chore(web): upgrade dependencies [security] (#98)

Author: airslice

.github/workflows/build_web.yml

@@ -34,9 +34,11 @@ jobs:
         with:
           node-version: lts/*
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: Enable Corepack
+        run: corepack enable
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
       - uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
@@ -45,7 +47,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
       - name: Install
-        run: yarn install
+        run: yarn install --immutable
       - name: Build
         run: yarn build
       - name: Pack

.github/workflows/ci_web.yml

@@ -13,9 +13,11 @@ jobs:
       - uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: lts/*
+      - name: Enable Corepack
+        run: corepack enable
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
       - uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
@@ -24,7 +26,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
       - name: Install
-        run: yarn install
+        run: yarn install --immutable
       - name: type
         run: yarn run type
       - name: eslint

.github/workflows/e2e.yml

@@ -17,9 +17,11 @@ jobs:
         with:
           node-version: lts/*
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: Enable Corepack
+        run: corepack enable
       - name: Get yarn cache directory path
         id: yarn-cache-dir-path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
       - uses: actions/cache@2f8e54208210a422b2efd51efaa6bd6d7ca8920f # v3.4.3
         id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
         with:
@@ -28,7 +30,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-yarn-
       - name: install
-        run: yarn install
+        run: yarn install --immutable
       - name: install playwright dependencies
         run: yarn run playwright install
       - name: E2E test

web/.yarn/install-state.gz

@@ -0,0 +1 @@
+nodeLinker: node-modules

web/.yarnrc.yml

@@ -0,0 +1,56 @@
+#!/usr/bin/env sh
+set -eu
+
+# Find nearest ancestor yarn.lock
+find_up() {
+  name="$1"; d="$PWD"
+  while [ "$d" != "/" ]; do
+    [ -f "$d/$name" ] && { printf '%s/%s\n' "$d" "$name"; return 0; }
+    d=$(dirname "$d")
+  done
+  return 1
+}
+
+LOCKFILE="${1:-$(find_up yarn.lock || true)}"
+[ -n "${LOCKFILE:-}" ] && [ -f "$LOCKFILE" ] || { echo "❌ yarn.lock not found"; exit 3; }
+
+echo "Scanning: $LOCKFILE"
+
+FOUND=0
+
+# Read banned list WITHOUT using a pipe (avoids subshell)
+while IFS=' ' read -r name ver; do
+  [ -z "${name:-}" ] && continue
+  pat="resolution: \"${name}@npm:${ver}\""
+  if grep -qF "$pat" "$LOCKFILE"; then
+    FOUND=$((FOUND+1))
+    # show where it matched for debugging
+    grep -nF "$pat" "$LOCKFILE"
+  fi
+done <<'EOF'
+ansi-styles 6.2.2
+debug 4.4.2
+chalk 5.6.1
+supports-color 10.2.1
+strip-ansi 7.1.1
+ansi-regex 6.2.1
+wrap-ansi 9.0.1
+color-convert 3.1.1
+color-name 2.0.1
+is-arrayish 0.3.3
+slice-ansi 7.1.1
+color 5.0.1
+color-string 2.1.1
+simple-swizzle 0.2.3
+supports-hyperlinks 4.1.1
+has-ansi 6.0.1
+chalk-template 1.1.1
+backslash 0.2.1
+EOF
+
+if [ "$FOUND" -gt 0 ]; then
+  echo "❌ Detected $FOUND banned resolution(s) in $LOCKFILE"
+  exit 1
+else
+  echo "✅ No banned resolutions found in $LOCKFILE"
+fi

web/bin/scan-yarn-lock.sh

@@ -6,6 +6,11 @@
     "license": "Apache-2.0",
     "type": "module",
     "private": true,
+    "resolutions": {
+        "@apollo/client": "3.8.1",
+        "@zip.js/zip.js": "2.7.48",
+        "@cesium/engine": "9.0.0"
+    },
     "scripts": {
         "start": "yarn && vite",
         "test": "vitest",
@@ -25,7 +30,8 @@
         "gql:beta": "graphql-codegen",
         "gql:classic": "graphql-codegen -c codegen-classic.ts",
         "i18n": "i18next",
-        "gen:doc:plugin": "ts-node -O '{\"module\":\"CommonJS\"}' ./bin/pluginDoc"
+        "gen:doc:plugin": "ts-node -O '{\"module\":\"CommonJS\"}' ./bin/pluginDoc",
+        "scan:lock": "sh ./bin/scan-yarn-lock.sh"
     },
     "engines": {
         "node": ">=20.11.0"
@@ -63,16 +69,16 @@
         "@types/js-md5": "0.7.1",
         "@types/lodash-es": "4.17.10",
         "@types/mapbox__vector-tile": "1.3.3",
-        "@types/node": "20.8.10",
-        "@types/react": "18.2.6",
-        "@types/react-dom": "18.2.4",
+        "@types/node": "22.13.14",
+        "@types/react": "18.3.12",
+        "@types/react-dom": "18.3.3",
         "@types/react-ga": "2.3.0",
         "@types/react-leaflet": "2.8.2",
         "@types/styled-components": "5.1.29",
         "@types/tinycolor2": "1.4.5",
         "@types/uuid": "9.0.6",
-        "@vitejs/plugin-react-swc": "3.5.0",
-        "@vitest/coverage-v8": "0.34.6",
+        "@vitejs/plugin-react-swc": "3.7.1",
+        "@vitest/coverage-v8": "1.6.1",
         "@welldone-software/why-did-you-render": "7.0.1",
         "del-cli": "5.1.0",
         "dotenv": "16.3.1",
@@ -81,31 +87,32 @@
         "eslint-plugin-playwright": "0.12.0",
         "eslint-plugin-storybook": "0.6.15",
         "husky": "8.0.3",
-        "i18next-parser": "8.9.0",
+        "i18next-parser": "9.3.0",
         "jsdom": "22.1.0",
         "lint-staged": "13.2.2",
         "npm-run-all": "4.1.5",
         "prettier": "2.8.8",
         "read-env": "2.0.0",
-        "rollup": "4.2.0",
-        "rollup-plugin-visualizer": "5.9.2",
+        "rollup": "4.22.4",
+        "rollup-plugin-visualizer": "6.0.3",
         "storybook": "7.5.2",
         "ts-node": "10.9.1",
         "type-fest": "4.6.0",
         "typescript": "5.0.4",
         "typescript-styled-plugin": "0.18.3",
-        "vite": "5.0.8",
-        "vite-plugin-cesium": "1.2.22",
-        "vite-plugin-svgr": "4.2.0",
-        "vite-tsconfig-paths": "4.2.1",
-        "vitest": "1.0.4",
+        "vite": "5.4.20",
+        "vite-plugin-cesium": "1.2.23",
+        "vite-plugin-svgr": "4.5.0",
+        "vite-tsconfig-paths": "5.1.4",
+        "vitest": "1.6.1",
         "web-streams-polyfill": "3.2.1"
     },
     "dependencies": {
         "@apollo/client": "3.8.1",
         "@auth0/auth0-react": "2.2.2",
         "@aws-amplify/ui-react": "5.3.1",
         "@carbon/colors": "11.20.1",
+        "@cesium/engine": "9.0.0",
         "@emotion/react": "11.11.1",
         "@emotion/styled": "11.11.0",
         "@floating-ui/react": "0.24.7",
@@ -114,22 +121,20 @@
         "@monaco-editor/react": "4.6.0",
         "@popperjs/core": "2.11.8",
         "@reearth/cesium-mvt-imagery-provider": "1.5.4",
-        "js-yaml": "4.1.0",
         "@reearth/core": "0.0.4",
         "@rot1024/use-transition": "1.0.0",
-        "@sentry/browser": "7.77.0",
+        "@sentry/browser": "7.119.1",
         "@seznam/compose-react-refs": "1.0.6",
         "@turf/turf": "6.5.0",
         "@types/d3": "7.4.3",
         "@types/escape-string-regexp": "2.0.1",
-        "@types/proj4": "^2.5.5",
         "@ungap/event-target": "0.2.4",
         "@xstate/react": "3.2.1",
         "apollo-link-sentry": "3.2.3",
         "apollo-upload-client": "17.0.0",
         "array-move": "4.0.0",
         "aws-amplify": "5.3.11",
-        "axios": "1.6.0",
+        "axios": "1.12.0",
         "cesium": "1.116.0",
         "cesium-dnd": "1.1.0",
         "cesium-mvt-imagery-provider": "1.4.0",
@@ -146,14 +151,15 @@
         "framer-motion": "10.18.0",
         "github-markdown-css": "5.4.0",
         "graphiql": "2.4.4",
-        "graphql": "16.6.0",
+        "graphql": "16.8.1",
         "i18next": "22.4.15",
         "i18next-browser-languagedetector": "7.0.1",
         "jotai": "1.12.1",
         "js-file-download": "0.4.12",
         "js-md5": "0.7.3",
+        "js-yaml": "4.1.0",
         "jsep": "1.3.8",
-        "jsonpath-plus": "7.2.0",
+        "jsonpath-plus": "10.3.0",
         "jszip": "3.10.1",
         "leaflet": "1.9.4",
         "lexical": "0.12.2",
@@ -164,18 +170,18 @@
         "moment-timezone": "0.5.43",
         "parse-domain": "7.0.1",
         "proj4": "2.11.0",
-        "protomaps": "^1.23.1",
+        "protomaps": "1.23.1",
         "quickjs-emscripten": "0.23.0",
         "quickjs-emscripten-sync": "1.5.2",
         "rc-slider": "9.7.5",
-        "react": "18.2.0",
+        "react": "18.3.1",
         "react-accessible-accordion": "5.0.0",
         "react-align": "2.2.2",
         "react-beautiful-dnd": "13.1.1",
         "react-colorful": "5.6.1",
         "react-dnd": "16.0.1",
         "react-dnd-html5-backend": "16.0.1",
-        "react-dom": "18.2.0",
+        "react-dom": "18.3.1",
         "react-dropzone": "14.2.3",
         "react-error-boundary": "4.0.11",
         "react-ga": "3.3.1",
@@ -193,13 +199,14 @@
         "react18-json-view": "0.2.7",
         "remark-gfm": "3.0.1",
         "resium": "1.17.3",
-        "suspend-react": "^0.1.3",
+        "suspend-react": "0.1.3",
         "tinycolor2": "1.6.0",
         "ts-easing": "0.2.0",
         "use-callback-ref": "1.3.0",
         "use-custom-compare": "1.4.0",
         "use-file-input": "1.0.0",
         "uuid": "9.0.1",
         "xstate": "4.38.2"
-    }
+    },
+    "packageManager": "yarn@4.10.2"
 }