Release/26.6.2

[skyflow-bharti]

WHY

Dependencies in skyflow-react-js had accumulated significant version debt — some runtime
packages were multiple major versions behind, several dev packages carried known CVEs, and
20 dev dependencies were entirely unused dead weight left over from a previous webpack-based
build setup that was never referenced by any script or config file. Running npm audit
against the old lockfile reported 26 vulnerabilities including a critical severity finding
in shell-quote (pulled in transitively by webpack-dev-server).

GOAL

Bring all dependencies to their current supported versions within the ** 14-day cooling period**
policy, eliminate the unused webpack toolchain from devDependencies, migrate ESLint to the
flat config format required by ESLint 9+, and reduce the vulnerability surface from 26
findings down to the minimum achievable without forcing breaking peer dependency overrides.

---

Changes

Production runtime (dependencies)

Package	Before	After	Published	Days old	Note
uuid	9.0.1	14.0.0	2026-04-19	53	ESM-only in v14 — test element ID generation end-to-end
skyflow-js	^2.7.8	^2.7.7	2026-05-05	37	^2.7.9 excluded by cooling period (3 days old)

Dev tooling — upgraded

Package	Before	After	Published	Days old
typescript	4.9.5	6.0.3	2026-04-16	56
eslint	8.57.1	9.39.4	2026-03-06	97
@eslint/js	—	9.39.4	2026-03-06	97
@typescript-eslint/*	5.62.0	8.60.0	2026-05-25	17
jest + jest-environment-jsdom	28.1.3	30.4.2 / 30.4.1	2026-05-09	33
@testing-library/react	13.4.0	16.3.2	2026-01-19	143
@testing-library/jest-dom	6.6.3	6.9.1	2025-10-01	253
prettier	2.8.8	3.8.3	2026-04-15	57
@babel/preset-react	7.12.13 (exact pin)	7.29.7	2026-05-25	17
ts-jest	28.0.8	29.4.11	2026-05-21	21
globals	—	17.6.0	2026-05-01	41
eslint-plugin-react	7.37.2	7.37.5	2025-04-03	434
eslint-plugin-react-hooks	4.6.2	7.1.1	2026-04-17	55
eslint-config-prettier	8.10.0	10.1.8	2025-07-18	328
eslint-plugin-prettier	4.2.1	5.5.6	2026-05-28	14
@types/jest	29.5.14	30.0.0	2025-06-16	360
@types/node	14.18.63	25.9.1	2026-05-19	23

ESLint 9, not 10: both eslint-plugin-react and eslint-plugin-import cap their
peer dep at ^9 — no published version of either supports ESLint 10 yet. ESLint 9 is
the correct landing point; it is where flat config became the default.

cspell not upgraded: cspell@9.x requires Node ≥20 and cspell@10.x requires
Node ≥22.18. CI is on Node 14; upgrading cspell is blocked until the CI Node version
is raised.

Dev tooling — removed (20 packages)

The entire webpack toolchain and associated plugins were removed. No webpack.config.*
file exists in the repo; a grep across all source and config files confirms zero references.

@babel/cli · @babel/plugin-proposal-class-properties · @babel/plugin-proposal-decorators
· @babel/plugin-proposal-object-rest-spread · @babel/plugin-transform-runtime ·
babel-loader · clean-webpack-plugin · compression-webpack-plugin ·
eslint-config-airbnb-base · eslint-config-airbnb-typescript ·
fork-ts-checker-webpack-plugin · html-webpack-plugin · webpack ·
webpack-bundle-analyzer · webpack-cli · webpack-dev-server ·
webpack-manifest-plugin · webpack-merge · @types/jquery-mask-plugin ·
@types/minimatch

Config file changes

• eslint.config.mjs (new) / .eslintrc.json (deleted) — ESLint 9 dropped
  .eslintrc.* support; migrated to flat config preserving all existing rules
• tsconfig.json — added "rootDir": "./src" (TypeScript 6 now requires explicit
  declaration when outDir is set) and "ignoreDeprecations": "6.0" to keep
  moduleResolution: node working through the TS6 lifetime; migration to node16/nodenext
  requires adding .js extensions to all relative imports and is tracked separately
• jest.config.js — updated type import from removed ts-jest/dist/types path to
  ts-jest

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep findings: No issues found, Good to merge.

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep findings: No issues found, Good to merge.

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep findings: No issues found, Good to merge.

[github-actions]

✅ Gitleaks Findings: No secrets detected. Safe to proceed!

[github-actions]

Semgrep findings: No issues found, Good to merge.