@unisphere/nx 4.13.1 → 4.14.0

package/dist/migrations/4-13-2/add-security-overrides.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Migration: Add security overrides
+ *
+ * Adds npm overrides for high/critical transitive dependency vulnerabilities
+ * that can be resolved without breaking changes:
+ * - shell-quote (critical): unescaped newlines in .op values
+ * - undici (high): TLS bypass, header injection, DoS, etc.
+ * - ws (high): memory disclosure + exhaustion DoS
+ * - qs (high): prototype pollution
+ * - axios (high): update existing override from vulnerable ^1.15.1 to ^1.16.0
+ */
+import { Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;
+//# sourceMappingURL=add-security-overrides.d.ts.map

package/dist/migrations/4-13-2/add-security-overrides.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-security-overrides.d.ts","sourceRoot":"","sources":["../../../src/migrations/4-13-2/add-security-overrides.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAsB,MAAM,YAAY,CAAC;AAUtD,wBAA8B,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C9D"}

package/dist/migrations/4-13-2/add-security-overrides.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * Migration: Add security overrides
+ *
+ * Adds npm overrides for high/critical transitive dependency vulnerabilities
+ * that can be resolved without breaking changes:
+ * - shell-quote (critical): unescaped newlines in .op values
+ * - undici (high): TLS bypass, header injection, DoS, etc.
+ * - ws (high): memory disclosure + exhaustion DoS
+ * - qs (high): prototype pollution
+ * - axios (high): update existing override from vulnerable ^1.15.1 to ^1.16.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const SECURITY_OVERRIDES = {
+    'shell-quote': '>=1.9.0',
+    undici: '>=7.28.0',
+    ws: '>=8.21.0',
+    qs: '>=6.14.0',
+    axios: '^1.16.0',
+};
+async function update(tree) {
+    devkit_1.logger.info('🔄 Adding security overrides for high/critical vulnerabilities...');
+    const packageJsonPath = 'package.json';
+    if (!tree.exists(packageJsonPath)) {
+        devkit_1.logger.warn('⚠️ No package.json found, skipping');
+        return;
+    }
+    const added = [];
+    const updated = [];
+    (0, devkit_1.updateJson)(tree, packageJsonPath, (packageJson) => {
+        if (!packageJson.overrides) {
+            packageJson.overrides = {};
+        }
+        for (const [pkg, version] of Object.entries(SECURITY_OVERRIDES)) {
+            if (packageJson.overrides[pkg]) {
+                if (packageJson.overrides[pkg] !== version) {
+                    packageJson.overrides[pkg] = version;
+                    updated.push(`${pkg}@${version}`);
+                }
+            }
+            else {
+                packageJson.overrides[pkg] = version;
+                added.push(`${pkg}@${version}`);
+            }
+        }
+        return packageJson;
+    });
+    if (added.length > 0) {
+        devkit_1.logger.info(`📦 Added overrides: ${added.join(', ')}`);
+    }
+    if (updated.length > 0) {
+        devkit_1.logger.info(`📦 Updated overrides: ${updated.join(', ')}`);
+    }
+    if (added.length === 0 && updated.length === 0) {
+        devkit_1.logger.info('ℹ️ All security overrides already present');
+    }
+    devkit_1.logger.info('✅ Security overrides applied');
+}

package/dist/migrations/4-13-2/remove-swc-cli.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Migration: Remove @swc/cli
+ *
+ * Removes @swc/cli from package.json (all dependency sections)
+ * and removes it from package-lock.json if present.
+ */
+import { Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;
+//# sourceMappingURL=remove-swc-cli.d.ts.map

package/dist/migrations/4-13-2/remove-swc-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-swc-cli.d.ts","sourceRoot":"","sources":["../../../src/migrations/4-13-2/remove-swc-cli.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAsB,MAAM,YAAY,CAAC;AAEtD,wBAA8B,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC9D"}

package/dist/migrations/4-13-2/remove-swc-cli.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * Migration: Remove @swc/cli
+ *
+ * Removes @swc/cli from package.json (all dependency sections)
+ * and removes it from package-lock.json if present.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+async function update(tree) {
+    devkit_1.logger.info('🔄 Removing @swc/cli from package.json and package-lock.json...');
+    const targetPackage = '@swc/cli';
+    let removedFromPackageJson = false;
+    // Remove from package.json
+    const packageJsonPath = 'package.json';
+    if (!tree.exists(packageJsonPath)) {
+        devkit_1.logger.warn('⚠️ No package.json found, skipping');
+        return;
+    }
+    (0, devkit_1.updateJson)(tree, packageJsonPath, (packageJson) => {
+        if (packageJson.dependencies?.[targetPackage]) {
+            delete packageJson.dependencies[targetPackage];
+            removedFromPackageJson = true;
+            devkit_1.logger.info(`📦 Removed ${targetPackage} from dependencies`);
+        }
+        if (packageJson.devDependencies?.[targetPackage]) {
+            delete packageJson.devDependencies[targetPackage];
+            removedFromPackageJson = true;
+            devkit_1.logger.info(`📦 Removed ${targetPackage} from devDependencies`);
+        }
+        if (packageJson.optionalDependencies?.[targetPackage]) {
+            delete packageJson.optionalDependencies[targetPackage];
+            removedFromPackageJson = true;
+            devkit_1.logger.info(`📦 Removed ${targetPackage} from optionalDependencies`);
+        }
+        return packageJson;
+    });
+    if (removedFromPackageJson) {
+        devkit_1.logger.info('✅ Successfully removed @swc/cli');
+    }
+    else {
+        devkit_1.logger.info('ℹ️ @swc/cli not found in package.json, skipping');
+    }
+}

package/dist/migrations/4-14-0/replace-cicd-workflow.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Migration: Replace cicd.yml workflow
+ *
+ * Replaces .github/workflows/cicd.yml with updated version:
+ * - Adds pull-requests: write permission
+ * - Removes legacy Cache npm step (uses actions/setup-node cache instead)
+ * - Adds cache: npm and cache-dependency-path to Setup Node.js step
+ */
+import { Tree } from '@nx/devkit';
+export default function update(tree: Tree): Promise<void>;
+//# sourceMappingURL=replace-cicd-workflow.d.ts.map

package/dist/migrations/4-14-0/replace-cicd-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replace-cicd-workflow.d.ts","sourceRoot":"","sources":["../../../src/migrations/4-14-0/replace-cicd-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAU,MAAM,YAAY,CAAC;AAI1C,wBAA8B,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B9D"}

package/dist/migrations/4-14-0/replace-cicd-workflow.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * Migration: Replace cicd.yml workflow
+ *
+ * Replaces .github/workflows/cicd.yml with updated version:
+ * - Adds pull-requests: write permission
+ * - Removes legacy Cache npm step (uses actions/setup-node cache instead)
+ * - Adds cache: npm and cache-dependency-path to Setup Node.js step
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = update;
+const devkit_1 = require("@nx/devkit");
+const fs_1 = require("fs");
+const path_1 = require("path");
+async function update(tree) {
+    devkit_1.logger.info('🔄 Updating GitHub CICD workflow for v4.14.0');
+    // Ensure .github/workflows directory exists
+    if (!tree.exists('.github')) {
+        tree.write('.github/.gitkeep', '');
+        devkit_1.logger.info('✅ Created .github directory');
+    }
+    if (!tree.exists('.github/workflows')) {
+        tree.write('.github/workflows/.gitkeep', '');
+        devkit_1.logger.info('✅ Created .github/workflows directory');
+    }
+    try {
+        const workflowPath = '.github/workflows/cicd.yml';
+        const templatePath = (0, path_1.join)(__dirname, 'templates', 'cicd.template');
+        const templateContent = (0, fs_1.readFileSync)(templatePath, 'utf-8');
+        const workflowExists = tree.exists(workflowPath);
+        tree.write(workflowPath, templateContent);
+        if (workflowExists) {
+            devkit_1.logger.info(`✅ Updated ${workflowPath}`);
+        }
+        else {
+            devkit_1.logger.info(`✅ Created ${workflowPath}`);
+        }
+    }
+    catch (error) {
+        devkit_1.logger.error(`❌ Failed to update GitHub CICD workflow: ${error?.message || 'Unknown error'}`);
+        throw error;
+    }
+}

package/dist/migrations/4-14-0/templates/cicd.template

@@ -0,0 +1,90 @@
+name: CI/CD
+
+on:
+  push:
+    branches:
+      - main
+      - 'prerelease/**'
+
+permissions:
+  id-token: write
+  contents: write
+  packages: write
+  pull-requests: write
+
+jobs:
+  release:
+    name: Release
+    runs-on:
+      - codebuild-ovp-unisphere-runner-${{ github.run_id }}-${{ github.attempt }}
+      - instance-size:medium
+    outputs:
+      hasChangesets: ${{ steps.changesets.outputs.hasChangesets }}
+    steps:
+
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+
+      - name: Check if part of prerelease or official release
+        id: check
+        run: |
+          if [ "${{ github.ref }}" = "refs/heads/main" ] && [ -f ".changeset/pre.json" ]; then
+            echo "main branch should not have pre.json file, skipping job"
+            exit 1
+          elif [[ "${{ github.ref }}" == "refs/heads/prerelease/"* ]] && [ ! -f ".changeset/pre.json" ]; then
+            echo "prerelease branch must have pre.json file, skipping job"
+            exit 1
+          elif [ "${{ github.ref }}" != "refs/heads/main" ] && [[ "${{ github.ref }}" != "refs/heads/prerelease/"* ]]; then
+            echo "not part of prerelease or official release, skipping job"
+            exit 1
+          fi
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Pre-CICD Checks
+        uses: kaltura/unisphere-core/.github/actions/pre-cicd@main
+        with:
+          repo-path: '${{ github.workspace }}'
+
+      - name: Setup JFrog
+
+        uses: jfrog/setup-jfrog-cli@v4
+        id: setup-jfrog
+        env:
+          JF_URL: https://kalturaa.jfrog.io
+        with:
+          oidc-provider-name: ovp-github-oidc
+
+      - name: Install Dependencies
+        run: npm ci --prefer-offline --include=optional --no-fund
+        env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          KALTURA_JFROG_TOKEN: ${{ steps.setup-jfrog.outputs.oidc-token }}
+
+
+#      - name: Security Audit
+#        run: npx unisphere tools audit
+#        env:
+#          KALTURA_JFROG_TOKEN: ${{ steps.setup-jfrog.outputs.oidc-token }}
+
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create release tags
+        if: steps.changesets.outputs.hasChangesets == 'false'
+        run: |
+          npx changeset tag
+          git push --follow-tags
+
+  publish-artifacts:
+    needs: release
+    if: needs.release.outputs.hasChangesets == 'false'
+    uses: ./.github/workflows/_publish-artifacts.yml

package/migrations.json

@@ -538,6 +538,30 @@
       "cli": {
         "postUpdateMessage": "✅ setup-local-runtimes.ts updated with experience-scoped runtimes support"
       }
+    },
+    "4.13.2-remove-swc-cli": {
+      "version": "4.13.2",
+      "description": "Removes @swc/cli from package.json and package-lock.json",
+      "factory": "./dist/migrations/4-13-2/remove-swc-cli.js",
+      "cli": {
+        "postUpdateMessage": "✅ @swc/cli removed from package.json and package-lock.json"
+      }
+    },
+    "4.13.2-add-security-overrides": {
+      "version": "4.13.2",
+      "description": "Adds npm overrides for high/critical transitive dependency vulnerabilities (shell-quote, undici, ws, qs, axios)",
+      "factory": "./dist/migrations/4-13-2/add-security-overrides.js",
+      "cli": {
+        "postUpdateMessage": "✅ Security overrides added for high/critical vulnerabilities"
+      }
+    },
+    "4.14.0-replace-cicd-workflow": {
+      "version": "4.14.0",
+      "description": "Replaces cicd.yml with updated workflow (pull-requests permission, improved npm caching)",
+      "factory": "./dist/migrations/4-14-0/replace-cicd-workflow.js",
+      "cli": {
+        "postUpdateMessage": "✅ .github/workflows/cicd.yml updated"
+      }
     }
   },
   "packageJsonUpdates": {
@@ -942,6 +966,37 @@
           "alwaysAddToPackageJson": false
         }
       }
+    },
+    "4.13.2": {
+      "version": "4.13.2",
+      "cli": "nx",
+      "postUpdateMessage": "🎉 Migration to @unisphere/nx 4.13.2 completed successfully!",
+      "packages": {
+        "@unisphere/cli": {
+          "version": "5.4.3",
+          "alwaysAddToPackageJson": false
+        },
+        "@kaltura/ds-react-bits": {
+          "version": "^12.21.10",
+          "alwaysAddToPackageJson": false
+        },
+        "@kaltura/ds-react-components": {
+          "version": "^12.21.10",
+          "alwaysAddToPackageJson": false
+        },
+        "@kaltura/ds-react-icons": {
+          "version": "^12.21.10",
+          "alwaysAddToPackageJson": false
+        },
+        "@kaltura/ds-react-theme": {
+          "version": "^12.21.10",
+          "alwaysAddToPackageJson": false
+        },
+        "@kaltura/ds-react-utils": {
+          "version": "^12.21.10",
+          "alwaysAddToPackageJson": false
+        }
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unisphere/nx",
-  "version": "4.13.1",
+  "version": "4.14.0",
   "private": false,
   "main": "./dist/index.js",
   "module": "./dist/index.js",