🔀 Merge main: batch API cleanup, prototype pollution fix, v7.4.0

Resolves conflicts from createBatch API refactor (reportError string
signature, forceFlush), prototype pollution guards in mergeInto,
debugger init version tests, and dep bumps. Converts new Jasmine
patterns to Vitest API in auto-merged files.

Author: mormubis

.gitlab-ci.yml

@@ -1,5 +1,5 @@
 variables:
-  CURRENT_STAGING: staging-25
+  CURRENT_STAGING: staging-26
   APP: 'browser-sdk'
   CURRENT_CI_IMAGE: 113
   BUILD_STABLE_REGISTRY: 'registry.ddbuild.io'

CHANGELOG.md

@@ -15,6 +15,46 @@
 
 ---
 
+## v7.4.0
+
+**Public Changes:**
+
+- ✨Rename feature operation APIs to operation ([#4810](https://github.com/DataDog/browser-sdk/pull/4810))
+- ✨[RUM-16632] add profiling bridge mode support ([#4747](https://github.com/DataDog/browser-sdk/pull/4747))
+- 🐛 [VULN-81506] fix prototype pollution via mergeInto and tryJsonParse ([#4820](https://github.com/DataDog/browser-sdk/pull/4820))
+- 🐛 Fix flaky stylesheet rules test ([#4803](https://github.com/DataDog/browser-sdk/pull/4803))
+- 🐛 [Profiler] Fix empty session ID & quota check on renew ([#4766](https://github.com/DataDog/browser-sdk/pull/4766))
+- 🐛 Tolerate an invalid view URL in the developer extension ([#4773](https://github.com/DataDog/browser-sdk/pull/4773))
+- 📝 add deterministic sampling warning to v7.0.0 release notes ([#4805](https://github.com/DataDog/browser-sdk/pull/4805))
+- 📝 use typedoc for js-core ([#4801](https://github.com/DataDog/browser-sdk/pull/4801))
+
+**Internal Changes:**
+
+- 👷 Update Node.js to v25 ([#4818](https://github.com/DataDog/browser-sdk/pull/4818))
+- 👷 Update Puppeteer to v25 ([#4819](https://github.com/DataDog/browser-sdk/pull/4819))
+- 👷 Update dependency babel-loader to v10 ([#4817](https://github.com/DataDog/browser-sdk/pull/4817))
+- 👷 Update all non-major dependencies ([#4816](https://github.com/DataDog/browser-sdk/pull/4816))
+- 👷 Update dependency undici to v8.5.0 [SECURITY] ([#4808](https://github.com/DataDog/browser-sdk/pull/4808))
+- 👷 Update Angular, Vue compiler-dom, and Vite dependencies ([#4799](https://github.com/DataDog/browser-sdk/pull/4799))
+- 👷 Add API surface linting for @datadog/js-core via API Extractor ([#4804](https://github.com/DataDog/browser-sdk/pull/4804))
+- 👷 Bump @datadog/js-core to 0.0.3 ([#4800](https://github.com/DataDog/browser-sdk/pull/4800))
+- 👷 [RUM-16634] Require WebView wildcard to match at least one character ([#4785](https://github.com/DataDog/browser-sdk/pull/4785))
+- 👷 Improve checkTelemetryErrors: exclude deprecated datacenters and add detailed logging ([#4794](https://github.com/DataDog/browser-sdk/pull/4794))
+- 👷 migrate module builds from TypeScript compiler API to tsdown ([#4767](https://github.com/DataDog/browser-sdk/pull/4767))
+- 👷 Update dependency @angular/common to v22.0.1 [SECURITY] ([#4789](https://github.com/DataDog/browser-sdk/pull/4789))
+- 👷 Update dependency @angular/core to v22.0.1 [SECURITY] ([#4786](https://github.com/DataDog/browser-sdk/pull/4786))
+- 👷 Allow passing a full commit hash to `json-schemas --update` ([#4784](https://github.com/DataDog/browser-sdk/pull/4784))
+- 👷 also pin angular-cli deps on angular-app ([#4783](https://github.com/DataDog/browser-sdk/pull/4783))
+- 👷 fix performance benchmark CI and rename e2e setup script ([#4781](https://github.com/DataDog/browser-sdk/pull/4781))
+- 👷 Update all non-major dependencies ([#4777](https://github.com/DataDog/browser-sdk/pull/4777))
+- 👷 Update dependency @vitejs/plugin-react to v6 ([#4776](https://github.com/DataDog/browser-sdk/pull/4776))
+- 👷 Update dependency webpack-cli to v7 ([#4780](https://github.com/DataDog/browser-sdk/pull/4780))
+- 👷 Update dependency vite to v8 ([#4778](https://github.com/DataDog/browser-sdk/pull/4778))
+- 👷 use rum-events-format as a yarn dependency ([#4772](https://github.com/DataDog/browser-sdk/pull/4772))
+- ♻️ move hook and merge utilities from browser-core to @datadog/js-core ([#4797](https://github.com/DataDog/browser-sdk/pull/4797))
+- ♻️ Migrate browser-core monitoring/display to @datadog/js-core ([#4758](https://github.com/DataDog/browser-sdk/pull/4758))
+- 🔧 set ephemeral:false for staging branches ([#4813](https://github.com/DataDog/browser-sdk/pull/4813))
+
 ## v7.3.0
 
 **Public Changes:**

developer-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datadog/browser-sdk-developer-extension",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "private": true,
   "scripts": {
     "build": "wxt build",
@@ -19,8 +19,8 @@
     "@datadog/browser-logs": "workspace:*",
     "@datadog/browser-rum": "workspace:*",
     "@datadog/browser-rum-core": "workspace:*",
-    "@mantine/core": "9.3.0",
-    "@mantine/hooks": "9.3.0",
+    "@mantine/core": "9.3.1",
+    "@mantine/hooks": "9.3.1",
     "@tabler/icons-react": "3.44.0",
     "clsx": "2.1.1",
     "react": "19.2.7",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "browser-sdk",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "description": "browser SDK",
   "private": true,
   "workspaces": [
@@ -48,16 +48,16 @@
     "@jsdevtools/coverage-istanbul-loader": "3.0.5",
     "@microsoft/api-extractor": "7.58.9",
     "@playwright/test": "1.60.0",
-    "@swc/core": "1.15.40",
+    "@swc/core": "1.15.41",
     "@types/busboy": "1.5.4",
     "@types/chrome": "0.1.43",
     "@types/cors": "2.8.19",
     "@types/express": "5.0.6",
     "@types/jasmine": "3.10.19",
-    "@types/node": "25.9.2",
+    "@types/node": "25.9.3",
     "@types/node-forge": "1.3.14",
     "@types/ws": "8.18.1",
-    "@typescript-eslint/utils": "8.60.1",
+    "@typescript-eslint/utils": "8.61.0",
     "@vitest/browser": "4.0.18",
     "@vitest/browser-playwright": "4.0.18",
     "@vitest/browser-webdriverio": "4.0.18",
@@ -68,7 +68,7 @@
     "chrome-webstore-upload": "4.0.4",
     "cors": "2.8.6",
     "emoji-name-map": "2.0.3",
-    "eslint": "10.4.1",
+    "eslint": "10.5.0",
     "eslint-import-resolver-typescript": "4.4.5",
     "eslint-plugin-import-x": "4.16.2",
     "eslint-plugin-jasmine": "4.2.2",
@@ -91,17 +91,17 @@
     "karma-webpack": "5.0.0",
     "minimatch": "10.2.5",
     "node-forge": "1.4.0",
-    "prettier": "3.8.3",
-    "puppeteer": "24.43.1",
+    "prettier": "3.8.4",
+    "puppeteer": "25.1.0",
     "swc-loader": "0.2.7",
     "terser-webpack-plugin": "5.6.1",
     "ts-loader": "9.6.0",
     "tsconfig-paths-webpack-plugin": "4.2.0",
     "tsdown": "0.22.2",
     "typedoc": "0.28.19",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.60.1",
-    "undici": "8.4.0",
+    "typescript-eslint": "8.61.0",
+    "undici": "8.5.0",
     "vitest": "4.0.18",
     "webdriverio": "9.27.1",
     "webpack": "5.107.2",

packages/browser-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datadog/browser-core",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "license": "Apache-2.0",
   "main": "cjs/index.js",
   "module": "esm/index.mjs",
@@ -23,7 +23,7 @@
     "directory": "packages/browser-core"
   },
   "dependencies": {
-    "@datadog/js-core": "0.0.3"
+    "@datadog/js-core": "0.0.4"
   },
   "devDependencies": {
     "@types/pako": "2.0.4",

packages/browser-core/src/browser/pageMayExitObservable.ts

@@ -1,6 +1,6 @@
 import { Observable } from '../tools/observable'
 import { objectValues } from '../tools/utils/polyfills'
-import { isWorkerEnvironment } from '../tools/globalObject'
+import { globalObject } from '../tools/globalObject'
 import { addEventListeners, addEventListener, DOM_EVENT } from './addEventListener'
 
 export const PageExitReason = {
@@ -18,8 +18,9 @@ export interface PageMayExitEvent {
 
 export function createPageMayExitObservable(): Observable<PageMayExitEvent> {
   return new Observable<PageMayExitEvent>((observable) => {
-    if (isWorkerEnvironment) {
-      // Page exit is not observable in worker environments (no window/document events)
+    const window = globalObject.window
+    if (!window) {
+      // Page exit is not observable in non-browser environments
       return
     }
     const { stop: stopListeners } = addEventListeners(

packages/browser-core/src/domain/context/storeContextManager.spec.ts

@@ -78,6 +78,12 @@ describe('storeContextManager', () => {
     expect(localStorage.getItem(buildStorageKey(PRODUCT_KEY, CustomerDataType.GlobalContext))).toBe('{"qux":"qix"}')
   })
 
+  it('should return empty context when localStorage contains invalid JSON', () => {
+    localStorage.setItem(STORAGE_KEY, 'not valid json')
+    const manager = createStoredContextManager()
+    expect(manager.getContext()).toEqual({})
+  })
+
   function createStoredContextManager({
     initialContext,
     productKey = PRODUCT_KEY,

packages/browser-core/src/domain/context/storeContextManager.ts

@@ -1,7 +1,7 @@
 import { combine } from '@datadog/js-core/util'
 import { addEventListener, DOM_EVENT } from '../../browser/addEventListener'
 import type { Context } from '../../tools/serialisation/context'
-import { isEmptyObject } from '../../tools/utils/objectUtils'
+import { isEmptyObject, tryJsonParse } from '../../tools/utils/objectUtils'
 import type { ContextManager } from './contextManager'
 import type { CustomerDataType } from './contextConstants'
 
@@ -45,7 +45,7 @@ export function storeContextManager(
 
   function getFromStorage() {
     const rawContext = localStorage.getItem(storageKey)
-    return rawContext ? (JSON.parse(rawContext) as Context) : {}
+    return rawContext ? (tryJsonParse<Context>(rawContext) ?? {}) : {}
   }
 }
 

packages/browser-core/src/domain/eventRateLimiter/createEventRateLimiter.spec.ts

@@ -1,9 +1,8 @@
 import { vi, beforeEach, describe, expect, it } from 'vitest'
-import { relativeToClocks, ONE_MINUTE } from '@datadog/js-core/time'
+import { ONE_MINUTE } from '@datadog/js-core/time'
 import type { Clock } from '../../../test'
 import { mockClock } from '../../../test'
 import { noop } from '../../tools/utils/functionUtils'
-import type { RawError } from '../error/error.types'
 import { createEventRateLimiter } from './createEventRateLimiter'
 import type { EventRateLimiter } from './createEventRateLimiter'
 
@@ -37,18 +36,13 @@ describe('createEventRateLimiter', () => {
     expect(eventLimiter.isLimitReached()).toBe(false)
   })
 
-  it('calls the "onLimitReached" callback with the raw "limit reached" error when the limit is reached', () => {
-    const onLimitReachedSpy = vi.fn<(rawError: RawError) => void>()
+  it('calls the "onLimitReached" callback with the "limit reached" message when the limit is reached', () => {
+    const onLimitReachedSpy = vi.fn<(message: string) => void>()
     eventLimiter = createEventRateLimiter('error', onLimitReachedSpy, limit)
 
     eventLimiter.isLimitReached()
     eventLimiter.isLimitReached()
-    expect(onLimitReachedSpy).toHaveBeenCalledTimes(1)
-    expect(onLimitReachedSpy).toHaveBeenCalledWith({
-      message: 'Reached max number of errors by minute: 1',
-      source: 'agent',
-      startClocks: relativeToClocks(clock.relative(0)),
-    })
+    expect(onLimitReachedSpy).toHaveBeenCalledWith('Reached max number of errors by minute: 1')
   })
 
   it('returns false when called from the "onLimitReached" callback to bypass the limit for the "limit reached" error', () => {
@@ -65,7 +59,7 @@ describe('createEventRateLimiter', () => {
   })
 
   it('does not call the "onLimitReached" callback more than once when the limit is reached', () => {
-    const onLimitReachedSpy = vi.fn<(rawError: RawError) => void>()
+    const onLimitReachedSpy = vi.fn<(message: string) => void>()
     eventLimiter = createEventRateLimiter('error', onLimitReachedSpy, limit)
 
     eventLimiter.isLimitReached()

packages/browser-core/src/domain/eventRateLimiter/createEventRateLimiter.ts

@@ -1,7 +1,5 @@
-import { ONE_MINUTE, clocksNow } from '@datadog/js-core/time'
+import { ONE_MINUTE } from '@datadog/js-core/time'
 import { setTimeout } from '../../tools/timer'
-import type { RawError } from '../error/error.types'
-import { ErrorSource } from '../error/error.types'
 
 export type EventRateLimiter = ReturnType<typeof createEventRateLimiter>
 
@@ -10,7 +8,7 @@ const EVENT_RATE_LIMIT = 3000
 
 export function createEventRateLimiter(
   eventType: string,
-  onLimitReached: (limitError: RawError) => void,
+  onLimitReached: (message: string) => void,
   limit = EVENT_RATE_LIMIT
 ) {
   let eventCount = 0
@@ -33,11 +31,7 @@ export function createEventRateLimiter(
       if (eventCount === limit + 1) {
         allowNextEvent = true
         try {
-          onLimitReached({
-            message: `Reached max number of ${eventType}s by minute: ${limit}`,
-            source: ErrorSource.AGENT,
-            startClocks: clocksNow(),
-          })
+          onLimitReached(`Reached max number of ${eventType}s by minute: ${limit}`)
         } finally {
           allowNextEvent = false
         }