Prod - August Release 1

.github/workflows/trivy.yaml

@@ -1,34 +1,45 @@
 name: Trivy Scanner
 
-permissions:
-  contents: read
-  security-events: write
 on:
   push:
     branches:
       - main
+      - master
       - dev
+      - develop
   pull_request:
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   trivy-scan:
-    name: Use Trivy
+    name: Trivy SAST and SCA
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
       - name: Run Trivy scanner in repo mode
-        uses: aquasecurity/trivy-action@0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: "v0.73.0"
           scan-type: "fs"
+          scan-ref: "."
           ignore-unfixed: true
           format: "sarif"
           output: "trivy-results.sarif"
           severity: "CRITICAL,HIGH,UNKNOWN"
+          limit-severities-for-sarif: true
           scanners: vuln,secret,misconfig,license
+          trivyignores: ".trivyignore.yaml"
           github-pat: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: "trivy-results.sarif"

.trivyignore.yaml

@@ -0,0 +1,31 @@
+# React Router GHSA-qwww-vcr4-c8h2 affects only applications using its unstable
+# React Server Components APIs. This project is a browser-only CRA application
+# and has no RSC dependencies, configuration, or API usage. React Router 8 also
+# requires React 19 and a newer Node runtime, so keep this exception pinned to
+# the reviewed package version and lockfile entry.
+vulnerabilities:
+  - id: GHSA-qwww-vcr4-c8h2
+    paths:
+      - "yarn.lock"
+    purls:
+      - "pkg:npm/react-router@7.18.2"
+    statement: "Not applicable: this browser SPA does not use React Router's unstable RSC APIs."
+
+# Stripe publishable keys are client-side identifiers, not secret API keys. Keep
+# this exception limited to the three environment files that intentionally
+# configure the browser application.
+secrets:
+  - id: stripe-publishable-token
+    paths:
+      - ".environments/.env.dev"
+      - ".environments/.env.qa"
+      - ".environments/.env.prod"
+    statement: "These are intentional Stripe publishable keys used by the client application."
+
+# ISC is the declared license for this project. Trivy reports the project-level
+# license against the dependency lockfile, so scope the exception to that path.
+licenses:
+  - id: ISC
+    paths:
+      - "yarn.lock"
+    statement: "ISC is the approved license for this project."

craco.config.js

@@ -21,6 +21,47 @@ function withNodeModulesWatchIgnore(ignored) {
     ];
 }
 
+/**
+ * Converts CRA's webpack-dev-server v4 hook registrations into v5 middleware entries.
+ *
+ * @param {Function|undefined} hook - Legacy CRA middleware hook.
+ * @param {object} devServer - Active webpack-dev-server instance.
+ * @param {string} namePrefix - Stable prefix used for middleware diagnostics.
+ * @returns {Array<object>} Middleware entries accepted by webpack-dev-server v5.
+ */
+function collectLegacyMiddlewares(hook, devServer, namePrefix) {
+    if (!hook) {
+        return [];
+    }
+
+    const originalApp = devServer.app;
+    const appProxy = Object.create(originalApp);
+    const registrations = [];
+
+    appProxy.use = (...args) => {
+        registrations.push(args);
+        return appProxy;
+    };
+
+    devServer.app = appProxy;
+    try {
+        hook(devServer);
+    } finally {
+        devServer.app = originalApp;
+    }
+
+    return registrations.flatMap((registration, registrationIndex) => {
+        const args = [...registration];
+        const path = typeof args[0] === 'string' ? args.shift() : undefined;
+
+        return args.map((middleware, middlewareIndex) => ({
+            name: `${namePrefix}-${registrationIndex}-${middlewareIndex}`,
+            ...(path ? { path } : {}),
+            middleware,
+        }));
+    });
+}
+
 /**
  * Preserves CRA's dev-server static config while disabling public asset watches.
  *
@@ -29,14 +70,53 @@ function withNodeModulesWatchIgnore(ignored) {
  * @throws This function does not throw.
  */
 function configureDevServer(devServerConfig) {
+    const {
+        https,
+        onAfterSetupMiddleware,
+        onBeforeSetupMiddleware,
+        setupMiddlewares,
+        ...supportedConfig
+    } = devServerConfig;
     const staticConfig = devServerConfig.static || {};
 
     return {
-        ...devServerConfig,
+        ...supportedConfig,
+        ...(https ? {
+            server: {
+                type: 'https',
+                options: typeof https === 'object' ? https : {},
+            },
+        } : {}),
         static: {
             ...staticConfig,
             watch: false,
         },
+        setupMiddlewares: (middlewares, devServer) => {
+            // CRA 5 still calls the webpack-dev-server v4 shutdown method.
+            if (!devServer.close && devServer.stopCallback) {
+                devServer.close = devServer.stopCallback.bind(devServer);
+            }
+
+            const configuredMiddlewares = setupMiddlewares
+                ? setupMiddlewares(middlewares, devServer)
+                : middlewares;
+            const beforeMiddlewares = collectLegacyMiddlewares(
+                onBeforeSetupMiddleware,
+                devServer,
+                'cra-before-setup',
+            );
+            const afterMiddlewares = collectLegacyMiddlewares(
+                onAfterSetupMiddleware,
+                devServer,
+                'cra-after-setup',
+            );
+
+            return [
+                ...beforeMiddlewares,
+                ...configuredMiddlewares,
+                ...afterMiddlewares,
+            ];
+        },
     };
 }
 
@@ -72,6 +152,15 @@ const localIdentName = isProd
 const resolve = dir => path.resolve(__dirname, dir);
 
 module.exports = {
+    jest: {
+        configure: {
+            moduleNameMapper: {
+                // Jest 27 cannot resolve React Router 7's nested conditional export.
+                '^react-router/dom$': '<rootDir>/test/react-router-dom.cjs',
+            },
+        },
+    },
+
     style: {
         modules: {
             localIdentName,

package.json

@@ -43,7 +43,7 @@
     "@uiw/react-codemirror": "^4.25.8",
     "amazon-s3-uri": "^0.1.1",
     "apexcharts": "^3.54.1",
-    "axios": "^1.15.0",
+    "axios": "^1.19.0",
     "browser-cookies": "^1.2.0",
     "city-timezones": "^1.3.2",
     "classnames": "^2.5.1",
@@ -52,7 +52,7 @@
     "crypto-js": "^4.2.0",
     "customize-cra": "^1.0.0",
     "date-fns": "^2.30.0",
-    "dompurify": "^2.5.8",
+    "dompurify": "^3.4.13",
     "draft-js": "^0.11.7",
     "draft-js-export-html": "^1.4.1",
     "draft-js-markdown-shortcuts-plugin": "^0.6.1",
@@ -68,7 +68,7 @@
     "highlight.js": "^11.11.1",
     "html2canvas": "^1.4.1",
     "lodash": "^4.18.1",
-    "markdown-it": "^13.0.2",
+    "markdown-it": "^14.3.0",
     "marked": "4.3.0",
     "moment": "^2.30.1",
     "moment-duration-format": "^2.3.2",
@@ -97,7 +97,7 @@
     "react-redux-toastr": "^7.6.13",
     "react-responsive": "^9.0.2",
     "react-responsive-modal": "^6.4.2",
-    "react-router-dom": "^6.30.2",
+    "react-router-dom": "^7.18.2",
     "react-scripts": "5.0.1",
     "react-select": "^5.10.2",
     "react-spinners": "^0.17.0",
@@ -116,7 +116,7 @@
     "remark-gfm": "^3.0.1",
     "remark-parse": "^11.0.0",
     "remove": "^0.1.5",
-    "sanitize-html": "^2.17.0",
+    "sanitize-html": "^2.17.6",
     "sass": "^1.95.0",
     "styled-components": "^5.3.11",
     "swr": "^1.3.0",
@@ -128,7 +128,7 @@
     "yup": "^1.7.1"
   },
   "devDependencies": {
-    "@babel/core": "^7.28.5",
+    "@babel/core": "^7.29.6",
     "@babel/plugin-syntax-jsx": "^7.27.1",
     "@babel/plugin-transform-runtime": "^7.28.5",
     "@babel/preset-env": "^7.28.5",
@@ -147,12 +147,10 @@
     "@testing-library/jest-dom": "^5.17.0",
     "@testing-library/react": "^13.4.0",
     "@testing-library/user-event": "^14.6.1",
-    "@types/axios": "^0.14.4",
-    "@types/dompurify": "^2.4.0",
     "@types/highlightjs": "^9.12.6",
     "@types/jest": "^29.5.14",
     "@types/lodash": "^4.17.21",
-    "@types/markdown-it": "^12.2.3",
+    "@types/markdown-it": "^14.1.2",
     "@types/marked": "4.3.2",
     "@types/node": "^18.19.130",
     "@types/reach__router": "^1.3.15",
@@ -162,30 +160,24 @@
     "@types/react-gtm-module": "^2.0.4",
     "@types/react-helmet": "^6.1.11",
     "@types/react-redux-toastr": "^7.6.6",
-    "@types/react-router-dom": "^5.3.3",
     "@types/redux-actions": "2.6.5",
     "@types/redux-logger": "^3.0.13",
     "@types/redux-promise": "^0.5.32",
     "@types/sanitize-html": "^2.16.0",
     "@types/systemjs": "^6.15.4",
     "@types/testing-library__jest-dom": "^5.14.9",
-    "@types/uuid": "^8.3.4",
     "@typescript-eslint/eslint-plugin": "^5.62.0",
     "@typescript-eslint/parser": "^5.62.0",
     "@wdio/junit-reporter": "^7.40.0",
     "autoprefixer": "^10.4.22",
     "babel-eslint": "^11.0.0-beta.2",
     "babel-jest": "^29.7.0",
-    "babel-plugin-inline-react-svg": "^2.0.2",
     "babel-plugin-module-resolver": "^4.1.0",
     "babel-plugin-named-exports-order": "^0.0.2",
-    "babel-plugin-react-css-modules": "^5.2.6",
     "concurrently": "^7.6.0",
     "craco-css-modules": "^1.0.6",
     "craco-plugin-env": "^1.0.5",
-    "craco-resolve-url-loader": "^1.0.0",
     "cross-env": "^7.0.3",
-    "css-loader": "3.6.0",
     "eslint": "^8.57.1",
     "eslint-config-airbnb": "^19.0.4",
     "eslint-config-react-app": "^7.0.1",
@@ -202,7 +194,6 @@
     "istanbul-lib-coverage": "^3.2.2",
     "jest": "^29.7.0",
     "jest-cli": "^29.7.0",
-    "lint-staged": "^13.3.0",
     "nyc": "^15.1.0",
     "postcss-loader": "^4.3.0",
     "postcss-scss": "^3.0.5",
@@ -218,15 +209,32 @@
     "style-loader": "^3.3.4",
     "systemjs-webpack-interop": "^2.3.7",
     "tsconfig-paths-webpack-plugin": "^4.2.0",
-    "typed-scss-modules": "^7.1.4",
     "webpack": "^5.103.0",
     "webpack-cli": "^4.10.0",
-    "webpack-config-single-spa-react": "^4.0.5",
-    "webpack-dev-server": "^4.15.2",
+    "webpack-dev-server": "^5.2.6",
     "webpack-merge": "^5.10.0"
   },
   "resolutions": {
     "@types/react": "18.3.27",
+    "@babel/core": "7.29.7",
+    "@tootallnate/once": "2.0.1",
+    "axios": "1.19.0",
+    "body-parser": "1.20.6",
+    "**/esbuild": "0.25.12",
+    "@jackwilsdon/craco-use-babelrc/@craco/craco/cross-spawn": "6.0.6",
+    "draft-js/immutable": "4.3.9",
+    "draft-js-plugins-editor/immutable": "4.3.9",
+    "draft-js-markdown-shortcuts-plugin/**/immutable": "4.3.9",
+    "sass/immutable": "5.1.9",
+    "react-scripts/resolve-url-loader": "5.0.0",
+    "react-scripts/resolve-url-loader/postcss": "8.5.25",
+    "react-scripts/**/serialize-javascript": "7.0.7",
+    "@svgr/plugin-svgo": "6.5.1",
+    "react-scripts/**/svgo": "2.8.3",
+    "**/tar": "7.5.22",
+    "underscore": "1.13.8",
+    "**/uuid": "11.1.1",
+    "react-scripts/webpack-dev-server": "5.2.6",
     "string-width": "4.2.0",
     "node-fetch": "2.6.7",
     "nth-check": "2.0.1",

src/apps/accounts/src/lib/components/setting-section/SettingSection.spec.tsx

@@ -0,0 +1,21 @@
+/* eslint-disable import/no-extraneous-dependencies, ordered-imports/ordered-imports */
+import '@testing-library/jest-dom'
+import type { RenderResult } from '@testing-library/react'
+import { render, screen } from '@testing-library/react'
+
+import SettingSection from './SettingSection'
+
+describe('SettingSection', () => {
+    it('renders user-provided information as text instead of HTML', () => {
+        const unsafeInfo: string = '<img src="invalid" onerror="alert(1)">'
+        const view: RenderResult = render(
+            <SettingSection title='Software' infoText={unsafeInfo} />,
+        )
+
+        expect(screen.getByText(unsafeInfo))
+            .toBeInTheDocument()
+        expect(view.container.querySelector('img'))
+            .not
+            .toBeInTheDocument()
+    })
+})

src/apps/accounts/src/lib/components/setting-section/SettingSection.tsx

@@ -17,10 +17,7 @@ const SettingSection: FC<SettingSectionProps> = (props: SettingSectionProps) =>
 
         <div className={styles.contentMiddle}>
             <p className='body-main-bold'>{props.title}</p>
-            <p
-                className={styles.infoText}
-                dangerouslySetInnerHTML={{ __html: props.infoText || '' }}
-            />
+            <p className={styles.infoText}>{props.infoText || ''}</p>
         </div>
 
         {props.actionElement}

src/apps/admin/src/ai/review-workflows/AiReviewWorkflowsPage.tsx

@@ -170,6 +170,15 @@ export const AiReviewWorkflowsPage: FC = () => {
             },
             type: 'element',
         },
+        {
+            defaultSortDirection: 'asc',
+            label: 'Review Method',
+            propertyName: 'reviewMethod',
+            renderer: (data: AiWorkflow) => (
+                <div className={styles.cellText}>{data.reviewMethod || 'N/A'}</div>
+            ),
+            type: 'element',
+        },
     ], [])
 
     const columnsMobile = useMemo<MobileTableColumn<AiWorkflow>[][]>(