fix(deps): bump adapter, core and utils to their released versions

[sasjs-dev]

Bumps the three @sasjs/* packages whose releases were being waited on:

@sasjs/adapter   4.19.2 -> 4.19.4
@sasjs/core      5.3.0  -> 5.3.1
@sasjs/utils     3.6.5  -> 3.7.0

What each carries

adapter 4.19.4 - the Socket alert cleanup (#915 + #917): tough-cookie 5.1.2 drops psl, punycode, url-parse, querystringify and requires-port from the prod tree, and the bundled @sasjs/utils 3.7.0 drops cli-table, colors, lodash.isequal and lodash.isfunction. Also declares engines.node >= 18, the floor its dep chain already requires, and folds the nanoid Dependabot bump (#916).

core 5.3.1 - the ms_runstp / ms_triggerstp / ms_testservice debug= parameter fix (#458, closing the 20-month-old draft #382 as superseded), plus the prepare install-script removal (#457) that had been stranded behind a chore:.

utils 3.7.0 - tables rendered in the logger without cli-table (#273), removing the last Dynamic require flagged package from the trees.

Verified on this head

build                        exit 0, 0 TS errors
full jest suite              87 suites / 668 tests, only the environmental
                             printVersion failing (needs npm list -g
                             @sasjs/cli; fails identically on main)
coverage                     75.67 / 63.38 / 75.44 / 76.24 - all above the
                             required 73 / 60.55 / 73.54 / 74
npm audit --omit=dev         0 vulnerabilities

What this clears

The Uses eval pair (lodash.isequal, lodash.isfunction) and the Unmaintained set (psl, punycode, url-parse, querystringify, requires-port) leave the CLI's prod tree via this bump, and cli-table + colors via lint's next release (lint 4.1.2 pins utils 3.6.4, so it holds the one remaining nested utils copy - the same exact-pin chain documented on the extension PR).

Still present and why: xml 1.0.1 (the CLI's own direct dep, used in saveOutput.ts - abandoned since 2016, needs a replacement not a bump), lodash.escaperegexp (@fast-csv/format still depends on it), delayed-stream / combined-stream (via form-data), cli-table / colors (via lint until it bumps utils).

Merge with squash or rebase

semantic-release reads only the first-parent chain, so a merge commit's subject is invisible to it.

[github-actions]

Coverage report

Total coverage

Status	Category	Percentage	Covered / Total
🟡	Statements	75.74%	3574/4719
🟡	Branches	63.39%	1463/2308
🟡	Functions	75.55%	717/949
🟢	Lines	84.29%	9094/10789

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Show files with reduced coverage 🔻

Reduced coverage

Status	Filename	Statements	Branches	Functions	Lines
🟢	src/commands/compile/compileSingleFile.ts	95.83% (-2.08% 🔻)	84% (-4% 🔻)	100%	100%

Status of coverage: 🟢 - ok, 🟡 - slightly more than threshold, 🔴 - under the threshold

Report generated by 🧪jest coverage report action from 3b1e91d

[sasjs-dev]

Reviewed the diff (package.json + package-lock.json: @sasjs/adapter 4.19.2 -> 4.19.4, @sasjs/core 5.3.0 -> 5.3.1, @sasjs/utils 3.6.5 -> 3.7.0 and the deduped transitive tree) plus a depcheck triage of the manifest and import graph at this head.

• package.json:5 - "engines": {"node": "^14.18.0 || >=16.10.0"} no longer matches the dependency floor this bump introduces: @sasjs/adapter 4.19.4 declares "node": ">=18" (4.19.2 declared no floor) and @sasjs/utils 3.7.0 pulls jwt-decode 4.0.0, which also requires >=18. The same stale range is baked into the checkNodeVersion script at package.json:13. Update engines and the version check to >=18, or the CLI keeps claiming Node 16 support it can no longer install against.
• src/utils/utils.ts:7 (also src/commands/run/run.ts:25) - import axios from 'axios' is a ghost: axios is not declared in package.json and resolves only through @sasjs/adapter's hoisted copy (axios 1.20.0 at the lockfile top level). If the adapter ever bundles or drops axios, the server-check and run paths break. Declare axios as a direct dependency pinned to the tested version.
• package.json:82 - "jwt-decode": "3.1.2" is stale: no import of jwt-decode remains anywhere in src (JWT decoding lives inside @sasjs/adapter now). Removing it also lets @sasjs/utils 3.7.0's jwt-decode 4.0.0 hoist out of node_modules/@sasjs/utils/node_modules instead of nesting.
• package.json:83 and :104 - "lodash.groupby": "4.6.0" and "@types/lodash.groupby": "4.6.9" are stale: the only lodash import in src is lodash.uniqby (src/commands/web/internal/createAssetServices.ts:13); lodash.groupby has no reference outside its declaration.
• package.json:122 - "tslib": "2.8.1" is declared but unreferenced: tsconfig sets no importHelpers and nothing imports tslib anywhere in the tree.

5 findings above for review.

[sasjs-dev]

Rolled into #1482, which carries this branch's bump (superseded there by a newer one: adapter 4.19.4, core 5.3.2, lint 4.1.3, utils 3.7.2) plus every review finding from this thread - the engines floor, the ghost axios declaration, and the jwt-decode / lodash.groupby / tslib / @types/lodash.groupby removals all land there. The head commit is 70f388f; closing as superseded rather than merging a narrower version of the same change.