Bump source-map-loader from 4.0.2 to 5.0.0

[dependabot]

Bumps source-map-loader from 4.0.2 to 5.0.0.

Release notes

Sourced from source-map-loader's releases.

v5.0.0

5.0.0 (2024-01-15)

⚠ BREAKING CHANGES

• minimum supported Node.js version is 18.12.0 (#230) (7fcab17)

Changelog

Sourced from source-map-loader's changelog.

5.0.0 (2024-01-15)

⚠ BREAKING CHANGES

• minimum supported Node.js version is 18.12.0 (#230) (7fcab17)

Commits

• accabb7 chore(release): 5.0.0
• 7fcab17 chore!: minimum supported Node.js version is 18.12.0 (#230)
• ac7068f chore: update dependencies to latest version (#229)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Low Risk
Dev-only webpack dependency bump with no application logic changes; Node engine requirements are already stricter than source-map-loader 5.x needs.

Overview
Upgrades source-map-loader in packages/gui from 4.0.2 to 5.0.0, with matching package-lock.json updates.

The major release only raises the loader’s minimum Node.js to 18.12.0; @chia-network/gui already declares engines.node >=20.0.0, so local and CI builds should stay compatible. The loader is still wired the same way in webpack.react.babel.ts (dev-only pre-rule on .js for source maps).

The lockfile diff also pins validator / @types/validator to exact versions in a few workspace entries (caret ranges removed); that is lockfile normalization, not a functional app change.

^{Reviewed by Cursor Bugbot for commit 59b6035. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	source-map-loader@​4.0.2 ⏵ 5.0.0

View full report

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the upstream source-map-loader 4.0.2→5.0.0 diff, lockfile/scripts, and scanner findings against the malware checklist.Verdict: benign

The 4.0.2 → 5.0.0 bump is a documented major version whose only advertised breaking change is engines (node ≥ 18.12.0). This repo already requires Node ≥ 20, so that constraint is satisfied.

Scanner status is warn (warn-only), with 0 Unicode, 0 confusable, and 0 IOC hits. The 25 heuristics are expected for this loader, not compromise:

• atob / fromCodePoint / ;base64 live in src/parse-data-url.js because the package decodes data: sourceMappingURL payloads (WHATWG-style parser, not a hidden decoder).
• exec( on a MIME regex is a false shell_process_spawn match.
• cross-spawn hits are in the upstream lockfile (dev tooling: npm-run-all, husky, cross-env), not in this app’s published graph.
• .github/workflows/nodejs.yml is upstream CI, not this PR. The Dependabot change is only packages/gui/package.json (^5.0.0) and package-lock.json.
• Direct deps stay iconv-lite + source-map-js (plus webpack peer). Integrity is a normal sha512-... from registry.npmjs.org. Tags v4.0.2 and v5.0.0 exist; there is no ghost version.

No install-time scripts (preinstall/install/postinstall) were added. Local use is webpack use: ['source-map-loader'] in webpack.react.babel.ts.

Treat remaining scanner noise as false positives for a webpack source-map loader; no supply-chain malware signal in this update.

Compatibility Analysis

I'll inspect how this repo uses source-map-loader and compare that against the 4.0.2 → 5.0.0 upstream changes.Recommendation: merge

source-map-loader 5.0.0 is an engines-only major. This repo already requires Node ≥ 20, uses webpack 5, and calls the loader with no options. Nothing in the 4.0.2 → 5.0.0 source/API change intersects this usage.

Usage in this repo

• Declared: packages/gui/package.json devDependencies (^5.0.0 in this PR).
• Locked: root package-lock.json → source-map-loader@5.0.0 (dev), peer webpack: ^5.72.1.
• Called: only packages/gui/webpack.react.babel.ts as a pre loader on .js files, only when DEV is true:

      {
        test: function (path) {
          return DEV ? /\.js$/.test(path) : false;
        },
        enforce: 'pre',
        use: ['source-map-loader'],
      },

No options (filterSourceMappingUrl unused). Production build:react does not run this loader. Not used in electron webpack or other packages.

Upstream vs this usage

v5.0.0 advertised break: Node ≥ 18.12.0 (was ≥ 14.15.0).

git diff v4.0.2..v5.0.0 on src/ is trailing commas / prettier. Loader signature, options schema, and webpack peer (^5.72.1) are unchanged. Runtime deps stay iconv-lite + source-map-js.

This GUI package: engines.node ≥ 20, webpack 5.105.1. Compatible.

Risks

• Low. Worst case is worse/missing maps in dev:react, not production.
• Unknowns: none for API. Confirm CI/dev Node is ≥ 18.12 (already required). A one-off npm run dev:react is enough smoke if you want extra confidence.

No hold reason.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 12
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 1
• Resolved upstream range: 0b9bbe8cc6f18f35dc4ba8edb74be1593629a210..accabb76a28858aa655b52acd07b268f10f356da
• Resolved refs: from=0b9bbe8cc6f18f35dc4ba8edb74be1593629a210 to=accabb76a28858aa655b52acd07b268f10f356da
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 25

Top findings

• src/parse-data-url.js:84 codepoint_decoder :: String.fromCodePoint(input[i + 1], input[i + 2]),
• src/parse-data-url.js:245 shell_process_spawn :: const mimeTypeBase64MatchResult = /(.*); *[Bb][Aa][Ss][Ee]64$/.exec(
• package-lock.json:7707 shell_process_spawn :: "cross-spawn": "^7.0.1"
• package-lock.json:7719 shell_process_spawn :: "node_modules/cross-spawn": {
• package-lock.json:7721 shell_process_spawn :: "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
• package-lock.json:8680 shell_process_spawn :: "cross-spawn": "^7.0.6",
• package-lock.json:9455 shell_process_spawn :: "cross-spawn": "^7.0.3",
• package-lock.json:9748 shell_process_spawn :: "cross-spawn": "^7.0.6",
• package-lock.json:13573 shell_process_spawn :: "cross-spawn": "^7.0.3",
• package-lock.json:15222 shell_process_spawn :: "cross-spawn": "^6.0.5",
• package-lock.json:15254 shell_process_spawn :: "node_modules/npm-run-all/node_modules/cross-spawn": {
• package-lock.json:15256 shell_process_spawn :: "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.6.tgz",
• CHANGELOG.md:165 obfuscation_indicator :: * Handle exception on loading invalid base64 source maps ([#53](https://github.com/webpack/source-map-loader/issues/53)) ([38da2eb](https://github.com/webpack/source-map-loader/commit/38da2eb))
• src/parse-data-url.js:97 obfuscation_indicator :: * A lookup table for atob(), which converts an ASCII character to the
• src/parse-data-url.js:112 obfuscation_indicator :: * Implementation of atob() according to the HTML and Infra specs, except that
• src/parse-data-url.js:115 obfuscation_indicator :: function atob(input) {
• src/parse-data-url.js:251 obfuscation_indicator :: const asString = atob(stringBody);
• test/loader.test.js:229 obfuscation_indicator :: it("should skip invalid base64 SourceMap", async () => {
• test/loader.test.js:241 obfuscation_indicator :: it("should warn on invalid base64 SourceMap", async () => {
• test/loader.test.js:754 obfuscation_indicator :: "data:application/json;base64,c29tZSBraW5kIGNvbnRlbnQ=",