fix: bump dependencies flagged by Artifactory's curation policy

[abueide]

Summary

release.yml's publish job resolves dependencies through curated Artifactory (see #1384). 42 package versions across the dependency tree were blocked by curation (known-CVE and/or cooldown-flagged versions - ws, minimatch, semver, tough-cookie, tar, @babel/traverse, axios, json5, path-to-regexp, and more), which would have kept every future release stuck the same way this one was. This clears all 42.

No breaking changes for package consumers

Everything bumped here is dev/build/test tooling or example-app dependencies (playwright, vite, wrangler, turbo, next, webpack, rollup, and their transitive chains) - nothing a consumer of @segment/analytics-next or the other published packages actually installs. The one exception, dset, only moves a stray transitive resolution (3.1.3) up to match the version this repo already declares (^3.1.4) - no range change, no consumer impact.

• Direct pins: playwright/@playwright/test (1.28.1 → 1.61.1), vite (2.9.18 → 8.1.4, with-vite playground only), wrangler (3.11.0 → 4.111.0, node-integration-tests only), turbo (2.3.4 → 2.10.5), next (12.3.5 → 16.2.10, next-playground only).
• Everything else forced via root resolutions, targeting the newest version within the same major where one exists (minimizing behavior change), only crossing a major where the flagged major line has no available fix (tar, ws, tough-cookie, minimatch, path-to-regexp, serialize-javascript, webpack-dev-middleware, http-proxy-middleware, is-email, js-yaml).

Code fixes required (test-only, no published-package impact)

• devtools was removed from Playwright's LaunchOptions. Dropped it in ajs-tester.ts (launch already used headless: true there, so it was a no-op); replaced it in qa/lib/browser.ts with --auto-open-devtools-for-tabs in args, gated on debug mode, to preserve the actual local-debugging behavior.
• browser-integration-tests/src/helpers/standalone-mock.ts derived its fixture-callback type via Parameters<typeof test['beforeEach']>[0], which silently resolved to the wrong overload once Playwright's beforeEach gained an optional-title overload. Replaced with the actual exported fixture-args type.
• One test snapshot updated (packages/browser/src/core/user): jsdom's cookie-jar (test-environment only, not real browsers) is backed by tough-cookie, bumped 4.0.0 → 4.1.4 here - the newer version serializes an edge case differently (no leading empty segment). Verified this doesn't reflect our own runtime cookie code (js-cookie, unaffected) and re-recorded the snapshot.

CI-only regressions found and fixed after the first push

• e2e-tests/performance/ajs-perf-browser.test.ts failed with "Class extends value undefined" - the newer playwright-core bundles @hono/node-server, which does class Request extends global.Request at import time, and jsdom's global (this file's inherited default test environment) doesn't provide that. Scoped a @jest-environment node docblock pragma to just this file rather than polyfilling globally - an earlier attempt at a global polyfill in jest.setup.js fixed this but broke 21 other suites by changing fetch's runtime behavior everywhere.
• Same test then failed differently: ChunkLoadError fetching tsub-middleware.bundle.<hash>.js from the real production CDN. Root cause: the test's runtime CDN resolution (getCDN()) falls back to cdn.segment.com for any lazy-loaded chunk regardless of where the main script was served from, so the test was never actually hermetic - it only passed because production happened to match the local build's hash, which broke the moment the webpack bump changed that hash. Mocked the CDN bundle request in ajs-tester.ts to serve from the local dist/umd instead, mirroring the identical pattern already used in browser-integration-tests/src/helpers/standalone-mock.ts. Independent of production state now.
• node-integration-tests' Cloudflare Workers suite failed on every test: wrangler 4.111.0's unstable_dev hard-fails if .dev.vars doesn't exist, where 3.11.0 tolerated its absence - confirmed as a real regression (the same CI job passed on master before this bump). Added an empty .dev.vars (no actual vars are needed) and gitignored the .wrangler/ local runtime cache it creates.

Verified locally

• yarn build, yarn lint (turbo, all 22 workspaces including both playgrounds on the bumped Next.js/Vite), yarn scripts lint, yarn scripts test, yarn constraints - all pass.
• Full make ci for browser (build, size-limit, lint, unit tests, e2e tests) - green end to end, including a real Chromium run: 70/70 unit suites, 841/845 tests, e2e-tests/performance 2/2.
• Jest suites: core (14/14), node (18/18), consent-tools (6/6), generic-utils (2/2), page-tools (1/1), Cloudflare Workers (5/5) - all pass.

Test plan

• Confirm release.yml's test job installs cleanly through curated Artifactory (no more 403 Forbidden on any of these 42)
• CI green across all workspaces

[changeset-bot]

⚠️ No Changeset found

Latest commit: 64ebbe3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[tvs-twilio-segment]

✅ TVS Validation Passed

View full report

Show details

All validation checks have successfully completed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.59%. Comparing base (db575f4) to head (7a2f47b).
⚠️ Report is 1 commits behind head on master.

⚠️ Current head 7a2f47b differs from pull request most recent head 64ebbe3

Please upload reports for the commit 64ebbe3 to get more accurate results.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1385   +/-   ##
=======================================
  Coverage   91.59%   91.59%           
=======================================
  Files         127      127           
  Lines        4142     4142           
  Branches     1033     1033           
=======================================
  Hits         3794     3794           
  Misses        348      348           

Flag	Coverage Δ
browser	92.51% <ø> (ø)
core	90.07% <ø> (ø)
node	89.43% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.