v0.4.0: security fixes for fetch and extract, stricter parsers

srcmap 0.4.0 has security fixes for the srcmap CLI and the dependencies, two possibly breaking API changes, and fixes for the WASM browser build.

Breaking changes

• @srcmap/sourcemap: SourceMap.source() and SourceMap.name() now declare string | null. They already returned null for an index that is out of range. The type declarations now say so. Strict TypeScript callers must handle null.
• Parsers without indexed map support now reject indexed maps. SourceMap::from_json_no_content, SourceMap::from_json_lines and the lazy parser return ParseError::NestedIndexMap for a map with sections. Before, they parsed it as an empty map. Use SourceMap::from_json for indexed maps.

Security

• Bundled root certificates no longer trust the distrusted emSign root. webpki-roots 1.0.10 fixes RUSTSEC-2026-0381. rustls-webpki 0.103.16 fixes RUSTSEC-2026-0382. rustls 0.23.46 fixes RUSTSEC-2026-0285 and RUSTSEC-2026-0346 to 0349. These affect srcmap fetch.
• srcmap fetch constrains its downloads.
  • It follows redirects and the derived source map URL only on the same origin.
  • One timeout applies across all redirects.
  • It does not overwrite an existing file and does not follow a symlink at the destination.
  • It rejects an output directory that is a symlink or that has a symlinked ancestor.
  • It removes a partial file when a write fails.
  • A server error or a timeout on the conventional .map URL is now an error. A 404 is still ignored.
• srcmap sources extract contains its writes in the output directory.
  • It skips absolute paths, backslash paths, existing files and symlinks in the target path.
  • It holds directory handles, so a path swap during the extraction cannot redirect a write.
• srcmap-codec: VLQ encoding is memory-safe for the full 64-bit range. The encoder reserved 7 bytes, but some values need 13.

Fixes

• @srcmap/sourcemap-wasm: the browser entry works again. It exposes the API as static ESM exports before initialization, initializes the module only once, and ships type declarations.
• @srcmap/source-map: applySourceMap works again. It copies sourcesContent and skips a source that the generator does not have.
• @srcmap/remapping: the CommonJS entry has its WASM fallback again.

Infrastructure

• Dependency updates, Dependabot repair automation, and release publication hardening.

Full Changelog: v0.3.9...v0.4.0