fix(deps): land source-map-js 1.2.2 and sync the workspace pins to the overrides

source-map-js 1.2.2 clears the last npm-audit finding in web and ui-tui
(GHSA-68fv-2mgg-jv7q). It was published 2026-09-30, inside min-release-age=14,
so .npmrc excludes it by name like the other advisory fixes, with a note to
remove the line once it is older than two weeks.

The override alone does not move an existing lock entry: package.json said
1.2.2 while package-lock.json still resolved 1.2.1 until `npm update
source-map-js --package-lock-only`. The lock now resolves 1.2.2 and a relock
is a no-op.

apps/desktop and tests-js still declared yaml 2.8.1 and vitest 4.1.10, which
the new overrides silently replaced; their declared pins now match the
overrides and the lock's workspace entries.

Doctor audit counts on this tree: root 0, web 0, ui-tui 0.

.npmrc

@@ -61,3 +61,6 @@ min-release-age-exclude[]=@oxc-project/types
 # ink needs
 min-release-age-exclude[]=lightningcss
 min-release-age-exclude[]=postcss
+
+# source-map-js 1.2.2 fixes GHSA-68fv-2mgg-jv7q (high, event-loop DoS). remove when 1.2.2 is > 2wks old (rel 2026-09-30)
+min-release-age-exclude[]=source-map-js

apps/desktop/package.json

@@ -157,7 +157,7 @@
     "use-stick-to-bottom": "1.1.6",
     "vfile": "6.0.3",
     "web-haptics": "0.0.6",
-    "yaml": "2.8.1"
+    "yaml": "2.9.1"
   },
   "optionalDependencies": {
     "get-windows": "9.3.0"
@@ -192,7 +192,7 @@
     "tsx": "4.23.1",
     "typescript": "6.0.3",
     "vite": "8.2.0",
-    "vitest": "4.1.10",
+    "vitest": "4.1.11",
     "wait-on": "9.0.10"
   }
 }

package-lock.json

@@ -153,7 +153,7 @@
         "use-stick-to-bottom": "1.1.6",
         "vfile": "6.0.3",
         "web-haptics": "0.0.6",
-        "yaml": "2.8.1"
+        "yaml": "2.9.1"
       },
       "devDependencies": {
         "@babel/core": "8.0.1",
@@ -185,7 +185,7 @@
         "tsx": "4.23.1",
         "typescript": "6.0.3",
         "vite": "8.2.0",
-        "vitest": "4.1.10",
+        "vitest": "4.1.11",
         "wait-on": "9.0.10"
       },
       "engines": {
@@ -17316,9 +17316,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -19538,7 +19538,7 @@
         "node-pty": "1.1.0",
         "plist": "3.1.1",
         "typescript": "6.0.3",
-        "vitest": "4.1.10"
+        "vitest": "4.1.11"
       }
     },
     "tests-js/node_modules/@xmldom/xmldom": {

tests-js/package.json

@@ -18,7 +18,7 @@
     "node-pty": "1.1.0",
     "plist": "3.1.1",
     "typescript": "6.0.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "dependencies": {
     "@playwright/test": "1.62.1",