Resolve all actionable dependabot alerts (vite, turbo, happy-dom, vitest)

[Vadman97]

What

Stacked on #29 (merge that first). Resolves 31 of 37 open dependabot alerts — everything except the 6 svelte advisories (see below). All flagged packages are dev-time tooling; nothing here changes published bundles.

Dependency	From → To	Alerts resolved
vitest (10 manifests)	^1.4.0 → ^3.2.6	7 critical (UI server arbitrary file read/execute)
happy-dom (root)	^14 → ^20.8.9	2 critical (script-tag SSCE, VM escape RCE) + 1 high
vite (17 manifests)	^6.0.1 → ^6.4.2	17 medium (path traversal)
turbo (root)	2.8.7 → ^2.9.14	1 low + 1 medium

Migration notes

• vitest 1 → 3: configs were already compatible (forks pool, configDefaults.exclude, retry options). Two test fixes: toThrow('') now means "exactly empty message" (packer test asserts the real message), and the cross-origin-iframe packFn test needed a networkidle0 wait that the upgrade surfaced (it was racing iframe load — the same flake that produced two stable snapshot outcomes earlier). Local rrweb-suite failures under vitest 3 are a strict subset of the vitest 1 set — no regressions.
• happy-dom 14 → 20: now enforces same-origin history URLs; one test switched to a relative replaceState path.
• Snapshots regenerated on the CI browser via the snapshot-update/** workflow (one webgl image changed, all text snapshots stable).

Deferred: svelte (6 medium alerts, rrweb-player)

All six are SSR-only XSS advisories — rrweb-player doesn't do SSR (it's a client-side replayer bundled by vite). Fixing requires the svelte 4 → 5 major migration plus coordinated bumps of @sveltejs/vite-plugin-svelte, svelte-preprocess, and the svelte2tsx d.ts pipeline — a meaningful migration that shouldn't ride along with dependency bumps. Recommend a follow-up ticket; in the interim the alerts can be dismissed as "vulnerable code not in use" given no SSR.

🤖 Generated with Claude Code

[Vadman97]

observability-sdk integration validation

Validated both PR branches against a throwaway observability-sdk clone with the rrweb submodule pinned to this branch, running o11y's own commands (yarn install, yarn build:sdk, yarn test). Three integration breaks were caught this way and are fixed in these PRs:

1. turbo nested-config keys (Refresh fork from upstream rrweb v2.0.1 + make CI build/lint/tests work standalone #29): globalDependencies/globalPassThroughEnv (and even task-level passThroughEnv) in rrweb/turbo.json make o11y's root turbo 2.8 hard-error (add extends key). The file must stay in the legacy tasks-only shape; standalone env passthrough now comes from --env-mode=loose on this repo's root scripts, which o11y never invokes.
2. happy-dom placement (Resolve all actionable dependabot alerts (vite, turbo, happy-dom, vitest) #31): declaring happy-dom 20 at the rrweb monorepo root made yarn (inside the o11y workspace) stop surfacing highlight.run's own vite/vitest bins, breaking its typegen. Declared in the three packages that use it instead.
3. vitest version skew: with rrweb on vitest 3, the same yarn quirk hides highlight.run's vite bin while it stays on vitest 1.

Required companion change in the o11y submodule-bump PR (validated end-to-end — build:sdk 18/18 green):

• sdk/highlight-run: bump vitest to ^3.2.6 (its own dependabot wants this too); keep vite at ^5.4.21 (vite 6 trips a separate CJS-interop issue in its worker build — not needed for this integration).
• sdk/highlight-run/src/client/otel/flush-on-unload.test.ts: change the four vi.fn<any, Promise<void>> to vitest-3 single-generic form (vi.fn<(...args: unknown[]) => Promise<void>>).
• Regenerate yarn.lock (yarn install; ~270 line diff).

Notes: o11y's root yarn build fails identically with the current production pin (pre-existing — its CI only runs yarn test/build:sdk paths). The aws-lambda#build failure in my local run is just the SAM CLI missing on my machine.