Would you welcome a tested alias migration from source-map-resolve?
The test suite currently pins [email protected] and calls resolveSources in both the library source-map tests and CLI source-map tests. Your Node >=18 contract and Node 20/22/24 Linux/Windows CI are compatible with @stackline/[email protected].
I maintain that package. It is a compatibility-first MIT fork that preserves the seven-function CommonJS API, callback and synchronous behavior, asynchronous scheduling, and error metadata while adding maintained packaging and correcting Windows cross-drive URL handling. This is routine maintenance, not a vulnerability claim, and Stackline is not affiliated with or endorsed by the original maintainer.
Would you welcome a focused PR that:
- changes the existing key to the exact alias
"source-map-resolve": "npm:@stackline/[email protected]"; - regenerates
yarn.lockwithout changing imports; - initially retains the repository's local ambient declaration to avoid unrelated type changes; and
- runs
yarn run buildandyarn run test:mocha-coveragethrough the existing Linux/Windows matrix?
Staying on the reviewed 0.6.0 pin or replacing these test helpers with a narrower maintained implementation are also reasonable options. I wanted maintainer agreement before preparing a dependency PR because this repository's contribution guidance asks for an issue before significant changes.
Source: javascript-obfuscator/javascript-obfuscator