Bump dependencies to fix dependabot security issues

apps/client/package.json

@@ -34,7 +34,7 @@
     "@iconify/vue": "^4.3.0",
     "@ts-rest/core": "^3.52.1",
     "@vue/tsconfig": "^0.7.0",
-    "axios": "^1.13.6",
+    "axios": "^1.15.1",
     "javascript-time-ago": "^2.6.4",
     "jszip": "^3.10.1",
     "keycloak-js": "^26.2.3",
@@ -57,24 +57,24 @@
     "@types/node": "^24.12.0",
     "@unocss/transformer-directives": "^0.65.4",
     "@vitejs/plugin-vue": "^6.0.4",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "@vue/eslint-config-typescript": "^14.7.0",
     "chalk": "^5.6.2",
     "eslint-plugin-vue": "^10.8.0",
     "jsdom": "^25.0.1",
     "rimraf": "^6.1.3",
-    "stylelint": "^17.4.0",
+    "stylelint": "^17.11.0",
     "stylelint-config-html": "^1.1.0",
     "stylelint-config-recommended-vue": "^1.6.1",
     "stylelint-config-standard": "^40.0.0",
     "typescript": "^5.9.3",
     "unocss": "^66.6.6",
     "unplugin-auto-import": "^0.18.6",
     "unplugin-vue-components": "^0.27.5",
-    "vite": "^7.3.1",
-    "vite-node": "^2.1.9",
+    "vite": "^7.3.2",
+    "vite-node": "^6.0.0",
     "vite-plugin-pwa": "^1.2.0",
-    "vitest": "^2.1.9",
+    "vitest": "^4.1.5",
     "vue-eslint-parser": "^10.4.0",
     "vue-tsc": "^2.2.12",
     "workbox-window": "^7.4.0"

apps/server-nestjs/package.json

@@ -98,7 +98,7 @@
     "@types/express": "^5.0.6",
     "@types/node": "^22.19.15",
     "@types/supertest": "^6.0.3",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "eslint": "^9.39.4",
     "fastify-plugin": "^5.1.0",
     "globals": "^16.5.0",
@@ -115,9 +115,9 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.57.0",
     "typescript-transform-paths": "^3.5.6",
-    "vite": "^7.3.1",
-    "vite-node": "^2.1.9",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vite-node": "^6.0.0",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "tag": "latest"

apps/server-nestjs/src/modules/service-chain/open-cds-client.service.spec.ts

@@ -40,8 +40,16 @@ describe('openCdsClientService', () => {
     tlsDispatcher = { dispatch: vi.fn() }
     proxyDispatcher = { dispatch: vi.fn() }
 
-    vi.mocked(Agent).mockImplementation(() => tlsDispatcher as never)
-    vi.mocked(ProxyAgent).mockImplementation(() => proxyDispatcher as never)
+    class MockAgent {
+      dispatch = tlsDispatcher
+    };
+
+    class ProxyMockAgent {
+      dispatch = proxyDispatcher
+    };
+
+    vi.mocked(Agent).mockImplementation(MockAgent as any)
+    vi.mocked(ProxyAgent).mockImplementation(ProxyMockAgent as any)
 
     config = {
       openCdsUrl: 'https://opencds.example.com/root/api/',
@@ -76,7 +84,7 @@ describe('openCdsClientService', () => {
     })
     const [url, init] = getLastFetchCall()
     expect(url).toBe('https://opencds.example.com/root/api/requests')
-    expect(init.dispatcher).toBe(tlsDispatcher)
+    expect(init.dispatcher?.dispatch).toBe(tlsDispatcher)
     expect(init.method).toBe('GET')
     expect(init.signal).toBeUndefined()
     expect(new Headers(init.headers).get('X-API-Key')).toBe('test-token')
@@ -102,7 +110,7 @@ describe('openCdsClientService', () => {
     })
     const [url, init] = getLastFetchCall()
     expect(url).toBe('https://opencds.example.com/root/api/requests')
-    expect(init.dispatcher).toBe(proxyDispatcher)
+    expect(init.dispatcher?.dispatch).toBe(proxyDispatcher)
     expect(init.method).toBe('GET')
     expect(init.signal).toBeUndefined()
     expect(new Headers(init.headers).get('X-API-Key')).toBe('test-token')
@@ -136,7 +144,7 @@ describe('openCdsClientService', () => {
 
     const [url, init] = getLastFetchCall()
     expect(url).toBe('https://opencds.example.com/root/api/validate/id')
-    expect(init.dispatcher).toBe(tlsDispatcher)
+    expect(init.dispatcher?.dispatch).toBe(tlsDispatcher)
     expect(init.method).toBe('POST')
     expect(init.signal).toBeUndefined()
     expect(init.body).toBeUndefined()
@@ -158,7 +166,7 @@ describe('openCdsClientService', () => {
       requestId: '123',
       enabled: true,
     }))
-    expect(init.dispatcher).toBe(tlsDispatcher)
+    expect(init.dispatcher?.dispatch).toBe(tlsDispatcher)
     expect(init.method).toBe('POST')
     expect(init.signal).toBeUndefined()
     expect(new Headers(init.headers).get('X-API-Key')).toBe('test-token')

apps/server/package.json

@@ -71,10 +71,10 @@
     "@ts-rest/core": "^3.52.1",
     "@ts-rest/fastify": "^3.52.1",
     "@ts-rest/open-api": "^3.52.1",
-    "axios": "^1.13.6",
+    "axios": "^1.15.1",
     "date-fns": "^4.1.0",
     "fastify": "^4.29.1",
-    "fastify-keycloak-adapter": "2.3.2",
+    "fastify-keycloak-adapter": "^3.0.0",
     "json-2-csv": "^5.5.10",
     "mustache": "^4.2.0",
     "prisma": "^6.19.2",
@@ -87,17 +87,17 @@
     "@cpn-console/ts-config": "workspace:^",
     "@faker-js/faker": "^9.9.0",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "fastify-plugin": "^5.1.0",
     "nodemon": "^3.1.14",
     "pino-pretty": "^13.1.3",
     "rimraf": "^6.1.3",
     "ts-patch": "^3.3.0",
     "typescript": "^5.9.3",
     "typescript-transform-paths": "^3.5.6",
-    "vite": "^7.3.1",
-    "vite-node": "^2.1.9",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vite-node": "^6.0.0",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

apps/server/src/connect.spec.ts

@@ -5,7 +5,10 @@ import prisma from './__mocks__/prisma.js'
 import app from './app.js'
 import { getConnection } from './connect.js'
 
-vi.mock('fastify-keycloak-adapter', (await import('./utils/mocks.js')).mockSessionPlugin)
+vi.mock(
+  'fastify-keycloak-adapter',
+  (await import('./utils/mocks.js')).mockSessionPlugin,
+)
 vi.mock('@/resources/queries-index.js')
 vi.mock('./models/log.js', () => getModel('getLogModel'))
 vi.mock('./models/repository.js', () => getModel('getRepositoryModel'))
@@ -16,6 +19,13 @@ vi.mock('./models/user.js', () => getModel('getUserModel'))
 vi.mock('./models/users-projects.js', () => getModel('getRolesModel'))
 vi.mock('./models/zone.js', () => getModel('getZoneModel'))
 vi.mock('./prisma.js')
+vi.mock('./utils/env.js', async (importOriginal) => {
+  const actual = await importOriginal()
+  return {
+    ...actual,
+    isTest: true,
+  }
+})
 
 vi.spyOn(app, 'listen')
 const infoSpy = vi.spyOn(logger, 'info')
@@ -48,21 +58,29 @@ describe('connect', () => {
     expect(infoSpy.mock.calls).toContainEqual(['Connected to Postgres!'])
   })
 
-  it('should fail to connect once, then connect to postgres', async () => {
-    const errorToCatch = new PrismaClientInitializationError('Failed to connect', '2.19.0', 'P1001')
+  it(
+    'should fail to connect once, then connect to postgres',
+    { timeout: 10_000 },
+    async () => {
+      const errorToCatch = new PrismaClientInitializationError(
+        'Failed to connect',
+        '2.19.0',
+        'P1001',
+      )
 
-    prisma.$connect.mockRejectedValueOnce(errorToCatch)
-    await getConnection()
+      prisma.$connect.mockRejectedValueOnce(errorToCatch)
+      await getConnection()
 
-    expect(errorSpy.mock.calls).toHaveLength(1)
-    expect(errorSpy.mock.calls[0]?.[1]).toBe('Could not connect to Postgres')
+      expect(errorSpy.mock.calls).toHaveLength(1)
+      expect(errorSpy.mock.calls[0]?.[1]).toBe('Could not connect to Postgres')
 
-    expect(infoSpy.mock.calls).toHaveLength(2)
-    expect(infoSpy.mock.calls[0]?.[1]).toBe('Retrying Postgres connection')
-    expect(infoSpy.mock.calls).toContainEqual(['Connected to Postgres!'])
+      expect(infoSpy.mock.calls).toHaveLength(2)
+      expect(infoSpy.mock.calls[0]?.[1]).toBe('Retrying Postgres connection')
+      expect(infoSpy.mock.calls).toContainEqual(['Connected to Postgres!'])
 
-    expect(debugSpy.mock.calls).toHaveLength(2)
-    expect(debugSpy.mock.calls[0]?.[1]).toBe('Connecting to Postgres')
-    expect(debugSpy.mock.calls[1]?.[1]).toBe('Connecting to Postgres')
-  })
+      expect(debugSpy.mock.calls).toHaveLength(2)
+      expect(debugSpy.mock.calls[0]?.[1]).toBe('Connecting to Postgres')
+      expect(debugSpy.mock.calls[1]?.[1]).toBe('Connecting to Postgres')
+    },
+  )
 })

package.json

@@ -46,16 +46,16 @@
     "playwright:test:ui": "pnpm --dir playwright run playwright:test:ui",
     "playwright:test:integration": "pnpm --dir playwright run playwright:test:integration",
     "prepare": "husky",
-    "test": "pnpm -r run test",
-    "test:cov": "pnpm -r run test:cov",
+    "test": "pnpm -r --no-bail run test",
+    "test:cov": "pnpm -r --no-bail run test:cov",
     "test:e2e": "pnpm kube:e2e",
     "test:e2e-ci": "pnpm kube:prod; pnpm kube:e2e-ci"
   },
   "devDependencies": {
-    "@commitlint/cli": "^20.5.0",
-    "@commitlint/config-conventional": "^20.5.0",
+    "@commitlint/cli": "^20.5.3",
+    "@commitlint/config-conventional": "^20.5.3",
     "@cpn-console/eslint-config": "workspace:^",
-    "eslint": "^10.1.0",
+    "eslint": "^10.3.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0"
   }

packages/eslintconfig/package.json

@@ -10,7 +10,7 @@
   "main": "src/index.js",
   "types": "types/index.d.ts",
   "devDependencies": {
-    "@antfu/eslint-config": "^7.7.0",
+    "@antfu/eslint-config": "^8.2.0",
     "eslint": "^10.0.3"
   },
   "publishConfig": {

packages/hooks/package.json

@@ -42,13 +42,13 @@
     "@cpn-console/ts-config": "workspace:^",
     "@types/json-schema": "^7.0.15",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "ts-algebra": "^2.0.0",
     "typescript": "^5.9.3",
     "undici-types": "^7.24.0",
-    "vitest": "^2.1.9"
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

packages/shared/package.json

@@ -42,13 +42,13 @@
     "@cpn-console/ts-config": "workspace:^",
     "@faker-js/faker": "^9.9.0",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "typescript": "5.7.2",
-    "vite": "^7.3.1",
-    "vite-node": "^2.1.9",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vite-node": "^6.0.0",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

plugins/argocd/package.json

@@ -29,20 +29,20 @@
     "@cpn-console/shared": "workspace:^",
     "@cpn-console/vault-plugin": "workspace:^",
     "@himenon/argocd-typescript-openapi": "^1.2.2",
-    "axios": "^1.13.6",
+    "axios": "^1.15.1",
     "yaml": "^2.7.1"
   },
   "devDependencies": {
     "@cpn-console/eslint-config": "workspace:^",
     "@cpn-console/ts-config": "workspace:^",
     "@faker-js/faker": "^9.9.0",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

plugins/gitlab/package.json

@@ -31,18 +31,18 @@
     "@gitbeaker/core": "^40.6.0",
     "@gitbeaker/requester-utils": "^40.6.0",
     "@gitbeaker/rest": "^40.6.0",
-    "axios": "^1.13.6"
+    "axios": "^1.15.1"
   },
   "devDependencies": {
     "@cpn-console/eslint-config": "workspace:^",
     "@cpn-console/ts-config": "workspace:^",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

plugins/harbor/package.json

@@ -30,21 +30,21 @@
     "@cpn-console/logger": "workspace:^",
     "@cpn-console/shared": "workspace:^",
     "@cpn-console/vault-plugin": "workspace:^",
-    "axios": "^1.13.6",
+    "axios": "^1.15.1",
     "bytes": "^3.1.2",
     "cron-validator": "^1.4.0"
   },
   "devDependencies": {
     "@cpn-console/eslint-config": "workspace:^",
     "@cpn-console/ts-config": "workspace:^",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "swagger-typescript-api": "^13.3.1",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

plugins/keycloak/package.json

@@ -27,19 +27,19 @@
     "@cpn-console/logger": "workspace:^",
     "@cpn-console/shared": "workspace:^",
     "@keycloak/keycloak-admin-client": "^26.5.5",
-    "axios": "^1.13.6"
+    "axios": "^1.15.1"
   },
   "devDependencies": {
     "@cpn-console/eslint-config": "workspace:^",
     "@cpn-console/ts-config": "workspace:^",
     "@cpn-console/vault-plugin": "workspace:^",
     "@types/node": "^24.12.0",
-    "@vitest/coverage-v8": "^2.1.9",
+    "@vitest/coverage-v8": "^4.1.5",
     "nodemon": "^3.1.14",
     "rimraf": "^6.1.3",
     "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "vitest": "^2.1.9"
+    "vite": "^7.3.2",
+    "vitest": "^4.1.5"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",