Bump proxy-addr and source-map-js

[uldisrudzitis]

Combines the two open Dependabot security patches into one PR. Both are lockfile-only, with no dependency or Node engine changes.

Changes

• proxy-addr 2.0.7 → 2.0.8 in editor/ (CVE-2026-90711). Dev-only, pulled in by @angular/cli through @modelcontextprotocol/sdk → express.
• source-map-js 1.2.1 → 1.2.2 in the root lockfile (CVE-2026-93749, plus a CSP crash fix). Dev-only, used by sass and postcss in the Gulp build.
• Switches the remaining http://registry.npmjs.org resolved URLs in the root lockfile to https://.

Testing

• editor/: npm ci, npm test -- --watch=false --browsers=ChromeHeadless (138/138 pass)
• root: npm ci, npm run build

Supersedes #658, #659.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (2)

• editor/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: e001a1a1-5597-4696-bbfb-f492abe21433

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}