Skip to content

Remove malicious postcss payload; Node 26, pnpm 12, deps #2023

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kylemh merged 15 commits into from
Oct 22, 2026
Merged

Remove malicious postcss payload; Node 26, pnpm 12, deps #2023

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
3ab80d6
pin Node to 26.12.1
kylemh Oct 22, 2026
271d6fe
bump pnpm to 12.15.0
kylemh Oct 22, 2026
3db1390
bump GitHub Actions to latest majors
kylemh Oct 22, 2026
5b2e042
update deps within existing semver ranges
kylemh Oct 22, 2026
94a63e8
apply prettier 3.9 formatting
kylemh Oct 22, 2026
a926779
update SVG snapshots for vite-plugin-magical-svg 1.10
kylemh Oct 22, 2026
00845f2
bump @types/node 26, chromatic 18, dotenv 18; drop stub types
kylemh Oct 22, 2026
50bd100
bump vitest 5, jsdom 30, jest-dom 7
kylemh Oct 22, 2026
2a38dd3
bump @sentry/nextjs to 11
kylemh Oct 22, 2026
e1da25a
bump ESLint plugin majors (eslint-react 5, unicorn 78, etc)
kylemh Oct 22, 2026
3b5fbf7
remove unused @eslint-react/purity disable directive
kylemh Oct 22, 2026
d6bb756
bump pinned Radix and lint-staged; drop stub airtable types
kylemh Oct 22, 2026
dc63fd4
override webpack-dev-middleware to patch path traversal
kylemh Oct 22, 2026
7ee45f4
remove malicious payload; lint root config files
kylemh Oct 22, 2026
734998f
lint the whole repo in CI, not just src
kylemh Oct 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/chromatic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,15 @@ jobs:

steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@v7
with:
fetch-depth: 0

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6

- name: Setup Node
uses: actions/setup-node@v5
uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "pnpm"
Expand Down
28 changes: 14 additions & 14 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,15 +11,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@v7

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
run_install: false

- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "pnpm"
Expand All @@ -34,15 +34,15 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@v7

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
run_install: false

- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "pnpm"
Expand All @@ -55,7 +55,7 @@ jobs:

- name: Upload coverage artifact
if: github.event_name == 'pull_request'
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: vitest-coverage
path: vitest-coverage
Expand All @@ -68,15 +68,15 @@ jobs:
pull-requests: write
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@v7

- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@v6
with:
run_install: false

- name: Install Node.js
uses: actions/setup-node@v4
uses: actions/setup-node@v7
with:
node-version-file: ".nvmrc"
cache: "pnpm"
Expand All @@ -94,15 +94,15 @@ jobs:

- name: Upload Playwright report
if: failure()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@v7
with:
name: playwright-report
path: playwright-report/
retention-days: 30

- name: Comment PR with Playwright artifact link
if: always() && github.event_name == 'pull_request'
uses: actions/github-script@v7
uses: actions/github-script@v9
with:
script: |
const runId = context.runId;
Expand Down Expand Up @@ -171,10 +171,10 @@ jobs:
permissions:
pull-requests: write
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7

- name: Download Coverage Artifact
uses: actions/download-artifact@v4
uses: actions/download-artifact@v8
with:
name: vitest-coverage
path: vitest-coverage
Expand Down
2 changes: 1 addition & 1 deletion .nvmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
24
26.12.1
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ Our entire UI library is documented via [![Storybook](https://github.com/storybo
Required versions of tools used within the repo:

- Node: See [.nvmrc](https://github.com/OperationCode/front-end/blob/main/.nvmrc)
- `pnpm@10`
- `pnpm@12`
- `git@2.17.1` or greater

```sh
Expand Down
8 changes: 4 additions & 4 deletions eslint.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,15 +16,16 @@
import reactYouMightNotNeedAnEffect from 'eslint-plugin-react-you-might-not-need-an-effect';
import eslintPluginStorybook from 'eslint-plugin-storybook';


const compat = new FlatCompat({
baseDirectory: import.meta.dirname,
});

/** @type {import("eslint").Linter.Config['languageOptions']} */
const languageOptions = {
parserOptions: {
projectService: true,
projectService: {
allowDefaultProject: ['*.config.js', '*.config.mjs'],
},
tsconfigRootDir: import.meta.dirname,
},
ecmaVersion: 'latest',
Expand All @@ -46,13 +47,12 @@
'public/**',
'src/.storybook/**',
'*.svg',
'prettier.config.js',
]),

// ── Base configs ──
eslint.configs.recommended,
...tseslint.configs.strict,

Check warning on line 54 in eslint.config.mjs

View workflow job for this annotation

GitHub Actions / lint 

Caution: `tseslint` also has a named export `configs`. Check if you meant to write `import {configs} from 'typescript-eslint'` instead
...tseslint.configs.stylistic,

Check warning on line 55 in eslint.config.mjs

View workflow job for this annotation

GitHub Actions / lint 

Caution: `tseslint` also has a named export `configs`. Check if you meant to write `import {configs} from 'typescript-eslint'` instead
{ languageOptions },

// ── Next.js (via FlatCompat — @next/eslint-plugin-next doesn't export flat configs yet) ──
Expand Down Expand Up @@ -118,8 +118,8 @@
},

// ── Import-X (replaces eslint-plugin-import) ──
eslintPluginImportX.flatConfigs.recommended,

Check warning on line 121 in eslint.config.mjs

View workflow job for this annotation

GitHub Actions / lint 

Caution: `eslintPluginImportX` also has a named export `flatConfigs`. Check if you meant to write `import {flatConfigs} from 'eslint-plugin-import-x'` instead
eslintPluginImportX.flatConfigs.typescript,

Check warning on line 122 in eslint.config.mjs

View workflow job for this annotation

GitHub Actions / lint 

Caution: `eslintPluginImportX` also has a named export `flatConfigs`. Check if you meant to write `import {flatConfigs} from 'eslint-plugin-import-x'` instead
{
files: ['**/*.{ts,tsx,js,jsx}'],
rules: {
Expand Down Expand Up @@ -197,7 +197,7 @@
},

// ── No Barrel Files ──
noBarrelFiles.flat,
...noBarrelFiles.configs['flat/recommended'],

// ── CommonJS files ──
{
Expand Down Expand Up @@ -415,7 +415,7 @@
},

// ── Storybook stories ──
...eslintPluginStorybook.configs['flat/recommended'],

Check warning on line 418 in eslint.config.mjs

View workflow job for this annotation

GitHub Actions / lint 

Caution: `eslintPluginStorybook` also has a named export `configs`. Check if you meant to write `import {configs} from 'eslint-plugin-storybook'` instead

// ── Prettier (must be last) ──
eslintPluginPrettierRecommended,
Expand Down
2 changes: 1 addition & 1 deletion next.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import type { NextConfig } from 'next';
import { withSentryConfig } from '@sentry/nextjs';
import { withSentryConfig } from '@sentry/nextjs/config';
import bundleAnalyzer from '@next/bundle-analyzer';
import createMDX from '@next/mdx';
import { svgoConfig } from './src/lib/config/svgo';
Expand Down
128 changes: 63 additions & 65 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"format": "prettier --write \"**/*\"",
"format:md": "prettier --write \"**/*.md\"",
"lint": "pnpm lint:scripts && pnpm format:md",
"lint:ci": "eslint src",
"lint:ci": "eslint .",
"lint:scripts": "eslint --fix src",
"postbuild": "next-sitemap --config next-sitemap.config.ts",
"prepare": "husky",
Expand All @@ -34,99 +34,97 @@
"vitest": "cross-env vitest --config ./vitest.config.mts"
},
"dependencies": {
"@base-ui/react": "^1.6.0",
"@hookform/resolvers": "^5.4.3",
"@base-ui/react": "^1.9.0",
"@hookform/resolvers": "^5.9.2",
"@mdx-js/loader": "^3.1.1",
"@mdx-js/react": "^3.1.1",
"@next/bundle-analyzer": "^16.2.11",
"@next/mdx": "^16.2.11",
"@radix-ui/react-dialog": "1.1.23",
"@radix-ui/react-tabs": "1.1.21",
"@sentry/nextjs": "^10.68.0",
"@types/airtable": "^0.10.5",
"@next/bundle-analyzer": "^16.4.2",
"@next/mdx": "^16.4.2",
"@radix-ui/react-dialog": "1.3.1",
"@radix-ui/react-tabs": "1.2.1",
"@sentry/nextjs": "^11.8.0",
"@types/mdx": "^2.0.14",
"airtable": "^0.12.2",
"axios": "^1.18.1",
"axios": "^1.20.0",
"cva": "1.0.0-beta.8",
"fast-xml-parser": "^5.10.1",
"fast-xml-parser": "^5.11.2",
"fingerprintjs2": "^2.1.4",
"fontfaceobserver": "^2.3.0",
"lodash": "^4.18.1",
"logrocket": "^12.1.1",
"logrocket": "^12.4.0",
"logrocket-react": "^7.0.1",
"lucide-react": "^1.26.0",
"next": "^16.3.3",
"lucide-react": "^1.59.0",
"next": "^16.4.2",
"next-sitemap": "^4.2.3",
"object-hash": "^3.0.0",
"react": "^19.2.8",
"react-dom": "^19.2.8",
"react-hook-form": "^7.83.0",
"react": "^19.3.1",
"react-dom": "^19.3.1",
"react-hook-form": "^7.90.0",
"react-player": "^3.4.0",
"react-select": "^5.10.2",
"remark-gfm": "^4.0.1",
"tailwind-merge": "^3.6.0",
"tailwind-merge": "^3.7.0",
"tw-animate-css": "^1.4.0",
"zod": "^4.4.3"
"zod": "^4.6.7"
},
"devDependencies": {
"@eslint-react/eslint-plugin": "^4.2.3",
"@eslint/eslintrc": "^3.3.5",
"@eslint-react/eslint-plugin": "^5.28.1",
"@eslint/eslintrc": "^3.3.7",
"@eslint/js": "^10.0.1",
"@faker-js/faker": "^10.4.0",
"@next/eslint-plugin-next": "^16.2.6",
"@playwright/test": "^1.59.1",
"@storybook/addon-docs": "^10.3.6",
"@storybook/nextjs": "^10.3.6",
"@faker-js/faker": "^10.6.0",
"@next/eslint-plugin-next": "^16.4.2",
"@playwright/test": "^1.64.1",
"@storybook/addon-docs": "^10.6.2",
"@storybook/nextjs": "^10.6.2",
"@svgr/webpack": "^8.1.0",
"@tailwindcss/postcss": "^4.3.0",
"@testing-library/jest-dom": "^6.9.1",
"@testing-library/react": "^16.3.2",
"@types/fingerprintjs2": "2",
"@tailwindcss/postcss": "^4.3.3",
"@testing-library/jest-dom": "^7.0.1",
"@testing-library/react": "^16.3.3",
"@types/fingerprintjs2": "^2.0.0",
"@types/fontfaceobserver": "^2.1.3",
"@types/lodash": "^4.17.24",
"@types/logrocket-react": "^3.0.3",
"@types/node": "^24.9.1",
"@types/object-hash": "^3.0.0",
"@types/react": "^19.2.14",
"@types/react-dom": "^19.2.3",
"@vitejs/plugin-react": "^6.0.1",
"@vitest/coverage-v8": "^4.1.5",
"@vitest/eslint-plugin": "^1.6.17",
"@vitest/ui": "^4.1.5",
"@types/lodash": "^4.17.26",
"@types/node": "^26.6.5",
"@types/object-hash": "^3.0.6",
"@types/react": "^19.3.0",
"@types/react-dom": "^19.3.0",
"@vitejs/plugin-react": "^6.1.2",
"@vitest/coverage-v8": "^5.0.5",
"@vitest/eslint-plugin": "^1.6.27",
"@vitest/ui": "^5.0.5",
"axios-mock-adapter": "^2.1.0",
"babel-plugin-react-compiler": "^1.0.0",
"chromatic": "^16.9.1",
"chromatic": "^18.13.0",
"cross-env": "^10.1.0",
"dotenv": "^17.4.2",
"eslint": "^10.3.0",
"dotenv": "^18.0.8",
"eslint": "^10.13.0",
"eslint-config-prettier": "^10.1.8",
"eslint-import-resolver-typescript": "^4.4.4",
"eslint-plugin-better-tailwindcss": "^4.5.0",
"eslint-plugin-import-x": "^4.16.2",
"eslint-plugin-lodash": "^8.0.0",
"eslint-plugin-no-barrel-files": "^1.3.1",
"eslint-plugin-playwright": "^2.10.2",
"eslint-plugin-prettier": "^5.5.5",
"eslint-import-resolver-typescript": "^4.4.5",
"eslint-plugin-better-tailwindcss": "^4.9.1",
"eslint-plugin-import-x": "^4.17.1",
"eslint-plugin-lodash": "^8.1.0",
"eslint-plugin-no-barrel-files": "^2.2.0",
"eslint-plugin-playwright": "^2.12.1",
"eslint-plugin-prettier": "^5.5.7",
"eslint-plugin-react-hooks": "^7.1.1",
"eslint-plugin-react-you-might-not-need-an-effect": "^0.10.1",
"eslint-plugin-storybook": "^10.3.6",
"eslint-plugin-unicorn": "^64.0.0",
"eslint-plugin-react-you-might-not-need-an-effect": "^1.0.2",
"eslint-plugin-storybook": "^10.6.2",
"eslint-plugin-unicorn": "^78.0.0",
"husky": "^9.1.7",
"jsdom": "^29.1.1",
"lint-staged": "17.0.4",
"jsdom": "^30.1.3",
"lint-staged": "17.6.0",
"postcss": "^8.5.14",
"prettier": "^3.8.3",
"prettier-plugin-tailwindcss": "^0.8.0",
"shadcn": "^4.7.0",
"storybook": "^10.3.6",
"tailwindcss": "^4.3.0",
"prettier": "^3.9.10",
"prettier-plugin-tailwindcss": "^0.8.1",
"shadcn": "^4.22.1",
"storybook": "^10.6.2",
"tailwindcss": "^4.3.3",
"typescript": "^6.0.3",
"typescript-eslint": "^8.59.2",
"typescript-eslint": "^8.71.2",
"vite": "^8.0.12",
"vite-plugin-magical-svg": "^1.9.0",
"vite-plugin-magical-svg": "^1.10.3",
"vite-tsconfig-paths": "^6.1.1",
"vitest": "^4.1.5",
"webpack": "^5.106.2"
"vitest": "^5.0.5",
"webpack": "^5.112.0"
},
"packageManager": "pnpm@11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f"
"packageManager": "pnpm@12.15.0+sha512.b3951d6d6ff4a9f13dc7cf56cd28d2b8eb37dbcc9c68e52e1e1191873ea9f82a017287ab50baadc5ccc494f036c67c0e47eb13608c2fa36f47711b61ea128e61"
}
Loading
Loading