fix(VP-2254): keep cursor visible over RTE links in Visual Builder

[shivamfl]

Summary

Fixes cursor disappearing when hovering links inside Rich Text Editors in Visual Builder (SF 00059859, reported by AIRBNB).

Root cause

In mouseHover.ts, on every hover the SDK ran document.elementFromPoint and, if the element under the pointer was an <a>/<button>, added visual-builder__no-cursor-style (cursor: none !important) to it — to suppress the native cursor while the custom cursor floats. That class was added but never removed. Once a link was hovered, cursor: none stuck; when the RTE was selected/editable (custom cursor hidden), the link kept cursor: none and the cursor vanished. Reproduces only inside full Visual Builder (needs the custom cursor), hence prod-only.

Fix (diff)

• mouseHover.ts: removed the elementFromPoint block that tagged links/buttons with no-cursor-style.
• visualBuilder.style.ts: extended the existing body-level visual-builder__default-cursor--disabled class (already toggled on show/hide of the custom cursor) to also cover & a, & button; removed the now-unused no-cursor-style class.

Links now follow the body class via the CSS cascade and revert automatically when it is removed — no per-element mutation, so the leak is gone by construction.

Also included

• Patched npm audit vulnerabilities (dompurify, form-data, js-yaml, vite, ws) by reconciling to the versions already pinned in the manifest — lockfile-only, no overrides, no forced bumps.
• Test fix surfaced by the vitest 3→4 bump in startEditingButton.test.tsx: made window.location redefines configurable and switched fireEvent.focus to button.focus() (synthetic focus no longer triggers Preact's onFocus under vitest 4).

Testing

• npm test: 861/861 pass on vitest 4.
• npm audit: 0 vulnerabilities.
• Manual: verified in Visual Builder that the cursor stays visible over links in both native and custom RTEs.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	0	25	✅ Passed
🟡 Medium Severity	0	0	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

✅ BUILD PASSED - All security checks passed

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	67.13%	2506 / 3733
🔵	Statements	65.99%	2544 / 3855
🔵	Functions	64.51%	449 / 696
🔵	Branches	61.45%	1508 / 2454

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/visualBuilder/visualBuilder.style.ts	100%	100%	100%	100%
src/visualBuilder/listeners/mouseHover.ts	62.41%	49.07%	54.54%	65.15%	52-57, 75, 85, 92, 112, 128-136, 143, 151-158, 167, 179, 189-206, 214-215, 218-260, 282-285, 301-302, 307-310, 312-313, 396, 403, 432

Generated in workflow #851 for commit 5650527 by the Vitest Coverage Report Action

[kirtesh-cstk]

LGTM