- feat: Export getCanvasManager & allow passing it to record() [#122](getsentry/rrweb#122)
- feat: Remove hooks related code, which is not used [#126](getsentry/rrweb#126)
- feat: Remove plugins related code, which is not used [#123](getsentry/rrweb#123)
- feat: Refactor module scope vars & export mirror & `takeFullSnapshot` directly [#113](getsentry/rrweb#113)
- fix(rrweb): Fix rule.style being undefined [#121](getsentry/rrweb#121)
- ref: Avoid unnecessary cloning of objects or arrays [#125](getsentry/rrweb#125)
- ref: Avoid cloning events to add timestamp [#124](getsentry/rrweb#124)

- feat: Export getCanvasManager & allow passing it to record() [#122](getsentry/rrweb#122)
- feat: Remove hooks related code, which is not used [#126](getsentry/rrweb#126)
- feat: Remove plugins related code, which is not used [#123](getsentry/rrweb#123)
- feat: Refactor module scope vars & export mirror & `takeFullSnapshot` directly [#113](getsentry/rrweb#113)
- fix(rrweb): Fix rule.style being undefined [#121](getsentry/rrweb#121)
- ref: Avoid unnecessary cloning of objects or arrays [#125](getsentry/rrweb#125)
- ref: Avoid cloning events to add timestamp [#124](getsentry/rrweb#124)

- feat: Export getCanvasManager & allow passing it to record() [#122](getsentry/rrweb#122)
- feat: Remove hooks related code, which is not used [#126](getsentry/rrweb#126)
- feat: Remove plugins related code, which is not used [#123](getsentry/rrweb#123)
- feat: Refactor module scope vars & export mirror & `takeFullSnapshot` directly [#113](getsentry/rrweb#113)
- fix(rrweb): Fix rule.style being undefined [#121](getsentry/rrweb#121)
- ref: Avoid unnecessary cloning of objects or arrays [#125](getsentry/rrweb#125)
- ref: Avoid cloning events to add timestamp [#124](getsentry/rrweb#124)

- feat: Export getCanvasManager & allow passing it to record()
[#122](getsentry/rrweb#122)
- feat: Remove hooks related code, which is not used
[#126](getsentry/rrweb#126)
- feat: Remove plugins related code, which is not used
[#123](getsentry/rrweb#123)
- feat: Refactor module scope vars & export mirror & `takeFullSnapshot`
directly [#113](getsentry/rrweb#113)
- fix(rrweb): Fix rule.style being undefined
[#121](getsentry/rrweb#121)
- ref: Avoid unnecessary cloning of objects or arrays
[#125](getsentry/rrweb#125)
- ref: Avoid cloning events to add timestamp
[#124](getsentry/rrweb#124)


Note: With this update, canvas is _always_ excluded, unless we opt in by
passing a `getCanvasManager` function to `record()`. We'll provide a way
to do this once we have a fully formed canvas story. For now, this will
reduce bundle size considerably for all SDK users.

…t` directly (#113)

Currently, we use these from `record.xx`, which is not ideal thinking
about treeshaking and lazy loading.

This moves these to be proper exports so we can use the in Replay
without having to import `record` and everything that comes with it
(=everything).

Bump the core build/test tooling across all workspace packages:

- **vite** ^5.2.8 → ^6.4.1
- **vitest** ^1.4.0 → ^2.1.9
- **vite-plugin-dts** ^3.8.1 → ^4.5.4
- **rollup-plugin-terser** (deprecated) → **@rollup/plugin-terser** in
rrweb-worker

Added `cssFileName: 'style'` to the shared vite config to preserve the
`style.css` output filename (Vite 6 changed the default to
package-name-based).

### Dependabot alerts resolved

**Fully resolved** (vulnerable version completely removed from
lockfile):

| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #113 | CRITICAL | `vitest` | Remote Code Execution when accessing a
malicious website while Vitest API server is listening |
| #203 | HIGH | `rollup` | Rollup 4 has Arbitrary File Write via Path
Traversal |
| #110 | MEDIUM | `vue-template-compiler` | Client-side XSS (no fix
available — removed by vite-plugin-dts v4 dropping the dependency) |

**Partially resolved** (some vulnerable entries removed, but package
still exists via other dependency chains):

| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #154, #146, #145, #141, #140, #139, #138, #126, #111 | MEDIUM/LOW |
`vite` | `@sveltejs/vite-plugin-svelte@3` still pulls in vite@5 (needs
Svelte 5 upgrade) |
| #114 | MEDIUM | `esbuild` | `esbuild-plugin-umd-wrapper` still uses
esbuild@0.18 |
| #214 | HIGH | `serialize-javascript` | webpack (via `@size-limit`)
still pulls in v6 |
| #105, #104 | MEDIUM | `nanoid` | postcss (via vite internally) still
uses nanoid@3 |
| #165, #155 | HIGH/MEDIUM | `validator` | `@microsoft/api-extractor`
(via vite-plugin-dts) — needs further investigation |

The partially resolved alerts will be addressed in later phases (Svelte
5 upgrade, @size-limit bump, mop-up).

closes
https://linear.app/getsentry/issue/SDK-1095/bump-vitest-vite-56-1-critical-7-alerts

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>