Release 4.0.0 - SDK packages update (security concerns)

[david-ruiz-cko]

GENERAL SECURITY UPDATE

This release updates several dependencies in the package.json file to their latest versions and introduces an overrides section to address specific sub-dependency versions, improving security and compatibility.

Dependency updates:

• Updated axios to ^1.18.0 and form-data to ^4.0.6 to incorporate the latest features and security fixes.
• Updated @babel/core to ^7.29.6 and uuid to ^13.0.1 to ensure compatibility with newer tooling and bug fixes. [1] [2]

Dependency management improvements:

• Added an overrides section to explicitly specify versions for several sub-dependencies (serialize-javascript, follow-redirects, picomatch, flatted, js-yaml, and @babel/plugin-transform-modules-systemjs), helping to mitigate potential security vulnerabilities and maintain consistent builds.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• 2.2.7_dependency_upgrade

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 2

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
2.2.7_dependency_upgrade	classifying	§2.2.7	All files are manifest + lockfile, and no security-sensitive package was touched.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• 2.2.7_dependency_upgrade

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}