fix(QTDI-3430): [TCK] NPM Security updates 1.26.10

[undx]

https://qlik-dev.atlassian.net/browse/QTDI-3430

[Copilot]

🟡 Changes recommended

Critical dependency override conflicts and missing direct dependency declarations remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Security refresh of frontend npm dependencies and lockfiles across documentation, component tools, and starter server modules.

Changes:

• Updates js-yaml, UI, router, and transitive dependencies.
• Adds security-related dependency overrides.
• Regenerates frontend lockfiles.

File summaries

File	Summary
documentation/src/main/frontend/package-template.json	Updates dependency overrides.
documentation/src/main/frontend/package-lock.json	Refreshes locked dependencies.
component-tools-webapp/src/main/frontend/package.json	Updates dependencies; moderate issue (2 votes): retain direct @talend/icons dependency.
component-tools-webapp/src/main/frontend/package-template.json	Critical issue (1 vote): unscoped postcss-selector-parser override conflicts with declared 7.x ranges. Moderate issue (3 votes): retain direct @talend/icons dependency.
component-tools-webapp/src/main/frontend/package-lock.json	Refreshes resolved dependencies.
component-starter-server/src/main/frontend/package.json	Updates dependencies and overrides.
component-starter-server/src/main/frontend/package-template.json	Critical issue (1 vote): unscoped postcss-selector-parser override conflicts with declared 7.x ranges.
component-starter-server/src/main/frontend/package-lock.json	Refreshes resolved dependencies.

Review details

Files not reviewed (3)

• component-starter-server/src/main/frontend/package-lock.json: Generated file
• component-tools-webapp/src/main/frontend/package-lock.json: Generated file
• documentation/src/main/frontend/package-lock.json: Generated file

• Files reviewed: 5/8 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Resolve the incompatible postcss-selector-parser override and restore direct runtime dependencies for imported packages.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (3)

• component-starter-server/src/main/frontend/package-lock.json: Generated file
• component-tools-webapp/src/main/frontend/package-lock.json: Generated file
• documentation/src/main/frontend/package-lock.json: Generated file

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

component-tools-webapp/src/main/frontend/package-template.json:14

• This generated template removes both @talend/react-cmf and @talend/icons from the app's direct runtime dependencies, even though the application still imports them in src/app/index.js, src/app/components/Detail/Detail.connect.js, and src/app/store/componentsList/actions.js. Because this template overwrites package.json during the Maven build, the resulting project relies on transitive packages in the lockfile and can fail with module-not-found after a transitive update or different install layout; keep both packages declared directly and regenerate the lockfile.

component-tools-webapp/src/main/frontend/package.json:14

• These dependency changes remove both @talend/react-cmf and @talend/icons from the app's direct runtime dependencies, even though the application still imports them in src/app/index.js, src/app/components/Detail/Detail.connect.js, and src/app/store/componentsList/actions.js. They are currently available only through transitive packages in the lockfile, so a future transitive update or a different install layout can make the build fail with module-not-found; keep both packages declared directly and regenerate the lockfile.

    "@talend/bootstrap-theme": "^9.2.0",
    "@talend/design-system": "^11.8.0",
    "@talend/react-components": "^17.5.0",
    "@talend/react-containers": "^11.0.4",
    "@talend/react-forms": "^15.0.2",

• Files reviewed: 5/8 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Direct @talend/react-cmf imports remain while the dependency was removed from the webapp manifests.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (3)

• component-starter-server/src/main/frontend/package-lock.json: Generated file
• component-tools-webapp/src/main/frontend/package-lock.json: Generated file
• documentation/src/main/frontend/package-lock.json: Generated file

• Files reviewed: 5/8 changed files
• Comments generated: 2
• Review effort level: Lite

[sonar-rnd]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (63.30% Estimated after merge)
• No data about duplications (1.40% Estimated after merge)

Project ID: org.talend.sdk.component:component-runtime

View in SonarQube