fix(deps): bump source-map-js from 1.2.1 to 1.2.2 in /dashboard

[dependabot]

Bumps source-map-js from 1.2.1 to 1.2.2.

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

[giscebot]

Approved. I reviewed the lockfile-only update conceptually and against current main (ee42e36): the PR head ad1cec8 is mergeable without conflicts, and regenerating source-map-js from the PR base reproduces the submitted package-lock.json byte-for-byte. The extra Tailwind WASM optional-package entries are npm lockfile metadata, not an unrelated dependency upgrade.

Validation on the merged tree:

• npm ci (lockfile hash unchanged; 0 vulnerabilities)
• npm test: 64 passed
• npm run build: passed
• Python 3.12 pytest in a clean CI-like environment: 431 passed (one Starlette deprecation warning)
• GitHub checks: dashboard, pytest 3.11, and pytest 3.12 all successful

The resolved graph consistently installs source-map-js 1.2.2 for the compatible transitive ranges, so this is ready to merge.

[giscebot]

Post-merge release follow-up: run 37444111591 failed before tests because a second main push advanced the shallow checkout, so the triggering SHA b581e83 was unavailable locally. The following release run succeeded and published v0.71.3, so this PR's changes were released.

The durable fix is merged in #253: release jobs now check out the exact triggering SHA with full history, skip stale runs, and recheck the remote head before publishing. The first release run with that fix completed successfully and published v0.71.4.