chore(security): bump fast-uri, undici, vitest to fix CVEs

.nx/workflows/dynamic-changesets.yml

@@ -1,5 +1,22 @@
 distribute-on:
-  small-changeset: 3 linux-medium-js # Distribute on small if 1-25% of projects affected in PR
-  medium-changeset: 6 linux-medium-js # Distribute on medium if 26-50% of projects affected in PR
-  large-changeset: 10 linux-medium-js # Distribute on large if 51-75% of projects affected in PR
-  extra-large-changeset: 15 linux-medium-js # Distribute on extra-large if 76-100% of projects affected in PR
+  small-changeset: 5 linux-medium-js # Distribute on small if 1-25% of projects affected in PR
+  medium-changeset: 8 linux-medium-js # Distribute on medium if 26-50% of projects affected in PR
+  large-changeset: 14 linux-medium-js # Distribute on large if 51-75% of projects affected in PR
+  extra-large-changeset: 19 linux-medium-js # Distribute on extra-large if 76-100% of projects affected in PR
+
+# Pin e2e suites to dedicated agent groups. Both suites use linux-medium-js
+# templates, but each assignment rule creates its own dedicated agent pool, so
+# the suites stay isolated. Both suites' web apps bind port 5829 (cannot change
+# due to CORS), so if an atomized task from one suite can run on the same agent
+# as the other suite, a leaked/orphaned dev server gets wrongly reused across
+# suites. Per-suite agent pools guarantee an orphaned server can only belong to
+# the same suite's app.
+assignment-rules:
+  - projects:
+      - '*davinci-suites*'
+    run-on:
+      - agent: linux-medium-js
+  - projects:
+      - '*journey-suites*'
+    run-on:
+      - agent: linux-medium-js

e2e/am-mock-api/eslint.config.mjs

@@ -0,0 +1,28 @@
+import baseConfig from '../../eslint.config.mjs';
+export default [
+  {
+    ignores: [
+      'node_modules',
+      '*.md',
+      'LICENSE',
+      '.babelrc',
+      '.env*',
+      '.bin',
+      'dist',
+      '.eslintignore',
+    ],
+  },
+  ...baseConfig,
+  {
+    files: ['*.ts', '*.tsx', '*.js', '*.jsx'],
+    rules: {},
+  },
+  {
+    files: ['*.ts', '*.tsx'],
+    rules: {},
+  },
+  {
+    files: ['*.js', '*.jsx'],
+    rules: {},
+  },
+];

e2e/am-mock-api/project.json

@@ -38,13 +38,6 @@
       "options": {
         "buildTarget": "am-mock-api:build"
       }
-    },
-    "lint": {
-      "options": {
-        "fix": true,
-        "ignore-path": ".eslintignore",
-        "args": ["**/*.ts"]
-      }
     }
   }
 }

e2e/mock-api-v2/package.json

@@ -27,6 +27,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:effect",
+    "typescript": "catalog:",
     "vitest": "catalog:vitest"
   },
   "nx": {

eslint.config.mjs

@@ -89,7 +89,6 @@ export default [
     rules: {
       'import/extensions': [2, 'ignorePackages'],
       'require-yield': 'off',
-      '@typescript-eslint/indent': ['error', 2],
       '@typescript-eslint/no-use-before-define': 'warn',
       'max-len': [
         'error',

package.json

@@ -60,18 +60,18 @@
     "@eslint/eslintrc": "^3.0.0",
     "@eslint/js": "~9.39.0",
     "@evilmartians/lefthook": "^2.1.4",
-    "@nx/devkit": "22.7.6",
-    "@nx/eslint": "22.7.6",
-    "@nx/eslint-plugin": "22.7.6",
-    "@nx/express": "22.7.6",
-    "@nx/jest": "22.7.6",
-    "@nx/js": "22.7.6",
-    "@nx/playwright": "22.7.6",
-    "@nx/plugin": "22.7.6",
-    "@nx/vite": "22.7.6",
-    "@nx/vitest": "22.7.6",
-    "@nx/web": "22.7.6",
-    "@nx/workspace": "22.7.6",
+    "@nx/devkit": "23.2.0",
+    "@nx/eslint": "23.2.0",
+    "@nx/eslint-plugin": "23.2.0",
+    "@nx/express": "23.2.0",
+    "@nx/jest": "23.2.0",
+    "@nx/js": "23.2.0",
+    "@nx/playwright": "23.2.0",
+    "@nx/plugin": "23.2.0",
+    "@nx/vite": "23.2.0",
+    "@nx/vitest": "23.2.0",
+    "@nx/web": "23.2.0",
+    "@nx/workspace": "23.2.0",
     "@playwright/test": "^1.47.2",
     "@swc-node/register": "1.11.1",
     "@swc/cli": "0.8.1",
@@ -86,7 +86,7 @@
     "@typescript-eslint/typescript-estree": "8.23.0",
     "@typescript-eslint/utils": "^8.13.0",
     "@vitest/coverage-v8": "catalog:vitest",
-    "@vitest/ui": "3.2.6",
+    "@vitest/ui": "4.1.11",
     "conventional-changelog-conventionalcommits": "^8.0.0",
     "cz-conventional-changelog": "^3.3.0",
     "cz-git": "^1.6.1",
@@ -101,7 +101,7 @@
     "jsdom": "27.4.0",
     "jsonc-eslint-parser": "^2.1.0",
     "madge": "8.0.0",
-    "nx": "22.7.6",
+    "nx": "23.2.0",
     "pkg-pr-new": "^0.0.67",
     "playwright": "^1.47.2",
     "prettier": "^3.2.5",
@@ -115,7 +115,7 @@
     "typedoc": "^0.27.4",
     "typedoc-github-theme": "0.2.1",
     "typedoc-plugin-rename-defaults": "^0.7.2",
-    "typescript": "5.8.3",
+    "typescript": "catalog:",
     "typescript-eslint": "^8.19.0",
     "verdaccio": "6.5.2",
     "vite": "catalog:vite",
@@ -135,15 +135,15 @@
       "rollup": "^4.59.0",
       "picomatch@>=4": "^4.0.4",
       "picomatch@<3": "^2.3.2",
-      "fast-uri": "^3.1.6",
+      "fast-uri": "^3.1.7",
       "qs": "^6.16.0",
       "@opentelemetry/core": "^2.8.0",
       "brace-expansion@<2": "~1.1.15",
       "brace-expansion@>=2 <3": "~2.1.1",
       "brace-expansion@>=3 <4": "~3.0.2",
       "brace-expansion@>=4": "~5.0.8",
       "ws": "^8.21.1",
-      "undici": "^7.29.0",
+      "undici": "^7.29.1",
       "nanoid": "^5.1.16",
       "postcss": "^8.5.23"
     },

packages/davinci-client/package.json

@@ -39,6 +39,7 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:effect",
+    "typescript": "catalog:",
     "vitest": "catalog:vitest"
   },
   "publishConfig": {

packages/device-client/package.json

@@ -31,7 +31,8 @@
     "@reduxjs/toolkit": "catalog:"
   },
   "devDependencies": {
-    "msw": "catalog:"
+    "msw": "catalog:",
+    "typescript": "catalog:"
   },
   "nx": {
     "tags": ["scope:package"],

packages/journey-client/package.json

@@ -45,6 +45,7 @@
   },
   "devDependencies": {
     "@vitest/coverage-v8": "catalog:vitest",
+    "typescript": "catalog:",
     "vite": "catalog:vite",
     "vitest": "catalog:vitest",
     "vitest-canvas-mock": "catalog:vitest"

packages/oidc-client/package.json

@@ -40,7 +40,8 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:effect",
-    "msw": "catalog:"
+    "msw": "catalog:",
+    "typescript": "catalog:"
   },
   "nx": {
     "tags": ["scope:package"],

packages/oidc-client/src/lib/authorize.request.utils.test.ts

@@ -6,7 +6,7 @@
  */
 import { it } from '@effect/vitest';
 import { Micro } from 'effect';
-import { vi, afterEach, expect } from 'vitest';
+import { vi, beforeEach, afterEach, expect } from 'vitest';
 import * as sdkOidc from '@forgerock/sdk-oidc';
 import { createParAuthorizeUrlµ, authorizeµ } from './authorize.request.js';
 import {
@@ -64,6 +64,12 @@ const mockLog = {
 
 const sessionStorageStub = { getItem: vi.fn(), setItem: vi.fn(), removeItem: vi.fn() };
 
+// vitest 4: restoreAllMocks no longer resets plain vi.fn() mocks (spies only),
+// so clear call history explicitly between tests.
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
 afterEach(() => {
   vi.unstubAllGlobals();
   vi.restoreAllMocks();

packages/recognize/vitest.config.mts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/packages/recognize',
   test: {
     name: 'recognize',