Merge main (v3.3.0) into develop

[github-actions]

Merge main (v3.3.0) into develop

[semgrep-code-yext]

High severity vulnerability may affect your project—review required:
Line 20161 lists a dependency (rollup) with a known High severity vulnerability.

ℹ️ Why this matters

Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing ../ sequences to survive and be passed into path.resolve when computing output paths. This lets an attacker escape the configured output directory and overwrite arbitrary files on the host filesystem that the build process can write to, potentially leading to persistent RCE by clobbering shell/profile or other executable/config files.

References: GHSA, CVE

To resolve this comment:
Check if you are running rollup --input.

• If you're affected, upgrade this dependency to at least version 4.59.0 at package-lock.json.
• If you're not affected, comment /fp we don't use this [condition]

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[github-actions]

Current unit coverage is 89.38856015779093%
Current visual coverage is 68.97081413210445%
Current combined coverage is 91.83120402632598%

[coveralls]

coverage: 84.687% (-0.04%) from 84.727% — dev/merge-v3.3.0-ebe270c-into-develop into develop