Fix the E2E and security audit CI failures

.github/actions/run-e2e-suite/action.yml

@@ -266,12 +266,12 @@ runs:
     - name: 🚀 Start Sample Apps
       shell: bash
       run: |
-        ( cd tests/e2e/.samples/quickstarts/browser && pnpm exec vite --port 5173 & )
-        ( cd tests/e2e/.samples/quickstarts/react && pnpm exec vite --port 5174 & )
-        ( cd tests/e2e/.samples/quickstarts/vue && pnpm exec vite --port 5175 & )
-        ( cd tests/e2e/.samples/quickstarts/nextjs && pnpm exec next dev -p 3001 & )
-        ( cd tests/e2e/.samples/quickstarts/nuxt && pnpm exec nuxt dev --port 3002 & )
-        ( cd tests/e2e/.samples/quickstarts/express && pnpm exec node --env-file-if-exists=.env index.mjs & )
+        ( cd tests/e2e/.samples/quickstarts/browser && npx --no-install vite --port 5173 & )
+        ( cd tests/e2e/.samples/quickstarts/react && npx --no-install vite --port 5174 & )
+        ( cd tests/e2e/.samples/quickstarts/vue && npx --no-install vite --port 5175 & )
+        ( cd tests/e2e/.samples/quickstarts/nextjs && npx --no-install next dev -p 3001 & )
+        ( cd tests/e2e/.samples/quickstarts/nuxt && npx --no-install nuxt dev --port 3002 & )
+        ( cd tests/e2e/.samples/quickstarts/express && node --env-file-if-exists=.env index.mjs & )
         for url in http://localhost:5173 http://localhost:5174 http://localhost:5175 http://localhost:3000 http://localhost:3001 http://localhost:3002; do
           ready=0
           for i in $(seq 1 60); do

packages/nextjs/package.json

@@ -59,7 +59,7 @@
     "@thunderid/prettier-config": "catalog:",
     "@types/node": "catalog:",
     "eslint": "catalog:",
-    "next": "15.5.25",
+    "next": "15.5.28",
     "prettier": "catalog:",
     "react": "catalog:",
     "rimraf": "catalog:",

playgrounds/nextjs/package.json

@@ -18,7 +18,7 @@
     "@thunderid/browser": "workspace:*",
     "@thunderid/nextjs": "workspace:*",
     "@thunderid/react": "workspace:*",
-    "next": "15.5.25",
+    "next": "15.5.28",
     "react": "catalog:",
     "react-dom": "catalog:"
   },

pnpm-workspace.yaml

@@ -12,17 +12,6 @@ allowBuilds:
   unrs-resolver: true
 
 overrides:
-  # JUSTIFICATION: Fixes GHSA-v422-hmwv-36x6 — body-parser silently disables its size limit on an
-  # invalid `limit` value, allowing a DoS. Transitive via packages/express's `express`
-  # devDependency (express > body-parser). express's own body-parser range already permits
-  # 1.20.6; remove once a fresh install picks it up without the override.
-  body-parser: 1.20.6
-  # JUSTIFICATION: Fixes GHSA-x5fp-wj9c-mxmx (array-limit bypass via bracket-key comma parsing) /
-  # GHSA-4mjr-xmp4-gh2g (DoS via attacker-controlled isBuffer). Transitive via body-parser's own
-  # `qs: ~6.15.1` range, which caps at 6.15.3 — the patched 6.15.4 was never published upstream, so
-  # the fix line jumps straight to 6.16.0. Remove once body-parser bumps its own `qs` range past
-  # 6.16.0.
-  body-parser>qs: 6.16.0
   # JUSTIFICATION: Fixes GHSA-3jxr-9vmj-r5cp / GHSA-mh99-v99m-4gvg / GHSA-rgw5-rvv9-x895 —
   # brace-expansion DoS via exponential/unbounded expansion of `{}` groups — plus GHSA-qhr7-859c-m2p7
   # / GHSA-6j4f-fj2g-mc7p (2026-10-02), stack exhaustion via uncontrolled recursion on nested brace
@@ -168,7 +157,7 @@ catalog:
   buffer: 6.0.3
   core-js: 3.42.0
   cross-fetch: 4.1.0
-  dompurify: 3.4.13
+  dompurify: 3.4.17
   eslint: 9.39.4
   fast-sha256: 1.3.0
   jose: 6.2.3

tests/e2e/package.json

@@ -28,6 +28,6 @@
     "prettier": "catalog:",
     "rimraf": "catalog:",
     "typescript": "catalog:",
-    "undici": "^7.30.0"
+    "undici": "^7.30.1"
   }
 }

tests/e2e/run-e2e.sh

@@ -310,12 +310,12 @@ EOF
 
 start_sample_apps() {
     echo "Starting sample apps..."
-    ( cd "$SAMPLES_DIR/quickstarts/browser" && pnpm exec vite --port 5173 ) &
-    ( cd "$SAMPLES_DIR/quickstarts/react" && pnpm exec vite --port 5174 ) &
-    ( cd "$SAMPLES_DIR/quickstarts/vue" && pnpm exec vite --port 5175 ) &
-    ( cd "$SAMPLES_DIR/quickstarts/nextjs" && pnpm exec next dev -p 3001 ) &
-    ( cd "$SAMPLES_DIR/quickstarts/nuxt" && pnpm exec nuxt dev --port 3002 ) &
-    ( cd "$SAMPLES_DIR/quickstarts/express" && pnpm exec node --env-file-if-exists=.env index.mjs ) &
+    ( cd "$SAMPLES_DIR/quickstarts/browser" && npx --no-install vite --port 5173 ) &
+    ( cd "$SAMPLES_DIR/quickstarts/react" && npx --no-install vite --port 5174 ) &
+    ( cd "$SAMPLES_DIR/quickstarts/vue" && npx --no-install vite --port 5175 ) &
+    ( cd "$SAMPLES_DIR/quickstarts/nextjs" && npx --no-install next dev -p 3001 ) &
+    ( cd "$SAMPLES_DIR/quickstarts/nuxt" && npx --no-install nuxt dev --port 3002 ) &
+    ( cd "$SAMPLES_DIR/quickstarts/express" && node --env-file-if-exists=.env index.mjs ) &
 
     wait_for_url "http://localhost:5173" "quickstarts/browser"
     wait_for_url "http://localhost:5174" "quickstarts/react"

tests/e2e/scripts/prepare-samples.ts

@@ -8,8 +8,9 @@
  *
  * Each package under `packages/` is packed with `pnpm pack` (which is why `pnpm build` must run
  * first), and every `@thunderid/*` dependency in a quickstart, direct or transitive, is pinned to
- * the resulting tarball through a pnpm override. The quickstarts install exactly as an adopter's
- * app would, from packed tarballs, instead of linking into the workspace.
+ * the resulting tarball through an npm override. The quickstarts are npm projects and install
+ * with `npm install` exactly as an adopter's app would, from packed tarballs, instead of linking
+ * into the workspace.
  *
  * Environment:
  *   THUNDERID_SAMPLES_DIR   Use this local samples checkout instead of cloning (copied, never modified).
@@ -77,20 +78,22 @@ function packPackages(): Record<string, string> {
   return tarballs;
 }
 
-/** Adds an `overrides` entry per packed package to the quickstart's own pnpm-workspace.yaml. */
+/**
+ * Points every packed package at its tarball in the quickstart's package.json. npm rejects an
+ * override that conflicts with a direct dependency, so direct dependencies are rewritten too.
+ */
 function overrideWithTarballs(sampleDir: string, tarballs: Record<string, string>): void {
-  const workspaceFile = path.join(sampleDir, 'pnpm-workspace.yaml');
-  const lines = fs.existsSync(workspaceFile) ? fs.readFileSync(workspaceFile, 'utf8').split('\n') : [];
-  const entries = Object.entries(tarballs).map(([name, spec]) => `  '${name}': '${spec}'`);
-
-  const overridesAt = lines.findIndex((line) => line.trimEnd() === 'overrides:');
-  if (overridesAt === -1) {
-    lines.push('', 'overrides:', ...entries, '');
-  } else {
-    lines.splice(overridesAt + 1, 0, ...entries);
+  const manifestFile = path.join(sampleDir, 'package.json');
+  const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8')) as Record<string, Record<string, string>>;
+
+  manifest.overrides = {...manifest.overrides, ...tarballs};
+  for (const field of ['dependencies', 'devDependencies']) {
+    for (const name of Object.keys(manifest[field] ?? {})) {
+      if (tarballs[name]) manifest[field][name] = tarballs[name];
+    }
   }
 
-  fs.writeFileSync(workspaceFile, lines.join('\n'));
+  fs.writeFileSync(manifestFile, `${JSON.stringify(manifest, null, 2)}\n`);
 }
 
 const source = resolveSource();
@@ -112,7 +115,7 @@ try {
     overrideWithTarballs(to, tarballs);
     console.log(`Installing quickstarts/${name} against the local SDK packages...`);
     // The samples repo's lockfile pins the published releases, which the overrides replace.
-    run('pnpm', ['install', '--no-frozen-lockfile'], to);
+    run('npm', ['install'], to);
   }
 } finally {
   source.cleanup?.();