chore: clear dependabot vulnerabilities + expand tests + fix blueprint lint

[TheRealAgentK]

Summary

Three related changes bundled:

1. Dependency cleanup: reduces npm audit vulnerabilities 88 → 43 (51% reduction; all 3 critical eliminated, high 25 → 6) while staying on Ember 4.12 (no framework version bump).
2. Test coverage expansion: 9 → 27 unit tests (+18) closing the gaps in AGENTS.md §8.7.
3. Lint cleanup: removes 3 pre-existing node/no-extraneous-require errors in the install blueprint by replacing undeclared transitive deps (chalk, fs-extra, rsvp) with Node stdlib + this.ui color support — same install-time UX, no new dependencies.

	Before	After
Critical	3	0
High	25	6
Moderate	33	20
Low	27	17
Total vulns	88	43
Tests	9	27
Lint errors	3	0

All vulnerabilities are in devDependencies — no consumer-facing runtime code is affected.

Verification

• ✅ npx ember build — succeeds
• ✅ npx ember test — 27/27 passing (verified locally with Firefox headless; CI uses the standard Chrome configuration in testem.js)
• ✅ npm run lint — clean (was 3 pre-existing errors)

Closes / resolves these dependabot PRs

All 13 open dependabot PRs target packages that are now updated past their target versions:

Dependabot PR	Target	Now installed
#41 ws → 7.4.6	7.4.6	8.18.3
#42 underscore → 1.13.1	1.13.1	1.13.8
#43 tmpl → 1.0.5	1.0.5	1.0.5
#44 path-parse → 1.0.7	1.0.7	1.0.7
#45 hosted-git-info → 2.8.9	2.8.9	2.8.9 + 6.1.1
#46 terser → 4.8.1	4.8.1	4.8.1 + 5.46.2
#47 socket.io-parser → 3.3.3	3.3.3	4.2.6
#48 engine.io & socket.io → 3.6.1 / 2.5.0	—	6.6.6 / 4.8.3
#49 decode-uri-component → 0.2.2	0.2.2	0.2.2
#50 qs → 6.5.3	6.5.3	6.14.2 + 6.15.1
#51 express → 4.18.2	4.18.2	4.22.1 + 5.2.1
mout → 1.2.3	1.2.3	1.2.4
follow-redirects → 1.14.8	1.14.8	1.16.0

npm audit confirms 0/13 of those packages remain vulnerable after this PR. The open dependabot PRs can be closed (manually or via @dependabot recreate to confirm they auto-close).

Commits

Dependency bumps

1. chore(deps): npm audit fix — non-breaking transitive patches — closes 41 vulns via package-lock.json only.
2. chore(deps): bump qunit-dom 2 → 3.5.1
3. chore(deps): bump @ember/string 3 → 4.0.1
4. chore(deps): bump @ember/optional-features 2 → 3.0.0
5. chore(deps): bump @glimmer/component 1 → 2.1.1 + Revert — kept in history to document that @glimmer/component@2 violates ember-source@4.12.4's peer requirement of ^1.1.2. We must stay on @glimmer/component@1 while on Ember 4.12.
6. chore(deps): bump ember-resolver 11 → 13.2.0

Test additions

7. test: expand unit coverage for service + initializer — 18 new tests against the upgraded deps:

   Service

   • setUser forwards args to rg4js('setUser', ...)
   • trackEvent supports the pageView payload shape
   • apiKey, enableCrashReporting, enablePulse setters call rg4js with the correct command + value, and getters round-trip
   • when rg4js is unavailable submodule — verifies graceful degradation: send / setUser / trackEvent return null + warn; the three property setters are no-ops + warn

   Instance initializer

   • RSVP.on('error') handler is registered and forwards { error } to raygun.send
   • applicationInstance.onerror is wrapped and routes errors to raygun.send
   • A previously-installed onerror handler is preserved (chained), not replaced
   • router.routeDidChange subscription is created and emits trackEvent({ type: 'pageView', path: ... }) per transition
   • When enableCrashReporting is false: no RSVP handler, no onerror replacement, no routeDidChange subscription

   Pattern: tests intercept RSVP.on / router.on to capture the handlers the initializer registers, then invoke each captured handler directly with synthetic input — verifying both the wiring and the behavior without depending on real RSVP rejections or real router transitions.

Blueprint lint fix

8. fix(blueprint): drop undeclared chalk/fs-extra/rsvp deps

   The blueprint was requiring three packages that aren't declared in package.json — they only worked because ember-cli pulled them in transitively, which lint was rightly flagging as node/no-extraneous-require.

   Replaced with stdlib-only equivalents (no new dependencies added):

   Removed	Replaced with
   chalk	this.ui.writeLine(msg, color) — ember-cli's UI helper applies the same colorization internally
   fs-extra	util.promisify(fs.readFile) — works on Node 10.* per package.json#engines, unlike fs.promises (Node ≥10.17)
   rsvp	No longer needed; util.promisify replaces rsvp.denodeify

   Same install-time UX: success banner is still printed in green/blue, config/environment.js is still patched idempotently.

What is not in this PR (deferred)

The remaining 43 vulnerabilities are blocked by the "stay on Ember 4.12" constraint:

• Need Ember 5/6 bump: ember-cli (high), @glimmer/component (low), and a large transitive cluster (braces, micromatch, ansi-html, body-parser, path-to-regexp, cookie, etc.) which are all only fixable via ember-cli@6.12.0.
• Need test-infra rewrite: @ember/test-helpers@5 and ember-qunit@9 changed the start() / test-loader API; bumping requires migrating tests/test-helper.js and tests/index.html to the new pattern. Attempted in this branch and reverted.
• npm "fix" suggestions that are actually downgrades (ignored): @embroider/macros, ember-cli-babel, ember-auto-import, ember-maybe-import-regenerator, ember-try, ember-source.

These should be tackled in a follow-up PR that explicitly bumps the Ember major version.

---

Supersedes #56 (test changes were rolled into this PR).

[QuantumNightmare]

I'm not familiar with Ember. I did a code review with AMP, which basically just said the equivalent of making sure the tests pass and it functions correctly. The main theme was that the tests are making assumptions about what methods exist, and so make sure that they do indeed exist. Otherwise I don't see any issues.

[Olwiba]

Just noting there are some major version bumps, so it might also pay to spin up a fresh Ember app to validate the provider is still functioning as intended by running some CR traffic through it and seeing it correctly turn up in the webapp

[TheRealAgentK]

Just noting there are some major version bumps, so it might also pay to spin up a fresh Ember app to validate the provider is still functioning as intended by running some CR traffic through it and seeing it correctly turn up in the webapp

The major bumps are in secondary libraries, but it's a good point regardless. I will have a look when I'm fully back.