[Md Junaed Hossain (junaed-optimizely)]

Summary

• Upgrade @optimizely/optimizely-sdk from ^6.6.1 to ^6.7.0 (JS SDK v6.7.0 release)
• Bump version 4.2.1 → 4.3.0 in package.json, package-lock.json, and CLIENT_VERSION (src/client/createInstance.ts)
• Add the 4.3.0 entry to CHANGELOG.md (copied from the JS SDK 6.7.0 changelog)

Test plan

• npm run test: 267/267 passing
• npm run build succeeds

🤖 Generated with Claude Code

Issues

FSSDK-13378

[Alex Yong (alexjoeyyong)]

Approving. CI is green on the head commit (unit tests on Node 18/20/22.23.4/24, integration, e2e, CodeQL). I did not run tests locally.

Verified:

• Diff matches the 4.1.0 / 4.2.0 / 4.2.1 release PR pattern; 4.3.0 is consistent across package.json, lockfile root and CLIENT_VERSION, with no stale 4.2.1 left outside changelog history.
• Lockfile integrity hash matches the registry for @optimizely/optimizely-sdk@6.7.0.
• Diffed published 6.6.1 vs 6.7.0: public types unchanged. The DecisionObj holdout -> holdouts[] change is not exported and react-sdk does not reference it. RN polyfill/peer-range changes are optional and React Native only.

Nits (optional):

1. Changelog date is "November 4, 2026", but the upstream 6.7.0 release is dated Nov 3. Confirm this is the intended release date.
2. The three non-holdout bullets (localStorage, RN polyfills, AsyncStorage v3) sit under the Local Holdouts paragraph and read as part of it. Consider splitting them out, restoring the upstream PR links, and adding a line noting the dependency moved to @optimizely/optimizely-sdk 6.7.0 as earlier entries did.
3. Local holdout hits no longer short-circuit the flag, so users' decisions can change. A minor bump is defensible since local holdouts only shipped in 4.1.0, but the release notes should say plainly that decisions can change.
4. react-sdk has no holdout tests, so green CI says little about the holdout change. That logic is covered upstream in the JS SDK.
5. Pre-existing, not for this PR: CLIENT_VERSION is hand-copied from package.json with no test tying them together.

[Matjaz Pirnovar (Mat001)]

This is a clean release PR whose package-lock is verifiably correct — the integrity hash, tarball URL, and widened peerDependencies ranges all match npm's published 6.7.0 exactly, and since 6.7.0's runtime deps are identical to 6.6.1's, the small 11-line lock diff is the complete and accurate delta. The version is bumped consistently in every place it lives (package.json, both package-lock.json fields, and CLIENT_VERSION in createInstance.ts, which is what's reported in dispatched events), with no stray hardcoded 4.2.1 left behind. The CHANGELOG entry is well-formed and consistent with the change (e.g. the "AsyncStorage v3" note matches the <4.0.0 peerDep widening), and a minor bump is the right semver call for an additive dependency upgrade