fix(security): patch runtime dependency advisories

.github/workflows/f6-1-fix-runtime-deps.yml

@@ -1,81 +0,0 @@
-name: F6.1 fix runtime dependencies
-
-on:
-  push:
-    branches:
-      - 'release/f6-1-presentation-ready'
-    paths:
-      - '.github/workflows/f6-1-fix-runtime-deps.yml'
-
-permissions:
-  contents: write
-
-jobs:
-  fix:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: release/f6-1-presentation-ready
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-
-      - name: Pin patched runtime dependency resolutions
-        run: |
-          set -Eeuo pipefail
-
-          cd api-v3
-          npm pkg set overrides.multer=2.3.0 overrides.qs=6.16.0
-          npm install --package-lock-only --ignore-scripts
-          npm audit --omit=dev --audit-level=high
-          cd ..
-
-          cd web-v2
-          npm pkg set dependencies.maplibre-gl=6.4.1
-          npm install --package-lock-only --ignore-scripts
-          npm audit --omit=dev --audit-level=high
-          cd ..
-
-      - name: Verify resolved patched versions
-        run: |
-          set -Eeuo pipefail
-          node <<'NODE'
-          const api = require('./api-v3/package-lock.json');
-          const web = require('./web-v2/package-lock.json');
-          const apiPackages = api.packages ?? {};
-          const webPackages = web.packages ?? {};
-
-          const versions = (packages, dependency) => Object.entries(packages)
-            .filter(([path]) => path.endsWith(`node_modules/${dependency}`))
-            .map(([, metadata]) => metadata.version);
-
-          const assertOnly = (dependency, actual, expected) => {
-            if (actual.length === 0 || actual.some((version) => version !== expected)) {
-              throw new Error(`${dependency}: expected only ${expected}, got ${JSON.stringify(actual)}`);
-            }
-            console.log(`${dependency}: ${actual.join(', ')}`);
-          };
-
-          assertOnly('multer', versions(apiPackages, 'multer'), '2.3.0');
-          assertOnly('qs', versions(apiPackages, 'qs'), '6.16.0');
-          assertOnly('maplibre-gl', versions(webPackages, 'maplibre-gl'), '6.4.1');
-
-          const webManifest = require('./web-v2/package.json');
-          if (webManifest.dependencies?.['maplibre-gl'] !== '6.4.1') {
-            throw new Error(`maplibre-gl manifest is ${webManifest.dependencies?.['maplibre-gl']}`);
-          }
-          NODE
-
-      - name: Commit patched dependency locks
-        run: |
-          set -Eeuo pipefail
-          rm .github/workflows/f6-1-fix-runtime-deps.yml
-          git config user.name 'github-actions[bot]'
-          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
-          git add api-v3/package.json api-v3/package-lock.json web-v2/package.json web-v2/package-lock.json .github/workflows/f6-1-fix-runtime-deps.yml
-          git diff --cached --check
-          git commit -m 'fix(security): patch runtime dependency advisories'
-          git push origin HEAD:release/f6-1-presentation-ready

api-v3/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "dhv2-api",
-  "version": "0.20.0-2",
+  "version": "0.29.0-1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dhv2-api",
-      "version": "0.20.0-2",
+      "version": "0.29.0-1",
       "license": "UNLICENSED",
       "dependencies": {
         "@nestjs/common": "^11.0.0",
@@ -4166,9 +4166,9 @@
       "license": "MIT"
     },
     "node_modules/multer": {
-      "version": "2.2.0",
+      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.3.0.tgz",
-      "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==",
+      "integrity": "sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
@@ -4666,9 +4666,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.3",
+      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",

api-v3/package.json

@@ -42,5 +42,9 @@
     "ts-node": "^10.9.2",
     "tsx": "^4.20.6",
     "typescript": "^5.9.0"
+  },
+  "overrides": {
+    "multer": "2.3.0",
+    "qs": "6.16.0"
   }
 }

web-v2/package-lock.json

@@ -1,14 +1,14 @@
 {
   "name": "dhv2-web",
-  "version": "0.20.0-2",
+  "version": "0.23.0-1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dhv2-web",
-      "version": "0.20.0-2",
+      "version": "0.23.0-1",
       "dependencies": {
-        "maplibre-gl": "^6.0.0",
+        "maplibre-gl": "6.4.1",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "react-router": "^8.0.0"
@@ -1633,9 +1633,9 @@
       }
     },
     "node_modules/maplibre-gl": {
-      "version": "6.3.0",
+      "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.3.0.tgz",
+      "resolved": "https://registry.npmjs.org/maplibre-gl/-/maplibre-gl-6.4.1.tgz",
-      "integrity": "sha512-F0Is48MTzn3DvOEidPjh68E0kuSA7hdzY1YIR0ypPtFgcif3WPtzI1oZFgsv9WtHmarQnbwIXfsf+EfQYvM00A==",
+      "integrity": "sha512-KzxQKtfBu/pSz1C+yW1hNS9eyj2h2lC7ufdAi6/SEt177n3oAfDfmUmslRfJdXY7ReAFBcnvwsqmiyoDhtA9GQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@mapbox/point-geometry": "^1.1.0",

web-v2/package.json

@@ -12,7 +12,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "maplibre-gl": "^6.0.0",
+    "maplibre-gl": "6.4.1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "react-router": "^8.0.0"