chore(rrweb): Replace fast-mhtml with inline MHTML parser

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[chargome]

Remove the fast-mhtml dependency which was only used in one test utility function (packages/rrweb/test/utils.ts) for parsing MHTML snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart MIME boundary splitting and quoted-printable content decoding. All 47 replayer tests pass.

fast-mhtml pulled in cheerio, express, undici, qs, bluebird, and cookie — a massive transitive tree for a simple test helper. This removes ~584 lines from yarn.lock.

Dependabot alerts resolved

Fully resolved (vulnerable package completely removed from lockfile):

Alert	Severity	Package	Summary
#166	MEDIUM	qs	arrayLimit bypass allows DoS via memory exhaustion
#183	LOW	qs	arrayLimit bypass in comma parsing allows DoS

Partially resolved (some entries removed, but package still exists via other dependency chains):

Alert	Severity	Package	Remaining source
#225, #224, #223, #222, #221, #170, #130, #112	HIGH/MEDIUM/LOW	undici	Still pulled in by puppeteer (Phase 3)
#100	LOW	cookie	Still pulled in by @sveltejs/kit (Phase 5)

closes https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

[linear-code]

SDK-1097 Replace fast-mhtml (~9 alerts)

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}