[SDK-757] Clear the remaining 28 Dependabot alerts

[devtools-agent]

Description of the change

Clears the 28 open Dependabot alerts that #173 doesn't cover. Together with #173, which handles the 4 react-router alerts, this resolves all 32 open alerts. None of them affect the published @rollbar/react, whose only runtime dependency is tiny-invariant. Every alert is in dev tooling or the example apps.

Package	Alerts	Lockfiles	Fix
next	14 (1 critical: next/og RCE GHSA-vcvr-r3jv-pc5j, 1 high SSRF)	nextjs, nextjs-approuter	next and eslint-config-next pinned 16.3.4 → 16.3.8
sharp	2 high	nextjs, nextjs-approuter	0.35.4 → 0.35.5, pulled in by the next bump
source-map-js	5 high	all five	1.2.1 → 1.2.2 (lockfile refresh; already inside existing ranges)
brace-expansion	2 medium	nextjs, nextjs-approuter	nested 5.0.9 → 5.0.12 (lockfile refresh)
postcss-selector-parser	2 medium	nextjs, nextjs-approuter	overrides: { "postcss-selector-parser": "^7.1.6" } (6.1.4 → 7.1.6)
sprintf-js	3 medium, no patched release	root, nextjs, nextjs-approuter	removed from the tree by overrides: { "@istanbuljs/load-nyc-config": { "js-yaml": "^4.1.0" } }

Why the two overrides

• sprintf-js: there's no fixed version. It came in via jest → babel-plugin-istanbul → @istanbuljs/load-nyc-config → js-yaml@3 → argparse@1 → sprintf-js, and Jest 30 has the same chain. load-nyc-config only calls require('js-yaml').load() when it finds a .nycrc.yaml. This repo doesn't have one, and load() behaves the same in js-yaml 4. With the override, argparse 1 and sprintf-js drop out of all three lockfiles.
• postcss-selector-parser: Tailwind 3.4.x (including the latest 3.4.19) still requires ^6, and the only fix is 7.1.6. The only breaking change in 7.0.0 is that inserting nodes during iteration became safe. I checked by running the Tailwind CLI on each example's globals.css with 6.1.4 and with 7.1.6: the generated CSS is byte-identical in both examples.

Lockfile hygiene: npm doesn't apply an override to a nested entry that's already in the lockfile, so I pruned the stale entries before reinstalling. I compared package versions in each lockfile before and after, and the only versions that change are the ones listed above. The .yalc/@rollbar/react entries in the Next lockfiles are kept exactly as they are on main.

This supersedes Dependabot's #175 (source-map-js). #173 merges cleanly with this branch in either order; I test-merged it locally.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Maintenance
• New release

Related issues

• Linear: SDK-757

Checklists

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests (dependency-only change)
• All tests related to the changed code pass in development

Validated locally on Node 20 / npm 10, the same sequence as CI: npm run install:all -- ci, lint, lint:examples, typecheck, build:all (including next build for both Next examples), test and test:examples. All passed, and prettier --check is clean on the changed manifests.

Code review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
• "Ready for review" label attached to the PR and reviewers assigned
• Issue from task tracker has a link to this pull request
• Changes have been reviewed by at least one other engineer

🤖 Generated with Claude Code

[linear-code]

SDK-757

[rollbar-circleci-machine]

AI Agent Review (openai, openai-astra)

Review: no blocking issues

This PR only changes dependencies: the root and two Next.js example manifests, plus five lockfiles. The published @rollbar/react still has tiny-invariant as its only runtime dependency (package.json:56-58). npm only applies overrides in the top-level project, so the new overrides block in the root package.json does nothing for people who install the package.

What I checked in the checkout

• js-yaml override (@istanbuljs/load-nyc-config → js-yaml ^4.1.0): load-nyc-config 1.1.0 only reaches js-yaml through require('js-yaml').load(...), and only for .yml/.yaml config files (node_modules/@istanbuljs/load-nyc-config/index.js:78-80). js-yaml 4.3.2 is installed (node_modules/js-yaml/package.json:3) and still exports load (node_modules/js-yaml/index.js:19). Only safeLoad became a stub that tells you to use load (node_modules/js-yaml/index.js:42), and this code doesn't call it. The repo has no .nycrc* outside node_modules.
• Root lockfile dedupe: the only remaining dependent asking for js-yaml ^3 is load-nyc-config (package-lock.json:2397). Every other dependent asks for ^4.1.0 (package-lock.json:2159, package-lock.json:6215). So collapsing the nested eslint and @eslint/eslintrc copies into one top-level js-yaml@4.3.2 + argparse@2.0.1, and dropping sprintf-js, keeps every declared range satisfied.
• Next.js example lockfiles: each one has a single top-level js-yaml 4.3.2, argparse 2.0.1, postcss-selector-parser 7.1.6 and source-map-js 1.2.2 (e.g. examples/nextjs/package-lock.json:3154, :7333, :8499, :9246), and the nested @typescript-eslint/typescript-estree brace-expansion is 5.0.12 (:2621). No stale nested js-yaml 3 or argparse 1 entries are left. next/eslint-config-next are pinned to 16.3.8 in both manifest and lockfile, and the sharp platform packages all moved to 0.35.5 / libvips 1.3.4 together.
• CI path: scripts/install-all.js:5,10,35 runs npm ci in the root and in each example, so these lockfiles are what CI installs. This review's pipeline also ran npm ci successfully against the root lockfile at this head.

Notes (not findings)

• The postcss-selector-parser override pushes Tailwind 3.4's declared ^6.x range (examples/nextjs/package-lock.json:8490, :9678) up to 7.1.6. That is a semver-major jump outside Tailwind's declared range. The author says the generated CSS is byte-identical; I couldn't check that here because I have no shell. Worth dropping the override once Tailwind accepts v7 or the examples move to Tailwind 4.
• Several lockfile entries lost their "license" field. That looks like npm-version churn, not a dependency change.
• The description says this supersedes build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /examples/typescript #175 and merges cleanly with [SDK-757] Clear react-router Dependabot alerts in the examples #173. Neither PR is checked out here, so that is declared but not verified.
• The description's claim that tests and builds pass is unverified here; the diff contains no CI output.