9router-proxy 0.5.98 → 0.6.2

package/app/node_modules/next/dist/server/lib/router-utils/block-cross-site-dev.js

@@ -11,6 +11,7 @@ Object.defineProperty(exports, "blockCrossSiteDEV", {
 const _url = require("../../../lib/url");
 const _log = require("../../../build/output/log");
 const _csrfprotection = require("../../app-render/csrf-protection");
+const _parsepath = require("../../../shared/lib/router/utils/parse-path");
 const allowedDevOriginsDocs = 'https://nextjs.org/docs/app/api-reference/config/next-config-js/allowedDevOrigins';
 function getBlockedResourcePath(req) {
     var _parseUrl;
@@ -62,17 +63,14 @@ function parseHostnameFromHeader(header) {
 }
 function isInternalEndpoint(req) {
     if (!req.url) return false;
-    try {
-        // TODO: We should standardize on a single prefix for this
-        const isMiddlewareRequest = req.url.includes('/__nextjs');
-        const isInternalAsset = req.url.includes('/_next');
-        // Static media requests are excluded, as they might be loaded via CSS and would fail
-        // CORS checks.
-        const isIgnoredRequest = req.url.includes('/_next/image') || req.url.includes('/_next/static/media') || req.url.includes('/_next/static/immutable/media');
-        return !isIgnoredRequest && (isInternalAsset || isMiddlewareRequest);
-    } catch (err) {
-        return false;
-    }
+    const { pathname } = (0, _parsepath.parsePath)(req.url);
+    // TODO: We should standardize on a single prefix for this
+    const isMiddlewareRequest = pathname.includes('/__nextjs');
+    const isInternalAsset = pathname.includes('/_next');
+    // Static media requests are excluded, as they might be loaded via CSS and would fail
+    // CORS checks.
+    const isIgnoredRequest = pathname.includes('/_next/image') || pathname.includes('/_next/static/media') || pathname.includes('/_next/static/immutable/media');
+    return !isIgnoredRequest && (isInternalAsset || isMiddlewareRequest);
 }
 const blockCrossSiteDEV = (req, res, allowedDevOrigins, hostname)=>{
     const allowedOrigins = [

package/app/node_modules/next/dist/server/lib/start-server.js

@@ -177,7 +177,7 @@ async function getRequestHandlers({ dir, port, isDev, onDevServerCleanup, server
 async function startServer(serverOptions) {
     const { dir, isDev, hostname, minimalMode, allowRetry, keepAliveTimeout, selfSignedCertificate, serverFastRefresh } = serverOptions;
     let { port } = serverOptions;
-    process.title = `next-server (v${"16.3.6"})`;
+    process.title = `next-server (v${"16.3.8"})`;
     let handlersReady = ()=>{};
     let handlersError = ()=>{};
     let handlersPromise = new Promise((resolve, reject)=>{

package/app/node_modules/next/dist/server/mcp/get-mcp-middleware.js

@@ -10,11 +10,13 @@ Object.defineProperty(exports, "getMcpMiddleware", {
 });
 const _getorcreatemcpserver = require("./get-or-create-mcp-server");
 const _parsebody = require("../api-utils/node/parse-body");
+const _parsepath = require("../../shared/lib/router/utils/parse-path");
+const _removetrailingslash = require("../../shared/lib/router/utils/remove-trailing-slash");
 const _streamableHttp = require("next/dist/compiled/@modelcontextprotocol/sdk/server/streamableHttp");
 function getMcpMiddleware(options) {
     return async function(req, res, next) {
-        const { pathname } = new URL(req.url || '', 'http://n');
-        if (!pathname.startsWith('/_next/mcp')) {
+        const { pathname } = (0, _parsepath.parsePath)(req.url || '');
+        if ((0, _removetrailingslash.removeTrailingSlash)(pathname) !== '/_next/mcp') {
             return next();
         }
         const mcpServer = (0, _getorcreatemcpserver.getOrCreateMcpServer)(options);

package/app/node_modules/next/dist/server/next-server.js

@@ -462,7 +462,10 @@ class NextNodeServer extends _baseserver.default {
             delete process.env.__NEXT_REQUEST_INSIGHTS;
         }
         if (!this.minimalMode) {
-            this.imageResponseCache = new _responsecache.default(this.minimalMode);
+            this.imageResponseCache = new _responsecache.default({
+                minimalMode: this.minimalMode,
+                route: 'image'
+            });
         }
         if (!options.dev && !this.minimalMode && this.nextConfig.experimental.preloadEntriesOnStart) {
             this.unstable_preloadEntries();
@@ -594,6 +597,7 @@ class NextNodeServer extends _baseserver.default {
         }
     }
     async getIncrementalCache({ requestHeaders }) {
+        var _this_nextConfig_i18n;
         const dev = !!this.dev;
         let CacheHandler;
         const { cacheHandler } = this.nextConfig;
@@ -615,6 +619,7 @@ class NextNodeServer extends _baseserver.default {
             maxMemoryCacheSize: this.nextConfig.cacheMaxMemorySize,
             flushToDisk: !this.minimalMode && this.nextConfig.experimental.isrFlushToDisk,
             getPrerenderManifest: ()=>this.getPrerenderManifest(),
+            locales: (_this_nextConfig_i18n = this.nextConfig.i18n) == null ? void 0 : _this_nextConfig_i18n.locales,
             CurCacheHandler: CacheHandler
         });
     }
@@ -801,8 +806,7 @@ class NextNodeServer extends _baseserver.default {
             const isAppPath = Array.isArray(appPaths);
             let page = ctx.pathname;
             if (isAppPath) {
-                // When it's an array, we need to pass all parallel routes to the loader.
-                page = appPaths[0];
+                page = (0, _apppaths.selectAppPageEntry)(ctx.pathname, appPaths);
             }
             for (const edgeFunctionsPage of edgeFunctionsPages){
                 if (edgeFunctionsPage === page) {

package/app/node_modules/next/dist/server/response-cache/index.js

@@ -9,12 +9,13 @@ Object.defineProperty(exports, "default", {
     }
 });
 0 && __export(require("./types"));
+const _types = _export_star(require("./types"), exports);
+const _invarianterror = require("../../shared/lib/invariant-error");
 const _batcher = require("../../lib/batcher");
 const _lrucache = require("../lib/lru-cache");
 const _log = require("../../build/output/log");
 const _scheduler = require("../../lib/scheduler");
 const _utils = require("./utils");
-_export_star(require("./types"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
         if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
@@ -74,7 +75,7 @@ function _export_star(from, to) {
     return invocationID === TTL_SENTINEL ? undefined : invocationID;
 }
 class ResponseCache {
-    constructor(minimal_mode, maxSize = DEFAULT_MAX_SIZE, ttl = DEFAULT_TTL_MS){
+    constructor({ minimalMode, route, maxSize = DEFAULT_MAX_SIZE, ttl = DEFAULT_TTL_MS }){
         this.getBatcher = _batcher.Batcher.create({
             // Ensure on-demand revalidate doesn't block normal requests, it should be
             // safe to run an on-demand revalidate for the same key as a normal request.
@@ -95,7 +96,11 @@ class ResponseCache {
    * Used to detect when the cache size may be too small.
    * Bounded to prevent memory growth.
    */ this.evictedInvocationIDs = new Set();
-        this.minimal_mode = minimal_mode;
+        if (!route) {
+            throw new _invarianterror.InvariantError('Response cache requires a source route');
+        }
+        this.route = route;
+        this.minimal_mode = minimalMode;
         this.maxSize = maxSize;
         this.ttl = ttl;
         // Create the LRU cache with eviction tracking
@@ -157,7 +162,7 @@ class ResponseCache {
                 (0, _log.warnOnce)(`Response cache entry was evicted for invocation ${context.invocationID}. ` + `Consider increasing NEXT_PRIVATE_RESPONSE_CACHE_MAX_SIZE (current: ${this.maxSize}).`);
             }
         }
-        const { incrementalCache, isOnDemandRevalidate = false, isFallback = false, isRoutePPREnabled = false, isPrefetch = false, waitUntil, routeKind, invocationID } = context;
+        const { incrementalCache, isOnDemandRevalidate = false, isFallback = false, isRoutePPREnabled = false, isPrefetch = false, waitUntil, invocationID } = context;
         const response = await this.getBatcher.batch({
             key,
             isOnDemandRevalidate
@@ -168,7 +173,6 @@ class ResponseCache {
                 isFallback,
                 isRoutePPREnabled,
                 isPrefetch,
-                routeKind,
                 invocationID
             }, resolve);
             // We need to ensure background revalidates are passed to waitUntil.
@@ -197,11 +201,7 @@ class ResponseCache {
         let resolved = false;
         try {
             // Get the previous cache entry if not in minimal mode
-            previousIncrementalCacheEntry = !this.minimal_mode ? await context.incrementalCache.get(key, {
-                kind: (0, _utils.routeKindToIncrementalCacheKind)(context.routeKind),
-                isRoutePPREnabled: context.isRoutePPREnabled,
-                isFallback: context.isFallback
-            }) : null;
+            previousIncrementalCacheEntry = !this.minimal_mode ? await context.incrementalCache.get(key, this.getCacheContext(context.isRoutePPREnabled, context.isFallback)) : null;
             // `isStale === -1` signals that the entry is past its `expire` (either
             // via an expired tag or, with `cacheLife({ expire })`, past the route's
             // expire time in the prerender manifest). In that case we must NOT
@@ -293,9 +293,8 @@ class ResponseCache {
             // every caller — including batched invocations — populates the cache.
             if (incrementalResponseCacheEntry.cacheControl && !this.minimal_mode) {
                 await incrementalCache.set(key, incrementalResponseCacheEntry.value, {
-                    cacheControl: incrementalResponseCacheEntry.cacheControl,
-                    isRoutePPREnabled,
-                    isFallback
+                    ...this.getCacheContext(isRoutePPREnabled, isFallback),
+                    cacheControl: incrementalResponseCacheEntry.cacheControl
                 });
             }
             return incrementalResponseCacheEntry;
@@ -306,18 +305,35 @@ class ResponseCache {
                 const revalidate = Math.min(Math.max(previousIncrementalCacheEntry.cacheControl.revalidate || 3, 3), 30);
                 const expire = previousIncrementalCacheEntry.cacheControl.expire === undefined ? undefined : Math.max(revalidate + 3, previousIncrementalCacheEntry.cacheControl.expire);
                 await incrementalCache.set(key, previousIncrementalCacheEntry.value, {
+                    ...this.getCacheContext(isRoutePPREnabled, isFallback),
                     cacheControl: {
                         revalidate: revalidate,
                         expire: expire
-                    },
-                    isRoutePPREnabled,
-                    isFallback
+                    }
                 });
             }
             // We haven't resolved yet, so let's throw to indicate an error.
             throw err;
         }
     }
+    getCacheContext(isRoutePPREnabled, isFallback) {
+        if (this.route === 'image') {
+            return {
+                kind: _types.IncrementalCacheKind.IMAGE,
+                isFallback: false
+            };
+        }
+        const kind = (0, _utils.routeKindToIncrementalCacheKind)(this.route.kind);
+        if (kind === _types.IncrementalCacheKind.IMAGE) {
+            throw new _invarianterror.InvariantError('Images must use the image response cache');
+        }
+        return {
+            route: this.route,
+            kind,
+            isRoutePPREnabled,
+            isFallback
+        };
+    }
 }
 
 //# sourceMappingURL=index.js.map

package/app/node_modules/next/dist/server/route-matcher-providers/app-page-route-matcher-provider.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "AppPageRouteMatcherProvider", {
         return AppPageRouteMatcherProvider;
     }
 });
+const _apppaths = require("../../shared/lib/router/utils/app-paths");
 const _isapppageroute = require("../../lib/is-app-page-route");
 const _constants = require("../../shared/lib/constants");
 const _app = require("../normalizers/built/app");
@@ -35,8 +36,7 @@ class AppPageRouteMatcherProvider extends _manifestroutematcherprovider.Manifest
         // Format the routes.
         const matchers = [];
         for (const [pathname, appPaths] of Object.entries(allAppPaths)){
-            // TODO-APP: (wyattjoh) this is a hack right now, should be more deterministic
-            const page = appPaths[0];
+            const page = (0, _apppaths.selectAppPageEntry)(pathname, appPaths, (appPath)=>this.normalizers.pathname.normalize(appPath));
             const filename = this.normalizers.filename.normalize(manifest[page]);
             const bundlePath = this.normalizers.bundlePath.normalize(page);
             matchers.push(new _apppageroutematcher.AppPageRouteMatcher({

package/app/node_modules/next/dist/server/route-modules/pages/pages-handler.js

@@ -30,6 +30,7 @@ const _redirectstatuscode = require("../../../client/components/redirect-status-
 const _isbot = require("../../../shared/lib/router/utils/is-bot");
 const _addpathprefix = require("../../../shared/lib/router/utils/add-path-prefix");
 const _removetrailingslash = require("../../../shared/lib/router/utils/remove-trailing-slash");
+const _routecachekey = require("../../lib/route-cache-key");
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -106,8 +107,12 @@ const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, i
             cacheKey = cacheKey === '/index' ? '/' : cacheKey;
         }
         if (hasStaticPaths && !isDraftMode) {
+            var _nextConfig_i18n;
             const decodedPathname = (0, _removetrailingslash.removeTrailingSlash)(locale ? (0, _addpathprefix.addPathPrefix)(resolvedPathname, `/${locale}`) : resolvedPathname);
-            const isPrerendered = Boolean(prerenderManifest.routes[decodedPathname]) || prerenderManifest.notFoundRoutes.includes(decodedPathname);
+            const isPrerendered = (Boolean(prerenderManifest.routes[decodedPathname]) || prerenderManifest.notFoundRoutes.includes(decodedPathname)) && // A sibling's positive or negative prerender cannot admit parameters
+            // that this route excluded. Development computes static paths on demand
+            // instead of reading build-time prerender metadata.
+            (routeModule.isDev || (0, _routecachekey.isRouteCacheOwner)(decodedPathname, routeModule.cacheOwner, prerenderManifest.routes[decodedPathname], (_nextConfig_i18n = nextConfig.i18n) == null ? void 0 : _nextConfig_i18n.locales));
             const prerenderInfo = prerenderManifest.dynamicRoutes[srcPage];
             if (prerenderInfo) {
                 if (prerenderInfo.fallback === false && !isPrerendered) {

package/app/node_modules/next/dist/server/route-modules/route-module.js

@@ -28,6 +28,7 @@ const _incrementalcache = require("../lib/incremental-cache");
 const _handlers = require("../use-cache/handlers");
 const _interopdefault = require("../app-render/interop-default");
 const _routekind = require("../route-kind");
+const _routecachekey = require("../lib/route-cache-key");
 const _responsecache = /*#__PURE__*/ _interop_require_default(require("../response-cache"));
 const _apppaths = require("../../shared/lib/router/utils/app-paths");
 const _routerservercontext = require("../lib/router-utils/router-server-context");
@@ -47,6 +48,7 @@ class RouteModule {
     constructor({ userland, definition, distDir, relativeProjectDir }){
         this._userland = userland;
         this.definition = definition;
+        this.cacheOwner = (0, _routecachekey.getResponseCacheOwner)(definition);
         this.isDev = !!process.env.__NEXT_DEV_SERVER;
         this.distDir = distDir;
         this.relativeProjectDir = relativeProjectDir;
@@ -270,6 +272,7 @@ class RouteModule {
         if (process.env.NEXT_RUNTIME === 'edge') {
             return globalThis.__incrementalCache;
         } else {
+            var _nextConfig_i18n;
             let CacheHandler;
             const { cacheHandler } = nextConfig;
             if (cacheHandler) {
@@ -293,7 +296,8 @@ class RouteModule {
                 maxMemoryCacheSize: nextConfig.cacheMaxMemorySize,
                 flushToDisk: !isMinimalMode && nextConfig.experimental.isrFlushToDisk,
                 getPrerenderManifest: ()=>prerenderManifest,
-                CurCacheHandler: CacheHandler
+                CurCacheHandler: CacheHandler,
+                locales: (_nextConfig_i18n = nextConfig.i18n) == null ? void 0 : _nextConfig_i18n.locales
             });
             globalThis.__incrementalCache = incrementalCache;
             return incrementalCache;
@@ -651,7 +655,10 @@ class RouteModule {
     getResponseCache(req) {
         if (!this.responseCache) {
             const minimalMode = (0, _requestmeta.getRequestMeta)(req, 'minimalMode') ?? false;
-            this.responseCache = new _responsecache.default(minimalMode);
+            this.responseCache = new _responsecache.default({
+                minimalMode,
+                route: this.cacheOwner
+            });
         }
         return this.responseCache;
     }

package/app/node_modules/next/dist/shared/lib/router/utils/app-paths.js

@@ -5,7 +5,8 @@ Object.defineProperty(exports, "__esModule", {
 0 && (module.exports = {
     compareAppPaths: null,
     normalizeAppPath: null,
-    normalizeRscURL: null
+    normalizeRscURL: null,
+    selectAppPageEntry: null
 });
 function _export(target, all) {
     for(var name in all)Object.defineProperty(target, name, {
@@ -22,6 +23,9 @@ _export(exports, {
     },
     normalizeRscURL: function() {
         return normalizeRscURL;
+    },
+    selectAppPageEntry: function() {
+        return selectAppPageEntry;
     }
 });
 const _ensureleadingslash = require("../../page-path/ensure-leading-slash");
@@ -54,6 +58,19 @@ function compareAppPaths(a, b) {
     if (!aHasSlot && bHasSlot) return 1;
     return a.localeCompare(b);
 }
+function selectAppPageEntry(pathname, appPaths, normalizePathname = (appPath)=>normalizeAppPath(appPath).replace(/%5F/g, '_')) {
+    let entry;
+    for (const appPath of appPaths){
+        if (normalizePathname(appPath) !== pathname) continue;
+        if (entry === undefined || compareAppPaths(entry, appPath) < 0) {
+            entry = appPath;
+        }
+    }
+    if (entry === undefined) {
+        throw new Error(`Invariant: no direct app page entry found for ${pathname}`);
+    }
+    return entry;
+}
 function normalizeRscURL(url) {
     return url.replace(/\.rsc($|\?)/, // $1 ensures `?` is preserved
     '$1');

package/app/node_modules/next/dist/telemetry/anonymous-meta.js

@@ -82,7 +82,7 @@ async function getAnonymousMeta() {
         isWsl: _iswsl.default,
         isCI: _ciinfo.isCI,
         ciName: _ciinfo.isCI && _ciinfo.name || null,
-        nextVersion: "16.3.6",
+        nextVersion: "16.3.8",
         agentName: await (0, _agentname.getAgentName)()
     };
     return traits;

package/app/node_modules/next/dist/telemetry/events/swc-load-failure.js

@@ -38,7 +38,7 @@ async function eventSwcLoadFailure(event) {
     telemetry.record({
         eventName: EVENT_PLUGIN_PRESENT,
         payload: {
-            nextVersion: "16.3.6",
+            nextVersion: "16.3.8",
             glibcVersion,
             installedSwcPackages,
             arch: process.arch,

package/app/node_modules/next/dist/telemetry/events/version.js

@@ -12,12 +12,12 @@ const EVENT_VERSION = 'NEXT_CLI_SESSION_STARTED';
 function eventCliSession(nextConfig, event) {
     var _nextConfig_experimental, _nextConfig_experimental_staleTimes, _nextConfig_experimental_staleTimes1, _nextConfig_reactCompiler, _nextConfig_reactCompiler1;
     // This should be an invariant, if it fails our build tooling is broken.
-    if (typeof "16.3.6" !== 'string') {
+    if (typeof "16.3.8" !== 'string') {
         return [];
     }
     const { images, i18n } = nextConfig || {};
     const payload = {
-        nextVersion: "16.3.6",
+        nextVersion: "16.3.8",
         nodeVersion: process.version,
         cliCommand: event.cliCommand,
         isSrcDir: event.isSrcDir,

package/app/node_modules/next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next",
-  "version": "16.3.6",
+  "version": "16.3.8",
   "description": "The React Framework",
   "main": "./dist/server/next.js",
   "license": "MIT",
@@ -81,7 +81,7 @@
     "next": "./dist/bin/next"
   },
   "dependencies": {
-    "@next/env": "16.3.6",
+    "@next/env": "16.3.8",
     "@swc/helpers": "0.5.23",
     "baseline-browser-mapping": "^2.9.19",
     "caniuse-lite": "^1.0.30001579",
@@ -112,14 +112,14 @@
   },
   "optionalDependencies": {
     "sharp": "^0.35.4",
-    "@next/swc-darwin-arm64": "16.3.6",
-    "@next/swc-darwin-x64": "16.3.6",
-    "@next/swc-linux-arm64-gnu": "16.3.6",
-    "@next/swc-linux-arm64-musl": "16.3.6",
-    "@next/swc-linux-x64-gnu": "16.3.6",
-    "@next/swc-linux-x64-musl": "16.3.6",
-    "@next/swc-win32-arm64-msvc": "16.3.6",
-    "@next/swc-win32-x64-msvc": "16.3.6"
+    "@next/swc-darwin-arm64": "16.3.8",
+    "@next/swc-darwin-x64": "16.3.8",
+    "@next/swc-linux-arm64-gnu": "16.3.8",
+    "@next/swc-linux-arm64-musl": "16.3.8",
+    "@next/swc-linux-x64-gnu": "16.3.8",
+    "@next/swc-linux-x64-musl": "16.3.8",
+    "@next/swc-win32-arm64-msvc": "16.3.8",
+    "@next/swc-win32-x64-msvc": "16.3.8"
   },
   "keywords": [
     "react",

package/app/node_modules/source-map-js/lib/quick-sort.js

@@ -112,6 +112,15 @@ function cloneSort(comparator) {
   return templateFn(comparator);
 }
 
+let isEvalAllowed = (function () {
+  try {
+    new Function('return 0')();
+    return true;
+  } catch {
+    return false;
+  }
+})();
+
 /**
  * Sort the given array in-place with the given comparator function.
  *
@@ -123,7 +132,7 @@ function cloneSort(comparator) {
 
 let sortCache = new WeakMap();
 exports.quickSort = function (ary, comparator, start = 0) {
-  let doQuickSort = sortCache.get(comparator);
+  let doQuickSort = isEvalAllowed ? sortCache.get(comparator) : SortTemplate(comparator);
   if (doQuickSort === void 0) {
     doQuickSort = cloneSort(comparator);
     sortCache.set(comparator, doQuickSort);

package/app/node_modules/source-map-js/lib/source-map-consumer.js

@@ -11,6 +11,14 @@ var ArraySet = require('./array-set').ArraySet;
 var base64VLQ = require('./base64-vlq');
 var quickSort = require('./quick-sort').quickSort;
 
+// Upper bound for a section's `offset.line` in an indexed source map. A flat
+// map spends one ';' per generated line, so a tiny indexed map with a huge
+// offset.line turns into a huge amount of work and memory once its mappings
+// are copied into a SourceMapGenerator (CVE-2026-93749). Ten million lines is
+// far beyond any real generated file. Columns are VLQ-encoded as deltas and
+// don't amplify, so they only need to be valid integers.
+var MAX_SECTION_OFFSET_LINE = 1e7;
+
 function SourceMapConsumer(aSourceMap, aSourceMapURL) {
   var sourceMap = aSourceMap;
   if (typeof aSourceMap === 'string') {
@@ -935,6 +943,7 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     line: -1,
     column: 0
   };
+  var maxOffsetLine = 0;
   this._sections = sections.map(function (s) {
     if (s.url) {
       // The url field will require support for asynchronicity.
@@ -945,12 +954,32 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
     var offsetLine = util.getArg(offset, 'line');
     var offsetColumn = util.getArg(offset, 'column');
 
+    if (!isValidOffset(offsetLine) || !isValidOffset(offsetColumn)) {
+      throw new Error('Section offset line and column must be non-negative integers.');
+    }
+    if (offsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE + '.');
+    }
+
     if (offsetLine < lastOffset.line ||
         (offsetLine === lastOffset.line && offsetColumn < lastOffset.column)) {
       throw new Error('Section offsets must be ordered and non-overlapping.');
     }
     lastOffset = offset;
 
+    var consumer = new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL);
+
+    // Offsets of a nested indexed map add up with this one, so apply the
+    // bound to the total.
+    var totalOffsetLine = offsetLine + (consumer._maxOffsetLine || 0);
+    if (totalOffsetLine > MAX_SECTION_OFFSET_LINE) {
+      throw new Error('Section offset line must not exceed ' + MAX_SECTION_OFFSET_LINE +
+                      ', including offsets of nested sections.');
+    }
+    if (totalOffsetLine > maxOffsetLine) {
+      maxOffsetLine = totalOffsetLine;
+    }
+
     return {
       generatedOffset: {
         // The offset fields are 0-based, but we use 1-based indices when
@@ -958,9 +987,24 @@ function IndexedSourceMapConsumer(aSourceMap, aSourceMapURL) {
         generatedLine: offsetLine + 1,
         generatedColumn: offsetColumn + 1
       },
-      consumer: new SourceMapConsumer(util.getArg(s, 'map'), aSourceMapURL)
+      consumer: consumer
     }
   });
+
+  // The largest offset.line of any section, including nested sections.
+  this._maxOffsetLine = maxOffsetLine;
+}
+
+/**
+ * Section offsets come from untrusted input and are used as line/column
+ * numbers, so only accept non-negative safe integers (rejects NaN, Infinity,
+ * strings, fractions, etc).
+ */
+function isValidOffset(aValue) {
+  return typeof aValue === 'number' &&
+    aValue >= 0 &&
+    aValue <= 9007199254740991 && // Number.MAX_SAFE_INTEGER
+    Math.floor(aValue) === aValue;
 }
 
 IndexedSourceMapConsumer.prototype = Object.create(SourceMapConsumer.prototype);
@@ -978,8 +1022,12 @@ Object.defineProperty(IndexedSourceMapConsumer.prototype, 'sources', {
   get: function () {
     var sources = [];
     for (var i = 0; i < this._sections.length; i++) {
-      for (var j = 0; j < this._sections[i].consumer.sources.length; j++) {
-        sources.push(this._sections[i].consumer.sources[j]);
+      // Read the getter once per section: for a nested indexed map it is
+      // itself this getter, and re-reading it per item is exponential in the
+      // nesting depth (CVE-2026-93749).
+      var sectionSources = this._sections[i].consumer.sources;
+      for (var j = 0; j < sectionSources.length; j++) {
+        sources.push(sectionSources[j]);
       }
     }
     return sources;

package/app/node_modules/source-map-js/lib/source-map-generator.js

@@ -348,10 +348,12 @@ SourceMapGenerator.prototype._serializeMappings =
 
       if (mapping.generatedLine !== previousGeneratedLine) {
         previousGeneratedColumn = 0;
-        while (mapping.generatedLine !== previousGeneratedLine) {
-          next += ';';
-          previousGeneratedLine++;
-        }
+        // One ';' per skipped line. Build large gaps with a single flat
+        // string: appending ';' one by one creates a rope node per line, which
+        // can exhaust the heap for a big gap (CVE-2026-93749).
+        var lineDelta = mapping.generatedLine - previousGeneratedLine;
+        next += lineDelta === 1 ? ';' : ';'.repeat(lineDelta);
+        previousGeneratedLine = mapping.generatedLine;
       }
       else {
         if (i > 0) {

package/app/node_modules/source-map-js/lib/source-node.js

@@ -113,6 +113,13 @@ SourceNode.fromStringWithSourceMap =
       // to the SourceNode without any mapping.
       // Each line is added as separate string.
       while (lastGeneratedLine < mapping.generatedLine) {
+        if (remainingLinesIndex >= remainingLines.length) {
+          // The generated code is exhausted. Skip the rest instead of adding
+          // empty lines one by one: a mapping may point far past the end of
+          // the code (e.g. an indexed map section with a huge offset.line).
+          lastGeneratedLine = mapping.generatedLine;
+          break;
+        }
         node.add(shiftNextLine());
         lastGeneratedLine++;
       }

package/app/node_modules/source-map-js/package.json

@@ -1,7 +1,7 @@
 {
   "name": "source-map-js",
   "description": "Generates and consumes source maps",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "homepage": "https://github.com/7rulnik/source-map-js",
   "author": "Valentin 7rulnik Semirulnik <v7rulnik@gmail.com>",
   "contributors": [