Address all known vulnerabilities

[aarsilv]

See commit 8979b1d for full per-package detail and verification notes. Summary:

• yarn audit: 128 paths → 0 (was 1 Critical / 59 High / 51 Moderate / 17 Low).
• Zero resolutions in package.json — the entire previous resolutions block (form-data, js-yaml, @babel/helpers, brace-expansion, diff, flatted, lodash, minimatch, picomatch, schema-utils/ajv, ajv-formats/ajv) was dropped. After the dep bumps every one of those transitives now resolves to a patched version on its own.
• Direct dep bumps: @eppo/js-client-sdk-common 4.15.5 → ^5 (drops the uuid runtime dep), @typescript-eslint/* 5 → 8, jest 29 → 30 + jest-environment-jsdom 29 → 30 + @types/jest 29 → 30, lint-staged 15 → 16, webpack 5.98 → 5.106, plus latest patches across api-extractor / api-documenter. Held @types/chrome in the 0.0.x line on purpose — 0.1.x tightens chrome.storage.StorageArea.get's generic in a way that would force a wider refactor.
• CI matrix updated [18, 20, 22, 23] → [20, 22, 24] and engines.node set to >=20.0.0 to match the @eppo/js-client-sdk-common v5 requirement (Node 18 is past EOL; Node 23 is non-LTS and explicitly excluded by jest 30's engine range).
• Three small source-side adjustments forced by the dep bumps: drop explicit IterableIterator return-type annotations on the LocalStorageAssignmentShim's iterator methods (TS 5.6+ tightened Map.entries/keys/values to return MapIterator); replace deprecated @typescript-eslint/no-var-requires and ban-types disable directives with the v8-equivalents; bare catch for unused catch (e) parameters.

Test plan

• CI runs yarn lint, yarn typecheck, yarn test:unit, yarn webpack green on Node 20/22/24
• yarn audit reports 0 vulnerabilities with no resolutions block

Manual verification

Built a tiny toy browser app that loads the bundled SDK from this branch (dist/eppo-sdk.js) and calls eppo.init(...).getStringAssignment(...) against an Eppo Sandbox account. Resolved My-Flag (with attrs {accountId, sd:'dsf'} to hit the 50/50 allocation) and megan-test-blahh for 12 distinct subject keys, comparing against the same 12 subjects in a parallel toy node app on node-server-sdk PR #124's branch. All 12 subjects produced identical variation assignments across the two SDK branches, distribution 8 treatment / 4 control, assignment-logger fired correctly on both sides.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the SDK’s dependency set and build/test tooling to eliminate known yarn audit vulnerabilities without relying on package.json resolutions, while also raising the supported Node.js baseline to match upstream requirements.

Changes:

• Bumped multiple direct dependencies/devDependencies (notably @eppo/js-client-sdk-common v5, Jest v30, @typescript-eslint/* v8, Webpack v5.x) and removed the previous resolutions block.
• Updated runtime/tooling expectations by setting engines.node >=20 and adjusting the GitHub Actions CI matrix to Node 20/22/24.
• Applied small source/test adjustments required by the tooling upgrades (new eslint disable rule name, bare catch, TS Map iterator typing change).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/sdk-data.ts	Updates eslint suppression to the v8 rule name for require usage.
src/local-storage-engine.ts	Replaces unused catch (e) bindings with bare catch blocks.
src/index.spec.ts	Updates eslint suppression rule name and improves typing for reloaded-module helpers.
src/cache/local-storage-assignment-shim.ts	Removes explicit iterator return annotations to match newer TS MapIterator typing.
package.json	Removes vulnerability resolutions, bumps deps, and enforces Node >=20.
docs/js-client-sdk.loglevel.md	Regenerates API docs output for LogLevel signature formatting.
.github/workflows/lint-test-sdk.yml	Updates CI Node matrix to 20/22/24.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aarsilv]

The pairing here is intentional and supported, not fragile.

ts-jest hasn't published a 30.x major — only the 29.x line exists. ts-jest 29.4.x explicitly declares jest 30 as a supported peer:

$ npm view ts-jest@29.4.9 peerDependencies.jest
^29.0.0 || ^30.0.0

So ts-jest ^29 IS the jest-30-compatible release. Bumping to ^30 would fail — that version doesn't exist. Reverting jest to 29 would only cost us the Node 24 support that jest 30 added, with no toolchain benefit.

The CI matrix runs lint-test-sdk + typecheck on Node 20/22/24 (all pass on this PR), and jest.config.ts is exercised by all 153 tests under that transformer.

[sameerank]

Some big changes (dropping Node 18, and major bumps in dependencies, esp js-client-common). Agreed with the major bump to 4.0.0