Request changes.
There is a stored XSS in the widget that executes on the client's storefront, the injected stylesheet restyles the client's whole page, and the shopper's email is written to a console we do not own. Any one of those is enough to hold the PR. The API also 500s on the exact catalog shape we advertise that we handle.
Ordered below the way I would want the author to fix them.