Remove malicious postcss payload; Node 26, pnpm 12, deps (#2023)

* pin Node to 26.12.1

* bump pnpm to 12.15.0

* bump GitHub Actions to latest majors

* update deps within existing semver ranges

* apply prettier 3.9 formatting

* update SVG snapshots for vite-plugin-magical-svg 1.10

* bump @types/node 26, chromatic 18, dotenv 18; drop stub types

* bump vitest 5, jsdom 30, jest-dom 7

* bump @sentry/nextjs to 11

* bump ESLint plugin majors (eslint-react 5, unicorn 78, etc)

* remove unused @eslint-react/purity disable directive

* bump pinned Radix and lint-staged; drop stub airtable types

* override webpack-dev-middleware to patch path traversal

* remove malicious payload; lint root config files

* lint the whole repo in CI, not just src

Author: kylemh

.github/workflows/chromatic.yml

@@ -8,15 +8,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "pnpm"

.github/workflows/ci.yml

@@ -11,15 +11,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           run_install: false
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "pnpm"
@@ -34,15 +34,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           run_install: false
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "pnpm"
@@ -55,7 +55,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: github.event_name == 'pull_request'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: vitest-coverage
           path: vitest-coverage
@@ -68,15 +68,15 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
 
       - name: Install pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
         with:
           run_install: false
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: ".nvmrc"
           cache: "pnpm"
@@ -94,15 +94,15 @@ jobs:
 
       - name: Upload Playwright report
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-report
           path: playwright-report/
           retention-days: 30
 
       - name: Comment PR with Playwright artifact link
         if: always() && github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
         with:
           script: |
             const runId = context.runId;
@@ -171,10 +171,10 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Download Coverage Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: vitest-coverage
           path: vitest-coverage

.nvmrc

@@ -1 +1 @@
-24
+26.12.1

README.md

@@ -25,7 +25,7 @@ Our entire UI library is documented via [![Storybook](https://github.com/storybo
 Required versions of tools used within the repo:
 
 - Node: See [.nvmrc](https://github.com/OperationCode/front-end/blob/main/.nvmrc)
-- `pnpm@10`
+- `pnpm@12`
 - `git@2.17.1` or greater
 
 ```sh

eslint.config.mjs

@@ -16,15 +16,16 @@ import eslintPluginReactHooks from 'eslint-plugin-react-hooks';
 import reactYouMightNotNeedAnEffect from 'eslint-plugin-react-you-might-not-need-an-effect';
 import eslintPluginStorybook from 'eslint-plugin-storybook';
 
-
 const compat = new FlatCompat({
   baseDirectory: import.meta.dirname,
 });
 
 /** @type {import("eslint").Linter.Config['languageOptions']} */
 const languageOptions = {
   parserOptions: {
-    projectService: true,
+    projectService: {
+      allowDefaultProject: ['*.config.js', '*.config.mjs'],
+    },
     tsconfigRootDir: import.meta.dirname,
   },
   ecmaVersion: 'latest',
@@ -46,7 +47,6 @@ export default defineConfig(
     'public/**',
     'src/.storybook/**',
     '*.svg',
-    'prettier.config.js',
   ]),
 
   // ── Base configs ──
@@ -197,7 +197,7 @@ export default defineConfig(
   },
 
   // ── No Barrel Files ──
-  noBarrelFiles.flat,
+  ...noBarrelFiles.configs['flat/recommended'],
 
   // ── CommonJS files ──
   {

next.config.ts

@@ -1,5 +1,5 @@
 import type { NextConfig } from 'next';
-import { withSentryConfig } from '@sentry/nextjs';
+import { withSentryConfig } from '@sentry/nextjs/config';
 import bundleAnalyzer from '@next/bundle-analyzer';
 import createMDX from '@next/mdx';
 import { svgoConfig } from './src/lib/config/svgo';

package.json

@@ -10,7 +10,7 @@
     "format": "prettier --write \"**/*\"",
     "format:md": "prettier --write \"**/*.md\"",
     "lint": "pnpm lint:scripts && pnpm format:md",
-    "lint:ci": "eslint src",
+    "lint:ci": "eslint .",
     "lint:scripts": "eslint --fix src",
     "postbuild": "next-sitemap --config next-sitemap.config.ts",
     "prepare": "husky",
@@ -34,99 +34,97 @@
     "vitest": "cross-env vitest --config ./vitest.config.mts"
   },
   "dependencies": {
-    "@base-ui/react": "^1.6.0",
-    "@hookform/resolvers": "^5.4.3",
+    "@base-ui/react": "^1.9.0",
+    "@hookform/resolvers": "^5.9.2",
     "@mdx-js/loader": "^3.1.1",
     "@mdx-js/react": "^3.1.1",
-    "@next/bundle-analyzer": "^16.2.11",
-    "@next/mdx": "^16.2.11",
-    "@radix-ui/react-dialog": "1.1.23",
-    "@radix-ui/react-tabs": "1.1.21",
-    "@sentry/nextjs": "^10.68.0",
-    "@types/airtable": "^0.10.5",
+    "@next/bundle-analyzer": "^16.4.2",
+    "@next/mdx": "^16.4.2",
+    "@radix-ui/react-dialog": "1.3.1",
+    "@radix-ui/react-tabs": "1.2.1",
+    "@sentry/nextjs": "^11.8.0",
     "@types/mdx": "^2.0.14",
     "airtable": "^0.12.2",
-    "axios": "^1.18.1",
+    "axios": "^1.20.0",
     "cva": "1.0.0-beta.8",
-    "fast-xml-parser": "^5.10.1",
+    "fast-xml-parser": "^5.11.2",
     "fingerprintjs2": "^2.1.4",
     "fontfaceobserver": "^2.3.0",
     "lodash": "^4.18.1",
-    "logrocket": "^12.1.1",
+    "logrocket": "^12.4.0",
     "logrocket-react": "^7.0.1",
-    "lucide-react": "^1.26.0",
-    "next": "^16.3.3",
+    "lucide-react": "^1.59.0",
+    "next": "^16.4.2",
     "next-sitemap": "^4.2.3",
     "object-hash": "^3.0.0",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "react-hook-form": "^7.83.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "react-hook-form": "^7.90.0",
     "react-player": "^3.4.0",
     "react-select": "^5.10.2",
     "remark-gfm": "^4.0.1",
-    "tailwind-merge": "^3.6.0",
+    "tailwind-merge": "^3.7.0",
     "tw-animate-css": "^1.4.0",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
-    "@eslint-react/eslint-plugin": "^4.2.3",
-    "@eslint/eslintrc": "^3.3.5",
+    "@eslint-react/eslint-plugin": "^5.28.1",
+    "@eslint/eslintrc": "^3.3.7",
     "@eslint/js": "^10.0.1",
-    "@faker-js/faker": "^10.4.0",
-    "@next/eslint-plugin-next": "^16.2.6",
-    "@playwright/test": "^1.59.1",
-    "@storybook/addon-docs": "^10.3.6",
-    "@storybook/nextjs": "^10.3.6",
+    "@faker-js/faker": "^10.6.0",
+    "@next/eslint-plugin-next": "^16.4.2",
+    "@playwright/test": "^1.64.1",
+    "@storybook/addon-docs": "^10.6.2",
+    "@storybook/nextjs": "^10.6.2",
     "@svgr/webpack": "^8.1.0",
-    "@tailwindcss/postcss": "^4.3.0",
-    "@testing-library/jest-dom": "^6.9.1",
-    "@testing-library/react": "^16.3.2",
-    "@types/fingerprintjs2": "2",
+    "@tailwindcss/postcss": "^4.3.3",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.3",
+    "@types/fingerprintjs2": "^2.0.0",
     "@types/fontfaceobserver": "^2.1.3",
-    "@types/lodash": "^4.17.24",
-    "@types/logrocket-react": "^3.0.3",
-    "@types/node": "^24.9.1",
-    "@types/object-hash": "^3.0.0",
-    "@types/react": "^19.2.14",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^6.0.1",
-    "@vitest/coverage-v8": "^4.1.5",
-    "@vitest/eslint-plugin": "^1.6.17",
-    "@vitest/ui": "^4.1.5",
+    "@types/lodash": "^4.17.26",
+    "@types/node": "^26.6.5",
+    "@types/object-hash": "^3.0.6",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "@vitest/coverage-v8": "^5.0.5",
+    "@vitest/eslint-plugin": "^1.6.27",
+    "@vitest/ui": "^5.0.5",
     "axios-mock-adapter": "^2.1.0",
     "babel-plugin-react-compiler": "^1.0.0",
-    "chromatic": "^16.9.1",
+    "chromatic": "^18.13.0",
     "cross-env": "^10.1.0",
-    "dotenv": "^17.4.2",
-    "eslint": "^10.3.0",
+    "dotenv": "^18.0.8",
+    "eslint": "^10.13.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-import-resolver-typescript": "^4.4.4",
-    "eslint-plugin-better-tailwindcss": "^4.5.0",
-    "eslint-plugin-import-x": "^4.16.2",
-    "eslint-plugin-lodash": "^8.0.0",
-    "eslint-plugin-no-barrel-files": "^1.3.1",
-    "eslint-plugin-playwright": "^2.10.2",
-    "eslint-plugin-prettier": "^5.5.5",
+    "eslint-import-resolver-typescript": "^4.4.5",
+    "eslint-plugin-better-tailwindcss": "^4.9.1",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-lodash": "^8.1.0",
+    "eslint-plugin-no-barrel-files": "^2.2.0",
+    "eslint-plugin-playwright": "^2.12.1",
+    "eslint-plugin-prettier": "^5.5.7",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "eslint-plugin-react-you-might-not-need-an-effect": "^0.10.1",
-    "eslint-plugin-storybook": "^10.3.6",
-    "eslint-plugin-unicorn": "^64.0.0",
+    "eslint-plugin-react-you-might-not-need-an-effect": "^1.0.2",
+    "eslint-plugin-storybook": "^10.6.2",
+    "eslint-plugin-unicorn": "^78.0.0",
     "husky": "^9.1.7",
-    "jsdom": "^29.1.1",
-    "lint-staged": "17.0.4",
+    "jsdom": "^30.1.3",
+    "lint-staged": "17.6.0",
     "postcss": "^8.5.14",
-    "prettier": "^3.8.3",
-    "prettier-plugin-tailwindcss": "^0.8.0",
-    "shadcn": "^4.7.0",
-    "storybook": "^10.3.6",
-    "tailwindcss": "^4.3.0",
+    "prettier": "^3.9.10",
+    "prettier-plugin-tailwindcss": "^0.8.1",
+    "shadcn": "^4.22.1",
+    "storybook": "^10.6.2",
+    "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.2",
+    "typescript-eslint": "^8.71.2",
     "vite": "^8.0.12",
-    "vite-plugin-magical-svg": "^1.9.0",
+    "vite-plugin-magical-svg": "^1.10.3",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^4.1.5",
-    "webpack": "^5.106.2"
+    "vitest": "^5.0.5",
+    "webpack": "^5.112.0"
   },
-  "packageManager": "pnpm@11.2.2+sha512.36e6621fad506178936455e70247b8808ef4ec25797a9f437a93281a020484e2607f6a469a22e982987c3dbb8866e3071514ab10a4a1749e06edcd1ec118436f"
+  "packageManager": "pnpm@12.15.0+sha512.b3951d6d6ff4a9f13dc7cf56cd28d2b8eb37dbcc9c68e52e1e1191873ea9f82a017287ab50baadc5ccc494f036c67c0e47eb13608c2fa36f47711b61ea128e61"
 }