-4                     2.053Ki ± 1%
GetTimeline_InMemory/events-10-4              7.953Ki ± 0%
GetTimeline_InMemory/events-50-4              46.62Ki ± 0%
GetTimeline_InMemory/events-100-4             94.48Ki ± 0%
GetTimeline_InMemory/events-500-4             472.8Ki ± 0%
GetTimeline_InMemory/events-1000-4            944.3Ki ± 0%
GetTimeline_SQLite/events-10-4                15.59Ki ± 0%
GetTimeline_SQLite/events-50-4                80.56Ki ± 0%
GetTimeline_SQLite/events-100-4               162.1Ki ± 0%
GetTimeline_SQLite/events-500-4               777.4Ki ± 0%
GetTimeline_SQLite/events-1000-4              1.503Mi ± 0%
geomean                                       65.64Ki

                                   │ benchmark-results.txt │
                                   │       allocs/op       │
EventStoreAppend_InMemory-4                     7.000 ± 0%
EventStoreAppend_SQLite-4                       55.00 ± 0%
GetTimeline_InMemory/events-10-4                125.0 ± 0%
GetTimeline_InMemory/events-50-4                653.0 ± 0%
GetTimeline_InMemory/events-100-4              1.306k ± 0%
GetTimeline_InMemory/events-500-4              6.514k ± 0%
GetTimeline_InMemory/events-1000-4             13.02k ± 0%
GetTimeline_SQLite/events-10-4                  316.0 ± 0%
GetTimeline_SQLite/events-50-4                 1.486k ± 0%
GetTimeline_SQLite/events-100-4                2.940k ± 0%
GetTimeline_SQLite/events-500-4                14.79k ± 0%
GetTimeline_SQLite/events-1000-4               29.80k ± 0%
geomean                                        1.065k

cpu: AMD EPYC 9V45 96-Core Processor                
                                   │ baseline-bench.txt │
                                   │       sec/op       │
EventStoreAppend_InMemory-4                670.6n ±  6%
EventStoreAppend_SQLite-4                  1.100m ±  5%
GetTimeline_InMemory/events-10-4           6.021µ ±  8%
GetTimeline_InMemory/events-50-4           33.80µ ±  4%
GetTimeline_InMemory/events-100-4          65.67µ ±  3%
GetTimeline_InMemory/events-500-4          340.5µ ± 14%
GetTimeline_InMemory/events-1000-4         695.3µ ±  4%
GetTimeline_SQLite/events-10-4             34.16µ ±  4%
GetTimeline_SQLite/events-50-4             114.0µ ±  3%
GetTimeline_SQLite/events-100-4            208.5µ ±  5%
GetTimeline_SQLite/events-500-4            999.3µ ±  2%
GetTimeline_SQLite/events-1000-4           2.024m ±  4%
geomean                                    111.8µ

                                   │ baseline-bench.txt │
                                   │        B/op        │
EventStoreAppend_InMemory-4                  791.5 ± 2%
EventStoreAppend_SQLite-4                  2.054Ki ± 2%
GetTimeline_InMemory/events-10-4           7.953Ki ± 0%
GetTimeline_InMemory/events-50-4           46.62Ki ± 0%
GetTimeline_InMemory/events-100-4          94.48Ki ± 0%
GetTimeline_InMemory/events-500-4          472.8Ki ± 0%
GetTimeline_InMemory/events-1000-4         944.3Ki ± 0%
GetTimeline_SQLite/events-10-4             15.59Ki ± 0%
GetTimeline_SQLite/events-50-4             80.56Ki ± 0%
GetTimeline_SQLite/events-100-4            162.1Ki ± 0%
GetTimeline_SQLite/events-500-4            777.4Ki ± 0%
GetTimeline_SQLite/events-1000-4           1.503Mi ± 0%
geomean                                    65.33Ki

                                   │ baseline-bench.txt │
                                   │     allocs/op      │
EventStoreAppend_InMemory-4                  7.000 ± 0%
EventStoreAppend_SQLite-4                    55.00 ± 0%
GetTimeline_InMemory/events-10-4             125.0 ± 0%
GetTimeline_InMemory/events-50-4             653.0 ± 0%
GetTimeline_InMemory/events-100-4           1.306k ± 0%
GetTimeline_InMemory/events-500-4           6.514k ± 0%
GetTimeline_InMemory/events-1000-4          13.02k ± 0%
GetTimeline_SQLite/events-10-4               316.0 ± 0%
GetTimeline_SQLite/events-50-4              1.486k ± 0%
GetTimeline_SQLite/events-100-4             2.940k ± 0%
GetTimeline_SQLite/events-500-4             14.79k ± 0%
GetTimeline_SQLite/events-1000-4            29.80k ± 0%
geomean                                     1.065k

Benchmarks run with go test -bench=. -benchmem -count=6.
Regressions ≥ 20% are flagged. Results compared via benchstat.

@intel352
intel352 marked this pull request as ready for review October 6, 2026 21:04
@intel352
intel352 merged commit ddeb644 into main Oct 6, 2026
24 of 25 checks passed
@intel352
intel352 deleted the fix/ui-source-map-js-security branch October 6, 2026 21:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

See More

Successfully merging this pull request may close these issues.

1 participant

@intel352