Merge pull request #193 from bcgov/AI-1392

AI-1392 Security and Vulnerability Round Up - June 2026

Author: dbarkowsky

apps/backend-services/package.json

@@ -53,7 +53,7 @@
 		"@prisma/client": "7.2.0",
 		"@temporalio/client": "1.10.0",
 		"ajv": "8.18.0",
-		"axios": "1.15.0",
+		"axios": "1.17.0",
 		"bcrypt": "6.0.0",
 		"body-parser": "1.20.3",
 		"class-transformer": "0.5.1",
@@ -71,6 +71,7 @@
 		"pg": "8.16.3",
 		"prisma": "7.2.0",
 		"prom-client": "15.1.3",
+		"reflect-metadata": "0.2.2",
 		"rxjs": "7.8.2",
 		"sharp": "0.34.5",
 		"uuid": "13.0.0",
@@ -81,7 +82,7 @@
 		"@nestjs/cli": "11.0.21",
 		"@nestjs/schematics": "11.1.0",
 		"@nestjs/testing": "11.1.19",
-		"@swc/cli": "0.7.9",
+		"@swc/cli": "0.8.1",
 		"@swc/core": "1.15.3",
 		"@testcontainers/postgresql": "11.10.0",
 		"@types/bcrypt": "6.0.0",
@@ -102,7 +103,7 @@
 		"ts-jest": "29.4.5",
 		"ts-node": "10.9.2",
 		"tsconfig-paths": "4.2.0",
-		"tsx": "4.20.6",
+		"tsx": "4.22.4",
 		"typescript": "5.9.3"
 	},
 	"engines": {

apps/backend-services/src/benchmark/dataset.service.ts

@@ -414,14 +414,14 @@ export class DatasetService {
     _actorId: string, // TODO: Why isn't this used?
     groupId: string,
   ): Promise<UploadResponseDto> {
-    this.logger.log(
-      `Uploading ${files.length} files to dataset ${datasetId}, version ${versionId}`,
-    );
-
     if (!Array.isArray(files)) {
       throw new BadRequestException("Invalid files payload");
     }
 
+    this.logger.log(
+      `Uploading ${files.length} files to dataset ${datasetId}, version ${versionId}`,
+    );
+
     const dataset = await this.datasetDbService.findDataset(datasetId);
 
     if (!dataset) {

apps/ches-adapter/package.json

@@ -27,7 +27,7 @@
 		"@types/node": "22.15.17",
 		"jest": "30.2.0",
 		"ts-jest": "29.4.5",
-		"tsx": "4.20.6",
+		"tsx": "4.22.4",
 		"typescript": "5.9.3"
 	},
 	"jest": {

apps/frontend/package.json

@@ -33,7 +33,7 @@
 		"@tanstack/react-query": "5.90.10",
 		"@uiw/react-codemirror": "4.25.4",
 		"@xyflow/react": "12.10.0",
-		"axios": "1.15.0",
+		"axios": "1.17.0",
 		"dagre-esm": "0.8.5",
 		"dayjs": "1.11.20",
 		"konva": "10.2.0",
@@ -42,24 +42,25 @@
 		"react": "19.2.1",
 		"react-dom": "19.2.1",
 		"react-konva": "19.2.1",
-		"react-router-dom": "7.14.0",
+		"react-router-dom": "7.17.0",
 		"recharts": "3.7.0",
 		"zod": "3.25.76"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.4.8",
+		"@testing-library/dom": "10.4.1",
 		"@testing-library/jest-dom": "6.9.1",
 		"@testing-library/react": "16.3.2",
 		"@types/dagre": "0.7.53",
 		"@types/react": "19.2.7",
 		"@types/react-dom": "19.2.3",
-		"@vitejs/plugin-react": "5.1.2",
-		"jsdom": "26.1.0",
+		"@vitejs/plugin-react": "5.2.0",
+		"jsdom": "29.1.1",
 		"postcss": "8.5.6",
 		"postcss-preset-mantine": "1.18.0",
 		"postcss-simple-vars": "7.0.1",
 		"typescript": "5.9.3",
-		"vite": "7.3.2",
-		"vitest": "4.0.18"
+		"vite": "7.3.5",
+		"vitest": "4.1.8"
 	}
 }

apps/temporal/package.json

@@ -41,11 +41,13 @@
 		"@temporalio/client": "1.10.0",
 		"@temporalio/worker": "1.10.0",
 		"@temporalio/workflow": "1.10.0",
-		"axios": "1.15.0",
+		"axios": "1.17.0",
 		"csv": "6.5.1",
 		"dictionary-en": "4.0.0",
 		"dotenv": "17.2.3",
-		"fast-xml-parser": "5.5.8",
+		"fast-xml-builder": "1.2.0",
+		"fast-xml-parser": "5.8.0",
+		"fast-xml-validator": "1.1.0",
 		"json-rules-engine": "4.0.0",
 		"mupdf": "1.27.0",
 		"nspell": "2.1.5",
@@ -56,7 +58,7 @@
 	"devDependencies": {
 		"@biomejs/biome": "2.4.8",
 		"@temporalio/testing": "1.10.0",
-		"@types/axios-mock-adapter": "1.9.0",
+		"@types/axios-mock-adapter": "1.10.4",
 		"@types/jest": "29.5.12",
 		"@types/node": "20.10.0",
 		"axios-mock-adapter": "2.1.0",
@@ -83,6 +85,8 @@
 		"moduleNameMapper": {
 			"^@generated/(.*)$": "<rootDir>/generated/$1"
 		},
-		"setupFilesAfterEnv": ["<rootDir>/jest-teardown.ts"]
+		"setupFilesAfterEnv": [
+			"<rootDir>/jest-teardown.ts"
+		]
 	}
 }

apps/temporal/src/activities/data-transform/execute.ts

@@ -1,6 +1,6 @@
 import { ApplicationFailure } from "@temporalio/activity";
 import { parse as parseCsv } from "csv/sync";
-import { XMLValidator } from "fast-xml-parser";
+import { SyntaxValidator } from "fast-xml-validator";
 import { BindingResolutionError, resolveBindings } from "./binding-resolver";
 import { renderCsv } from "./csv-renderer";
 import type { InputFormat } from "./input-parser";
@@ -20,6 +20,7 @@ const KNOWN_PARAM_KEYS = new Set([
   "fieldMapping",
   "xmlEnvelope",
   "requestId",
+  "groupId",
 ]);
 
 /**
@@ -45,6 +46,8 @@ export interface ExecuteTransformNodeParams {
   xmlEnvelope?: string;
   /** Optional request correlation ID (injected by the workflow runner). */
   requestId?: string;
+  /** Tenant scope (injected by the workflow runner; not a port-binding input). */
+  groupId?: string | number;
   /** Port-binding inputs from the workflow context (any additional keys). */
   [key: string]: unknown;
 }
@@ -131,21 +134,30 @@ export async function executeTransformNode(
 
   // Step 4: Render the resolved mapping to the configured output format.
   let output: string;
-  switch (outputFormat) {
-    case "json":
-      output = renderJson(resolvedMapping);
-      break;
-    case "xml": {
-      const innerXml = renderXml(
-        resolvedMapping,
-        xmlEnvelope ? null : undefined,
-      );
-      output = injectXmlEnvelope(innerXml, xmlEnvelope);
-      break;
+  try {
+    switch (outputFormat) {
+      case "json":
+        output = renderJson(resolvedMapping);
+        break;
+      case "xml": {
+        const innerXml = renderXml(
+          resolvedMapping,
+          xmlEnvelope ? null : undefined,
+        );
+        output = injectXmlEnvelope(innerXml, xmlEnvelope);
+        break;
+      }
+      case "csv":
+        output = renderCsv(resolvedMapping);
+        break;
     }
-    case "csv":
-      output = renderCsv(resolvedMapping);
-      break;
+  } catch (err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    throw ApplicationFailure.create({
+      type: "TRANSFORM_OUTPUT_ERROR",
+      message: `Rendered ${outputFormat} output failed validation: ${detail}`,
+      nonRetryable: true,
+    });
   }
 
   // Step 5: Post-render output validation.
@@ -159,9 +171,9 @@ export async function executeTransformNode(
         JSON.parse(output);
         break;
       case "xml": {
-        const result = XMLValidator.validate(output);
+        const result = SyntaxValidator.validate(output);
         if (result !== true) {
-          throw new Error(result.err.msg);
+          throw new Error((result as { err: { msg: string } }).err.msg);
         }
         break;
       }

apps/temporal/src/activities/data-transform/input-parser.ts

@@ -1,5 +1,6 @@
 import { parse as parseCsv } from "csv/sync";
-import { XMLParser, XMLValidator } from "fast-xml-parser";
+import { XMLParser } from "fast-xml-parser";
+import { SyntaxValidator } from "fast-xml-validator";
 
 /** Supported input formats for the data transform node. */
 export type InputFormat = "json" | "xml" | "csv";
@@ -78,9 +79,15 @@ function parseJson(input: string): Record<string, unknown> | unknown[] {
  * @throws {InputParseError} If the string is not valid XML.
  */
 function parseXml(input: string): Record<string, unknown> {
-  const validation = XMLValidator.validate(input);
-  if (validation !== true) {
-    throw new InputParseError("xml", validation.err.msg);
+  try {
+    const validation = SyntaxValidator.validate(input);
+    if (validation !== true) {
+      throw new InputParseError("xml", validation.err.msg);
+    }
+  } catch (err) {
+    if (err instanceof InputParseError) throw err;
+    const detail = err instanceof Error ? err.message : String(err);
+    throw new InputParseError("xml", detail);
   }
 
   const parser = new XMLParser({

apps/temporal/src/activities/data-transform/xml-renderer.ts

@@ -1,4 +1,4 @@
-import { XMLBuilder } from "fast-xml-parser";
+import Builder from "fast-xml-builder";
 import { IterationResult } from "./binding-resolver";
 
 /** Regex pattern for valid XML element names. */
@@ -136,7 +136,7 @@ export function renderXml(
   validateElementNames(preprocessed);
 
   try {
-    const builder = new XMLBuilder({ format: false });
+    const builder = new Builder({ format: false });
     return rootElement === null
       ? builder.build(preprocessed)
       : builder.build({ [rootElement]: preprocessed });

apps/temporal/src/graph-engine/node-executors-transform.test.ts

@@ -153,4 +153,20 @@ describe("executeTransformNode activity — successful execution", () => {
 
     expect(result.output).toBe(JSON.stringify({ name: "Alice" }));
   });
+
+  it("ignores system-injected groupId and does not attempt to parse it as input", async () => {
+    // groupId is injected by the graph runner for tenant scoping and must
+    // never be treated as a port-binding input, even for XML inputFormat.
+    const params: ExecuteTransformNodeParams = {
+      inputFormat: "xml",
+      outputFormat: "json",
+      fieldMapping: JSON.stringify({ orderId: "{{src.Order.OrderId}}" }),
+      src: "<Order><OrderId>ORD-001</OrderId></Order>",
+      groupId: "customer-group-123",
+    };
+
+    const result = await executeTransformNode(params);
+
+    expect(result.output).toBe(JSON.stringify({ orderId: "ORD-001" }));
+  });
 });

apps/temporal/src/graph-workflow.test.ts

@@ -275,7 +275,7 @@ describe("Graph Workflow", () => {
 
       expect(result.ctx.documentId).toBe("override-123");
       expect(result.status).toBe("completed");
-    });
+    }, 15000);
 
     it("executes a linear 3-node graph (A -> B -> C)", async () => {
       const graph = makeLinearGraph();