Fix CVEs issues in release/4.11.x branch (#9190)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: GytisCepk

common/changes/@itwin/ecschema-editing/gytis-fix-cves-in-4-x_2026-04-10-15-27.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@itwin/ecschema-editing",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@itwin/ecschema-editing"
+}

common/changes/@itwin/ecschema-locaters/gytis-fix-cves-in-4-x_2026-04-10-15-27.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@itwin/ecschema-locaters",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@itwin/ecschema-locaters"
+}

common/changes/@itwin/ecschema-metadata/gytis-fix-cves-in-4-x_2026-04-10-15-27.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@itwin/ecschema-metadata",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@itwin/ecschema-metadata"
+}

common/changes/@itwin/ecschema2ts/gytis-fix-cves-in-4-x_2026-04-10-15-27.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@itwin/ecschema2ts",
+      "comment": "",
+      "type": "none"
+    }
+  ],
+  "packageName": "@itwin/ecschema2ts"
+}

common/config/eslint/eslint.config.base.js

@@ -23,4 +23,11 @@ module.exports = [
       "@typescript-eslint/no-non-null-assertion": "off"
     }
   },
+  {
+    files: ["**/*.ts"],
+    rules: {
+      "@typescript-eslint/await-thenable": "warn",
+      "@typescript-eslint/no-deprecated": "warn",
+    }
+  },
 ]

common/config/rush/pnpm-config.json

@@ -3,7 +3,11 @@
   "useWorkspaces": true,
   "strictPeerDependencies": false,
   "globalPeerDependencyRules": {
-    "ignoreMissing": ["@babel/core", "@types/node", "@typescript-eslint/parser"]
+    "ignoreMissing": [
+      "@babel/core",
+      "@types/node",
+      "@typescript-eslint/parser"
+    ]
   },
   "globalOverrides": {
     "cross-spawn": "^7.0.5", // https://github.com/advisories/GHSA-3xgq-45jj-v275 npm-run-all>cross-spawn
@@ -20,7 +24,9 @@
     "axios": "^1.13.5", // https://github.com/advisories/GHSA-43fc-jf86-j433
     "serialize-javascript": "^7.0.3", // https://github.com/advisories/GHSA-5c6j-r48x-rmvq mocha>serialize-javascript (related to CVE-2020-7660)
     "sequelize": ">=6.37.8", // https://github.com/advisories/GHSA-6457-6jrx-69cr azurite>sequelize
-    "underscore": ">=1.13.8" // https://github.com/advisories/GHSA-qpx9-hpmf-5gmw json-schema-faker>jsonpath>underscore
+    "underscore": ">=1.13.8", // https://github.com/advisories/GHSA-qpx9-hpmf-5gmw json-schema-faker>jsonpath>underscore
+    "path-to-regexp@<0.1.13": "~0.1.13", // https://github.com/advisories/GHSA-37ch-88jc-xwx2 express>path-to-regexp
+    "lodash": ">=4.18.0" // https://github.com/advisories/GHSA-r5fr-rjxr-66jc lodash _.template code injection
   },
   // A list of temporary advisories excluded from the High and Critical list.
   // Warning this should only be used as a temporary measure to avoid build failures
@@ -37,7 +43,12 @@
           "CVE-2025-58754", // https://github.com/advisories/GHSA-4hjh-wcwx-xvwj azurite>@azure/ms-rest-js>axios
           "CVE-2026-26996", // https://github.com/advisories/GHSA-3ppc-4f35-3m26 mocha>glob>minimatch
           "CVE-2025-59288", // https://github.com/advisories/GHSA-7mvr-c777-76hp @itwin/oidc-signin-tool>@playwright/test>playwright (playwright is dev only dep, requires active MitM to exploit)
-          "CVE-2026-1615" // https://github.com/advisories/GHSA-87r5-mp6g-5w5j presentation/common>json-schema-faker>jsonpath
+          "CVE-2026-1615", // https://github.com/advisories/GHSA-87r5-mp6g-5w5j presentation/common>json-schema-faker>jsonpath
+          // Fixes for following CVEs only available in newer Electron versions which are not supported by iTwin.js 4.x. Non of the CVEs should be exploitable in library itself.
+          "CVE-2026-34774", // https://github.com/advisories/GHSA-532v-xpq5-8h95 electron (offscreen child window UAF, not used)
+          "CVE-2026-34771", // https://github.com/advisories/GHSA-8337-3p73-46f4 electron (fullscreen/pointer-lock/keyboard-lock permission UAF, not used)
+          "CVE-2026-34770", // https://github.com/advisories/GHSA-jjp3-mq3x-295m electron (PowerMonitor UAF, not used)
+          "CVE-2026-34769" // https://github.com/advisories/GHSA-9wfr-w7mm-pc7f electron (commandLineSwitches injection, webPreferences are hardcoded)
         ]
       }
     }