This major version upgrade introduces significant environmental requirements that are likely to be breaking.

Breaking Changes:

• Node.js Requirement: The minimum required version of Node.js has been raised to v22.x. This is a substantial jump from the v14 requirement in the 1.14.x series and will likely require a major environment upgrade.
• Python Support: Support for Python 2 has been completely removed.

Recommendation:
Given the jump to a very recent version of Node.js, proceed with caution. Verify that your development and production environments meet the new Node.js v22 requirement before upgrading. If you are using the Python package, ensure you are on Python 3.

Source: GitHub CHANGELOG

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

AI Code Review

🔶 Changes requested — one or more medium-severity items must be addressed

What was reviewed

Skipped (out of scope): dist/, pnpm-lock.yaml (except noting the transitive changes)

Findings

🔶 Medium — @types/js-beautify version mismatch after major bump

File: packages/pluggableWidgets/rich-text-web/package.json line 77
Problem: @types/js-beautify is pinned to ^1.14.3 but the runtime package is now 2.0.3. This is a major version bump; the type definitions for v1 may not accurately reflect the v2 API. Specifically, beautify.HTMLBeautifyOptions is referenced at src/components/ModalDialog/ViewCodeDialog.tsx:17 — if the type signature changed between v1 and v2, TypeScript will silently use the wrong types. This could cause runtime errors that aren't caught at build time.
Fix:

// package.json devDependencies
- "@types/js-beautify": "^1.14.3",
+ "@types/js-beautify": "^2.0.0",

Check if @types/js-beautify@2.x exists on npm first. If it does not, confirm the API shape in the v2 source and update the usage in ViewCodeDialog.tsx accordingly.

🔶 Medium — Major version bump has undocumented breaking changes; no functional test evidence provided

File: packages/pluggableWidgets/rich-text-web/package.json line 54
Problem: The upgrade from js-beautify@1.x to 2.x is a major version change. The existing PR description says "Existing unit and E2E tests pass" but no CI checks output is visible in this review context. Additionally, a reviewer comment (from the Snyk bot) specifically calls out that nopt, abbrev, commander, editorconfig, glob, and @one-ini/wasm are all being bumped to major versions with significantly raised Node.js requirements (Node ≥22 in some cases). The monorepo's minimum Node requirement and CI environment should be verified to meet these requirements before merging.
Fix: Confirm the following before merging:

1. All CI checks (unit + E2E) are green for the rich-text-web package.
2. The monorepo's Node version constraint (check root package.json engines field or CI runner configuration) is ≥22, or verify these transitive deps aren't affecting the Node.js minimum at runtime.
3. Run a manual smoke test of the View Source / Code dialog in the Rich Text editor (the only code path using js-beautify) since that is the only consumer.

Positives

• The changelog entry correctly uses the ### Security category under [Unreleased] per Keep a Changelog conventions — exactly the right format for a CVE fix.
• The PR is tightly scoped: only the affected package and its lockfile are changed, with no unrelated modifications.
• The CVE ID is included in the CHANGELOG entry, giving users clear traceability from the release notes to the vulnerability report.