chore(deps): fix npm package vulnerabilities in web and e2e/playwright (#5905)

* chore(deps): fix npm package vulnerabilities in web and e2e/playwright

* chore(deps): update resolution versions in web/package.json

* fix(web): patch ajv vulns and fix unit tests

- Upgrade ajv to 8.20.0 via yarn selective resolutions and lockfile
  update to resolve 4 moderate ReDoS vulnerabilities.
- Add mjs transform and babel plugin for private methods to
  support ESM-only msw dependencies (rettime, @open-draft, etc).
- Add WritableStream polyfill for msw compatibility in jsdom.
- Expand transformIgnorePatterns to cover msw's ESM transitive
  dependencies.

Fixes yarn audit: 6 vulns -> 2 low (elliptic, no patch available).

Author: emosbaugh

e2e/playwright/package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "playwright",
+  "name": "kots-e2e-playwright",
   "version": "1.0.0",
   "description": "",
   "main": "index.js",

e2e/playwright/package.json

@@ -7,5 +7,6 @@ module.exports = {
   plugins: [
     ["@babel/plugin-transform-class-properties", { loose: true }],
     ["@babel/plugin-transform-optional-chaining", { loose: true }],
+    ["@babel/plugin-transform-private-methods", { loose: true }],
   ],
 };

web/babel.config.js

@@ -7,7 +7,7 @@ module.exports = {
 
   // Transform files with babel and ts-jest
   transform: {
-    '^.+\\.(js|jsx)$': 'babel-jest',
+    '^.+\\.(js|jsx|mjs)$': 'babel-jest',
     '^.+\\.(ts|tsx)$': ['ts-jest', {
       useESM: true
     }],
@@ -18,7 +18,7 @@ module.exports = {
 
   // Transform ignore patterns for ES modules
   transformIgnorePatterns: [
-    'node_modules/(?!(query-string|intersection-observer|@tanstack|msw|decode-uri-component|filter-obj|split-on-first|until-async)/)'
+    'node_modules/(?!(query-string|intersection-observer|@tanstack|msw|@mswjs|@open-draft|decode-uri-component|filter-obj|split-on-first|until-async|rettime|outvariant|strict-event-emitter|headers-polyfill|is-node-process)/)'
   ],
 
   // Module name mapping for imports

web/jest.config.js

@@ -139,14 +139,16 @@
     "not dead"
   ],
   "resolutions": {
-    "qs": "^6.14.2",
+    "qs": "^6.15.1",
     "**/glob": "^10.5.0",
-    "**/react-router": "^7.12.0",
+    "**/react-router": "^7.15.0",
     "**/js-yaml": "^4.1.1",
     "dompurify": "^3.4.2",
     "serialize-javascript": "^7.0.5",
     "lodash": "^4.18.1",
-    "minimatch": "^3.1.4",
-    "picomatch": "^2.3.2"
+    "minimatch": "^3.1.5",
+    "picomatch": "^2.3.2",
+    "schema-utils/ajv": "^8.20.0",
+    "ajv-formats/ajv": "^8.20.0"
   }
 }

web/package.json

@@ -1,5 +1,14 @@
 import "intersection-observer";
 import "@testing-library/jest-dom";
+import { WritableStream } from "node:stream/web";
+
+// Polyfill WritableStream for MSW compatibility in JSDOM
+// jest-fixed-jsdom provides ReadableStream but not WritableStream
+// @ts-ignore
+if (typeof globalThis.WritableStream === "undefined") {
+  // @ts-ignore
+  globalThis.WritableStream = WritableStream;
+}
 
 // Set default API endpoint for tests to prevent undefined URLs
 process.env.API_ENDPOINT = process.env.API_ENDPOINT || "http://test-api";