[Mercy811]

Summary

Patch compatible legacy Browser SDK and documentation-tooling vulnerabilities in one native Yarn refresh, and replace the reported Node 14 development pin with 24.22.2 (includes the October Brotli security fix). The ambiguous SDK-560 package is trim, patched at 0.0.3. Upgrade the root YAML 2 consumer (lint-staged) within its existing major and retain webpack 5.104.1 for Docusaurus 2 compatibility: newer webpack versions break private plugin APIs/progress options used by this old toolchain.

The native lockfile refresh also updates production dependencies within their declared ranges: @amplitude/analytics-connector 1.4.6 → 1.7.0, @babel/runtime 7.28.6 → 7.29.10, and tslib 2.5.0 → 2.9.1. Documentation CI now reads .node-version, because refreshed Cheerio/Undici dependencies require Node ≥20.18.1; no deployment was run.

Validation (original implementation run; completed cloud revalidation is recorded below):

• All SDK Rollup bundles, snippet/test bundles, and lint pass.
• Chromium Karma suites pass: 453 main tests and 18 web-worker tests.
• JSDoc generation and production documentation build pass.
• System make is blocked by the unaccepted Xcode license; the exact Rollup/uglify/Karma steps were run directly instead.
• Development runtime tested on checksum-verified Node 24.22.2; no release performed.

Still unresolved — keep these tickets In Progress:

• SDK-627: semver-regex 2.0.0 remains under karma-sauce-launcher → saucelabs → bin-wrapper.
• SDK-587: http-cache-semantics 3.8.1 remains under the same Sauce Labs download chain.
• SDK-572: cross-spawn 6/7 occurrences are patched, but 5.1.0 remains in the old launcher chain.
• SDK-584: decode-uri-component 0.2.2 and 0.4.1 remain; current fixes require parent-package migration to the 0.5 line.
• SDK-562: Docusaurus 2 still locks axios 0.25.0; migrate the documentation toolchain rather than force an incompatible Axios major.

These parent-toolchain migrations need separate PRs/validation. Existing single-package Dependabot PRs are untouched. Other reported versions are patched in this graph; Semgrep confirmation requires merge/rescan. Newer unrelated audit findings are not claimed resolved.

Tickets

SDK-644, SDK-645, SDK-646, SDK-647, SDK-648, SDK-628, SDK-622, SDK-626, SDK-627, SDK-624, SDK-604, SDK-605, SDK-608, SDK-606, SDK-607, SDK-584, SDK-588, SDK-587, SDK-585, SDK-586, SDK-572, SDK-570, SDK-571, SDK-569, SDK-560, SDK-562, SDK-555, SDK-554.

Checklist

• Does your PR title have the correct title format? Conventional commit.
• Does your PR have a breaking change?: No published SDK API change. Development runtime now requires Node 24.22.2.

Cloud follow-up validation

Validated latest head fedcea6a51457d3b086bfabfc5ca53c42da15128 in hosted Linux using official SHA-256-verified Node 24.22.2:

• Native Yarn 1.22.22 frozen installs succeed for root and website; neither lockfile changes.
• make build, lint, JSDoc generation, and documentation production build succeed.
• Karma main: 453 tests pass; web-worker: 18 tests pass. Used official Chrome 151 headless-shell with container-compatible launch flags after full Chrome could not open its process-singleton Unix socket; no repository tests/configuration were disabled.
• Current GitHub Lint, Semantic PR Check, and Semgrep checks succeed for this head. The repository Test workflow only targets main, so these Karma results are hosted local validation, not a GitHub Test check. The v8.x branch response lists no required status-check contexts; full classic protection details are inaccessible to the connector.
• Independent review of all six changed files, full lockfile dependency graphs, runtime compatibility, and all reported scanner package sets found no remaining blockers after the docs runtime fix. The five unresolved ticket portions above remain In Progress and require parent migrations/Semgrep disposition.

Readiness blocker

The exact bugbot run trigger was posted as human Mercy811 for the head above. Cursor explicitly skipped it because Bugbot is disabled for this repository. No Bugbot review ran. Keep draft/needs-human-help until a repository administrator enables Bugbot and starts a real review for this existing head in the dashboard. No duplicate trigger will be posted for the unchanged head.

[linear-code]

SDK-645

SDK-572

SDK-607

SDK-586

SDK-647

SDK-606

SDK-585

SDK-646

SDK-604

SDK-555

SDK-571

SDK-627

SDK-569

SDK-554

SDK-626

SDK-560

SDK-644

SDK-628

SDK-584

SDK-624

SDK-562

SDK-587

SDK-605

SDK-588

SDK-570

SDK-608

SDK-648

SDK-622

[Mercy811]

bugbot run

[cursor]

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

[Mercy811]

Hosted follow-up on fedcea6a51457d3b086bfabfc5ca53c42da15128 is complete through CI and independent review: latest Lint, Semantic PR Check, and Semgrep checks pass; frozen Yarn installs, all bundles, lint, JSDoc, documentation production build, 453 main Karma tests, and 18 worker tests pass on Node 24.22.2. The independent complete-diff review found the docs Node 16 incompatibility, now fixed by reading .node-version, and has no remaining blocking code findings.

Bugbot is the remaining readiness blocker. The exact bugbot run comment was posted as human account Mercy811. Cursor responded that Bugbot is disabled for this repository. No Bugbot review actually started. A repository administrator needs to enable this repository in the Bugbot dashboard and initiate a review of this existing head there. I will not post another trigger for this unchanged SHA. Keeping this PR as draft with needs-human-help until a real Bugbot review runs and its findings are addressed.

SDK-627, SDK-587, SDK-572, SDK-584, and SDK-562 retain the unresolved parent-toolchain portions recorded in the description. All linked Linear work remains In Progress; no tickets were closed, and no merge, release, or auto-merge was performed.

[Mercy811]

Test it locally using Node 24.22.2:

• All SDK and test bundles build.
• All 471 enabled tests pass: 453 main + 18 web-worker.
• Lint, JSDoc, and production docs build pass.
• Frozen installs preserve both lockfiles.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-11-03T17:23:15.797133Z We couldn’t complete this review. Comment @codex review to try again.	fedcea6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.