Refresh workspace and GitHub Actions dependencies

[niemyjski]

This refreshes compatible dependencies across the SDKs and examples, keeps GitHub Actions SHA-pinned, and fixes a rerun failure in CI package publishing. The latest cooled Expo SDK 57 patches, Next.js 16.3.5, and the security-fixed devalue 5.9.2 are included. No public SDK APIs change.

Merge gate: Code validation is complete; human review is still required. Expo Doctor reports 20/21 because three expected patches were published September 18 and have not cleared this repo's seven-day release-age policy. No check is suppressed. Native-device crash reporting and delivery to a live Exceptionless backend remain unverified.

Validation: Clean Node 24/npm 11 install; 351 tests; full SDK/sample build and lint; Linux/macOS/Windows CI and CodeQL green; Svelte check (0 diagnostics); Expo web/iOS exports; Next.js production route (HTTP 200); npm audit and OSV (0 findings).

Verification and implementation details

• Next.js 16.3.5 includes image-cache and CSP nonce fixes. The production sample route queued its event; the local backend was offline, so delivery was not verified.
• Expo SDK 57 remains paired with React/React DOM 19.2.3, React Native 0.86.3, and AsyncStorage 2.2.0. Expo Doctor's remaining expected versions are expo@57.0.24, @expo/metro-runtime@57.0.16, and expo-constants@57.0.19; all were published September 18. The currently selected patches are the newest eligible under min-release-age=7.
• GHSA-9rgm-9g3h-6x36 is fixed by the compatible devalue@5.9.2 lockfile update. The prior qs cooling exception is removed now that its fix has aged in. All 41 changed lockfile entries are at least seven days old; all 877 remote entries use the npm registry with integrity hashes.
• GitHub CI package publication checks each exact package version and skips only versions already present. Registry/authentication and publish failures still fail the job; regression tests cover partial reruns and both failure paths. The workflow keeps least-privilege job permissions and pinned Actions. Current official checkout, setup-node, and setup-dotnet releases were rechecked September 21.
• PR build passed on all three operating systems; CodeQL passed JavaScript and Actions analysis. The push workflow first published seven CI packages, then a targeted rerun passed with 0 published, 7 already present. The related review thread is resolved. npm release publication was correctly skipped on this branch.
• The latest commit used the existing local GPG signer, but GitHub reports unknown_key rather than a verified badge. This is not a current branch-protection blocker; no signing keys or account settings were changed.
• The thermo-nuclear review found no new public API changes, scattered SDK conditionals, unnecessary abstraction in the SDKs, or file newly crossing 1,000 lines. The only new helper owns the CI publication retry policy and is tested. Existing sample behavior was exercised in the earlier PR pass; this pass reran all builds and tests plus targeted Expo and Next.js runtime/export checks.

[Copilot]

Pull request overview

Refreshes dependency versions across the Exceptionless.JavaScript monorepo (core SDK packages plus example apps) to align on current compatible tooling, reduce known vulnerabilities via overrides, and keep the build/test toolchain consistent across workspaces.

Changes:

• Bumps esbuild across all SDK packages and updates root allowScripts accordingly.
• Updates framework/example dependencies (React, Vue, Vite, SvelteKit, Next.js, Expo/RN) and adds the missing @testing-library/dom dependency for the React example.
• Adds root overrides to pin @react-native-async-storage/async-storage and patch vulnerable transitive dependencies (cookie, postcss, uuid).

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Updates shared dev deps (React/Vitest), updates allowScripts, and adds dependency overrides for security/compatibility pins.
packages/core/package.json	Bumps esbuild used for bundling core package outputs.
packages/browser/package.json	Bumps esbuild used for bundling browser package outputs.
packages/angularjs/package.json	Bumps esbuild used for bundling AngularJS wrapper outputs.
packages/node/package.json	Bumps esbuild and updates @types/node for Node package development/build.
packages/react/package.json	Updates React type dependencies and bumps esbuild for the React wrapper bundle.
packages/react-native/package.json	Pins AsyncStorage dev dependency for Expo/RN compatibility and updates React types.
packages/vue/package.json	Bumps esbuild used for bundling Vue wrapper outputs.
example/browser/package.json	Updates Vite for the browser sample app.
example/react/package.json	Updates React/Vite tooling and adds @testing-library/dom to satisfy testing-library peer requirements.
example/vue/package.json	Updates Vue/compiler and Vite for the Vue sample app.
example/svelte-kit/package.json	Updates SvelteKit/Svelte/Vite/Vitest versions for the SvelteKit sample app.
example/nextjs/package.json	Updates Next.js and aligns React versions for the Next.js sample app.
example/expo/package.json	Upgrades Expo SDK and React Native version while keeping Expo-pinned React and AsyncStorage versions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19e8d457aa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[niemyjski]

Dependency/security recheck (2026-07-31)

• Updated official actions to their current releases: actions/checkout@v7, actions/setup-node@v7, actions/cache@v6, and actions/setup-dotnet@v6.
• Refreshed the remaining compatible workspace updates, including Vite 8.2.0, Expo 57.0.9 / React Native 0.86.2, SvelteKit 2.70.2, and current React/Node type packages.
• npm audit: 0 vulnerabilities across 908 dependencies.
• OSV Scanner: no issues across 868 lockfile packages (14 local workspace entries are unscannable by design).
• npm registry verification: 800 package signatures verified; 221 packages also have verified attestations.
• Reconciled the 33 open Dependabot alerts shown for the default branch against this PR lockfile. Every vulnerable package resolves at or above its patched version here, including shell-quote@1.10.0, next@16.2.12, sharp@0.35.3, undici@7.29.0, postcss@8.5.23, and brace-expansion@5.0.8.

Validation passed:

• clean npm 11 install
• full monorepo build
• 347 tests
• ESLint + Prettier
• Svelte diagnostics (0 errors / 0 warnings)
• Expo Doctor (20/20)
• Expo iOS and web production exports
• Sharp native smoke test
• live sample exercises for Browser, React, Vue, SvelteKit, Next.js, Expo web, and Express

The samples successfully rendered and queued their log/error events. Submission failures were expected because the local Exceptionless backend at ports 7110/7111 was not running.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 92e79b4c52

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T03:11:23.897537Z	bcd340e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.