[security]: Resolve dependency track vulnerabilities

[deeonwuli]

📌 References

• Issue: Closes #869e9vzju
• Documentation: RESOLUTIONS.md. This new file gives the reason, the advisory and the removal condition for each entry.
• Findings: open code-scanning alerts on this branch. Read the scan, not this description. The scan is the authority.

📝 Implementation

This PR corrects the Dependency-Track findings. It also removes their cause. The resolutions block
held packages at exact versions. An exact version cannot receive a patch.

Resolutions: 21 entries become 42 entries

• 17 entries change from an exact version to a minimum version. Three of these entries held a
  vulnerable version in the tree: qs@6.14.2 is inside GHSA-q8mj-m7cp-5q26, brace-expansion@1.1.12
  is below the patch 1.1.17, and axios@1.13.5 is inside GHSA-gcfj-64vw-6mp9.
• 17 new bare entries move packages up to a patched version in the cypress, eslint, vite,
  jsdom and i18n chains.
• 7 new per-parent entries set picomatch for GHSA-c2c7-rcm5-vvqj. picomatch has two major lines
  in the tree. A bare entry would stop micromatch@4.
• 3 entries are removed. semver and debug held their package below the range that the parents
  declare. path-to-regexp had no effect.
• i18next: 19.8.5 stays an exact version. @dhis2/d2-i18n needs that release.
• dependencies.axios and dependencies.lodash move to the same ranges as their entries.
• The development dependency babel-core: 6.26.3 is removed. The project does not use babel 6.
• The development dependency @babel/core was the exact version 7.15.5. It is now ^7.29.6.
  GHSA-4x5r-pxfx-6jf8 patches at 7.29.6, and the exact version prevented that release. It also held
  @babel/helpers at 7.15.4, which GHSA-968p-4wvh-cqc8 includes. Both now resolve to 7.29.7.

⚠️ Do not remove the lodash entry to upgrade lodash. Two @eyeseetea packages ask for the exact
version 4.17.21. Without the entry, lodash moves down to that vulnerable version.

Vite tool set

Package	Before	After
vite	^5.2.0	^6.4.3
vitest	^1.5.0	^3.2.6
vite-plugin-checker	^0.6.4	^0.9.3
@types/lodash	4.14.172	4.17.24

vite 5.4.21 declares esbuild@^0.21.3. The Syft scan reports the Go standard library in that binary.
The tree now holds vite 6.4.3 and vite 7.3.6, and the entry esbuild: ^0.28.1 gives one binary to
both.

Two changes go with this upgrade:

• vite.config.ts sets ESBUILD_TARGET. esbuild 0.28 does not build for Safari 14.0. The constant is
  the default Vite "modules" target with safari14.1 in place of safari14. Do not remove it while
  the esbuild entry is in the file.
• vitest 3 removed the basic reporter. The test script is now vitest run. vite.config.ts sets
  reporters: [["default", { summary: false }]], which gives the same output.

Stale lockfile: 14 findings with no new entry

An advisory can move after an analysis. The GitHub Advisory Database changed the patched version of
GHSA-2v37-7h3g-55p8 (nanoid) to 3.3.18 on 2026-08-13, and it added GHSA-jmr9-qjv8-65gv
(extract-zip) on 2026-08-12.

On 2026-08-21 we compared each of the 1267 resolved versions in yarn.lock with the GitHub Advisory
Database. 20 package findings occurred. For 14 of them, the range that the parent declares already
permitted the patch, and the lockfile held an older resolution. We removed those lockfile blocks and
did yarn install again:

Package	Before	After	Advisory
nanoid	3.3.17	3.3.18	GHSA-2v37-7h3g-55p8 (high)
picomatch	2.2.2	2.3.2	GHSA-c2c7-rcm5-vvqj (high), GHSA-3v7f-55p6-f55p
micromatch	4.0.2	4.0.8	GHSA-952p-6rrq-rcjv
ajv	6.12.2, 6.12.4, 8.6.0	6.15.0, 8.20.0	GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw
joi	17.4.2	17.13.6	GHSA-q7cg-457f-vx79
yaml	1.10.0	1.10.3	GHSA-48c2-rrv3-qjmp
hosted-git-info	2.8.8	2.8.9	GHSA-43f8-2h32-f4cj
@sideway/formula	3.0.0	3.0.1	GHSA-c2jc-4fpr-4vhg
@babel/helpers	7.15.4	7.29.7	GHSA-968p-4wvh-cqc8
@babel/runtime-corejs3	7.10.4	7.29.7	GHSA-968p-4wvh-cqc8
@babel/core	7.15.5, 7.29.0	7.29.7	GHSA-4x5r-pxfx-6jf8

The picomatch row also corrects RESOLUTIONS.md. The file recorded picomatch@2.2.2 in the Yarn 1
tree as a cost of the per-parent entries. The entries were correct. The lockfile was the reason:
micromatch asks for ^2.0.5 and fast-glob asks for ^2.2.1, and both ranges permit 2.3.2. The
two scans now agree.

⚠️ yarn up -R <package> does not apply here. That is a Yarn Berry command, and this project uses
Yarn 1. Remove the block from yarn.lock, do yarn install, then read the new version from
yarn.lock.

CI

.github/workflows/main.yml passes the DTRACK_API_KEY secret to the shared master workflow. The
Dependency-Track scan needs this secret.

Findings that stay open

Three findings have no correction. RESOLUTIONS.md records each one with its chain, its reachability
and the condition to examine it again:

Package	GHAD severity	CVSS	Advisory	Why
extract-zip@2.0.1	high	8.1	GHSA-jmr9-qjv8-65gv	cypress@8.3.1 asks for the exact 2.0.1. 2.0.1 is the newest release. The advisory records no patch.
@cypress/request@2.88.6	medium	6.1	GHSA-p8p7-x288-28g6	The patch is 3.0.0. cypress asks for ^2.88.6.
elliptic@6.6.1	low	5.6	GHSA-848j-6mx2-7j84	The advisory includes each published version.

Each of the three is a development tool. None is in the application bundle.

Dependency-Track ranks a finding by its CVSS score, but the GitHub Advisory Database sets its own
severity. The two values disagree in both directions. nanoid is high in the GitHub Advisory
Database and 5.9 in CVSS. elliptic is low in the GitHub Advisory Database and 5.6 in CVSS. Read both
values.

The scanner compares 17 components by CPE and not by package URL. It then compares the short name with
a different product, for example progress@2.0.3 with Progress Telerik UI for WinUI. No entry can
correct these findings. They occur on both sides of the CI comparison, so they do not stop the
workflow. RESOLUTIONS.md lists them.

Four advisories in the reports are withdrawn: GHSA-gv7w-rqvm-qjhr, GHSA-qmq6-f8pr-cx5x,
GHSA-p5wg-g6qr-c7cg and GHSA-7gc6-qh9x-w6h8. Do not do work for them.

🎨 Screenshots

None. This PR changes no user interface.

🔥 Notes for the reviewer

Verification

Check	Result
yarn install --frozen-lockfile	Pass. The lockfile is reproducible.
tsc --noEmit	Pass.
yarn lint	Pass. This tests the eslint chain.
yarn test	Pass. 864 tests.
yarn localize	Pass. This tests handlebars and node-gettext.
yarn build-folder	Pass.
GitHub Advisory Database sweep of all 1267 resolved versions	6 findings stay: 3 withdrawn, 3 with no patch.
require() of @cypress/request/lib/multipart.js and lib/auth.js	Both load. This tests the uuid entry.

Costs to accept

• linkify-it: ^5.0.2 forces a major upgrade on react-linkify. The interface does not change.
• tough-cookie: ^4.1.4 and uuid: ^11.1.1 change the Cypress request client. uuid 11 is an ES
  module. Do not set .nvmrc below Node 22.
• ansi-regex: ^5.0.1 holds one strip-ansi copy in the vite-plugin-checker chain one major below
  its request. The 6.x line is not vulnerable.
• Yarn 1 ignores the two 2.x picomatch entries, because their parents are transitive. Berry applies
  them, and CI scans with Berry.
• vite-plugin-node-stdlib-browser declares a peer dependency of vite@^2.0.0 || ^3.0.0 || ^4.0.0.
  This project now uses vite 6. Yarn shows a warning at each install. The build passes.

Tests not done

Do these tests before you approve:

• yarn cy:e2e:run. The tough-cookie entry and the uuid entry change the Cypress request client.
• Start the application. Do a manual test of the user functions.
• Examine each view that shows links, for the linkify-it upgrade.

[deeonwuli]

Dependent on PR #31

[xurxodev]

Thanks @deeonwuli

Can you leave a complete description PR with the realized work equal than other Prs about this.

Example: EyeSeeTea/metadata-synchronization#1264