Temporary PR to test the reusable CI workflow

[tuomas777]

DO NOT MERGE!

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9c865f49-3899-4e06-9720-50dd2bb06534

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch RATY-350-test

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)

See the Details below.

Vulnerabilities

pnpm-lock.yaml

OpenSSF Scorecard

Scanned Files

• .github/workflows/ci.yml
• pnpm-lock.yaml

Name	Version	Vulnerability	Severity	Patched Version
dompurify	2.3.10	DOMPurify vulnerable to tampering by prototype polution	critical	2.4.2
		DOMPurify allows tampering by prototype pollution	high	2.5.4
		DOMpurify has a nesting-based mXSS	high	2.5.0
		DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)	moderate	3.4.11
		DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content	moderate	3.4.7			DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`	moderate	3.4.7			DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks	moderate	3.4.6			DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM	moderate	3.4.6			DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)	moderate	3.4.0			DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode	moderate	3.4.0			DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation	moderate	3.4.0			DOMPurify ADD_ATTR predicate skips URI validation	moderate	3.3.2			DOMPurify USE_PROFILES prototype pollution allows event handlers	moderate	3.3.2			DOMPurify is vulnerable to mutation-XSS via Re-Contextualization	moderate	3.3.2			DOMPurify allows Cross-site Scripting (XSS)	moderate	3.2.4			DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects	low	N/A			DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output	low	3.4.9	Package	Version	Score	Details	actions/City-of-Helsinki/.github/.github/workflows/ci-pnpm-node.yml	feature/KEH-351-dependency-review-ci	Unknown	Unknown	npm/dompurify	2.3.10	🟢 9.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 30 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10 Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 7 badge detected: Silver SAST 🟢 10 SAST tool is run on all commits License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 10 signed artifacts. Vulnerabilities 🟢 10 0 existing vulnerabilities detected Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 40 contributing companies or organizations	npm/react-router	7.18.0	🟢 3.6	Details Check Score Reason Code-Review ⚠️ 1 Found 5/29 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

[azure-pipelines]

LINKEDCOMPONENTS-UI branch is deployed to platta: https://linkedcomponents-ui-pr616.dev.hel.ninja 🚀🚀🚀

[azure-pipelines]

e2e tests result is failed for https://linkedcomponents-ui-pr616.dev.hel.ninja 😿💢💥💥