chore: Reduce npm vulnerability and attack surface across workspace

.github/workflows/build.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   build:
-    name: "Build and Test Package"
+    name: "Build"
     runs-on: ubuntu-latest
     timeout-minutes: 30
 
@@ -26,14 +26,16 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          node-version: 22.x
-
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+          node-version: 24.x
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

.github/workflows/lint.yml

@@ -0,0 +1,46 @@
+name: Lint
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: "Lint"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+          node-version: 24.x
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm check-types

.github/workflows/release.yml

@@ -23,22 +23,28 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
+      - name: Install pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: 22.x
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+          node-version: 24.x
           registry-url: "https://registry.npmjs.org"
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build package
-        run: |
-          cd packages/js
-          pnpm build
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm check-types
+
+      - name: Build
+        run: pnpm build
 
       - name: Run tests
         run: pnpm test:coverage

.github/workflows/sonarqube.yml

@@ -24,17 +24,25 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          node-version: 22.x
-
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+          node-version: 24.x
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Lint
+        run: pnpm lint
+
+      - name: Typecheck
+        run: pnpm check-types
+
       - name: Run tests with coverage
         run: |
           pnpm test:coverage

.github/workflows/test.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   test:
-    name: "Test Package"
+    name: "Test"
     runs-on: ubuntu-latest
 
     steps:
@@ -24,14 +24,16 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
-        with:
-          node-version: 22.x
-
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
 
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+          node-version: 24.x
+
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

AGENTS.md

@@ -0,0 +1,47 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+
+- This repository is a `pnpm` workspace managed with Turborepo.
+- The published SDK lives in `packages/js`.
+- SDK source, helpers, and shared types live in `packages/js/src`, `packages/js/src/lib`, and `packages/js/src/types`.
+- The demo app lives in `apps/playground` and exercises SDK behavior locally with Vite + React.
+- Generated output such as `dist/`, `coverage/`, and `.turbo/` should not be edited by hand.
+
+## Build, Test, and Development Commands
+
+Run commands from the repo root unless you are working on a single package.
+
+- `pnpm install` installs workspace dependencies.
+- `pnpm dev` runs workspace dev tasks through Turbo; for interactive UI work, use `pnpm --filter playground dev`.
+- `pnpm build` builds all packages; `pnpm --filter @formbricks/js build` rebuilds only the SDK.
+- `pnpm test` runs workspace tests; `pnpm test:coverage` collects coverage via Vitest.
+- `pnpm lint` checks formatting and lint rules with Biome.
+- `pnpm check-types` runs TypeScript without emitting output.
+- `pnpm clean` removes local build artifacts.
+
+## Coding Style & Naming Conventions
+
+- Biome is the formatter and linter.
+- The repository uses 2-space indentation, double quotes, trailing commas, and semicolons.
+- Prefer TypeScript modules and keep public exports in `packages/js/src/index.ts`.
+- Use `camelCase` for variables and functions.
+- Use `PascalCase` for types and components.
+- Keep filenames descriptive; tests follow the source name, for example `load-formbricks.test.ts`.
+
+## Testing Guidelines
+
+- SDK tests use Vitest and currently live beside the implementation under `packages/js/src`.
+- Add or update `*.test.ts` files when changing SDK behavior, especially proxy/loading logic in `src/lib`.
+- Run `pnpm --filter @formbricks/js test` before opening a PR.
+- Use `pnpm --filter @formbricks/js test:coverage` when touching core runtime paths.
+- No explicit coverage threshold is configured, so contributors should cover new branches and regressions directly.
+
+## Commit & Pull Request Guidelines
+
+- Recent history follows Conventional Commits such as `fix: restore eslint 9` and `chore: bump minor dependencies`.
+- Keep commit subjects short, imperative, and prefixed with `fix:`, `feat:`, `chore:`, or similar.
+- PRs should explain the behavioral change and note affected packages (`packages/js`, `apps/playground`, or both).
+- Link related issues when applicable.
+- Include screenshots or short recordings for playground UI changes.
+- Mention any required environment setup, such as `apps/playground/.env` variables, in the PR description.

apps/playground/.env.example

@@ -1,2 +1,2 @@
-NEXT_PUBLIC_FORMBRICKS_API_HOST=http://localhost:3000
-NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=YOUR-ENVIRONMENT-ID
+VITE_FORMBRICKS_API_HOST=http://localhost:3000
+VITE_FORMBRICKS_ENVIRONMENT_ID=YOUR-ENVIRONMENT-ID

apps/playground/.gitignore

@@ -13,9 +13,8 @@
 # testing
 /coverage
 
-# next.js
-/.next/
-/out/
+# vite
+/dist/
 
 # production
 /build
@@ -39,4 +38,3 @@ yarn-error.log*
 
 # typescript
 *.tsbuildinfo
-next-env.d.ts

apps/playground/README.md

@@ -1,6 +1,6 @@
 # Formbricks Playground
 
-A demo application for testing and developing Formbricks in-product surveys. This Next.js app provides an interactive environment to test survey triggers, user actions, and attributes.
+A demo application for testing and developing Formbricks in-product surveys. This Vite + React app provides an interactive environment to test survey triggers, user actions, and attributes.
 
 ## Setup
 
@@ -10,22 +10,22 @@ A demo application for testing and developing Formbricks in-product surveys. Thi
 pnpm install
 ```
 
-2. Create a `.env.local` file with your Formbricks credentials:
+1. Create a `.env` file with your Formbricks credentials:
 
 ```env
-NEXT_PUBLIC_FORMBRICKS_ENVIRONMENT_ID=your-environment-id
-NEXT_PUBLIC_FORMBRICKS_API_HOST=https://app.formbricks.com
+VITE_FORMBRICKS_ENVIRONMENT_ID=your-environment-id
+VITE_FORMBRICKS_API_HOST=https://app.formbricks.com
 ```
 
 You can find your environment ID in the Formbricks app under Settings → Setup.
 
-3. Start the development server:
+1. Start the development server:
 
 ```bash
 pnpm dev
 ```
 
-Open [http://localhost:3000](http://localhost:3000) to view the app.
+Open [http://localhost:5173](http://localhost:5173) to view the app.
 
 ## Features