[Mercy811]

Summary

Restore the v8.x release build by pinning query-string to 9.5.1, retaining the patched decoder dependency without migrating this maintenance SDK's build toolchain.

After #633 upgraded query-string from 8.1.0 to 10.0.0, the release job failed during make test, before publishing:

(plugin commonjs--resolver) SyntaxError: Invalid regular expression flag (5:73)
node_modules/query-string/base.js

Why 9.5.1 preserves the security remediation

• Version 8.1.0 depended on decode-uri-component@^0.4.1, which cannot resolve to the patched 0.5.x line.
• Version 9.5.1 depends on decode-uri-component@^0.5.0. The regenerated lockfile resolves it to 0.5.1.
• 0.5.1 is the required fix for CVE-2026-118664 / GHSA-qr28-fpjm-wq7f, the advisory referenced by build(deps) : Bump query string from 8.x to 10.x #633. Version 0.5.0 fixed the earlier CVE-2026-45822 but is still affected by this newer advisory.
• Consumers with existing lockfiles should refresh this dependency chain and verify that the decoder resolves to 0.5.1 or later; the ^0.5.0 range alone does not force an existing 0.5.0 resolution to update.

Why not keep 10.0.0 and upgrade Rollup now?

Version 10 uses regular-expression literals with the v flag. Rollup 2's parser rejects that syntax, regardless of the Node version running the build. This was reproduced with Rollup 2.80.0, so updating within the Rollup 2 line does not fix v10. Version 9.5.1 bundles successfully with that same toolchain.

Rollup 4 can parse v10, but a 2-to-4 migration also requires compatible plugin versions, configuration-loading changes, build-environment checks, and validation of generated bundles, module interoperability, tree-shaking, and minification. Rollup 4 also installs platform-specific native dependencies. Separately, accepting v10's syntax during bundling does not transpile it for older browsers; v10 raises browser requirements through the regex v flag and newer runtime APIs.

For this maintenance release, the dependency pin restores the build with a smaller change and retains the security remediation. A Rollup migration can be evaluated separately; this is a scope decision, not a claim that Rollup 2 has a formal EOL date or that Rollup 4 is unsuitable.

Scope and compatibility

Production code uses queryString.stringify() to encode event-upload bodies in src/xhr.js; parse() is used in tests. The decoder vulnerability is not reached through this identified production upload path, but the dependency finding still warrants remediation.

No SDK API, transport implementation, Rollup/plugin configuration, or browser-support policy changes are included. Older decoder versions remain in other dependency chains; this PR does not claim to clear every repository audit finding. Version 9.5.1 declares Node >=18, compared with >=22 in v10; the release workflow already uses Node 24.

Validation

• yarn install --frozen-lockfile passes.
• Installed versions verified: query-string@9.5.1, its decode-uri-component@0.5.1, and unchanged rollup@2.80.0.
• Full make test build and suites pass: 453 browser tests + 18 worker tests, using installed Chromium Headless 141 via CHROME_BIN (20-second capture timeout, no launch retries).
• yarn lint and git diff --check pass.
• The existing test workflow only targets main; the suites above were run locally for this v8.x change.

Checklist

• Does your PR title have the correct title format?
• Does your PR have a breaking change?: No SDK API changes expected; dependency compatibility notes are documented above.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-12T22:22:17.853093Z	8d0599f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.