…in message constants

… Path Traversal)

fixed snyk issues

fix: snyk fixes and added dependency overrides

Fix/dx 8733 snyk fix low risk

…xperiences and missing variant entry data file [DX-9469]

Two related bugs in the Personalize import pipeline:

1. experiences.ts — pendingVariantAndVariantGrpForExperience was populated with ALL
   created experience UIDs regardless of whether valid variants were submitted to the
   API. Experiences with variants:[] never get variant groups from the Personalize
   backend, so the validation loop timed out and set importData=false, skipping
   attachCTsInExperience for every experience including valid ones. Fixed by changing
   importExperienceVersions to return boolean and only adding UIDs to the pending set
   when valid variants were actually submitted. Also adds a null guard in
   attachCTsInExperience before accessing variantGroup to prevent a silent crash.

2. entries.ts — a bare return inside the no-environments-file branch of the entries
   import function exited the entire function, skipping createEntryDataForVariantEntry().
   This meant data-for-variant-entry.json was never written whenever a stack had no
   environments, causing the variant-entries module to warn about the missing file and
   skip all variant entry imports. Fixed by removing the return.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…DX-9469

Revert changes to audiences.test.ts, variant-entries.test.ts, and
package.json (test script narrowing) — these were workarounds for the
ESM/uuid runner issue and are not part of the DX-9469 fix scope.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…h empty envs [DX-9469]

After removing the bare return, publishEntries is called even when no
environments exist — serializePublishEntries handles empty envs as a
no-op. Updated test assertion to reflect this and added assertion that
createEntryDataForVariantEntry always runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- experiences.ts: pass versionReqObj (already audience-mapped) to
  lookUpEvents instead of original version — was relying on mutation
  side effect of lookUpAudiences to make this work

- entries.ts: skip publish loop and success log entirely when envs is
  empty, instead of running the loop as a no-op; createEntryDataForVariantEntry
  still runs unconditionally afterward

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…X-9469]

If versionReqObj.status was e.g. PAUSED (not PAUSE), the previous code
silently added a 4th key to the Record-typed map, causing Object.values
to find a non-undefined entry and return true — even though
handleVersionUpdateOrCreate only destructures ACTIVE/DRAFT/PAUSE and
would have processed nothing. The experience UID then incorrectly entered
the polling pending list, reintroducing the timeout bug.

Fix: narrow versionMap to a typed object with only the three known keys
and validate status against a HANDLED_STATUSES set before writing.
Unrecognized statuses are logged and skipped.

Also aligns the variant-skip warning message with the generic wording
adopted in fix/DX-9469-v2.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(personalize,import): fix CT linking failure from empty-audience experiences and missing variant entry data file

chore: version bump