Merge pull request #22 from browserstack/LTS-4750-extract-zip-path-traversal

LTS-4750: drop extract-zip via @puppeteer/browsers 3.x override (GHSA-jmr9-qjv8-65gv)

Author: SaranshBS

.npmrc

@@ -9,9 +9,12 @@
 # postinstalls (edgedriver/geckodriver) are not needed. browserstack-node-sdk is
 # pinned to the latest release (1.61.0) so no update-postinstall is needed either.
 #
-# engine-strict=true enforces the package.json `engines.node` floor (>=18), which
-# matches our runner pod and what @wdio/cli 9 already requires. Customers on EOL
-# Node (<18) get a clear upgrade message instead of obscure failures.
+# engine-strict=true enforces the package.json `engines.node` floor (>=22.12.0).
+# The floor was raised from >=18 for LTS-4750: the only fix for the unpatched
+# extract-zip path traversal (GHSA-jmr9-qjv8-65gv) is @puppeteer/browsers 3.x,
+# which is ESM-only and requires Node >=22.12.0. Node 18 (EOL 2025-04-30) and
+# Node 20 (EOL 2026-04-30) are both out of support anyway, so customers on EOL
+# Node get a clear upgrade message instead of obscure failures.
 
 strict-ssl=true
 save-exact=true