fix(deps): raise chalk floor to ^5.6.2 to exclude malicious 5.6.1 (GHSA-2v46-p5h4-248w) - #255

_{Comment @coderabbitai help to get the list of available commands.}

RUN_TESTS

⚠️ Needs human review

No code defects found in the reviewed changes. The chalk floor moves from ^5.3.0 to ^5.6.2 inside the same major, which excludes the compromised 5.6.1, and the changeset text matches the change.

One region could not be reviewed automatically: the matching range line in package-lock.json (lockfiles are outside automated review scope). A reviewer should confirm the packages/browserstack-service entry reads ^5.6.2 and that node_modules/chalk still resolves to 5.6.2 (the author reports npm ls chalk --all shows only 5.6.2 / 4.1.2).

Change map (generated deterministically from the diff)

graph LR
  subgraph nnode_agent["node-agent"]
    n_changeset_pr_255_md["pr-255.md<br/>~5 lines"]
    npackages_browserstack_service_package_json["package.json<br/>~2 lines"]
  end

↻ This verdict comment is the review anchor — it's updated in place on each run (the gate posts its status separately).

— SDK PR Review Agent

Lockfile check on head 706da2a (the region the automated review skipped): the only package-lock.json change is the packages/browserstack-service entry's chalk range ^5.3.0 → ^5.6.2. node_modules/chalk still resolves to 5.6.2, and no path resolves 5.6.1. A human reviewer still needs to confirm this to clear the ⚠️.

⚠️ Sanity needs human review: SDK Wdio Test failed (https://minion-qa.browserstack.com/job/QA/job/SDKWdioTest/620/). The same job is also red on the most recent PRs, whatever their change: #251 (run 612), #252 (run 619), #253 (run 618). That points to a job or environment failure, not this change, which only touches the range and leaves the resolved dependency tree identical (chalk 5.6.2). Local results: build passes, and vitest passes 59 files / 1345 tests. A human needs to confirm the Jenkins failure cause before merge.

RUN_TESTS

🟢 SDK PR Review gate is green — the SDK PR Review Agent has run on the current head commit (verdict: pending).

This gate confirms a review ran on the latest commit. The verdict itself is advisory — read the findings and use your judgement; it does not block merge. A native GitHub reviewer approval is still separately required by branch protection before this PR can merge.

[SDK Wdio Test] TRA build state: passed | Stability 100% — verdict: success. Passed: 51, Failed: 0, Aggregate: 51. TRA: https://observability.browserstack.com/builds/yqdauqadubc5j16rknzieefndvyfyg47obyzxybo

🟢 SDK PR Review gate is green — the SDK PR Review Agent has run on the current head commit (verdict: pending).

This gate confirms a review ran on the latest commit. The verdict itself is advisory — read the findings and use your judgement; it does not block merge. A native GitHub reviewer approval is still separately required by branch protection before this PR can merge.