DP-42328-Update-critical-node-packages

.github/workflows/deploy.yml

@@ -15,7 +15,7 @@ on:
         default: false
 
 env:
-  NODE_VERSION: "14.15.2"
+  NODE_VERSION: "24.19.0"
   PHP_VERSION: "8.0.11"
 
 jobs:
@@ -39,7 +39,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Install packages
         run: node common/scripts/install-run-rush.js install
@@ -92,7 +92,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Build
         run: cd packages/patternlab/styleguide && node ../../../common/scripts/install-run-rushx.js build
@@ -304,7 +304,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Build Mayflower React
         working-directory: packages/react
@@ -443,7 +443,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Build
         run: cd packages/assets && node ../../common/scripts/install-run-rushx.js build
@@ -474,7 +474,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Publish mayflower-assets NPM package
         working-directory: packages/assets
@@ -512,7 +512,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-26
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Build Mayflower React NPM Package
         working-directory: packages/react
@@ -622,7 +622,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-27
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Install global dependencies
         run: npm install -g js-yaml@3.13.1 @octokit/rest@18.12.0 semver@6.3.0 shelljs@0.8.3 simple-git@1.126.0
@@ -669,7 +669,7 @@ jobs:
             packages/react/node_modules
             packages/patternlab/styleguide/node_modules
             packages/core/node_modules
-          key: root-npm-v6-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-27
+          key: root-npm-v9-${{ hashFiles('common/config/rush/pnpm-lock.yaml') }}-1
 
       - name: Install global dependencies
         run: npm install -g js-yaml@3.13.1 @octokit/rest@18.12.0 semver@6.3.0 shelljs@0.8.3 simple-git@1.126.0

.nvmrc

@@ -1 +1 @@
-v14.15.2
+v24.19.0

changelogs/DP-42328.yml

@@ -0,0 +1,6 @@
+Security:
+  - project: Patternlab, React
+    component: Dependency
+    description: Update critical npm packages and make the Mayflower toolchain compatible with Node.js 24. Upgrades Rush to 5.178.0, pnpm to 9.15.9, gulp-sass to 5.x (Dart Sass), remediates critical/high advisories in root tooling, and adds React/ReactDOM as React package devDependencies so pnpm workspaces can resolve peers for lint and builds.
+    issue: DP-42328
+    impact: Minor

common/config/rush/.pnpmfile.cjs

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * When using the PNPM package manager, you can use .pnpmfile.cjs to workaround
+ * dependencies that have mistakes in their package.json file.  (This feature is
+ * functionally similar to Yarn's "resolutions".)
+ *
+ * For details, see the PNPM documentation:
+ * https://pnpm.io/pnpmfile
+ *
+ * IMPORTANT: SINCE THIS FILE CONTAINS EXECUTABLE CODE, MODIFYING IT IS LIKELY TO INVALIDATE
+ * ANY CACHED DEPENDENCY ANALYSIS.  After any modification to .pnpmfile.cjs, it's recommended to run
+ * "rush update --full" so that PNPM will recalculate all version selections.
+ */
+module.exports = {
+  hooks: {
+    readPackage
+  }
+};
+
+/**
+ * This hook is invoked during installation before a package's dependencies
+ * are selected.
+ * The `packageJson` parameter is the deserialized package.json
+ * contents for the package that is about to be installed.
+ * The `context` parameter provides a log() function.
+ * The return value is the updated object.
+ */
+function readPackage(packageJson, context) {
+  // Force patched versions of packages with known high/critical advisories,
+  // staying within major lines that older eslint/storybook tooling can consume.
+  const overrides = {
+    'brace-expansion': '^1.1.18',
+    minimatch: '^3.1.5',
+    'js-yaml': '^4.1.1',
+    'cross-spawn': '^7.0.6',
+    micromatch: '^4.0.8',
+    'form-data': '^3.0.4',
+    qs: '^6.14.1',
+    lodash: '^4.17.21',
+    flatted: '^3.3.3'
+  };
+
+  for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+    const deps = packageJson[field];
+    if (!deps) {
+      continue;
+    }
+    for (const [name, version] of Object.entries(overrides)) {
+      if (deps[name]) {
+        deps[name] = version;
+      }
+    }
+  }
+
+  return packageJson;
+}