deps: update vulnerable packages

- Fixes dependabot alert findings: 212, 201, 198, 193, 187, 186, 185,
184, 183, 182, 180, 179, 178, 166 and 164
- Moved unnecessary packages from dependencies to devDependencies

Refs: KEH-281

Author: tjgofore

CHANGELOG.md

@@ -4,60 +4,52 @@
 
 ## [4.2.3](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.2.2...kukkuu-admin-v4.2.3) (2026-03-23)
 
-
 ### Dependencies
 
-* Bump eslint plugins Refs: RATY-299 ([9697b05](https://github.com/City-of-Helsinki/kukkuu-admin/commit/9697b05e8dcb7f9af6298879b8e15eff4002914a))
-* Bump flatted from 3.4.1 to 3.4.2 ([96eb4ef](https://github.com/City-of-Helsinki/kukkuu-admin/commit/96eb4ef95a7d3b35e4e91108cfba1f2b2cd1a6bf))
+- Bump eslint plugins Refs: RATY-299 ([9697b05](https://github.com/City-of-Helsinki/kukkuu-admin/commit/9697b05e8dcb7f9af6298879b8e15eff4002914a))
+- Bump flatted from 3.4.1 to 3.4.2 ([96eb4ef](https://github.com/City-of-Helsinki/kukkuu-admin/commit/96eb4ef95a7d3b35e4e91108cfba1f2b2cd1a6bf))
 
 ## [4.2.2](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.2.1...kukkuu-admin-v4.2.2) (2026-03-16)
 
-
 ### Dependencies
 
-* Bump axios from 1.12.0 to 1.13.5 ([6c28da1](https://github.com/City-of-Helsinki/kukkuu-admin/commit/6c28da1ca38f0313fed6a9cfbfe2a1206ccb93fe))
-* Bump flatted from 3.3.2 to 3.4.1 ([8baed2b](https://github.com/City-of-Helsinki/kukkuu-admin/commit/8baed2bd38b6993979f26833be508a72e88807b6))
+- Bump axios from 1.12.0 to 1.13.5 ([6c28da1](https://github.com/City-of-Helsinki/kukkuu-admin/commit/6c28da1ca38f0313fed6a9cfbfe2a1206ccb93fe))
+- Bump flatted from 3.3.2 to 3.4.1 ([8baed2b](https://github.com/City-of-Helsinki/kukkuu-admin/commit/8baed2bd38b6993979f26833be508a72e88807b6))
 
 ## [4.2.1](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.2.0...kukkuu-admin-v4.2.1) (2026-01-27)
 
-
 ### Dependencies
 
-* Bump lodash from 4.17.21 to 4.17.23 ([f7c24a4](https://github.com/City-of-Helsinki/kukkuu-admin/commit/f7c24a4561c61b6ca305ee238c655ef1b34a77d2))
+- Bump lodash from 4.17.21 to 4.17.23 ([f7c24a4](https://github.com/City-of-Helsinki/kukkuu-admin/commit/f7c24a4561c61b6ca305ee238c655ef1b34a77d2))
 
 ## [4.2.0](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.1.1...kukkuu-admin-v4.2.0) (2026-01-09)
 
-
 ### Features
 
-* Yarn install hardening RATY-280 ([b522a60](https://github.com/City-of-Helsinki/kukkuu-admin/commit/b522a6048da5436a74c8417551561013ffe7d862))
-
+- Yarn install hardening RATY-280 ([b522a60](https://github.com/City-of-Helsinki/kukkuu-admin/commit/b522a6048da5436a74c8417551561013ffe7d862))
 
 ### Bug Fixes
 
-* Testcafe disable local network checks ([4a6ecda](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4a6ecda479b9e33588899c217e774a4e88d29280))
+- Testcafe disable local network checks ([4a6ecda](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4a6ecda479b9e33588899c217e774a4e88d29280))
 
 ## [4.1.1](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.1.0...kukkuu-admin-v4.1.1) (2025-12-09)
 
-
 ### Dependencies
 
-* Bump jws from 3.2.2 to 3.2.3 ([91e29a6](https://github.com/City-of-Helsinki/kukkuu-admin/commit/91e29a637458f939097c63bba2f07d4fa1a1e86b))
-* Upgrade jsonwebtoken to 9.0.3 ([19e6f18](https://github.com/City-of-Helsinki/kukkuu-admin/commit/19e6f186030b6c7055b61d87adaeaa09126160db))
+- Bump jws from 3.2.2 to 3.2.3 ([91e29a6](https://github.com/City-of-Helsinki/kukkuu-admin/commit/91e29a637458f939097c63bba2f07d4fa1a1e86b))
+- Upgrade jsonwebtoken to 9.0.3 ([19e6f18](https://github.com/City-of-Helsinki/kukkuu-admin/commit/19e6f186030b6c7055b61d87adaeaa09126160db))
 
 ## [4.1.0](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.0.6...kukkuu-admin-v4.1.0) (2025-11-26)
 
-
 ### Features
 
-* Add csp report-uri Ref: KK-1477 ([7dc2e0b](https://github.com/City-of-Helsinki/kukkuu-admin/commit/7dc2e0bc056efd1f232344dcb546813fa842b232))
-* Enable cloud Sentry Ref: KK-1477 ([4f4482f](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4f4482ff7811f09038e2a1bc522dfaba5fb8adab))
-* Generate sourcemaps Ref: KK-1477 ([4f4482f](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4f4482ff7811f09038e2a1bc522dfaba5fb8adab))
-
+- Add csp report-uri Ref: KK-1477 ([7dc2e0b](https://github.com/City-of-Helsinki/kukkuu-admin/commit/7dc2e0bc056efd1f232344dcb546813fa842b232))
+- Enable cloud Sentry Ref: KK-1477 ([4f4482f](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4f4482ff7811f09038e2a1bc522dfaba5fb8adab))
+- Generate sourcemaps Ref: KK-1477 ([4f4482f](https://github.com/City-of-Helsinki/kukkuu-admin/commit/4f4482ff7811f09038e2a1bc522dfaba5fb8adab))
 
 ### Bug Fixes
 
-* Use correct release variable Ref: KK-1477 ([c881109](https://github.com/City-of-Helsinki/kukkuu-admin/commit/c881109058ac9c9232aa5929494803b70a797e74))
+- Use correct release variable Ref: KK-1477 ([c881109](https://github.com/City-of-Helsinki/kukkuu-admin/commit/c881109058ac9c9232aa5929494803b70a797e74))
 
 ## [4.0.6](https://github.com/City-of-Helsinki/kukkuu-admin/compare/kukkuu-admin-v4.0.5...kukkuu-admin-v4.0.6) (2025-10-24)
 

LICENSE.md

@@ -1,3 +1,7 @@
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
 MIT License
 
 Copyright (c) 2024 City of Helsinki

README.md

@@ -188,7 +188,6 @@ If you're using a local Kukkuu API backend (`VITE_API_URI=http://localhost:8081/
 1. **Start the backend:** Ensure your local Kukkuu API backend is running.
 
 2. **Access the Django admin interface:**
-
    - Open the Django admin interface: http://localhost:8081/admin/
    - Log in with the default credentials: username `admin`, password `admin`. If you don't have an admin user yet, you can create one with `python manage.py createsuperuser`.
 
@@ -203,12 +202,10 @@ You should now be able to log in to Kukkuu-admin with that user.
 If you're using the test environment's backend (`VITE_API_URI=https://kukkuu.api.test.hel.ninja/graphql`), you'll need to grant superuser privileges to your user account. Here's how:
 
 1. **Obtain Django admin credentials:**
-
    - Contact the administrator of the test environment's backend to get the credentials to its Django admin **or**
    - If you have access to the [backend pod in OpenShift](https://console-openshift-console.apps.arodevtest.hel.fi/k8s/ns/hki-kuva-kukkuu-test/pods?name=kukkuu-api&orderBy=desc&sortBy=Status&rowFilter-pod-status=Running), you can create a superuser by running `python manage.py createsuperuser` in the pod's terminal.
 
 2. **Access the Django admin interface:**
-
    - Open the Django admin interface for the test environment's backend at https://kukkuu.api.test.hel.ninja/admin
    - Log in using the credentials from step 1.
 

package.json

@@ -46,6 +46,7 @@
     "@mui/lab": "^5.0.0-alpha.146",
     "@mui/material": "^5.14.11",
     "@mui/styles": "^5.14.11",
+    "@nabla/vite-plugin-eslint": "^3.0.1",
     "@sentry/browser": "^10.25.0",
     "@testing-library/jest-dom": "^6.1.3",
     "@testing-library/react": "^14.0.0",
@@ -62,7 +63,7 @@
     "@types/react-router-dom": "^5.3.3",
     "@typescript-eslint/eslint-plugin": "^8.57.1",
     "@typescript-eslint/parser": "^8.57.1",
-    "@vitejs/plugin-react": "^4.3.4",
+    "@vitejs/plugin-react": "^5.1.0",
     "@vitest/coverage-v8": "^3.0.7",
     "@vitest/eslint-plugin": "^1.6.13",
     "apollo-upload-client": "^17.0.0",
@@ -99,9 +100,8 @@
     "react-dom": "^18.2.0",
     "react-idle-timer": "^5.7.2",
     "typescript": "<5.4.0",
-    "vite": "^6.4.2",
-    "vite-plugin-eslint": "^1.8.1",
-    "vite-tsconfig-paths": "^5.1.4",
+    "vite": "^7.0.0",
+    "vite-tsconfig-paths": "^6.1.1",
     "vitest": "^3.0.7",
     "vitest-localstorage-mock": "^0.1.2",
     "vitest-sonar-reporter": "^2.0.0",
@@ -111,10 +111,10 @@
     "@commitlint/cli": "^19.6.1",
     "@commitlint/config-conventional": "^19.6.0",
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@graphql-codegen/add": "^5.0.0",
-    "@graphql-codegen/cli": "^5.0.0",
-    "@graphql-codegen/typescript": "^4.0.1",
-    "@graphql-codegen/typescript-operations": "^4.0.1",
+    "@graphql-codegen/add": "^6.0.0",
+    "@graphql-codegen/cli": "^6.2.1",
+    "@graphql-codegen/typescript": "^5.0.9",
+    "@graphql-codegen/typescript-operations": "^5.0.9",
     "@graphql-codegen/typescript-react-apollo": "^4.1.0",
     "@testing-library/testcafe": "^5.0.0",
     "doctoc": "^2.2.1",
@@ -124,5 +124,10 @@
     "lint-staged": "^15.4.3",
     "testcafe": "^3.7.1",
     "testcafe-reporter-html": "^1.4.6"
+  },
+  "resolutions": {
+    "@types/minimatch": "^5.1.2",
+    "lodash": "^4.18.1",
+    "underscore": "^1.13.8"
   }
 }

src/assets/styles/index.css

@@ -1,13 +1,13 @@
 body {
   margin: 0;
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto',
-    'Oxygen', 'Ubuntu', 'Cantarell', 'Fira Sans', 'Droid Sans',
-    'Helvetica Neue', sans-serif;
+  font-family:
+    -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu',
+    'Cantarell', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif;
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
 }
 
 code {
-  font-family: source-code-pro, Menlo, Monaco, Consolas, 'Courier New',
-    monospace;
+  font-family:
+    source-code-pro, Menlo, Monaco, Consolas, 'Courier New', monospace;
 }

src/common/components/languageTab/__tests__/LanguageTabs.test.jsx

@@ -36,14 +36,23 @@ describe('LanguageTabs', () => {
   });
 
   it('renders correctly', () => {
-    const { container } = render(<LanguageTabs />);
-    expect(container).toMatchSnapshot();
+    render(<LanguageTabs />);
+    expect(screen.getByRole('tablist')).toBeInTheDocument();
+
+    const selectedTab = screen.getByRole('tab', {
+      name: 'languages.en',
+      selected: true,
+    });
+    expect(selectedTab).toHaveAttribute('aria-selected', 'true');
   });
 
   it('renders the correct number of tabs', () => {
     render(<LanguageTabs />);
     const tabs = screen.getAllByRole('tab');
     expect(tabs.length).toBe(mockLanguages.length);
+    expect(mockTranslate).toHaveBeenCalledWith('languages.en');
+    expect(mockTranslate).toHaveBeenCalledWith('languages.fi');
+    expect(mockTranslate).toHaveBeenCalledWith('languages.sv');
   });
 
   it('calls selectLanguage when a tab is clicked', () => {

src/common/components/languageTab/__tests__/__snapshots__/LanguageTabs.test.jsx.snap

@@ -1,7 +1,7 @@
 import { MessageChannel } from 'worker_threads';
 
 import React from 'react';
-import { render, cleanup } from '@testing-library/react';
+import { render, cleanup, screen } from '@testing-library/react';
 
 import App, { getReactAdminResources } from '../App';
 import dataProvider from '../../../api/dataProvider';
@@ -60,19 +60,28 @@ test('renders without crashing', () => {
     },
   });
 
-  const { container } = render(<App />);
-  expect(container).toMatchSnapshot();
+  render(<App />);
+  expect(screen.getByText(/kulttuurin kummilapset admin/i)).toBeInTheDocument();
 });
 
 describe('getReactAdminResources', () => {
   const allResourceNames = [
+    'events-and-event-groups',
+    'events',
+    'venues',
+    'children',
+    'occurrences',
+    'messages',
+    'event-groups',
+  ];
+
+  const resourceNamesWithoutChildren = [
     'events-and-event-groups',
     'events',
     'venues',
     'occurrences',
     'messages',
     'event-groups',
-    'children',
   ];
 
   const adminPermissionsBase: Permissions = {
@@ -104,16 +113,27 @@ describe('getReactAdminResources', () => {
     });
 
     expect(resources.length).toBe(allResourceNames.length);
-    expect(resources.map((r) => r.name).includes('children')).toBe(true);
-    expect(resources).toMatchSnapshot();
+    expect(resources.map((r) => r.name)).toEqual(allResourceNames);
+
+    const eventResource = resources.find((r) => r.name === 'events');
+    expect(eventResource).toBeDefined();
+    expect(eventResource?.create).toBeDefined();
+    expect(eventResource?.edit).toBeDefined();
+    expect(eventResource?.show).toBeDefined();
+
+    const childrenResource = resources.find((r) => r.name === 'children');
+    expect(childrenResource).toBeDefined();
+    expect(childrenResource?.list).toBeDefined();
+    expect(childrenResource?.show).toBeDefined();
   });
 
   it('should hide the children resource when user does not have canViewFamiliesWithinProject permission', () => {
     const resources = getReactAdminResources(project.id, {
       ...adminPermissionsBase,
       canViewFamiliesWithinProject: (projectId?: string) => false,
     });
-    expect(resources.length).toBe(allResourceNames.length - 1);
-    expect(resources.map((r) => r.name).includes('children')).toBe(false);
+    expect(resources.length).toBe(resourceNamesWithoutChildren.length);
+    expect(resources.map((r) => r.name)).toEqual(resourceNamesWithoutChildren);
+    expect(resources.find((r) => r.name === 'children')).toBeUndefined();
   });
 });