Maintenance/adobe edge/dependency

[tvanlaerhoven]

Upgraded @adobe/alloy dependency to v2.35.0.

---

[changeset-bot]

🦋 Changeset detected

Latest commit: 881483b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@theoplayer/react-native-analytics-adobe-edge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Alloy 2.35 runtime behaviour not verifiable in this checkout

AGENTS.md advises verifying third-party SDK behaviour against the pinned dependency in node_modules/@adobe/alloy/dist/alloy.js rather than from memory. node_modules is not installed in this checkout, so the only assurance that the connector's usage of createInstance and the media tracker API (adobe-edge/src/internal/web/AdobeEdgeHandler.ts) is unchanged in 2.35.0 comes from the mocked jest suite, which does not exercise the real SDK. Worth confirming the package-level checks (cd adobe-edge && npm test, npm run typescript) were run against the upgraded dependency, since CI runs neither.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Review — LGTM

Scope is exactly right: adobe-edge/package.json (^2.34.1 → ^2.35.0), the lockfile, and a patch changeset. No source changes needed.

Verified locally (on the branch, after npm ci):

• npm ci resolves cleanly from the committed lockfile
• cd adobe-edge && npm test → 3 suites / 32 tests pass
• cd adobe-edge && npm run typescript → clean
• npx bob build in adobe-edge → clean
• root npm run lint → 0 errors (105 pre-existing warnings), npm run prettier red only on pre-existing comscore/, drm/, engage/ files

API compatibility with what the connector actually uses (createInstance + monitors, 'configure', 'getMediaAnalyticsTracker', 'setDebug', media.getInstance/createQoEObject): I diffed alloy 2.34.1→2.35.0 and alloy-core 1.2.1→1.2.2 sources. MediaAnalyticsBridge is byte-identical, monitors is still a supported createInstance option, and no configure option was removed. The alloy-core changes are an internal refactor to a platformServices abstraction (cookie/globals/legacy getEcidFromVisitor moved out of Identity/visitorService) — no public surface change.

The one behavioural thing worth a mention in a changelog sense: 2.35.0 adds injectSendBeaconRequest/injectSendFetchRequest and drops alloy-core's network/requestMethods, i.e. the Edge network transport changed. Web e2e is green, so no observed regression.

Lockfile side effects (all benign, all upstream):

• @adobe/aep-rules-engine 3.1.1 → 3.1.2 drops its bogus runtime dependency on @vitest/coverage-v8, which is why vitest/vite/tinypool/test-exclude/… disappear from the tree and a batch of entries flip to "dev": true. Nice install-size win for consumers.
• js-cookie moved from alloy-core's deps up into alloy's; uuid 14.0.0 → 14.0.1.
• Also fixes a stale adobe-edge version in the lockfile (1.3.0 → 1.3.1, matching package.json on main).

Supply-chain check: @adobe/alloy@2.35.0 was published 2026-07-30, ~19 days ago (not a fresh publish); 2.35.1-beta.0 is the only newer tag and is a prerelease.

Nothing blocking. Only remaining gate is the pending Android/iOS/tvOS e2e jobs — which don't exercise the web alloy path anyway.

Written by Devin