Update package dependencies and enhance workspace configuration

- Upgraded various dependencies across the project, including NestJS packages, Prisma client, and TypeScript for improved performance and features. - Added new script commands for security audits and checks in package.json. - Enhanced pnpm workspace configuration to include only built dependencies for better management. - Refactored test cases to improve type handling and ensure compatibility with updated dependencies. - Cleaned up package.json files across applications to maintain consistency and clarity in dependency management.
2025-12-10 13:38:16 +09:00 · 2025-12-10 13:38:16 +09:00 · 92a7e852c0
commit 92a7e852c0
parent 29ad4236d6
11 changed files with 2360 additions and 2169 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -0,0 +1,126 @@
+# Dependabot configuration for automated dependency updates
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+
+version: 2
+updates:
+  # NPM dependencies for the monorepo
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "automated"
+    commit-message:
+      prefix: "chore(deps):"
+    groups:
+      # Group NestJS packages together
+      nestjs:
+        patterns:
+          - "@nestjs/*"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group React/Next.js packages together
+      react-next:
+        patterns:
+          - "react"
+          - "react-dom"
+          - "next"
+          - "@next/*"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group TypeScript tooling
+      typescript-tooling:
+        patterns:
+          - "typescript"
+          - "typescript-eslint"
+          - "@types/*"
+          - "ts-*"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group testing packages
+      testing:
+        patterns:
+          - "jest"
+          - "@jest/*"
+          - "supertest"
+          - "@types/jest"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group linting/formatting
+      linting:
+        patterns:
+          - "eslint"
+          - "eslint-*"
+          - "@eslint/*"
+          - "prettier"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group Tailwind CSS
+      tailwind:
+        patterns:
+          - "tailwindcss"
+          - "@tailwindcss/*"
+          - "tailwind-*"
+        update-types:
+          - "minor"
+          - "patch"
+      # Group Prisma
+      prisma:
+        patterns:
+          - "prisma"
+          - "@prisma/*"
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Ignore major version updates for critical packages (review manually)
+      - dependency-name: "next"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "react-dom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@prisma/client"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "prisma"
+        update-types: ["version-update:semver-major"]
+
+  # Docker base images
+  - package-ecosystem: "docker"
+    directory: "/apps/portal"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+
+  - package-ecosystem: "docker"
+    directory: "/apps/bff"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "docker"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@ -0,0 +1,86 @@
+name: Security Audit
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    # Run every Monday at 9:00 AM UTC
+    - cron: "0 9 * * 1"
+  workflow_dispatch:
+
+jobs:
+  audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10.15.0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run security audit
+        run: |
+          echo "## 🔒 Security Audit Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          # Run audit and capture output
+          if pnpm audit --audit-level=high 2>&1 | tee audit-output.txt; then
+            echo "✅ No high or critical vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "⚠️ Vulnerabilities detected. See details below." >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            cat audit-output.txt >> $GITHUB_STEP_SUMMARY
+            echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+            # Fail the workflow for high/critical vulnerabilities
+            exit 1
+          fi
+
+      - name: Check for outdated packages
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        run: |
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "## 📦 Outdated Packages" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          pnpm outdated --recursive 2>&1 | head -100 >> $GITHUB_STEP_SUMMARY || true
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript-typescript"
+
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@ -0,0 +1,20 @@
+#!/usr/bin/env sh
+. "$(dirname -- "$0")/_/husky.sh"
+
+# Run type checking
+pnpm type-check
+
+# Run linting
+pnpm lint
+
+# Quick security check (only fail on high/critical vulnerabilities)
+echo "🔒 Running security audit..."
+if ! pnpm audit --audit-level=high > /dev/null 2>&1; then
+  echo ""
+  echo "⚠️  High or critical security vulnerabilities detected!"
+  echo "Run 'pnpm audit' to see details and 'pnpm update' to fix."
+  echo ""
+  # Uncomment the line below to block commits with vulnerabilities:
+  # exit 1
+fi
+
--- a/.pnpm-approved-builds
+++ b/.pnpm-approved-builds
@ -0,0 +1,2 @@
+prisma
+@prisma/engines
--- a/apps/bff/package.json
+++ b/apps/bff/package.json
@ -32,65 +32,65 @@
  },
  "dependencies": {
    "@customer-portal/domain": "workspace:*",
-    "@nestjs/bullmq": "^11.0.3",
-    "@nestjs/common": "^11.1.6",
+    "@nestjs/bullmq": "^11.0.4",
+    "@nestjs/common": "^11.1.9",
    "@nestjs/config": "^4.0.2",
-    "@nestjs/core": "^11.1.6",
-    "@nestjs/jwt": "^11.0.0",
+    "@nestjs/core": "^11.1.9",
+    "@nestjs/jwt": "^11.0.2",
    "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^11.1.6",
-    "@nestjs/throttler": "^6.4.0",
-    "@prisma/client": "^6.16.0",
+    "@nestjs/platform-express": "^11.1.9",
+    "@nestjs/throttler": "^6.5.0",
+    "@prisma/client": "^6.19.0",
    "@sendgrid/mail": "^8.1.6",
-    "@types/ssh2-sftp-client": "^9.0.5",
+    "@types/ssh2-sftp-client": "^9.0.6",
    "bcrypt": "^6.0.0",
-    "bullmq": "^5.58.0",
+    "bullmq": "^5.65.1",
    "cookie-parser": "^1.4.7",
-    "express": "^5.1.0",
+    "express": "^5.2.1",
    "helmet": "^8.1.0",
-    "ioredis": "^5.7.0",
-    "jsforce": "^3.10.4",
-    "jsonwebtoken": "^9.0.2",
-    "nestjs-pino": "^4.4.0",
+    "ioredis": "^5.8.2",
+    "jsforce": "^3.10.10",
+    "jsonwebtoken": "^9.0.3",
+    "nestjs-pino": "^4.5.0",
    "nestjs-zod": "^5.0.1",
-    "p-queue": "^7.4.1",
+    "p-queue": "^9.0.1",
    "passport": "^0.7.0",
    "passport-jwt": "^4.0.1",
    "passport-local": "^1.0.0",
-    "pino": "^9.9.0",
-    "pino-http": "^10.5.0",
-    "pino-pretty": "^13.1.1",
-    "rate-limiter-flexible": "^4.0.1",
+    "pino": "^10.1.0",
+    "pino-http": "^11.0.0",
+    "pino-pretty": "^13.1.3",
+    "rate-limiter-flexible": "^9.0.0",
    "reflect-metadata": "^0.2.2",
    "rxjs": "^7.8.2",
-    "salesforce-pubsub-api-client": "^5.5.0",
+    "salesforce-pubsub-api-client": "^5.5.1",
    "ssh2-sftp-client": "^12.0.1",
    "tsconfig-paths": "^4.2.0",
-    "zod": "^4.1.9"
+    "zod": "^4.1.13"
  },
  "devDependencies": {
-    "@nestjs/cli": "^11.0.10",
-    "@nestjs/schematics": "^11.0.7",
-    "@nestjs/testing": "^11.1.6",
+    "@nestjs/cli": "^11.0.14",
+    "@nestjs/schematics": "^11.0.9",
+    "@nestjs/testing": "^11.1.9",
    "@types/bcrypt": "^6.0.0",
-    "@types/cookie-parser": "^1.4.9",
-    "@types/express": "^5.0.3",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/express": "^5.0.6",
    "@types/jest": "^30.0.0",
    "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.3.0",
+    "@types/node": "^24.10.2",
    "@types/passport-jwt": "^4.0.1",
    "@types/passport-local": "^1.0.38",
    "@types/supertest": "^6.0.3",
-    "jest": "^30.0.5",
-    "prisma": "^6.16.0",
+    "jest": "^30.2.0",
+    "prisma": "^6.19.0",
    "source-map-support": "^0.5.21",
    "supertest": "^7.1.4",
-    "ts-jest": "^29.4.1",
+    "ts-jest": "^29.4.6",
    "ts-loader": "^9.5.4",
    "ts-node": "^10.9.2",
-    "tsx": "^4.19.2",
+    "tsx": "^4.21.0",
    "ttypescript": "^1.5.15",
-    "typescript": "^5.9.2",
+    "typescript": "^5.9.3",
    "typescript-transform-paths": "^3.5.5"
  },
  "jest": {
--- a/apps/bff/src/modules/orders/services/checkout.service.spec.ts
+++ b/apps/bff/src/modules/orders/services/checkout.service.spec.ts
@ -258,7 +258,7 @@ describe("CheckoutService - SIM activation fees", () => {
      getPlansForUser: jest.fn(),
      getAddons: jest.fn().mockResolvedValue([]),
      getActivationFees: jest.fn().mockResolvedValue([
-        { ...defaultActivationFee, sku: "" },
+        { ...(defaultActivationFee as Record<string, unknown>), sku: "" },
        alternateActivationFee,
      ]),
    };
--- a/apps/portal/package.json
+++ b/apps/portal/package.json
@ -20,28 +20,28 @@
  "dependencies": {
    "@customer-portal/domain": "workspace:*",
    "@heroicons/react": "^2.2.0",
-    "@tanstack/react-query": "^5.85.5",
-    "@tanstack/react-query-devtools": "^5.85.5",
+    "@tanstack/react-query": "^5.90.12",
+    "@tanstack/react-query-devtools": "^5.91.1",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
    "date-fns": "^4.1.0",
-    "next": "15.5.0",
-    "react": "19.1.1",
-    "react-dom": "19.1.1",
-    "tailwind-merge": "^3.3.1",
-    "tw-animate-css": "^1.3.7",
+    "next": "15.5.7",
+    "react": "19.2.1",
+    "react-dom": "19.2.1",
+    "tailwind-merge": "^3.4.0",
+    "tw-animate-css": "^1.4.0",
    "world-countries": "^5.1.0",
-    "zod": "^4.1.9",
-    "zustand": "^5.0.8"
+    "zod": "^4.1.13",
+    "zustand": "^5.0.9"
  },
  "devDependencies": {
-    "@next/bundle-analyzer": "^15.5.0",
-    "@tailwindcss/postcss": "^4.1.12",
-    "@types/node": "^24.3.0",
-    "@types/react": "^19.1.10",
-    "@types/react-dom": "^19.1.7",
-    "tailwindcss": "^4.1.12",
-    "typescript": "^5.9.2",
-    "webpack-bundle-analyzer": "^4.10.2"
+    "@next/bundle-analyzer": "^15.5.7",
+    "@tailwindcss/postcss": "^4.1.17",
+    "@types/node": "^24.10.2",
+    "@types/react": "^19.2.7",
+    "@types/react-dom": "^19.2.3",
+    "tailwindcss": "^4.1.17",
+    "typescript": "^5.9.3",
+    "webpack-bundle-analyzer": "^5.1.0"
  }
 }
--- a/package.json
+++ b/package.json
@ -7,7 +7,7 @@
    "node": ">=22.0.0",
    "pnpm": ">=10.0.0"
  },
-  "packageManager": "pnpm@10.15.0",
+  "packageManager": "pnpm@10.25.0+sha512.5e82639027af37cf832061bcc6d639c219634488e0f2baebe785028a793de7b525ffcd3f7ff574f5e9860654e098fe852ba8ac5dd5cefe1767d23a020a92f501",
  "scripts": {
    "predev": "pnpm --filter @customer-portal/domain build",
    "dev": "./scripts/dev/manage.sh apps",
@ -53,29 +53,37 @@
    "update:check": "pnpm outdated --recursive",
    "update:all": "pnpm update --recursive --latest && pnpm audit && pnpm type-check",
    "update:safe": "pnpm update --recursive && pnpm audit && pnpm type-check",
+    "security:audit": "pnpm audit",
+    "security:audit-fix": "pnpm audit --fix || pnpm update --recursive && pnpm audit",
+    "security:check": "pnpm audit --audit-level=high",
    "dev:watch": "pnpm --parallel --filter @customer-portal/domain --filter @customer-portal/portal --filter @customer-portal/bff run dev",
    "plesk:images": "bash ./scripts/plesk/build-images.sh",
    "postinstall": "husky install || true"
  },
  "devDependencies": {
-    "@eslint/eslintrc": "^3.3.1",
-    "@eslint/js": "^9.34.0",
-    "@types/node": "^24.3.0",
-    "eslint": "^9.33.0",
+    "@eslint/eslintrc": "^3.3.3",
+    "@eslint/js": "^9.39.1",
+    "@types/node": "^24.10.2",
+    "eslint": "^9.39.1",
    "eslint-config-next": "15.5.0",
    "eslint-plugin-prettier": "^5.5.4",
-    "globals": "^16.3.0",
+    "globals": "^16.5.0",
    "husky": "^9.1.7",
-    "pino": "^9.9.0",
-    "prettier": "^3.6.2",
-    "sharp": "^0.34.3",
-    "tsx": "^4.20.5",
-    "typescript": "^5.9.2",
-    "typescript-eslint": "^8.40.0",
-    "zod": "^4.1.9"
+    "pino": "^10.1.0",
+    "prettier": "^3.7.4",
+    "sharp": "^0.34.5",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.49.0",
+    "zod": "^4.1.13"
  },
  "dependencies": {
-    "@types/ssh2-sftp-client": "^9.0.5",
+    "@types/ssh2-sftp-client": "^9.0.6",
    "ssh2-sftp-client": "^12.0.1"
+  },
+  "pnpm": {
+    "overrides": {
+      "js-yaml": ">=4.1.1"
+    }
  }
 }
--- a/packages/domain/package.json
+++ b/packages/domain/package.json
@ -49,10 +49,10 @@
    "typecheck": "pnpm run type-check"
  },
  "dependencies": {
-    "zod": "^4.1.9"
+    "zod": "^4.1.13"
  },
  "devDependencies": {
-    "@types/node": "^24.3.0",
-    "typescript": "^5.9.2"
+    "@types/node": "^24.10.2",
+    "typescript": "^5.9.3"
  }
 }
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@ -1,3 +1,5 @@
 packages:
-  - "apps/*"
-  - "packages/*"
+  - apps/*
+  - packages/*
+
+onlyBuiltDependencies: '@prisma/engines'