From 39f97a2af312dd9d6b702c23babd344bb040aeb5 Mon Sep 17 00:00:00 2001 From: GCHQDeveloper581 <63102987+GCHQDeveloper581@users.noreply.github.com> Date: Tue, 7 Apr 2026 10:43:28 +0100 Subject: [PATCH 1/6] Update vulnerable dependencies (#2311) Results of running 'npm audit fix' --- package-lock.json | 58 ++++++++++++++++++++--------------------------- 1 file changed, 25 insertions(+), 33 deletions(-) diff --git a/package-lock.json b/package-lock.json index 1104671d..617b9b51 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5738,9 +5738,9 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.12", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz", - "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==", + "version": "1.1.13", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz", + "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==", "dev": true, "license": "MIT", "dependencies": { @@ -9479,9 +9479,9 @@ } }, "node_modules/filelist/node_modules/brace-expansion": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", - "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", + "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", "dev": true, "license": "MIT", "dependencies": { @@ -10436,14 +10436,13 @@ } }, "node_modules/grunt-legacy-log-utils": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/grunt-legacy-log-utils/-/grunt-legacy-log-utils-2.1.0.tgz", - "integrity": "sha512-lwquaPXJtKQk0rUM1IQAop5noEpwFqOXasVoedLeNzaibf/OPWjKYvvdqnEHNmU+0T0CaReAXIbGo747ZD+Aaw==", + "version": "2.1.3", + "resolved": "https://registry.npmjs.org/grunt-legacy-log-utils/-/grunt-legacy-log-utils-2.1.3.tgz", + "integrity": "sha512-sgG+QvKmdb44wZyzJP+ejDsy3jYxG2wzohpol+JTMlXqMUBDoZb01JPQ5jKAedtZBFwhmABAc88T9hEBLy3U+Q==", "dev": true, "license": "MIT", "dependencies": { - "chalk": "~4.1.0", - "lodash": "~4.17.19" + "chalk": "^4.1.0" }, "engines": { "node": ">=10" @@ -10482,13 +10481,6 @@ "url": "https://github.com/chalk/chalk?sponsor=1" } }, - "node_modules/grunt-legacy-log-utils/node_modules/lodash": { - "version": "4.17.23", - "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz", - "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==", - "dev": true, - "license": "MIT" - }, "node_modules/grunt-legacy-log-utils/node_modules/supports-color": { "version": "7.2.0", "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz", @@ -13235,9 +13227,9 @@ } }, "node_modules/mocha/node_modules/brace-expansion": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", - "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", + "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", "dev": true, "license": "MIT", "dependencies": { @@ -14639,9 +14631,9 @@ "license": "ISC" }, "node_modules/path-to-regexp": { - "version": "0.1.12", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz", - "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==", + "version": "0.1.13", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz", + "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==", "dev": true, "license": "MIT" }, @@ -15460,9 +15452,9 @@ } }, "node_modules/readdir-glob/node_modules/brace-expansion": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", - "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", + "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", "dev": true, "license": "MIT", "dependencies": { @@ -18106,9 +18098,9 @@ } }, "node_modules/webpack-dev-server/node_modules/brace-expansion": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz", - "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==", + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz", + "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==", "dev": true, "license": "MIT", "dependencies": { @@ -18736,9 +18728,9 @@ "license": "ISC" }, "node_modules/yaml": { - "version": "2.8.2", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.2.tgz", - "integrity": "sha512-mplynKqc1C2hTVYxd0PU2xQAc22TI1vShAYGksCCfxbn/dFwnHTNi1bvYsBTkhdUNtGIf5xNOg938rrSSYvS9A==", + "version": "2.8.3", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz", + "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==", "dev": true, "license": "ISC", "bin": { From c68cc5a09602a65b66cb1569ebc39235ee7d60b5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 11:36:55 +0100 Subject: [PATCH 2/6] chore (deps): bump basic-ftp from 5.2.0 to 5.2.1 (#2313) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 617b9b51..f96b80f9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5316,9 +5316,9 @@ "license": "MIT" }, "node_modules/basic-ftp": { - "version": "5.2.0", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz", - "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==", + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.1.tgz", + "integrity": "sha512-0yaL8JdxTknKDILitVpfYfV2Ob6yb3udX/hK97M7I3jOeznBNxQPtVvTUtnhUkyHlxFWyr5Lvknmgzoc7jf+1Q==", "dev": true, "license": "MIT", "engines": { From 7b9ff751d21ee83f422f5522147b5191e8cf75bc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 10 Apr 2026 07:26:01 +0100 Subject: [PATCH 3/6] chore (deps): bump webpack from 5.105.4 to 5.106.0 (#2315) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index f96b80f9..d38debbc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -155,7 +155,7 @@ "prompt": "^1.3.0", "sitemap": "^8.0.3", "terser": "^5.46.1", - "webpack": "^5.105.4", + "webpack": "^5.106.0", "webpack-bundle-analyzer": "^4.10.2", "webpack-dev-server": "5.0.4", "webpack-node-externals": "^3.0.0", @@ -17884,9 +17884,9 @@ } }, "node_modules/webpack": { - "version": "5.105.4", - "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.105.4.tgz", - "integrity": "sha512-jTywjboN9aHxFlToqb0K0Zs9SbBoW4zRUlGzI2tYNxVYcEi/IPpn+Xi4ye5jTLvX2YeLuic/IvxNot+Q1jMoOw==", + "version": "5.106.0", + "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.106.0.tgz", + "integrity": "sha512-Pkx5joZ9RrdgO5LBkyX1L2ZAJeK/Taz3vqZ9CbcP0wS5LEMx5QkKsEwLl29QJfihZ+DKRBFldzy1O30pJ1MDpA==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index 160fc4ca..df6e7e97 100644 --- a/package.json +++ b/package.json @@ -86,7 +86,7 @@ "prompt": "^1.3.0", "sitemap": "^8.0.3", "terser": "^5.46.1", - "webpack": "^5.105.4", + "webpack": "^5.106.0", "webpack-bundle-analyzer": "^4.10.2", "webpack-dev-server": "5.0.4", "webpack-node-externals": "^3.0.0", From d8830e2b3b682b4448421bd3dbdd545bf6edecfe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 11 Apr 2026 10:49:29 +0100 Subject: [PATCH 4/6] chore (deps): bump axios from 1.13.6 to 1.15.0 (#2316) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Checked by: GCHQDeveloper581 --- package-lock.json | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index d38debbc..71eb8f3e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5169,15 +5169,25 @@ } }, "node_modules/axios": { - "version": "1.13.6", - "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz", - "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==", + "version": "1.15.0", + "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz", + "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==", "dev": true, "license": "MIT", "dependencies": { "follow-redirects": "^1.15.11", "form-data": "^4.0.5", - "proxy-from-env": "^1.1.0" + "proxy-from-env": "^2.1.0" + } + }, + "node_modules/axios/node_modules/proxy-from-env": { + "version": "2.1.0", + "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz", + "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=10" } }, "node_modules/babel-loader": { From 2eb8810bf66cb17fac105016e04c1ebc945bdabb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 11 Apr 2026 11:20:20 +0100 Subject: [PATCH 5/6] chore (deps): bump basic-ftp from 5.2.1 to 5.2.2 (#2317) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 71eb8f3e..4cd466af 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5326,9 +5326,9 @@ "license": "MIT" }, "node_modules/basic-ftp": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.1.tgz", - "integrity": "sha512-0yaL8JdxTknKDILitVpfYfV2Ob6yb3udX/hK97M7I3jOeznBNxQPtVvTUtnhUkyHlxFWyr5Lvknmgzoc7jf+1Q==", + "version": "5.2.2", + "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.2.tgz", + "integrity": "sha512-1tDrzKsdCg70WGvbFss/ulVAxupNauGnOlgpyjKzeQxzyllBLS0CGLV7tjIXTK3ZQA9/FBEm9qyFFN1bciA6pw==", "dev": true, "license": "MIT", "engines": { From f646065c36d51a928b7fe691c5b114d82b140354 Mon Sep 17 00:00:00 2001 From: BigYellowHammer <6392942+BigYellowHammer@users.noreply.github.com> Date: Sat, 11 Apr 2026 13:03:16 +0200 Subject: [PATCH 6/6] Rewriting fixCryptoApiImports and fixSnackbarMarkup to js to make it OS agnostic (#2298) --- Gruntfile.js | 18 +------ .../config/scripts/fixCryptoApiImports.mjs | 54 +++++++++++++++++++ src/core/config/scripts/fixSnackBarMarkup.mjs | 28 ++++++++++ 3 files changed, 84 insertions(+), 16 deletions(-) create mode 100644 src/core/config/scripts/fixCryptoApiImports.mjs create mode 100644 src/core/config/scripts/fixSnackBarMarkup.mjs diff --git a/Gruntfile.js b/Gruntfile.js index a67aa5b8..b04f3048 100755 --- a/Gruntfile.js +++ b/Gruntfile.js @@ -411,25 +411,11 @@ module.exports = function (grunt) { stdout: false, }, fixCryptoApiImports: { - command: function () { - switch (process.platform) { - case "darwin": - return `find ./node_modules/crypto-api/src/ \\( -type d -name .git -prune \\) -o -type f -print0 | xargs -0 sed -i '' -e '/\\.mjs/!s/\\(from "\\.[^"]*\\)";/\\1.mjs";/g'`; - default: - return `find ./node_modules/crypto-api/src/ \\( -type d -name .git -prune \\) -o -type f -print0 | xargs -0 sed -i -e '/\\.mjs/!s/\\(from "\\.[^"]*\\)";/\\1.mjs";/g'`; - } - }, + command: `node ${nodeFlags} src/core/config/scripts/fixCryptoApiImports.mjs`, stdout: false }, fixSnackbarMarkup: { - command: function () { - switch (process.platform) { - case "darwin": - return `sed -i '' 's/
/
/g' ./node_modules/snackbarjs/src/snackbar.js`; - default: - return `sed -i 's/
/
/g' ./node_modules/snackbarjs/src/snackbar.js`; - } - }, + command: `node ${nodeFlags} src/core/config/scripts/fixSnackBarMarkup.mjs`, stdout: false }, }, diff --git a/src/core/config/scripts/fixCryptoApiImports.mjs b/src/core/config/scripts/fixCryptoApiImports.mjs new file mode 100644 index 00000000..f4b7c767 --- /dev/null +++ b/src/core/config/scripts/fixCryptoApiImports.mjs @@ -0,0 +1,54 @@ +/** + * This script updates crypto-api package + * It adds .mjs to local imports where its missing + * + * before: + * import foo from "./bar"; + * after + * import foo from "./bar.mjs"; + * + */ + +/* eslint no-console: ["off"] */ + +import { readdirSync, readFileSync, writeFileSync } from "fs"; +import { join } from "path"; + +// Base directory of crypto-api source +const baseDir = join(process.cwd(), "node_modules/crypto-api/src"); + +/** + * Recursively walk a directory, updating import statements + * to include ".mjs" if missing + */ +function walk(dir) { + const entries = readdirSync(dir, { withFileTypes: true }); + + for (const entry of entries) { + if (entry.name === ".git") continue; + + const fullPath = join(dir, entry.name); + + if (entry.isDirectory()) { + walk(fullPath); + } else if (entry.isFile()) { + const content = readFileSync(fullPath, "utf8"); + + // Add .mjs to imports if not present + const updated = content.replace( + /from "(\.[^"]*)";/g, + (match, p1) => { + if (p1.endsWith(".mjs")) return match; + return `from "${p1}.mjs";`; + } + ); + + if (updated !== content) { + writeFileSync(fullPath, updated, "utf8"); + } + } + } +} + +// Run the walker +walk(baseDir); diff --git a/src/core/config/scripts/fixSnackBarMarkup.mjs b/src/core/config/scripts/fixSnackBarMarkup.mjs new file mode 100644 index 00000000..eba011ab --- /dev/null +++ b/src/core/config/scripts/fixSnackBarMarkup.mjs @@ -0,0 +1,28 @@ +/** + * This script updates snackbarjs package + * Replaces self-closing div with standard opening div + * + * before: + *
+ * after: + *
+ * + */ + +/* eslint no-console: ["off"] */ + +import { readFileSync, writeFileSync } from "fs"; +import { join } from "path"; + +// Base directory of snackbarjs source +const filePath = join(process.cwd(), "node_modules/snackbarjs/src/snackbar.js"); + +const content = readFileSync(filePath, "utf8"); + +// Replace self-closing div with standard opening div +const updated = content.replace( + /
/g, + "
" +); + +writeFileSync(filePath, updated, "utf8");