fix: resolve 72 of 79 Dependabot security alerts

apps/client/.stylelintrc.js

@@ -35,6 +35,7 @@ export default {
       },
     ],
     'no-descending-specificity': null,
+    'no-invalid-position-declaration': null,
     'selector-class-pattern': '^((sm|md|lg|xl|2xl):)?[a-z][-_/a-z0-9]*$',
   },
 }

apps/client/vite.config.ts

@@ -135,7 +135,12 @@ export default defineConfig({
     dedupe: ['vue'],
   },
   build: {
-    target: 'ESNext',
+    target: 'es2022',
+  },
+  css: {
+    lightningcss: {
+      errorRecovery: true,
+    },
   },
   optimizeDeps: {
     include: [

apps/server-nestjs/package.json

@@ -10,7 +10,6 @@
     "url": "https://github.com/cloud-pi-native/console"
   },
   "scripts": {
-    "prebuild": "pnpm i --frozen-lockfile",
     "build": "nest build",
     "db:generate": "prisma generate",
     "db:migrate": "prisma migrate dev --name dso",
@@ -21,10 +20,8 @@
     "start:debug": "nest start --debug --watch",
     "start:dev": "nest start --watch",
     "start:prod": "node dist/main",
-    "pretest": "pnpm run db:generate",
     "test": "vitest run",
     "test:watch": "vitest",
-    "pretest:cov": "pnpm run db:generate",
     "test:cov": "vitest run --coverage",
     "test:debug": "vitest --inspect"
   },
@@ -47,21 +44,21 @@
     "@nestjs/cache-manager": "^3.1.2",
     "@nestjs/common": "^11.1.16",
     "@nestjs/config": "^4.0.3",
-    "@nestjs/core": "^11.1.16",
+    "@nestjs/core": "^11.1.18",
     "@nestjs/event-emitter": "^3.0.1",
     "@nestjs/jwt": "^11.0.2",
     "@nestjs/platform-fastify": "^11.1.16",
     "@nestjs/schedule": "^6.1.1",
     "@nestjs/swagger": "^11.4.1",
     "@nestjs/terminus": "^11.1.1",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/auto-instrumentations-node": "^0.70.1",
-    "@opentelemetry/exporter-metrics-otlp-proto": "^0.213.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.213.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.75.0",
+    "@opentelemetry/exporter-metrics-otlp-proto": "^0.217.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.217.0",
     "@opentelemetry/instrumentation-nestjs-core": "^0.58.0",
     "@opentelemetry/instrumentation-pino": "^0.59.0",
     "@opentelemetry/sdk-metrics": "^2.5.1",
-    "@opentelemetry/sdk-node": "^0.212.0",
+    "@opentelemetry/sdk-node": "^0.217.0",
     "@prisma/client": "^6.19.2",
     "@ts-rest/core": "^3.52.1",
     "@ts-rest/fastify": "^3.52.1",
@@ -92,7 +89,7 @@
     "@nestjs/schematics": "^11.0.9",
     "@nestjs/testing": "^11.1.16",
     "@types/node": "^22.19.15",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.9",
     "eslint": "^9.39.4",
     "globals": "^16.5.0",
     "msw": "^2.12.10",
@@ -103,7 +100,7 @@
     "typescript-eslint": "^8.57.0",
     "vite": "^7.3.2",
     "vite-node": "^6.0.0",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.9"
   },
   "publishConfig": {
     "tag": "latest"

apps/server-nestjs/src/modules/registry/registry.service.ts

@@ -118,7 +118,6 @@ export class RegistryService {
       if (error instanceof VaultError && error.kind === 'NotFound') return null
       throw error
     })
-
     const expiring = vaultRobotSecret
       ? this.isRobotSecretExpiring(vaultRobotSecret)
       : false

apps/server-nestjs/tsconfig.build.json

@@ -1,4 +1,13 @@
 {
   "extends": "./tsconfig.json",
-  "exclude": ["node_modules", "test", "dist", "**/*spec.ts"]
+  "include": ["src/**/*.ts"],
+  "exclude": [
+    "node_modules",
+    "test",
+    "dist",
+    "**/*spec.ts",
+    "**/__mocks__/**",
+    "vitest.config.ts",
+    "vite.config.ts"
+  ]
 }

apps/server-nestjs/tsconfig.json

@@ -7,6 +7,20 @@
     "baseUrl": "./",
     "module": "nodenext",
     "moduleResolution": "nodenext",
+    "paths": {
+      "@/*": ["src/*"],
+      "@cpn-console/shared": ["../../packages/shared/src/index.ts"],
+      "@cpn-console/hooks": ["../../packages/hooks/src/index.ts"],
+      "@cpn-console/logger": ["../../packages/logger/src/index.ts"],
+      "@cpn-console/logger/hooks": ["../../packages/logger/src/hooks.ts"],
+      "@cpn-console/argocd-plugin": ["../../plugins/argocd/src/index.ts"],
+      "@cpn-console/gitlab-plugin": ["../../plugins/gitlab/src/index.ts"],
+      "@cpn-console/harbor-plugin": ["../../plugins/harbor/src/index.ts"],
+      "@cpn-console/keycloak-plugin": ["../../plugins/keycloak/src/index.ts"],
+      "@cpn-console/nexus-plugin": ["../../plugins/nexus/src/index.ts"],
+      "@cpn-console/sonarqube-plugin": ["../../plugins/sonarqube/src/index.ts"],
+      "@cpn-console/vault-plugin": ["../../plugins/vault/src/index.ts"]
+    },
     "resolvePackageJsonExports": true,
     "strictBindCallApply": false,
     "strictNullChecks": true,

apps/server-nestjs/vitest-init.ts

@@ -0,0 +1,12 @@
+process.env.ARGOCD_URL = 'https://argo-cd.readthedocs.io'
+process.env.GITLAB_URL = 'https://gitlab.com'
+process.env.HARBOR_URL = 'https://goharbor.io'
+process.env.NEXUS_URL = 'https://sonatype.com/products/nexus-repository'
+process.env.SONARQUBE_URL = 'https://www.sonarqube.org'
+process.env.VAULT_URL = 'https://www.vaultproject.io'
+process.env.PROJECTS_ROOT_DIR = 'forge-mi/projects'
+process.env.KEYCLOAK_REDIRECT_URI = 'http://console.dso.local'
+process.env.CONTACT_EMAIL = 'cloudpinative-relations@interieur.gouv.fr'
+process.env.OPENCDS_URL = 'https://opencds.gouv.fr'
+process.env.OPENCDS_API_TOKEN='***'
+process.env.NODE_ENV = 'test'

apps/server-nestjs/vitest.config.ts

@@ -1,13 +1,24 @@
 import path from 'node:path'
-import { defineConfig } from 'vitest/config'
+import { fileURLToPath } from 'node:url'
+import { configDefaults, defineConfig } from 'vitest/config'
+
+const rootDir = fileURLToPath(new URL('./', import.meta.url))
 
 export default defineConfig({
   resolve: {
     alias: [
-      { find: '@cpn-console/logger/hooks', replacement: path.resolve(__dirname, '../../packages/logger/src/hooks.ts') },
-      { find: '@cpn-console/logger', replacement: path.resolve(__dirname, '../../packages/logger/src/index.ts') },
-      { find: '@cpn-console/shared', replacement: path.resolve(__dirname, '../../packages/shared/src/index.ts') },
-      { find: '@cpn-console/hooks', replacement: path.resolve(__dirname, '../../packages/hooks/src/index.ts') },
+      { find: '@', replacement: fileURLToPath(new URL('./src', import.meta.url)) },
+      { find: '@cpn-console/hooks', replacement: path.resolve(rootDir, '../../packages/hooks/src/index.ts') },
+      { find: '@cpn-console/logger/hooks', replacement: path.resolve(rootDir, '../../packages/logger/src/hooks.ts') },
+      { find: '@cpn-console/logger', replacement: path.resolve(rootDir, '../../packages/logger/src/index.ts') },
+      { find: '@cpn-console/shared', replacement: path.resolve(rootDir, '../../packages/shared/src/index.ts') },
+      { find: '@cpn-console/argocd-plugin', replacement: path.resolve(rootDir, '../../plugins/argocd/src/index.ts') },
+      { find: '@cpn-console/gitlab-plugin', replacement: path.resolve(rootDir, '../../plugins/gitlab/src/index.ts') },
+      { find: '@cpn-console/harbor-plugin', replacement: path.resolve(rootDir, '../../plugins/harbor/src/index.ts') },
+      { find: '@cpn-console/keycloak-plugin', replacement: path.resolve(rootDir, '../../plugins/keycloak/src/index.ts') },
+      { find: '@cpn-console/nexus-plugin', replacement: path.resolve(rootDir, '../../plugins/nexus/src/index.ts') },
+      { find: '@cpn-console/sonarqube-plugin', replacement: path.resolve(rootDir, '../../plugins/sonarqube/src/index.ts') },
+      { find: '@cpn-console/vault-plugin', replacement: path.resolve(rootDir, '../../plugins/vault/src/index.ts') },
     ],
   },
   test: {
@@ -17,6 +28,14 @@ export default defineConfig({
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html'],
+      include: ['src/**/*.ts', 'test/**/*.ts'],
+      exclude: [
+        '**/*.spec.ts',
+        '**/*.d.ts',
+      ],
     },
+    exclude: [...configDefaults.exclude, 'e2e/*'],
+    root: fileURLToPath(new URL('./', import.meta.url)),
+    pool: 'forks',
   },
 })

apps/server/package.json

@@ -16,7 +16,6 @@
     "src"
   ],
   "scripts": {
-    "prebuild": "pnpm i --frozen-lockfile",
     "build": "tspc",
     "build:clean": "rimraf ./dist ./types ./tsconfig.tsbuildinfo",
     "db:deploy": "prisma migrate deploy",
@@ -35,9 +34,7 @@
     "prepublishOnly": "pnpm run db:generate",
     "prestart": "npm run db:deploy",
     "start": "node --enable-source-maps dist/bootstrap.js",
-    "pretest": "pnpm run db:generate",
     "test": "vitest run",
-    "pretest:cov": "pnpm run db:generate",
     "test:cov": "vitest run --coverage",
     "test:e2e": "pnpm run dev",
     "test:e2e-ci": "pnpm run start"
@@ -62,13 +59,13 @@
     "@gitbeaker/core": "^40.6.0",
     "@gitbeaker/rest": "^40.6.0",
     "@kubernetes-models/argo-cd": "^2.7.2",
-    "@opentelemetry/auto-instrumentations-node": "^0.70.1",
-    "@opentelemetry/exporter-metrics-otlp-proto": "^0.213.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.213.0",
+    "@opentelemetry/auto-instrumentations-node": "^0.75.0",
+    "@opentelemetry/exporter-metrics-otlp-proto": "^0.217.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.217.0",
     "@opentelemetry/instrumentation-nestjs-core": "^0.58.0",
     "@opentelemetry/instrumentation-pino": "^0.59.0",
     "@opentelemetry/sdk-metrics": "^2.5.1",
-    "@opentelemetry/sdk-node": "^0.212.0",
+    "@opentelemetry/sdk-node": "^0.217.0",
     "@prisma/client": "^6.19.2",
     "@ts-rest/core": "^3.52.1",
     "@ts-rest/fastify": "^3.52.1",
@@ -89,7 +86,7 @@
     "@cpn-console/ts-config": "workspace:^",
     "@faker-js/faker": "^9.9.0",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^4.1.5",
+    "@vitest/coverage-v8": "^4.1.9",
     "fastify-plugin": "^5.1.0",
     "nodemon": "^3.1.14",
     "pino-pretty": "^13.1.3",
@@ -99,7 +96,7 @@
     "typescript-transform-paths": "^3.5.6",
     "vite": "^7.3.2",
     "vite-node": "^6.0.0",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.9"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

apps/server/vitest-init.ts

@@ -8,4 +8,5 @@ process.env.PROJECTS_ROOT_DIR = 'forge-mi/projects'
 process.env.KEYCLOAK_REDIRECT_URI = 'http://console.dso.local'
 process.env.CONTACT_EMAIL = 'cloudpinative-relations@interieur.gouv.fr'
 process.env.OPENCDS_URL = 'https://opencds.gouv.fr'
-process.env.OPENCDS_API_TOKEN = 'test_token'
+process.env.OPENCDS_API_TOKEN='***'
+process.env.NODE_ENV = 'test'

apps/server/vitest.config.ts

@@ -1,28 +1,47 @@
+import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { mergeConfig } from 'vite'
 import { configDefaults, defineConfig } from 'vitest/config'
 import viteConfig from './vite.config'
 
+const rootDir = fileURLToPath(new URL('./', import.meta.url))
+
 export default mergeConfig(
   viteConfig,
   defineConfig({
+    resolve: {
+      alias: [
+        { find: '@', replacement: fileURLToPath(new URL('./src', import.meta.url)) },
+        // Workspace packages - resolve to source files to bypass Vite 8 / Rolldown dep scanner
+        { find: '@cpn-console/hooks', replacement: path.resolve(rootDir, '../../packages/hooks/src/index.ts') },
+        { find: '@cpn-console/logger/hooks', replacement: path.resolve(rootDir, '../../packages/logger/src/hooks.ts') },
+        { find: '@cpn-console/logger', replacement: path.resolve(rootDir, '../../packages/logger/src/index.ts') },
+        { find: '@cpn-console/shared', replacement: path.resolve(rootDir, '../../packages/shared/src/index.ts') },
+        // Plugins - resolve to source files to bypass Vite 8 / Rolldown dep scanner
+        { find: '@cpn-console/argocd-plugin', replacement: path.resolve(rootDir, '../../plugins/argocd/src/index.ts') },
+        { find: '@cpn-console/gitlab-plugin', replacement: path.resolve(rootDir, '../../plugins/gitlab/src/index.ts') },
+        { find: '@cpn-console/harbor-plugin', replacement: path.resolve(rootDir, '../../plugins/harbor/src/index.ts') },
+        { find: '@cpn-console/keycloak-plugin', replacement: path.resolve(rootDir, '../../plugins/keycloak/src/index.ts') },
+        { find: '@cpn-console/nexus-plugin', replacement: path.resolve(rootDir, '../../plugins/nexus/src/index.ts') },
+        { find: '@cpn-console/sonarqube-plugin', replacement: path.resolve(rootDir, '../../plugins/sonarqube/src/index.ts') },
+        { find: '@cpn-console/vault-plugin', replacement: path.resolve(rootDir, '../../plugins/vault/src/index.ts') },
+      ],
+    },
     test: {
       reporters: ['default', 'hanging-process'],
       environment: 'node',
       testTimeout: 2000,
       coverage: {
         provider: 'v8',
         reporter: ['text', 'lcov'],
-        include: ['src/**'],
+        include: ['src/**/*.ts'],
         exclude: [
           '**/types',
           '**/mocks',
           '**/*.spec.ts',
           '**/*.d.ts',
-          '**/*.vue',
           '**/queries.ts',
           '**/mocks.ts',
-          '**/*.sql',
         ],
       },
       include: ['src/**/*.spec.{ts,js}'],

package.json

@@ -13,9 +13,10 @@
     "npm": ">=11.0.0"
   },
   "scripts": {
+    "prebuild": "pnpm run db:generate",
     "build": "pnpm -r run build",
     "build:clean": "pnpm -r run build:clean",
-    "db:generate": "pnpm -r run db:generate",
+    "db:generate": "pnpm -r --workspace-concurrency=1 run db:generate",
     "dev": "docker compose -f ./docker/docker-compose.local.yml up -d --remove-orphans && echo '\nStart applications with commands:\n\n  pnpm --filter @cpn-console/server run dev\n  pnpm --filter @cpn-console/client run dev\n  pnpm --filter @cpn-console/server-nestjs run dev\n\nMake sure you provide env variables in `.env` files.'",
     "dev:clean": "docker compose -f ./docker/docker-compose.local.yml down --remove-orphans",
     "dev:delete": "docker compose -f ./docker/docker-compose.local.yml down -v --remove-orphans",
@@ -46,6 +47,8 @@
     "lint:root": "eslint .",
     "lint:style": "pnpm -r run lint:style",
     "lint:ts": "pnpm -r run lint:ts",
+    "pretest": "pnpm run db:generate",
+    "pretest:cov": "pnpm run db:generate",
     "playwright:test": "pnpm --dir playwright run playwright:test",
     "playwright:test:ui": "pnpm --dir playwright run playwright:test:ui",
     "playwright:test:integration": "pnpm --dir playwright run playwright:test:integration",

packages/hooks/package.json

@@ -11,9 +11,13 @@
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
+      "import": "./dist/index.js",
       "default": "./dist/index.js"
     }
   },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./types/index.d.ts",
   "files": [
     "dist",
     "types"

packages/logger/package.json

@@ -12,17 +12,23 @@
     ".": {
       "types": "./types/index.d.ts",
       "browser": "./dist/browser.js",
+      "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
     "./browser": {
       "types": "./types/browser.d.ts",
+      "import": "./dist/browser.js",
       "default": "./dist/browser.js"
     },
     "./hooks": {
       "types": "./types/hooks.d.ts",
+      "import": "./dist/hooks.js",
       "default": "./dist/hooks.js"
     }
   },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "browser": "./dist/browser.js",
   "files": [
     "dist",
     "types"

packages/shared/package.json

@@ -11,9 +11,13 @@
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
+      "import": "./dist/index.js",
       "default": "./dist/index.js"
     }
   },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./types/index.d.ts",
   "files": [
     "dist",
     "types"