Repository navigation
sync: release/11.14.0 (sba-internal → sba-angular) - #328
Merged
Merged
Conversation
- Karma was the only remaining source of the brace-expansion advisory (GHSA-mh99-v99m-4gvg, 12 high) through glob@7/minimatch@3/rimraf@3. Only brace-expansion@5 is patched and it is API-incompatible with minimatch@3, so no override could fix it; dropping Karma was the way out. - karma is an optional peer of @angular/build, so removing it also clears the @angular/build and @angular-devkit/build-angular findings. npm audit at the workspace root now reports 0 vulnerabilities. - test-setup.ts installs a ProxyZone per spec: zone.js only patches Jasmine/Jest/Mocha, so waitForAsync fails under Vitest without it. It also restores what Jasmine did implicitly (spies reset between specs and stubbed rather than called through, en-US locale) and fills the matchMedia/scrollIntoView gaps left by jsdom. - The unit-test builder compiles templates AOT where Karma used JIT, hence the wider tsconfig.spec includes and three adjusted TestBed setups. - Same 254 specs as before, all passing. (cherry picked from commit 64954ec)
- Replace docusaurus-lunr-search with @easyops-cn/docusaurus-search-local, configured with docsRouteBasePath '/' since the classic preset serves the docs at the site root. - Drop patch-package along with the gray-matter patch and the js-yaml override it needed. - Bump the docs deploy workflows to Node 20. - The remaining npm audit findings under docusaurus/ are all the same brace-expansion advisory, reported upstream as having no fix available. (cherry picked from commit 3b4dbac)
All Angular advisories are fixed inside the 20.3.x line — the vulnerable ranges stop at <20.3.22, <20.3.25 and <20.3.27 — so a patch bump in the same minor clears them without moving to v21 or v22. This covers the Angular i18n XSS (event-handler attributes), the HttpTransferCache cache-key ambiguity and information leak, the hydration DOM-clobbering issue, and the OOM DoS in date/number formatting. - framework and compiler-cli/language-service: ^20.3.15 -> ^20.3.27 - @angular-devkit/build-angular and @angular/cli: ^20.3.13 -> ^20.3.32 - ng-packagr: ^20.0.1 -> ^20.3.2 npm audit fix --force wanted @angular-devkit/build-angular@22.1.2 instead, which is not an option here. Side effect worth having: every @angular/* package now resolves to a single version, ending the core 20.3.18 / animations 20.3.15 skew that made the tree internally inconsistent. It does not remove the need for --legacy-peer-deps, though: that comes from ngx-bootstrap@19.0.2 declaring peer @angular/*@^19.0.1 on an Angular 20 workspace. @angular/cdk, @angular/google-maps and vitest are left alone — no advisory, and vitest's 4.x is a major right after the runner was introduced.
npm audit at the workspace root now reports 0 vulnerabilities, down from 44 after the backport (a same-day baseline of pristine release/11.13.0 measures 52, with 3 critical and 28 high). Runtime dependency bumps: - uuid 8.3.2 -> ^11.1.1 (GHSA-w5hq-g745-h8pq) - vis-data -> ^7.1.10, vis-network -> 9.1.13, vis-timeline -> 7.7.4 projects/analytics peerDependencies are aligned with these, so the library stops declaring versions the workspace no longer installs. uuid is a contract change for consumers of @sinequa/analytics, but it is imported nowhere in this repo — a declared-but-dead dependency. Three overrides, each checked rather than assumed: - uuid ^11.1.1: sockjs pins uuid@^8.3.2 and npm's only offered fix was Angular 22. sockjs calls require('uuid').v4 and uuid@11 still exports v4, so forcing it is safe — unlike the minimatch@3 / brace-expansion case, where the API shape had changed. - webpack-dev-server ^5.2.6: build-angular pins 5.2.5 exactly, the top of the vulnerable range (CSRF + DoS). Patch bump, dev server only, never shipped. - @types/google.maps 3.58.1: fixes a regression this refresh introduced. Re-resolving lifted the types to 3.65.4, where Google removed HeatmapLayerOptions and WeightedLocation while @angular/google-maps still references them, so analytics stopped compiling with TS2694. Types only, no security implication; revisit when google-maps drops those references. The lockfile is a full re-resolution (404 removed, 176 added, 389 versions changed), not an incremental update — npm could not reconcile the bump against the frozen tree. That wide refresh is what cleared most transitive advisories, including dompurify (3.3.3 -> 3.4.13, reached via fusioncharts) and ws (7.5.10 -> 7.5.13, via @microsoft/signalr), the only two that touched shipped code: both were already permitted by their declared ranges. Verified: 254 specs pass (core 42, components 210, analytics 2 + 1 skipped), 50 library entry points build, and vanilla-search bundles in production.
…lease/11.13.0' ES-33095 #done ES-33085 #done chore: backport !1523 to 11.13.0 and bring npm audit to zero on Angular 20 See merge request sinequa/rnd/sba-internal!1525
Brings the 5 commits missing from 11.14.0: the Karma -> Vitest migration, Docusaurus 3.10, the Angular 20.3.15 -> 20.3.27 bump (tooling to 20.3.32) and the npm-audit-to-zero pass. 11.14.0 had already received the Vitest migration and Docusaurus 3.10 via backport, plus its own npm audit fix passes, so the branches only really diverged on dependency versions. Conflicts were limited to package.json, package-lock.json and docusaurus/package-lock.json. package.json: all three conflicting hunks resolved in favour of 11.13.0. Its overrides block is a strict superset of 11.14.0's (webpack-dev-server ^5.2.6 satisfies >=5.2.5), and its vis-* / Angular / ng-packagr versions are newer. "version" stays at 11.14.0. package-lock.json: taken from 11.13.0 with only the two root "version" fields retargeted to 11.14.0. The merged package.json is byte-identical to 11.13.0's apart from that field, so 11.13.0's tree is exactly the right resolution -- no re-resolution needed. npm audit reports 0 vulnerabilities. docusaurus/package-lock.json: taken from 11.14.0, NOT 11.13.0. Both branches carry an identical docusaurus/package.json, so the conflict was pure transitive drift -- and 11.14.0's resolution is newer on every flagged package (shell-quote 1.10.0 vs 1.8.3, websocket-driver 0.7.5 vs 0.7.4, webpack-dev-server 5.2.6 vs 5.2.3, ...). Taking 11.13.0's would have been a security regression: 12 advisories against 3. Verified: 212 Vitest tests pass, npm run buildall (50 entry points) and npm run docs:build both succeed. Pre-existing and untouched: npm ci fails on peer resolution because ngx-bootstrap@19.0.2 requires @angular/animations@^19. This reproduces identically on pristine release/11.13.0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Minor transitive dependency bumps and lockfile dedup, no functional change. Does not fix the 21 high-severity npm audit findings (root: image-size -> less -> @angular-devkit/build-angular; docusaurus: image-size -> @docusaurus/mdx-loader -> @docusaurus/*) — these are all rooted in a single unresolved DoS in image-size (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq) with no patched version published upstream yet. `npm audit fix --force` is not viable: it would downgrade @angular-devkit/build-angular to 0.1002.1 and @easyops-cn/docusaurus-search-local to 0.29.0, both ancient and incompatible with the current Angular 20 / Docusaurus 3.10 setup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@angular-devkit/build-angular pins less to 4.4.0, which still lists image-size (~0.5.0) as an optional dependency. image-size <=2.0.2 has an unpatched high-severity DoS (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq). less >=4.7.0 dropped image-size in favor of probe-image-size, so overriding to >=4.7.0 removes the vulnerable package entirely. less is not used anywhere in this repo (no .less files) — it's only present as an optional Angular build-tool style preprocessor, so this is a zero functional-risk change. `npm audit` now reports 0 vulnerabilities at the workspace root. The 18 remaining high-severity findings in docusaurus/ are a separate, still-unresolved chain (image-size pulled directly by @docusaurus/mdx-loader, not through less) and are not addressed here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
allow_failure: true so these still-manual doc deploy jobs no longer force the pipeline into a permanent "manual" (blocked) status, which was preventing merge on projects with only_allow_merge_if_pipeline_succeeds.
…lease/11.14.0' ES-33022 #done fix: override less to remove image-size DoS vulnerability See merge request sinequa/rnd/sba-internal!1526
- Add `action` (correction/expansion/suggestion) to DidYouMeanItemSchema, reflecting how the engine actually applied the correction (ES-28698) - Switch the did-you-mean template to pivot on this per-term action instead of the query-level spellingCorrectionMode, fixing cases where the displayed message didn't match the actual search (ES-27719) - Fall back to spellingCorrectionMode-based inference for engines prior to 11.14 that don't report the action attribute - Update EN/FR/DE did-you-mean messages accordingly
- The engine reports the per-term action in text.appliedChanges[]
(form/correction/action), not directly on text as previously assumed
- Add DidYouMeanAppliedChangeSchema and the appliedChanges field to
DidYouMeanItemSchema to match the actual backend response
- resolveAction() now derives the action from appliedChanges (common
action when all terms agree, "suggestion" fallback otherwise), and
still falls back to legacyAction() for engines prior to 11.14
- Update the demo mock with a real multi-term example ("katalon
selenim" -> "Catalon selenium", both terms expanded)
ES-32655 #done feat: select DYM message from per-term action See merge request sinequa/rnd/sba-internal!1520
…11.14.0 release/11.14.0 moved on by 6 commits since this merge branch was cut (DYM per-term action fix, dependabot fix, and notably the "less">=4.7.0 npm override that closes the image-size DoS advisory at the root, plus a routine lockfile refresh). Conflicts were limited to package.json and package-lock.json. package.json: additive conflict only. Kept this branch's full overrides block (serialize-javascript, uuid, webpack-dev-server, @types/google.maps) and added release/11.14.0's "less": ">=4.7.0" entry alongside it. package-lock.json: regenerated with `npm install --legacy-peer-deps` (the flag works around the pre-existing, unrelated ngx-bootstrap@19.0.2 -> @angular/animations@^19 peer conflict — see project history). Taking 11.13.0's lockfile verbatim would have silently reintroduced the DoS (less@4.4.0 instead of 4.9.0). Root npm audit: 0 vulnerabilities. docusaurus/package.json and docusaurus/package-lock.json: no conflict, unchanged from both sides. Verified: 212 Vitest tests pass, npm run buildcore succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…/11.14.0' #noJiraCheck chore: merge release/11.13.0 into release/11.14.0 See merge request sinequa/rnd/sba-internal!1529
…ze DoS vuln @angular-devkit/build-angular pins less to a version that still lists image-size (~0.5.0) as an optional dependency. image-size <=2.0.2 has an unpatched high-severity DoS (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq). less >=4.7.0 dropped image-size in favor of probe-image-size, so overriding to >=4.7.0 removes the vulnerable package entirely. less is not used anywhere in this repo (no .less files), so this is a zero functional-risk change. npm audit at the workspace root now reports 0 vulnerabilities. Backport of the fix already applied on release/11.14.0 (ES-33022, commit 737de71). The 18 remaining high-severity findings in docusaurus/ are a separate, unfixable chain (image-size pulled directly by @docusaurus/mdx-loader, upstream repo archived) and are not addressed here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…confusion vulns fast-uri is pulled transitively via ng-packagr -> ajv@8.18.0, pinned to 3.1.5 in the lockfile. Versions <=3.1.5 have four high-severity host confusion / SSRF issues (CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172) where parse/resolve/normalize/equal can disagree on the resolved host. 3.1.6 is the patched release on the same major line ajv's peerDependency accepts (^3.0.1), so the override is capped at <4.0.0 to avoid an unintended major bump. browserslist (ES-33336, CVE-2026-73088, prototype pollution via normalizeStats) was already resolved to the patched 4.28.7 by the refreshed lockfile from the previous commit, so no override was needed for it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
allow_failure: true so these still-manual doc deploy jobs no longer force the pipeline into a permanent "manual" (blocked) status, which was preventing merge on projects with only_allow_merge_if_pipeline_succeeds. Backport of commit 1eb0b19 from release/11.14.0 / develop, hit again on this MR (!1530) targeting release/11.13.0. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
… 'release/11.13.0' ES-33338 #done ES-33336 #done chore(deps): fix npm audit vulnerabilities (image-size, fast-uri, browserslist) See merge request sinequa/rnd/sba-internal!1530
…e-release-11.13.0-into-11.14.0 # Conflicts: # package-lock.json # package.json
…/11.14.0' chore: merge release/11.13.0 into release/11.14.0 #noJiraCheck See merge request sinequa/rnd/sba-internal!1531
- token.service: deleteWebTokenCookie now returns an optional logoutUrl - authentication.service: redirect to logoutUrl on logout when present Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…4.0' ES-31722 #done Handle logout redirect for oAuth2 authentication See merge request sinequa/rnd/sba-internal!1532
fix vulnerabilities ES-33506 #done ES-33505 #done See merge request sinequa/rnd/sba-internal!1533
- ES-33749: proxy-addr 2.0.7 -> 2.0.8 (CVE-2026-90711, IP trust bypass) - ES-33752: undici 7.29.0 -> 7.30.0 (critical advisory) - Both pinned via overrides in docusaurus/package.json, same pattern as the ES-33565 batch fix
…1.13.0' ES-33749 #done ES-33752 #done fix: bump proxy-addr and undici in docusaurus See merge request sinequa/rnd/sba-internal!1537
- webpack-dev-middleware -> 7.4.6 (GHSA-g84c-rxfj-3j2c path traversal, fixes ES-33861), compatible with webpack-dev-server's ^7.4.2 range - http-cache-semantics -> 4.3.0 (fixes CVE-2026-93750, ES-33751); note CVE-2026-93748 (max-stale) referenced in ES-33751 has no upstream fix yet, see Jira comment - lockfiles regenerated with --legacy-peer-deps due to a pre-existing ngx-bootstrap/@angular-animations peer conflict on this branch, unrelated to this change (npm ci in CI is unaffected)
- CVE-2026-101896 (GHSA-ff3f-86qr-9cv3): DoS via numeric matrix params in SSR, fixed upstream in @angular/router 20.3.32 - Updates all @angular/* packages to 20.3.33 (latest v20 LTS patch), already within the declared ^20.3.27 range - App has no SSR usage, so the vulnerability was not practically exploitable, but the fix is applied as a precaution
…11.13.0' ES-33815 #done fix: bump @angular/router to fix DoS vulnerability See merge request sinequa/rnd/sba-internal!1539
Without allow_failure: true, GitLab defaults when: manual rules to allow_failure: false, so the required pipeline never reaches "success" unless these doc-deploy jobs are triggered manually. That blocks merge on this branch, since the project requires a successful pipeline. release/11.13.0 already carries this fix; backport it here. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…e/11.12.0' ES-33861 #done ES-33751 #done fix: fix npm audit overrides See merge request sinequa/rnd/sba-internal!1538
…11.13.0 Conflits résolus dans package.json et package-lock.json (racine et docusaurus). Seuls les overrides encore pertinents de 11.12.0 sont conservés (http-cache-semantics 4.3.0, webpack-dev-middleware 7.4.6) ; les autres rétrograderaient des versions déjà plus récentes dans 11.13.0 (esbuild, dompurify, webpack-dev-server) ou sont sans effet (tmp, jspdf, canvg, path-to-regexp). Lockfiles régénérés. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…/11.13.0' chore: merge release/11.12.0 into release/11.13.0 #noJiraCheck See merge request sinequa/rnd/sba-internal!1540
Fix command injection in quote() (GHSA-pqg4-j6r4-53mv). Transitive dependency of launch-editor, bumped from 1.10.0 to 1.12.0 in root and docusaurus. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nd others (ES-33932) Root: piscina ^5.3.2, @modelcontextprotocol/sdk >=1.31.0, dompurify ^3.4.16, serialize-javascript ^7.1.2, source-map-js ^1.2.2. docusaurus: compression ^1.8.2, serialize-javascript ^7.1.2, source-map-js ^1.2.2. Remaining vulnerabilities have no usable fix (braces, tinypool, postcss-selector-parser). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
#noJiraCheck fix(deps): override shell-quote to ^1.11.0 (ES-33932) See merge request sinequa/rnd/sba-internal!1541
…32-npm-audit-overrides # Conflicts: # docusaurus/package.json
#noJiraCheck fix(deps): bump npm audit overrides for piscina, MCP SDK, dompurify and others (ES-33932) See merge request sinequa/rnd/sba-internal!1542
…s (ES-33904, ES-33907, ES-33909) - tinypool ^2.1.2 (CVE-2026-104848, CVE-2026-104849) - postcss-selector-parser ^7.1.6 (CVE-2026-104844), including the 6.x consumers (cssnano), which have no fix on the 6.x line - compression already at 1.8.2 (ES-33901, no change needed) docusaurus build verified. ES-33901 #done ES-33904 #done ES-33907 #done ES-33909 #done Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…rrides' into 'release/11.13.0' #noJiraCheck fix(deps): override tinypool and postcss-selector-parser in docusaurus ES-33901 #done ES-33904 #done ES-33907 #done ES-33909 #done See merge request sinequa/rnd/sba-internal!1543
Pin jira-ticket-check to [sinequa, shell] (grep only, drop the alpine image) and the jobs that run node/npm in a container to [sinequa, docker]. A bare tag can land on the old runner. pages-internal and pages-jekyll-internal are left untagged: they target a self-hosted runner. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
ci: use the sinequa runners #noJiraCheck See merge request sinequa/rnd/sba-internal!1544
…aurus build (ES-33900/ES-33906) - Force postcss-selector-parser to 7.1.6 (CVE-2026-104844) in the root and docusaurus/ lockfiles; the 6.x line has no patched release, so the 6.x consumers (cssnano chain) are overridden to 7.1.6 in docusaurus/ only. - Override webpackbar to 7.0.0: webpackbar 6.0.1 is rejected by webpack 5.111.1 (ProgressPlugin options validation), which broke `docusaurus build` since the ES-33751/33861 audit overrides. - Fix MDX-incompatible autolinks in the 11.9.0 / 11.10.0 release notes (same content fix as 948d677 on develop). ES-33905 (sprintf-js 1.0.3) has no upstream fix and is not addressed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… into 'release/11.12.0' fix(deps): override postcss-selector-parser to 7.1.6 and repair docusaurus build ES-33900 #done ES-33906 #done ES-33905 #done See merge request sinequa/rnd/sba-internal!1545
….13.0 Conflicts resolved in package.json, docusaurus/package.json and docusaurus/package-lock.json: - keep the 11.13.0 overrides (incl. global postcss-selector-parser ^7.1.6) - add the postcss-selector-parser@^7.0.0 override (root) and webpackbar 7.0.0 (docusaurus) coming from 11.12.0 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…/11.13.0' chore: merge release/11.12.0 into release/11.13.0 #noJiraCheck See merge request sinequa/rnd/sba-internal!1546
…se-11-14-0-2176-20261105
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Synchronizes
release/11.14.0with the internal repository at version 11.14.0.2176 (tages-11.14.0.2176).Commits from the internal repository:
No merge conflicts.
🤖 Generated with Claude Code