[jaissica12]

Summary

Applies npm audit fix --package-lock-only. Every change stays within the ranges already declared in package.json: package.json is unchanged and no direct dependency is added or removed. The SDK has no runtime dependencies, so this only affects build, test and release tooling (including the npm used by the release plugin).

• npm audit goes from 80 advisories (7 critical, 44 high) to 54 (0 critical, 31 high). The rest need a major version bump or have no fix yet.
• webpack moves to 5.112.2, whose minimizer plugin needs terser 5.51. That terser is nested under the plugin, so rollup keeps building with terser 5.22.0.

Testing

• mparticle.js, mparticle.common.js, mparticle.esm.js and the stub are byte-identical to a build with the previous lockfile.
• npm run build, npm run lint, Jest (3,358), Karma (1,218) and npm run test:integrations (2,436 per bundler) pass.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (v3-development@706687f). Learn more about missing BASE report.

Additional details and impacted files

@@                Coverage Diff                @@
##             v3-development    #1732   +/-   ##
=================================================
  Coverage                  ?   63.37%           
=================================================
  Files                     ?       79           
  Lines                     ?    10419           
  Branches                  ?     2993           
=================================================
  Hits                      ?     6603           
  Misses                    ?     3505           
  Partials                  ?      311           

Flag	Coverage Δ
core	53.85% <ø> (?)
rokt-kit	92.58% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

I reviewed this PR and didn't find any bugs. Because it is a large lockfile refresh (about 314 resolution changes) that also changes the bundling toolchain, a human look would still be worthwhile. The main thing to check is the new minimizer-webpack-plugin package, which I couldn't verify against the registry from here.

What was reviewed:

• The webpack entry moves from 5.89.0 to 5.112.2. It now depends on minimizer-webpack-plugin ^5.13.0 instead of terser-webpack-plugin, and loader-runner and acorn-import-assertions are gone. The new plugin resolves from registry.npmjs.org with an integrity hash and its own nested terser 5.51.2.
• I searched the repo's own sources for the removed packages (terser-webpack-plugin, loader-runner, event-stream/ps-tree, temp-fs, open). They only show up in committed dist/ bundles, not in configs or scripts.
• package.json is unchanged. Every change is a transitive resolution or a newly added resolved/integrity field.

Extended reasoning...

The change only touches package-lock.json and affects dev and build tooling only, not SDK runtime code. Its security-relevant surface is the supply chain: newly resolved tarballs and a new package (minimizer-webpack-plugin) that now sits in webpack's minification path. I could not confirm from the registry that this package is the official webpack-contrib successor to terser-webpack-plugin. The project notes that minifier and toolchain changes can break the CDN build even when tests pass. The size of the diff and the minifier swap decided defer over approve.

[crisryantan]

This is an automated review by Moody (Senior Engineer), requested by Ryan Tan in Chat. Automated review; not an independent human approval.

Risk: high

No blocking defect found. The refresh reaches publishing and signature tooling as well as builds. All 67 supplied CI checks passed.

Checked against v3-development at 9135454; head a390878.

Checks on this head: 67 passed, 0 failed, 0 pending

No changes needed. I can't approve this one: part of the review draws on internal reference code, which is not posted on a public PR, so a person needs to approve it on GitHub. The part to look at: package-lock.json:16637 | The npm upgrade reaches release tooling and updates its signing and verification dependencies.

Non-blocking

• (withheld on this public PR: it draws on internal reference code)
• PR description: Mention release tooling in the scope summary too. The refreshed npm dependency is consumed by the configured release plugin.

Checked

• package-lock.json | Reviewed dependency changes, registry locations, integrity metadata, nesting and engine requirements; no new external registry or install-script declaration appeared.
• rollup.config.js; package-lock.json:24500 | Traced CJS and ESM output through the Rollup minifier; root Terser remains 5.22.0, with webpack's newer version nested separately.
• test/integrations/cjs/webpack/webpack.config.js; test/integrations/module/webpack/webpack.config.js | Traced bundle outputs into Karma configurations. Both webpack configurations disable minimization.
• release.config.js; scripts/build-v3-release.sh; .github/workflows/staging-step-1.yml:718 | Traced refreshed npm into release preparation and publishing; configured release Node satisfies its engine requirement.
• scripts/check-cdn-minifier.js; test/jest/cdn-minifier-check.spec.ts | Checked ESLint consumers and regression assertions for missing bindings and invalid generated syntax.
• .github/workflows/pull-request.yml; test/karma.config.js; jest.config.js | Checked build, lint, browser, Jest and CDN compatibility coverage. Supplied head status reports 67 passes.

Not verified:

• Registry archive contents and upstream security fixes were not independently inspected; dependency implementations and advisory reports were not supplied.
• Reported bundle byte equality and live publishing/provenance behavior were not independently verified; comparison artifacts and a release transcript were not supplied.
• Part of this review draws on internal reference code, so it is in the requester's Chat reply only.

[jaissica12]

Updated the description: the scope now says the refresh reaches build, test and release tooling, including the npm used by the release plugin. No code change needed.

[crisryantan]

This is an automated review by Moody (Senior Engineer), requested by Ryan Tan in Chat. Automated review; not an independent human approval.

Risk: high

No blocking defect found in the lockfile refresh. Publishing and signature tooling change too; the Google Tag Manager kit check is red, with no failure logs supplied.

Checked against v3-development at 706687f; head ba6164a.

Checks on this head: 65 passed, 1 failed, 0 pending; failed: Kit Tests: Google Tag Manager

No changes needed. I can't approve this one: part of the review draws on internal reference code, which is not posted on a public PR, so a person needs to approve it on GitHub. The part to look at: package-lock.json:16640 | The npm upgrade reaches release tooling and changes its bundled signing, verification and archive dependencies.

Non-blocking

• (withheld on this public PR: it draws on internal reference code)

Checked

• package.json; package-lock.json | Security: compared declared ranges and root lock metadata with base; checked added registry URLs, integrity metadata and install-script changes.
• rollup.config.js; package-lock.json:24500 | Web-performance and docs-and-plans: traced shipped bundle generation; Rollup retains Terser 5.22.0, with webpack's newer version nested separately.
• test/integrations/cjs/webpack/webpack.config.js; test/integrations/module/webpack/webpack.config.js | Followed bundle inputs into Karma harnesses. Both webpack configurations disable minimization.
• release.config.js; .github/workflows/staging-step-1.yml:718 | Security and reliability: followed dependency installation through release preparation and publishing; checked npm consumers and Node compatibility.
• package-lock.json:15011; jest.config.js | Traced updated HTTP, socket, parser and crypto dependencies through Karma, jsdom, BrowserSync and Browserify tooling.
• scripts/check-cdn-minifier.js; test/jest/cdn-minifier-check.spec.ts | Testing: checked the updated ESLint consumer and assertions for undeclared names, valid renaming, comments and parse failures.
• .github/workflows/pull-request.yml:117; kits/google-tag-manager/package.json | Read supplied CI results: 65 passed, one failed. The failed kit installs its own unchanged lockfile.

Not verified:

• Google Tag Manager kit failure | Logs were not supplied, so its cause remains unverified. The CDN minifier job depends on kit success; the aggregate check summary does not establish whether it executed.
• package-lock.json | Upstream package contents and the claimed advisory reduction were not independently verified; dependency sources and an audit report were not supplied.
• Part of this review draws on internal reference code, so it is in the requester's Chat reply only.