chore(control): refresh source-map-js lockfile to restore dependency audit gates #266

What happened

Priority: release gate. The current Control lockfile pins source-map-js@1.2.1, and existing optional-Control dependency audits fail on published GHSA-68fv-2mgg-jv7q.

Evidence:

• Pinned lockfile
• Published upstream advisory: affected >=1.0.0,<1.2.2; first patched version 1.2.2.
• Observed CI failure, exact design-PR commit 99d8ec3855d57da34a6fa789f3a375820a8fbe85: four optional-Control audit jobs and release gate failed.

The selected dependency path is Vite → PostCSS → source-map-js, marked devOptional. Existing logs report npm audit --omit=dev failure.

What you expected

A clean dependency installation should satisfy the audit and release gates without disabling them.

Environment and verification limits

• Source snapshot 817d92ab780f657ec754d40fcf86087b5b01a883; Control lockfile matches the 1.0.3 source baseline.
• Existing CI logs, lockfile and upstream advisory inspected. No fresh npm install/audit or deployment was performed for this report.
• Direct server-source use of the consumer was not found; this does not prove complete runtime unreachability.
• Remote exploitability in the hosted Control service is not established. Do not classify an audit match alone as a reproduced production vulnerability.
• Node Control dependencies/deployment are separate from the Python wheel/sdist and fleet CLI installs.

Proposed fix and acceptance criteria

• Refresh the lockfile to a patched compatible source-map-js release (at least 1.2.2); confirm the selected dependency graph and minimize unrelated updates.
• Use a clean isolated install to run npm ci, npm audit --omit=dev, typecheck, build and Control tests.
• Restore optional-Control audit jobs and the full release gate.
• Keep audits enabled; do not suppress or bypass the finding to obtain green CI.
• Document build/runtime and deployment boundaries without claiming unverified hosted exploitability or remediation.

Related work

Follow-up dependency maintenance under the auditing introduced by closed #236. PR #261's failure exposes the gate; the handoff design files did not introduce this lockfile entry.

Checked

• Searched existing issues and open PRs; no source-map-js update is currently open.
• Used only public advisory/CI links and repository sources.
• No credentials, transcripts, account/session identifiers, or operational configuration are included.