fix(ci): resolve pipeline #516 audit and test failures (#429)

Co-authored-by: Jason Woltje <[email protected]>
Co-committed-by: Jason Woltje <[email protected]>

apps/web/vitest.setup.ts

@@ -24,3 +24,33 @@ Object.defineProperty(window, "matchMedia", {
     dispatchEvent: () => false,
   }),
 });
+
+// Ensure localStorage exists with a full Storage API for tests.
+// Avoid touching the built-in accessor (which emits warnings in Node).
+let storageStore: Record<string, string> = {};
+const storageMock: Storage = {
+  getItem: (key: string): string | null => storageStore[key] ?? null,
+  setItem: (key: string, value: string): void => {
+    storageStore[key] = value;
+  },
+  removeItem: (key: string): void => {
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+    delete storageStore[key];
+  },
+  clear: (): void => {
+    storageStore = {};
+  },
+  get length(): number {
+    return Object.keys(storageStore).length;
+  },
+  key: (index: number): string | null => {
+    const keys = Object.keys(storageStore);
+    return keys[index] ?? null;
+  },
+};
+
+Object.defineProperty(window, "localStorage", {
+  value: storageMock,
+  writable: true,
+  configurable: true,
+});

package.json

@@ -63,6 +63,8 @@
     ],
     "overrides": {
       "@isaacs/brace-expansion": ">=5.0.1",
+      "minimatch": ">=10.2.1",
+      "tar": ">=7.5.8",
       "form-data": ">=2.5.4",
       "lodash": ">=4.17.23",
       "lodash-es": ">=4.17.23",

pnpm-lock.yaml

@@ -6,6 +6,8 @@ settings:
 
 overrides:
   '@isaacs/brace-expansion': '>=5.0.1'
+  minimatch: '>=10.2.1'
+  tar: '>=7.5.8'
   form-data: '>=2.5.4'
   lodash: '>=4.17.23'
   lodash-es: '>=4.17.23'
@@ -1457,14 +1459,6 @@ packages:
   '@ioredis/[email protected]':
     resolution: {integrity: sha512-eUgLqrMf8nJkZxT24JvVRrQya1vZkQh8BBeYNwGDqa5I0VUi8ACx7uFvAaLxintokpTenkK6DASvo/bvNbBGow==}
 
-  '@isaacs/[email protected]':
-    resolution: {integrity: sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==}
-    engines: {node: 20 || >=22}
-
-  '@isaacs/[email protected]':
-    resolution: {integrity: sha512-WMz71T1JS624nWj2n2fnYAuPovhv7EUhk69R6i9dsVyzxt5eM3bjwvgk9L+APE1TRscGysAVMANkB0jh0LQZrQ==}
-    engines: {node: 20 || >=22}
-
   '@isaacs/[email protected]':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
@@ -1517,6 +1511,7 @@ packages:
 
   '@mosaicstack/[email protected]':
     resolution: {integrity: sha512-1udg6p4cs8rhQgQ2pKCfi7EpRlJieRRhA5CIqthRQ6HQZLgQ0wH+632jEulov3rlHSM1iplIQ+AAe5DWrvSkEA==, tarball: https://git.mosaicstack.dev/api/packages/mosaic/npm/%40mosaicstack%2Ftelemetry-client/-/0.1.1/telemetry-client-0.1.1.tgz}
+    engines: {node: '>=18'}
 
   '@mrleebo/[email protected]':
     resolution: {integrity: sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==}
@@ -3426,8 +3421,9 @@ packages:
       react-native-b4a:
         optional: true
 
-  balanced-match@1.0.2:
+  balanced-match@4.0.3:
-    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+    resolution: {integrity: sha512-1pHv8LX9CpKut1Zp4EXey7Z8OfH11ONNH6Dhi2WDUt31VVZFXZzKwXcysBgqSumFCmR+0dqjMK5v5JiFHzi0+g==}
+    engines: {node: 20 || >=22}
 
   [email protected]:
     resolution: {integrity: sha512-riJjyv1/mHLIPX4RwiK+oW9/4c3TEUeORHKefKAKnZ5kyslbN+HXowtbaVEqt4IMUB7OXlfixcs6gsFeo/jhiQ==}
@@ -3549,11 +3545,9 @@ packages:
     resolution: {integrity: sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==}
     engines: {node: '>=18'}
 
-  brace-expansion@1.1.12:
+  brace-expansion@5.0.2:
-    resolution: {integrity: sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==}
+    resolution: {integrity: sha512-Pdk8c9poy+YhOgVWw1JNN22/HcivgKWwpxKq04M/jTmHyCZn12WPJebZxdjSa5TmBqISrUSgNYU3eRORljfCCw==}
-
+    engines: {node: 20 || >=22}
-  [email protected]:
-    resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
 
   [email protected]:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
@@ -3792,9 +3786,6 @@ packages:
     resolution: {integrity: sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==}
     engines: {node: '>= 14'}
 
-  [email protected]:
-    resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
-
   [email protected]:
     resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==}
     engines: {'0': node >= 6.0}
@@ -5373,20 +5364,9 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==}
 
-  minimatch@10.1.1:
+  minimatch@10.2.2:
-    resolution: {integrity: sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==}
+    resolution: {integrity: sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==}
-    engines: {node: 20 || >=22}
+    engines: {node: 18 || 20 || >=22}
-
-  [email protected]:
-    resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
-
-  [email protected]:
-    resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==}
-    engines: {node: '>=10'}
-
-  [email protected]:
-    resolution: {integrity: sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==}
-    engines: {node: '>=16 || 14 >=14.17'}
 
   [email protected]:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
@@ -7408,7 +7388,7 @@ snapshots:
       chalk: 5.6.2
       commander: 12.1.0
       dotenv: 17.2.4
-      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
+      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
       open: 10.2.0
       pg: 8.17.2
       prettier: 3.8.1
@@ -7725,7 +7705,7 @@ snapshots:
     dependencies:
       '@eslint/object-schema': 2.1.7
       debug: 4.4.3
-      minimatch: 3.1.2
+      minimatch: 10.2.2
     transitivePeerDependencies:
       - supports-color
 
@@ -7746,7 +7726,7 @@ snapshots:
       ignore: 5.3.2
       import-fresh: 3.3.1
       js-yaml: 4.1.1
-      minimatch: 3.1.2
+      minimatch: 10.2.2
       strip-json-comments: 3.1.1
     transitivePeerDependencies:
       - supports-color
@@ -8037,12 +8017,6 @@ snapshots:
 
   '@ioredis/[email protected]': {}
 
-  '@isaacs/[email protected]': {}
-
-  '@isaacs/[email protected]':
-    dependencies:
-      '@isaacs/balanced-match': 4.0.1
-
   '@isaacs/[email protected]':
     dependencies:
       string-width: 5.1.2
@@ -9938,7 +9912,7 @@ snapshots:
       '@typescript-eslint/types': 8.54.0
       '@typescript-eslint/visitor-keys': 8.54.0
       debug: 4.4.3
-      minimatch: 9.0.5
+      minimatch: 10.2.2
       semver: 7.7.3
       tinyglobby: 0.2.15
       ts-api-utils: 2.4.0([email protected])
@@ -10375,7 +10349,7 @@ snapshots:
 
   [email protected]: {}
 
-  balanced-match@1.0.2: {}
+  balanced-match@4.0.3: {}
 
   [email protected]: {}
 
@@ -10410,7 +10384,7 @@ snapshots:
     optionalDependencies:
       '@prisma/client': 5.22.0([email protected]([email protected])([email protected]))
       better-sqlite3: 12.6.2
-      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
+      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
       next: 16.1.6(@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected])
       pg: 8.17.2
       prisma: 6.19.2([email protected])([email protected])
@@ -10435,7 +10409,7 @@ snapshots:
     optionalDependencies:
       '@prisma/client': 6.19.2([email protected]([email protected])([email protected]))([email protected])
       better-sqlite3: 12.6.2
-      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@5.22.0([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
+      drizzle-orm: 0.41.0(@opentelemetry/[email protected])(@prisma/client@6.19.2([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected]))
       next: 16.1.6(@babel/[email protected])(@opentelemetry/[email protected])([email protected]([email protected]))([email protected])
       pg: 8.17.2
       prisma: 6.19.2([email protected])([email protected])
@@ -10527,14 +10501,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  brace-expansion@1.1.12:
+  brace-expansion@5.0.2:
     dependencies:
-      balanced-match: 1.0.2
+      balanced-match: 4.0.3
-      concat-map: 0.0.1
-
-  [email protected]:
-    dependencies:
-      balanced-match: 1.0.2
 
   [email protected]:
     dependencies:
@@ -10790,8 +10759,6 @@ snapshots:
       normalize-path: 3.0.0
       readable-stream: 4.7.0
 
-  [email protected]: {}
-
   [email protected]:
     dependencies:
       buffer-from: 1.1.2
@@ -11229,17 +11196,6 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected])))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])):
-    optionalDependencies:
-      '@opentelemetry/api': 1.9.0
-      '@prisma/client': 5.22.0([email protected]([email protected])([email protected]))
-      '@types/pg': 8.16.0
-      better-sqlite3: 12.6.2
-      kysely: 0.28.10
-      pg: 8.17.2
-      postgres: 3.4.8
-      prisma: 6.19.2([email protected])([email protected])
-
   [email protected](@opentelemetry/[email protected])(@prisma/[email protected]([email protected]([email protected])([email protected]))([email protected]))(@types/[email protected])([email protected])([email protected])([email protected])([email protected])([email protected]([email protected])([email protected])):
     optionalDependencies:
       '@opentelemetry/api': 1.9.0
@@ -11250,7 +11206,6 @@ snapshots:
       pg: 8.17.2
       postgres: 3.4.8
       prisma: 6.19.2([email protected])([email protected])
-    optional: true
 
   [email protected]:
     dependencies:
@@ -11456,7 +11411,7 @@ snapshots:
       is-glob: 4.0.3
       json-stable-stringify-without-jsonify: 1.0.1
       lodash.merge: 4.6.2
-      minimatch: 3.1.2
+      minimatch: 10.2.2
       natural-compare: 1.4.0
       optionator: 0.9.4
     optionalDependencies:
@@ -11685,7 +11640,7 @@ snapshots:
       deepmerge: 4.3.1
       fs-extra: 10.1.0
       memfs: 3.5.3
-      minimatch: 3.1.2
+      minimatch: 10.2.2
       node-abort-controller: 3.1.1
       schema-utils: 3.3.0
       semver: 7.7.3
@@ -11805,14 +11760,14 @@ snapshots:
     dependencies:
       foreground-child: 3.3.1
       jackspeak: 3.4.3
-      minimatch: 9.0.5
+      minimatch: 10.2.2
       minipass: 7.1.2
       package-json-from-dist: 1.0.1
       path-scurry: 1.11.1
 
   [email protected]:
     dependencies:
-      minimatch: 10.1.1
+      minimatch: 10.2.2
       minipass: 7.1.2
       path-scurry: 2.0.1
 
@@ -12420,21 +12375,9 @@ snapshots:
 
   [email protected]: {}
 
-  minimatch@10.1.1:
+  minimatch@10.2.2:
     dependencies:
-      '@isaacs/brace-expansion': 5.0.1
+      brace-expansion: 5.0.2
-
-  [email protected]:
-    dependencies:
-      brace-expansion: 1.1.12
-
-  [email protected]:
-    dependencies:
-      brace-expansion: 2.0.2
-
-  [email protected]:
-    dependencies:
-      brace-expansion: 2.0.2
 
   [email protected]: {}
 
@@ -13010,7 +12953,7 @@ snapshots:
 
   [email protected]:
     dependencies:
-      minimatch: 5.1.6
+      minimatch: 10.2.2
 
   [email protected]: {}
 
@@ -13670,7 +13613,7 @@ snapshots:
     dependencies:
       '@istanbuljs/schema': 0.1.3
       glob: 10.5.0
-      minimatch: 9.0.5
+      minimatch: 10.2.2
 
   [email protected]:
     dependencies: