chore: Reduce npm vulnerability and attack surface across workspace (#57)

* chore: reduce npm vulnerability and attack surface across workspace

* fix: align sdk TypeScript resolution

* fix: wire turbo task dependencies correctly

* docs: add repository agent guide

* fix: preserve survey script base path

* fix: address CodeRabbit review findings

* refactor: remove redundant segment filters cast

Author: mattinannt

.github/workflows/build.yml

@@ -23,10 +23,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

.github/workflows/lint.yml

@@ -0,0 +1,41 @@
+name: Lint and Type Check
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: 24.x
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check types
+        run: pnpm check-types

.github/workflows/release.yml

@@ -35,6 +35,12 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check types
+        run: pnpm check-types
+
       - name: Build package
         run: |
           cd packages/react-native

.github/workflows/test.yml

@@ -24,10 +24,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

AGENTS.md

@@ -0,0 +1,34 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+This repository is a `pnpm` workspace with two main packages:
+
+- `packages/react-native`: the published SDK (`@formbricks/react-native`). Source lives in `src/`, grouped by domain under `src/lib/`, with React components in `src/components/` and shared types in `src/types/`.
+- `apps/playground`: an Expo app for manual testing and integration checks. App code is in `src/`, with static assets in `assets/`.
+
+GitHub Actions under `.github/workflows/` enforce build, lint, type-check, test, and release steps.
+
+## Build, Test, and Development Commands
+Run commands from the repository root unless package-scoped work is needed.
+
+- `pnpm install --frozen-lockfile`: install workspace dependencies.
+- `pnpm dev`: run Turbo watchers across packages.
+- `pnpm build`: build the SDK and playground.
+- `pnpm lint`: enforce exact dependency versions, then run Biome checks.
+- `pnpm check-types`: run TypeScript checks across the workspace.
+- `pnpm test`: run unit tests with Vitest.
+- `pnpm test:coverage`: generate coverage reports used in release validation.
+- `pnpm --filter playground ios` / `pnpm --filter playground android`: launch the Expo playground on a device target.
+
+## Coding Style & Naming Conventions
+Use TypeScript with strict compiler settings. Biome is the formatter and linter; run `pnpm format` before large refactors. The repo uses spaces for indentation, double quotes, and semicolons.
+
+Follow existing naming patterns: React components in lowercase kebab-style filenames such as `survey-web-view.tsx`, domain modules in concise lowercase names such as `state.ts`, and tests as `*.test.ts`. Keep imports using the `@/` alias inside `packages/react-native` when referencing `src/`.
+
+## Testing Guidelines
+Unit tests live beside each domain under `src/lib/**/tests/`. Prefer small, focused Vitest suites and place reusable doubles in local `__mocks__/` folders. Add or update tests with every behavior change; there is no published coverage threshold, but `test:coverage` is part of the release workflow, so changed code should stay covered.
+
+## Commit & Pull Request Guidelines
+Recent history mostly follows Conventional Commit-style subjects such as `feat:`, `fix:`, and `chore:` with short imperative summaries. Keep commits narrowly scoped and descriptive.
+
+PRs should include a clear summary, linked issue if applicable, and the commands you ran locally (`pnpm lint`, `pnpm check-types`, relevant tests). Include screenshots or screen recordings when a playground or UI behavior changes. Avoid loose dependency ranges: this repo enforces exact versions in every `package.json`.

apps/playground/.eslintrc.js

@@ -9,11 +9,6 @@
     "assetBundlePatterns": ["**/*"],
     "icon": "./assets/icon.png",
     "ios": {
-      "infoPlist": {
-        "NSCameraUsageDescription": "Take pictures for certain activities.",
-        "NSMicrophoneUsageDescription": "Need microphone access for recording videos.",
-        "NSPhotoLibraryUsageDescription": "Select pictures for certain activities."
-      },
       "supportsTablet": true
     },
     "jsEngine": "hermes",

apps/playground/app.json

@@ -7,21 +7,22 @@
     "android": "expo start --android",
     "ios": "expo start --ios",
     "clean": "rimraf .turbo node_modules .expo",
-    "build": "expo export --no-bytecode"
+    "build": "expo export --no-bytecode",
+    "check-types": "tsc --noEmit"
   },
   "dependencies": {
     "@formbricks/react-native": "workspace:*",
-    "@react-native-async-storage/async-storage": "2.2.0",
-    "expo": "54.0.33",
-    "expo-status-bar": "3.0.9",
+    "@react-native-async-storage/async-storage": "3.0.2",
+    "expo": "55.0.9",
+    "expo-status-bar": "55.0.4",
     "react": "19.2.4",
-    "react-native": "0.84.0",
-    "react-native-webview": "13.16.0"
+    "react-native": "0.84.1",
+    "react-native-webview": "13.16.1"
   },
   "devDependencies": {
     "@babel/core": "7.29.0",
     "@types/react": "19.2.14",
-    "typescript": "5.9.3"
+    "typescript": "6.0.2"
   },
   "private": true
 }

apps/playground/package.json

@@ -1,6 +1,3 @@
-import { StatusBar } from "expo-status-bar";
-import React, { type JSX } from "react";
-import { Button, LogBox, StyleSheet, Text, View } from "react-native";
 import Formbricks, {
   logout,
   setAttribute,
@@ -9,6 +6,9 @@ import Formbricks, {
   setUserId,
   track,
 } from "@formbricks/react-native";
+import { StatusBar } from "expo-status-bar";
+import type { JSX } from "react";
+import { Button, LogBox, StyleSheet, Text, View } from "react-native";
 
 LogBox.ignoreAllLogs();
 
@@ -74,7 +74,7 @@ export default function App(): JSX.Element {
               (error: unknown) => {
                 // eslint-disable-next-line no-console -- logging is allowed in demo apps
                 console.error("Error setting user attributes:", error);
-              }
+              },
             );
           }}
         />

apps/playground/src/app.tsx

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.4.9/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!**/coverage",
+      "!**/dist",
+      "!**/.expo",
+      "!**/node_modules"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space"
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "always"
+    }
+  }
+}