follow-up: review-squad LOW/MED follow-ups (5 items, stacked on #390)

[vikrantpuppala]

Summary

Stacked on top of #390 (security-bump-runtime-and-dev). Addresses the LOW/MED findings from the multi-perspective self-review pass on #390 that were intentionally deferred to keep that PR's scope tight.

Each item below has a 1:1 correspondence with a finding (F-number) from the #390 self-review.

F4 — Add SECURITY-OVERRIDES.md

Documents each of the 18 entries in package.json's overrides block:

• Class (runtime vs dev tooling)
• Dependent chain (what package pulled the vulnerable transitive in)
• CVE id(s) cleared
• Exit condition (what change in upstream would let us remove the entry)

Pure docs. Referenced from CONTRIBUTING.md.

F2 — lz4 test ESM-safe

Refactored lib/utils/lz4.ts to expose setLz4LoaderForTest(fn) and resetLz4CacheForTest() seams. The test (tests/unit/utils/lz4.test.ts) was previously skipping the entire suite on Node 22+ because it patched CJS-only primitives (Module._load, require.cache). Now it injects via the new seams, and the suite runs cleanly on every Node version in the matrix.

Node	Before	After
16/18/20	904 passing	904 passing
22/24	898 passing + 6 pending (lz4 skipped)	904 passing (re-enabled)

F8 — FederationProvider HTTP exchange tests

Refactored lib/connection/auth/tokenProvider/FederationProvider.ts to expose setFederationFetchForTest(fn) so tests can stub node-fetch without patching the import system. Then added 3 unit tests in FederationProvider.test.ts that exercise the previously-uncovered HTTP exchange branch:

1. Exchange foreign-issued JWT for a Databricks token — verifies the URL hits /oidc/v1/token on the Databricks host, the method is POST, AND init.signal reaches fetch as an AbortSignal-shaped object (this is the cast site that TS 5 type-strictness caught in Clear OSV-Scanner HIGH/MED/LOW findings via dep bumps + overrides #390).
2. Signal propagation contract — verifies the signal observed by fetch implements aborted: boolean and addEventListener: Function.
3. Failure fallback — verifies that a non-retryable HTTP failure falls back to the original token under the default returnOriginalTokenOnFailure: true.

907 passing (904 prior + 3 new).

F11 — e2e parallel-safety audit

Audited all DDL in tests/e2e/**. All CREATE TABLE/DROP TABLE statements are templated against ${E2E_TABLE_SUFFIX} (which is unique per-job in CI: ${{ github.sha }}_node${{ matrix.node-version }}). Staging tests in staging_ingestion.test.ts already use uuid.v4() for file names. No test mutates the shared catalog/schema/volume.

Added tests/e2e/README.md documenting the parallelism contract, env-var inventory, and warehouse-capacity considerations for the new 5-entry matrix in #390.

F14 — OAuthCallbackServerStub interface-drift refactor

The stub in tests/unit/.stubs/OAuth.ts previously carried a pile of no-op shim methods (setTimeout, closeAllConnections, closeIdleConnections, getConnections, ref, unref, Symbol.asyncDispose, plus maxHeadersCount, maxRequestsPerSocket, timeout, headersTimeout, keepAliveTimeout, requestTimeout, maxConnections, connections) — each of these existed only to satisfy http.Server's structural type and accumulated as @types/node widened the interface.

Production OAuth code only calls listen() and close() on the returned server (verified by grepping lib/connection/auth/DatabricksOAuth/). The structural-type satisfaction is already handled by the as unknown as (typeof authCode)['createHttpServer'] cast in AuthorizationCode.test.ts (from #390's F10).

Dropped the dead shims; kept the minimal address() returning null. Future @types/node additions to http.Server won't require touching this stub anymore.

Drive-by

The repo's lint script glob expanded tests/e2e/** into all files (including .md), causing eslint to attempt parsing the new tests/e2e/README.md. Changed "lint": "eslint lib/** tests/e2e/** --ext .js,.ts" → "lint": "eslint 'lib/**/*.{js,ts}' 'tests/e2e/**/*.{js,ts}' --ext .js,.ts". Same scope, no false positives.

Test plan

• npm run prettier — clean
• npm run lint — clean
• npx tsc --project tsconfig.build.json --noEmit — clean
• npm test on Node 16 — 907 passing
• npm test on Node 20 — 907 passing
• npm test on Node 22 — 907 passing (was 898 + 6 pending — lz4 suite now active)
• osv-scanner scan source --lockfile=package-lock.json — No issues found
• CI green on the matrix (waiting for this PR to fire)

This pull request was AI-assisted by Isaac.