[JuroUhlar]

Part of INTER-2697.

Why

Catch critical advisories in dependencies on every PR and daily, since new advisories appear without code changes.

Things to note

• The check runs pnpm audit --prod --audit-level critical. --prod skips devDependencies but still covers the dependencies of every workspace project: the SDK's runtime deps (@fingerprint/agent) and the examples' frameworks (next, react-scripts, ...). On main it fails on 7 criticals, all in examples.
• The next commit is the same change as INTER-2697: chore: bump next to 16.4.2 in Next.js examples #214 (cherry-picked, identical lockfile). It drops out on rebase once INTER-2697: chore: bump next to 16.4.2 in Next.js examples #214 merges.
• The preact-cli fixes use overrides in pnpm-workspace.yaml. The React 19 e2e jobs replace overrides with pnpm config set, so they install the old versions. That is harmless there: those jobs reinstall without a frozen lockfile and never ship anything.

Verification

pnpm audit run on a copy of the lockfile and manifests, with no node_modules:

Command	main	this PR
--prod --audit-level critical	exit 1, 7 critical	exit 0
--audit-level critical (full)	exit 1, 10 critical	exit 0

Locally: lint, tsc --noEmit, test:coverage (41 passed), build, test:dts and all 6 example builds pass. pnpm peers check shows one new warning, webpack-cli@7.2.1 wants webpack-dev-server ^5 || ^6 but gets 4.15.2. It comes from the next bump re-resolving peers and is in #214 too.

Change outline

New workflow .github/workflows/audit.yml: runs on pull_request, daily cron, and manually. Setup matches e2e.yml.

Dependency fixes, one per advisory:

Package	From	To	How	Advisory
next (examples)	16.2.10	16.4.2	direct bump (#214)	GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr, GHSA-p293-qw3h-jr36, GHSA-2xp9-vwfh-vxw4, GHSA-vcvr-r3jv-pc5j
proxy-addr	2.0.7	2.0.8	in-range lockfile update	GHSA-jqcg-44mw-7w3h
shell-quote	1.10.0	1.12.0	in-range lockfile update	GHSA-pqg4-j6r4-53mv
loader-utils	0.2.17	1.4.2	override (preact-cli)	GHSA-76p3-8jx3-jpfq
form-data	2.3.3	2.5.6	override (preact-cli)	GHSA-fjxv-7rqg-78g4
tar	4.4.19, 6.2.1	7.5.22	override (preact-cli)	GHSA-23hp-3jrh-7fpw

The overridden packages are only in the preact example's dev tooling. html-webpack-plugin 3 only calls parseQuery and stringifyRequest, which loader-utils 1.x keeps. Only gittar (preact create) calls tar.extract, which tar 7 keeps. The preact example still builds.

No changeset: nothing in the published package changes.

---

Generated by Claude Code

[github-actions]

⚠️ This PR doesn't contain any changesets. If there are user-facing changes, don't forget to run:

pnpm exec changeset

to create a changeset.

[github-actions]

Coverage report

St.❔	Category	Percentage	Covered / Total
🟢	Statements	96.79%	151/156
🟢	Branches	95.51%	85/89
🟢	Functions	97.78%	44/45
🟢	Lines	97.33%	146/150

Test suite run success

41 tests passing in 15 suites.

Report generated by 🧪jest coverage report action from 7c295cf

Show full coverage report

St	File	% Stmts	% Branch	% Funcs	% Lines	Uncovered Line #s
🟢	All files	96.79	95.5	97.77	97.33
🟢	src	100	100	100	100
🟢	detect-env.ts	100	100	100	100
🟢	env.types.ts	100	100	100	100
🟢	...nt-context.ts	100	100	100	100
🟢	ssr.ts	100	100	100	100
🟢	...sitor-data.ts	100	100	100	100
🟢	src/components	100	100	100	100
🟢	...-provider.tsx	100	100	100	100
🟢	...vironment.tsx	100	100	100	100
🟢	src/utils	88.09	87.5	92.3	90
🟢	...is-defined.ts	100	100	100	100
🟢	...-cache-key.ts	80.76	83.33	85.71	84	5,10,43,52
🟢	to-error.ts	100	100	100	100
🟢	...mise-store.ts	100	100	100	100

[Copilot]

🔵 Needs a closer look

Cross-major dependency overrides in legacy Preact tooling need human compatibility confirmation beyond the reported example builds.

No open issues 🎉

What changed in this PR

Adds recurring dependency security checks and updates vulnerable dependencies in the examples without changing the published SDK.

Changes:

• Runs a production-dependency audit for critical advisories on every PR, daily, and manually.
• Upgrades both Next.js examples to version 16.4.2.
• Adds transitive dependency overrides for legacy Preact build tooling.

File	Description
pnpm-workspace.yaml	Overrides vulnerable versions of loader-utils, form-data, and tar.
examples/​next/​package.json	Upgrades Next.js to 16.4.2.
examples/​next-appDir/​package.json	Upgrades Next.js to 16.4.2.
.github/​workflows/​audit.yml	Adds PR, daily, and manual dependency audits.

_{Review effort: Balanced}