[abruption]

Summary

Refresh only the transitive source-map-js lock entry from 1.2.1 to 1.2.2, the patched compatible release for GHSA-68fv-2mgg-jv7q. Preserve unrelated package versions and dependency classification metadata.

Closes #266

Type

• chore / dependency maintenance

Validation

• Node 24.16.0 / npm 11.15.0, isolated Control checkout.
• Clean npm ci; npm audit --omit=dev: 0 vulnerabilities.
• npm run typecheck: passed.
• npm test (includes build): 18 files / 123 tests passed.
• Clean install and audit repeated after reducing the diff to the three lock-entry fields; npm ls source-map-js confirms the selected graph.
• git diff --check: passed. No secrets or service configuration changes.

Notes

This restores a dependency audit prerequisite without suppressing audits. CI and source/security review must still complete on this PR. Node Control deployment is separate from Python packaging and is not included. No hosted exploitability or operational remediation is claimed; no release or service restart was performed. Native local/SSH messaging tests are not applicable to this lockfile-only change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T06:42:03.688758Z	d8d742f	PR opened
🔒 Security Review	✅ Completed 2026-10-07T06:49:29.897801Z	d8d742f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[abruption]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: d8d742fada

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[abruption]

Six-fix local integration check

Combined PRs #269–#274 locally without changing or pushing main:

PR	Verified candidate
#269	d8d742f
#270	e09838a
#271	0046364
#272	3fdd170
#273	e322d9b
#274	e9f6bcb

Final local integration commit (not pushed): 94d07f71398e594accaee1215e7e3acc2043be75.

• Python 3.13.7 with isolated Relay/MCP/test dependencies: 787 tests, 775 passed, 12 optional/platform skips.
• Documentation: 29 passed; standalone generator and diff checks passed.
• Wheel built from sdist, packaged source equality including the new framing module, and Python 3.9 grammar passed. These private test artifacts retain 1.0.3 metadata; they are not a release or publication.
• All six candidate CI/release gates passed at the heads above (28 checks each, including CodeQL and GitGuardian). Exact-head code/security review summaries show completion for all six. Final fix(delivery): retain uncertain send outcomes and native evidence #272 code re-review found no additional major issues and security re-review found no security issues; its original P2 finding is fixed, tested, replied to and resolved.

Merge integration note: PR #269 is the shared audit-only prerequisite. The two CLI-reference changes from #272 and #271 merge text cleanly, but their shared i18n manifest hash conflicts. Recompute the hash of the combined canonical document; do not select either old hash. Verified combined CLI-reference SHA-256: a4abf8ca375d058a23b3ae1d91698f95c77e59f0ebd98f623da26461e6b3e08b. Re-run generator/docs/full gates after any main integration; this local report does not authorize a merge.

No live agent/model ACK, operational service/fleet change, global installation, main merge or release was performed. Known earlier non-failing asyncio teardown diagnostics are documented in #274; final integrated runs did not repeat that diagnostic.