Record the no-backport disposition for security ledger 190 [skip changelog]

Maintainer decision 2026-08-14: the 1.x line keeps the pre-existing
unguarded shape - 2.0 RC is imminent, the final 2.0 release is scheduled
for 2026-09-01, and 1.x is not planned to change. Low severity, no
external actor; the checklist row now says so, so later reviews do not
re-raise it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: duracelltomi

.security/code-review-checklist.md

@@ -1088,7 +1088,7 @@ green; JS 724 tests / 35 suites green; `phpcs` exit 0 repo-wide**.
 
 | # | Sev | Status | Summary | File(s) |
 |---|-----|--------|---------|---------|
-| 190 | Low (correctness — RI-21's consumer side; no site actor, trigger is the site's own eec-filter callbacks) | **fixed 2026-08-14** | The two single-product tracker paths were the only unguarded consumers of the product-JSON parse family (8 sibling call sites guard): an unencodable/null product payload yielded a malformed `add_to_cart` push on one path and an uncaught TypeError in the variation handler on the other. Verifier-confirmed with probes both directions; pre-existing shape (also carried by released 1.x), not introduced by the range. Fixed with the two sibling guards the verifier probe-validated. | `js/frontend/gtm4wp-woocommerce.js`, `js/frontend/test/woocommerce-tracker.test.js` |
+| 190 | Low (correctness — RI-21's consumer side; no site actor, trigger is the site's own eec-filter callbacks) | **fixed 2026-08-14** | The two single-product tracker paths were the only unguarded consumers of the product-JSON parse family (8 sibling call sites guard): an unencodable/null product payload yielded a malformed `add_to_cart` push on one path and an uncaught TypeError in the variation handler on the other. Verifier-confirmed with probes both directions; pre-existing shape (also carried by released 1.x), not introduced by the range. Fixed with the two sibling guards the verifier probe-validated. **No 1.x back-port, per the maintainer (2026-08-14):** 2.0 RC is imminent with the final release scheduled for 2026-09-01, and there is no plan to change this — do not re-raise the 1.x side; the shape is Low with no external actor. | `js/frontend/gtm4wp-woocommerce.js`, `js/frontend/test/woocommerce-tracker.test.js` |
 
 > **Adjudication (R25): 1 dispatch, 0 mechanisms refuted, 0 recommendations refuted, 0
 > dispositions refuted, 0 left PLAUSIBLE.** Three cosmetic revisions folded in: the family