[bhabalan]

COMPLETES #SNYK-JS-INFLIGHT-6095116 and CVE-2017-16115

This pull request addresses

Widgets currently resolves @webex/component-adapter-interfaces@1.30.18. That package brings unused build tools and Jest tooling into consumer production installations, including timespan@2.3.0 and inflight@1.0.6.

Interfaces PR #181 removed the unused tools and moved the test tools to development dependencies. The fixed interfaces 1.30.22 package is now published with no production dependencies.

by making the following changes

• Raise the Widgets manifest minimum from ^1.30.5 to ^1.30.22.
• Regenerate yarn.lock so the direct dependency and the components/adapter dependency paths all resolve to 1.30.22. Remove orphaned tooling entries. Retained dependency versions are unchanged.
• Update the meetings widget dependency baseline to describe the minimum version and cleanup.

The manifest minimum records the fix for future consumers. Existing consumer lockfiles must also be refreshed to adopt the updated dependency tree. Development tooling elsewhere in this monorepo can still depend on inflight.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Tooling change
• Internal code refactor

The following scenarios were tested

• The testing is done with the amplify link

Using Node 22.14.0 and Yarn 4.5.1:

• Verified the published interfaces tarball against its npm SHA-512 integrity value. Its manifest has no production dependencies and keeps the Jest tools in devDependencies.
• yarn install --immutable: passed.
• yarn workspace @webex/widgets build:src: passed with the existing bundle-size warnings.
• yarn workspace @webex/widgets pack --out <temporary-path>/widgets-candidate.tgz: passed; the packed manifest requires interfaces ^1.30.22.
• Installed the packed Widgets candidate in an isolated consumer with npm install --omit=dev --ignore-scripts --no-audit --no-fund. npm ls --omit=dev --all --json contained neither timespan nor inflight. All three interfaces paths resolved to 1.30.22.
• The normal pre-commit hook passed yarn run test:unit and yarn run test:styles, including all 30 Meetings Widget tests. The style check reported 6 existing warnings and no errors.
• Reviewed the generated lockfile: no unrelated retained package versions changed. Whitespace and credential-pattern checks passed.

Live meeting, KMS, and manual Amplify tests were not run. Full PR CI remains pending.

The GAI Coding Policy And Copyright Annotation Best Practices

• GAI was not used (or, no additional notation is required)
• Code was generated entirely by GAI
• GAI was used to create a draft that was subsequently customized or modified
• Coder created a draft manually that was non-substantively modified by GAI (e.g., refactoring was performed by GAI on manually written code)
• Tool used for AI assistance (GitHub Copilot / Other - specify)
  • Github Copilot
  • Other - Please Specify
• This PR is related to
  • Feature
  • Defect fix
  • Tech Debt
  • Automation

AI assistance: OpenAI Codex generated the dependency manifest and documentation changes and this description. Yarn generated the lockfile. Existing source copyright notices were preserved.

Checklist before merging

• I have not skipped any automated checks
• All existing and new tests passed
• I have updated the testing document
• I have tested the functionality with amplify link

The full-test and Amplify checklist items remain open until the required CI and manual checks are complete. The dependency baseline was updated; a separate testing document was not updated.

---

Make sure to have followed the contributing guidelines before submitting.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T14:59:55.371061Z	69517db	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[aws-amplify-us-east-2]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-759.d1b38q61t1z947.amplifyapp.com