The test suite currently pins [email protected] and calls resolveSources in both the library source-map tests and CLI source-map tests. Your Node >=18 contract and Node 20/22/24 Linux/Windows CI are compatible with @stackline/[email protected].
I maintain that package. It is a compatibility-first MIT fork that preserves the seven-function CommonJS API, callback and synchronous behavior, asynchronous scheduling, and error metadata while adding maintained packaging and correcting Windows cross-drive URL handling. This is routine maintenance, not a vulnerability claim, and Stackline is not affiliated with or endorsed by the original maintainer.
Would you welcome a focused PR that:
- changes the existing key to the exact alias
"source-map-resolve": "npm:@stackline/[email protected]";
- regenerates
yarn.lock without changing imports;
- initially retains the repository's local ambient declaration to avoid unrelated type changes; and
- runs
yarn run build and yarn run test:mocha-coverage through the existing Linux/Windows matrix?
Staying on the reviewed 0.6.0 pin or replacing these test helpers with a narrower maintained implementation are also reasonable options. I wanted maintainer agreement before preparing a dependency PR because this repository's contribution guidance asks for an issue before significant changes.
The test suite currently pins
[email protected]and callsresolveSourcesin both the library source-map tests and CLI source-map tests. Your Node >=18 contract and Node 20/22/24 Linux/Windows CI are compatible with@stackline/[email protected].I maintain that package. It is a compatibility-first MIT fork that preserves the seven-function CommonJS API, callback and synchronous behavior, asynchronous scheduling, and error metadata while adding maintained packaging and correcting Windows cross-drive URL handling. This is routine maintenance, not a vulnerability claim, and Stackline is not affiliated with or endorsed by the original maintainer.
Would you welcome a focused PR that:
"source-map-resolve": "npm:@stackline/[email protected]";yarn.lockwithout changing imports;yarn run buildandyarn run test:mocha-coveragethrough the existing Linux/Windows matrix?Staying on the reviewed 0.6.0 pin or replacing these test helpers with a narrower maintained implementation are also reasonable options. I wanted maintainer agreement before preparing a dependency PR because this repository's contribution guidance asks for an issue before significant changes.