2.0.0: breaking security bump — Node >=20, thrift 0.23, uuid 11 (0 OSV findings)

[vikrantpuppala]

Summary

Breaking security release (2.0.0) — completes the vulnerability cleanup, taking the lockfile to 0 OSV-Scanner findings. This stacks on the non-breaking #446 (1.17.0), which ships first and clears the criticals without breaking changes.

⚠️ Stacked on #446 — this branch is built on top of 1.17.0. Merge #446 first; this PR then merges cleanly onto main. (Until #446 merges, this shows as conflicting against bare main.)

Breaking changes

Change	From → To	Why
engines.node	>=14 → >=20	Node 14/16/18 dropped — all past upstream EOL (18 EOL'd 2025-04). >=20 is also the floor for the patched serialize-javascript (dev) and clears the kernel backend's Node 18 requirement.
thrift	^0.16.0 → ^0.23.0	Clears GHSA-r67j-r569-jrwp (HIGH) + GHSA-526f-jxpj-jmg2. Direct runtime dep; fix is a major bump.
uuid	^9.0.0 → ^11.1.1	Clears GHSA-w5hq-g745-h8pq (HIGH 7.5). uuid 11 dual-publishes ESM+CJS; the driver's CJS dist/ still require('uuid') unchanged. An overrides pin holds thrift's transitive uuid at 11 (uuid 13 is ESM-only → would break require()).

Supporting changes

• typescript pinned to exact 5.5.4 — uuid@11's .d.ts uses export type (needs TS 5+); <5.6 avoids @types/node Buffer-generic emit changing our published .d.ts.
• serialize-javascript override ^7.0.5 (its only patched line requires Node ≥20 — now satisfied by the floor bump).
• @types/node-fetch ^2.6.13.
• OAuth.ts test stub: cast Symbol.asyncDispose through any (ES2018 target predates the symbol; Node 20+ runtime provides it).
• CI matrix → [20, 22, 24]; e2e expanded to a matrix; setup-jfrog rewrites lockfile resolved: URLs to the JFrog mirror so protected runners can npm ci.

Net security result

OSV-Scanner v2.3.8 against the regenerated lockfile: No issues found (0 CRITICAL / 0 HIGH / 0 MED / 0 LOW).

Verification (local, Node 20)

• npm run build clean (TS 5.5.4)
• eslint clean
• 1249 unit tests passing
• osv-scanner = No issues found
• CI green on the [20, 22, 24] matrix (pending 1.17.0: clear CRITICAL + transitive OSV findings via overrides (non-breaking) #446 merge for a clean base)

Closes #370

This pull request was AI-assisted by Isaac.

[github-actions]

Thanks for your contribution! To satisfy the DCO policy in our contributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).

[vikrantpuppala]

Heads-up — I force-updated this branch to a clean rebuild (re-review needed).

What changed since the last approval:

• This PR is now the breaking 2.0.0 half of a two-PR split. The non-breaking fixes (2 CRITICAL + transitive) moved to 1.17.0: clear CRITICAL + transitive OSV findings via overrides (non-breaking) #446 (1.17.0), which clears customers' critical alerts without a breaking bump — directly addressing the request in Vulnerability Issues #386.
• The branch was rebuilt cleanly on top of 1.17.0: clear CRITICAL + transitive OSV findings via overrides (non-breaking) #446 (was 25 commits behind main + conflicting). It now contains only the genuinely-breaking delta: engines.node >=20, thrift ^0.23, uuid ^11, plus the TS 5.5.4 pin and test-stub fixes those require.
• Node floor is >=20 (not >=18 as the old title said) — this is the minimum for the last patched dev dep (serialize-javascript) and gets us to a true 0 OSV findings.

This PR is stacked on #446 — please merge #446 first; this then merges cleanly. Verified locally on Node 20: build + eslint clean, 1249 unit tests passing, osv-scanner reports no issues.

[github-actions]

Thanks for your contribution! To satisfy the DCO policy in our contributing guide every commit message must include a sign-off message. One or more of your commits is missing this message. You can reword previous commit messages with an interactive rebase (git rebase -i main).