chore: reduce npm vulnerability and attack surface across workspace

Author: mattinannt

.github/workflows/build.yml

@@ -23,10 +23,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

.github/workflows/lint.yml

@@ -0,0 +1,41 @@
+name: Lint and Type Check
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Node.js 24.x
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
+        with:
+          node-version: 24.x
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check types
+        run: pnpm check-types

.github/workflows/release.yml

@@ -35,6 +35,12 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Lint
+        run: pnpm lint
+
+      - name: Check types
+        run: pnpm check-types
+
       - name: Build package
         run: |
           cd packages/react-native

.github/workflows/test.yml

@@ -24,10 +24,10 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Setup Node.js 22.x
+      - name: Setup Node.js 24.x
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
-          node-version: 22.x
+          node-version: 24.x
 
       - name: Install pnpm
         uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0

apps/playground/.eslintrc.js

@@ -9,11 +9,6 @@
     "assetBundlePatterns": ["**/*"],
     "icon": "./assets/icon.png",
     "ios": {
-      "infoPlist": {
-        "NSCameraUsageDescription": "Take pictures for certain activities.",
-        "NSMicrophoneUsageDescription": "Need microphone access for recording videos.",
-        "NSPhotoLibraryUsageDescription": "Select pictures for certain activities."
-      },
       "supportsTablet": true
     },
     "jsEngine": "hermes",

apps/playground/app.json

@@ -7,21 +7,22 @@
     "android": "expo start --android",
     "ios": "expo start --ios",
     "clean": "rimraf .turbo node_modules .expo",
-    "build": "expo export --no-bytecode"
+    "build": "expo export --no-bytecode",
+    "check-types": "tsc --noEmit"
   },
   "dependencies": {
     "@formbricks/react-native": "workspace:*",
-    "@react-native-async-storage/async-storage": "2.2.0",
-    "expo": "54.0.33",
-    "expo-status-bar": "3.0.9",
+    "@react-native-async-storage/async-storage": "3.0.2",
+    "expo": "55.0.9",
+    "expo-status-bar": "55.0.4",
     "react": "19.2.4",
-    "react-native": "0.84.0",
-    "react-native-webview": "13.16.0"
+    "react-native": "0.84.1",
+    "react-native-webview": "13.16.1"
   },
   "devDependencies": {
     "@babel/core": "7.29.0",
     "@types/react": "19.2.14",
-    "typescript": "5.9.3"
+    "typescript": "6.0.2"
   },
   "private": true
 }

apps/playground/package.json

@@ -1,6 +1,3 @@
-import { StatusBar } from "expo-status-bar";
-import React, { type JSX } from "react";
-import { Button, LogBox, StyleSheet, Text, View } from "react-native";
 import Formbricks, {
   logout,
   setAttribute,
@@ -9,6 +6,9 @@ import Formbricks, {
   setUserId,
   track,
 } from "@formbricks/react-native";
+import { StatusBar } from "expo-status-bar";
+import type { JSX } from "react";
+import { Button, LogBox, StyleSheet, Text, View } from "react-native";
 
 LogBox.ignoreAllLogs();
 
@@ -74,7 +74,7 @@ export default function App(): JSX.Element {
               (error: unknown) => {
                 // eslint-disable-next-line no-console -- logging is allowed in demo apps
                 console.error("Error setting user attributes:", error);
-              }
+              },
             );
           }}
         />

apps/playground/src/app.tsx

@@ -0,0 +1,34 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.4.9/schema.json",
+  "vcs": {
+    "enabled": true,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!**/coverage",
+      "!**/dist",
+      "!**/.expo",
+      "!**/node_modules"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space"
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "double",
+      "semicolons": "always"
+    }
+  }
+}

biome.json

@@ -4,29 +4,20 @@
   "scripts": {
     "build": "turbo run build",
     "dev": "turbo run dev",
-    "lint": "node scripts/check-exact-deps.mjs && turbo run lint",
-    "format": "prettier --write \"**/*.{ts,tsx,md}\"",
+    "lint": "node scripts/check-exact-deps.mjs && biome check .",
+    "format": "biome format --write .",
     "check-types": "turbo run check-types",
     "test": "turbo run test --no-cache",
     "test:coverage": "turbo run test:coverage --no-cache"
   },
   "devDependencies": {
-    "prettier": "3.8.1",
-    "turbo": "2.8.20",
-    "typescript": "5.9.3",
+    "@biomejs/biome": "2.4.9",
+    "turbo": "2.8.21",
+    "typescript": "6.0.2",
     "rimraf": "6.1.3"
   },
-  "packageManager": "pnpm@10.32.1",
+  "packageManager": "pnpm@10.33.0",
   "engines": {
-    "node": ">=20.19.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "on-headers": "1.1.0",
-      "glob": "13.0.4",
-      "node-forge": "1.3.3",
-      "js-yaml": "4.1.1",
-      "tar": "7.5.12"
-    }
+    "node": "^20.19.0 || >=22.12.0"
   }
 }