The test suite currently pins source-map-resolve@0.6.0 and calls resolveSources in both the library source-map tests and CLI source-map tests. Your Node >=18 contract and Node 20/22/24 Linux/Windows CI are compatible with @stackline/source-map-resolve@1.0.0.
I maintain that package. It is a compatibility-first MIT fork that preserves the seven-function CommonJS API, callback and synchronous behavior, asynchronous scheduling, and error metadata while adding maintained packaging and correcting Windows cross-drive URL handling. This is routine maintenance, not a vulnerability claim, and Stackline is not affiliated with or endorsed by the original maintainer.
Would you welcome a focused PR that:
- changes the existing key to the exact alias
"source-map-resolve": "npm:@stackline/source-map-resolve@1.0.0";
- regenerates
yarn.lock without changing imports;
- initially retains the repository's local ambient declaration to avoid unrelated type changes; and
- runs
yarn run build and yarn run test:mocha-coverage through the existing Linux/Windows matrix?
Staying on the reviewed 0.6.0 pin or replacing these test helpers with a narrower maintained implementation are also reasonable options. I wanted maintainer agreement before preparing a dependency PR because this repository's contribution guidance asks for an issue before significant changes.
The test suite currently pins
source-map-resolve@0.6.0and callsresolveSourcesin both the library source-map tests and CLI source-map tests. Your Node >=18 contract and Node 20/22/24 Linux/Windows CI are compatible with@stackline/source-map-resolve@1.0.0.I maintain that package. It is a compatibility-first MIT fork that preserves the seven-function CommonJS API, callback and synchronous behavior, asynchronous scheduling, and error metadata while adding maintained packaging and correcting Windows cross-drive URL handling. This is routine maintenance, not a vulnerability claim, and Stackline is not affiliated with or endorsed by the original maintainer.
Would you welcome a focused PR that:
"source-map-resolve": "npm:@stackline/source-map-resolve@1.0.0";yarn.lockwithout changing imports;yarn run buildandyarn run test:mocha-coveragethrough the existing Linux/Windows matrix?Staying on the reviewed 0.6.0 pin or replacing these test helpers with a narrower maintained implementation are also reasonable options. I wanted maintainer agreement before preparing a dependency PR because this repository's contribution guidance asks for an issue before significant changes.