chore: bump Node 21→22; update data-requirements doc URLs

[ayush-cstk]

🔗 Jira Ticket

CMG-1050

---

📋 PR Type

• ✨ Feature
• 🐛 Bug Fix
• 🔥 Hotfix
• ♻️ Refactor
• 🧹 Chore / Dependency Update
• 📝 Documentation

---

📝 Description

What changed?

• Bumped required Node.js version from 21 → 22 in setup.sh (version check, nvm install/nvm use calls, and the per-service terminal launch commands for macOS and Linux)
• Updated VALIDATION_DOCUMENTATION_URL in ui/src/utilities/constants.ts with the new hosted data-requirements PDFs for Sitecore, Contentful, WordPress, Drupal, and AEM (WordPress previously had no doc; AEM's doc is newly published)

Why?

• Node 21 is EOL; standardizing local setup on Node 22 keeps the dev environment aligned with the supported LTS line.
• The data-requirements documentation links shown in the UI were stale/missing (e.g. WordPress had none); this points every connector at its current, correctly hosted PDF — including the newly authored AEM guide.

---

🧩 Affected Areas

• api — Node.js backend
• ui — React frontend
• upload-api — Upload API server
• docker / docker-compose
• CI / GitHub Actions workflows
• Environment variables / config
• Other: local dev setup script (setup.sh)

---

🧪 How to Test

1. Run ./setup.sh on a machine with nvm installed and confirm it installs/switches to Node 22 (not 21) for api, upload-api, and ui
2. In the UI, open the connector selection/upload screen for each CMS (Sitecore, Contentful, WordPress, Drupal, AEM) and click the "data requirements" documentation link
3. Confirm each link opens the correct, matching PDF (no 404s, no mismatched CMS content)

Expected result: setup.sh provisions Node 22 across all three services; every connector's documentation link opens its correct, live PDF.

---

🔗 Related PRs / Dependencies

---

✅ Author Checklist

• Branch follows naming convention: feature/, bugfix/, or hotfix/ + 5–30 lowercase chars
• Jira ticket linked above
• Self-reviewed the diff — no debug logs, commented-out code, or TODOs left in
• .env / example.env updated if new environment variables were added — N/A, no env vars touched
• No sensitive credentials or secrets committed
• Existing tests pass locally (npm test)
• New tests written (or not applicable — explain why) — N/A, config/constants-only change, no testable logic
• README.md / docs updated if behaviour changed — N/A, no user-facing behavior/API changed
• Talisman pre-push scan passes (no secrets flagged)

---

👀 Reviewer Notes

Small, self-contained change — two files only, no logic touched. Worth double-checking the AEM URL specifically since that doc was only just published.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	4	382	25	✅ Passed
🟡 Medium Severity	0	1	500	✅ Passed
🔵 Low Severity	1	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 382
• Medium without fixes: 1
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	4	382	25	✅ Passed
🟡 Medium Severity	0	1	500	✅ Passed
🔵 Low Severity	1	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 382
• Medium without fixes: 1
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed

[Copilot]

Pull request overview

This PR updates local development setup to use Node.js 22 and refreshes the UI’s data-requirements documentation links so each connector points at the current hosted PDF.

Changes:

• Update setup.sh to install/use Node 22 and launch all services with nvm use 22.
• Refresh VALIDATION_DOCUMENTATION_URL constants to new hosted PDF URLs (including newly added WordPress and AEM docs).
• Update the unit test assertions to validate the new documentation filenames.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
setup.sh	Bumps local dev Node version usage from 21 → 22 and updates service terminal launch commands accordingly.
ui/src/utilities/constants.ts	Replaces stale/missing validation documentation URLs with new hosted PDF links per CMS.
ui/tests/unit/utilities/constants.test.ts	Updates unit test expectations to match the new documentation URL filenames.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	1	0	10	✅ Passed
🟠 High Severity	4	382	25	✅ Passed
🟡 Medium Severity	0	1	500	✅ Passed
🔵 Low Severity	1	0	1000	✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	0	90 / 365 days	✅ Passed
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 382
• Medium without fixes: 1
• Low without fixes: 0

✅ BUILD PASSED - All security checks passed