fix: remediate API, frontend and build security vulnerabilities

.eslintignore

@@ -8,3 +8,6 @@ config/certification-settings.js
 config/superblock-order.js
 web/**
 docs/**/*.md
+
+tools/ui-components/storybook-static/**
+tools/challenge-editor/client/build/**

.eslintrc.json

@@ -36,7 +36,12 @@
     "import/no-named-as-default": "off",
     "import/no-named-as-default-member": "off",
     "import/order": "error",
-    "import/no-cycle": [2, { "maxDepth": 2 }],
+    "import/no-cycle": [
+      2,
+      {
+        "maxDepth": 2
+      }
+    ],
     "react/prop-types": "off",
     "no-only-tests/no-only-tests": "error",
     "no-unused-vars": "off",
@@ -60,7 +65,8 @@
           "./tools/ui-components/tsconfig.json",
           "./utils/tsconfig.json",
           "./web/tsconfig.json",
-          "./curriculum-server/tsconfig.json"
+          "./curriculum-server/tsconfig.json",
+          "./tools/challenge-editor/client/tsconfig.json"
         ]
       },
       "extends": [
@@ -135,7 +141,9 @@
         "plugin:testing-library/react",
         "plugin:jest-dom/recommended"
       ],
-      "rules": { "import/named": 2 }
+      "rules": {
+        "import/named": 2
+      }
     },
     {
       "files": ["cypress/**/*.js"],

.github/workflows/codesee-diagram.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   test_map_action:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     if: ${{ github.actor != 'renovate[bot]' && github.actor != 'camperbot' }}
     continue-on-error: true
     name: Run CodeSee Map Analysis
@@ -42,7 +42,7 @@ jobs:
         uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3
         if: ${{ fromJSON(steps.detect-languages.outputs.languages).javascript }}
         with:
-          node-version: '16'
+          node-version: '22'
 
       - name: Configure Python 3.x
         uses: actions/setup-python@13ae5bb136fac2878aff31522b9efb785519f984 # tag=v4

.github/workflows/crowdin-download.curriculum.yml

@@ -14,10 +14,10 @@ env:
 jobs:
   i18n-download-curriculum-translations:
     name: Curriculum
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
       fail-fast: true
 
     steps:

.github/workflows/e2e-mobile.yml

@@ -13,7 +13,7 @@ on:
 jobs:
   mobile-test:
     name: Test curriculum for mobile app
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout Source Files
@@ -25,10 +25,10 @@ jobs:
           repository: freeCodeCamp/mobile
           path: mobile
 
-      - name: Use Node.js 16.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3
         with:
-          node-version: 16.x
+          node-version: 22.x
 
       - name: Setup Flutter 3.3.x
         uses: subosito/flutter-action@dbf1fa04f4d2e52c33185153d06cdb5443aa189d # tag=v2
@@ -56,9 +56,13 @@ jobs:
           flutter pub get
           flutter test test/widget_test.dart
 
+      - name: Install matching Cypress binary
+        run: node cypress-install.js
+
       - name: Cypress run
-        uses: cypress-io/github-action@v4
+        uses: cypress-io/github-action@18016a55674bd02cabf197de5762a1710cb5577c # v7.4.9
         with:
+          install: false
           record: ${{ env.CYPRESS_RECORD_KEY != 0 }}
           start: npx serve
           wait-on: http://localhost:3000

.github/workflows/e2e-third-party.yml

@@ -12,7 +12,7 @@ on:
 jobs:
   do-everything:
     name: Build & Test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     services:
       mongodb:
         image: mongo:4.4
@@ -34,10 +34,10 @@ jobs:
           repository: freeCodeCamp/client-config
           path: client-config
 
-      - name: Use Node.js 16.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3
         with:
-          node-version: 16.x
+          node-version: 22.x
 
       - name: Set freeCodeCamp Environment Variables
         run: |
@@ -56,9 +56,13 @@ jobs:
       - name: Move serve.json to Public Folder
         run: cp client-config/serve.json client/public/serve.json
 
+      - name: Install matching Cypress binary
+        run: node cypress-install.js
+
       - name: Cypress run
-        uses: cypress-io/github-action@v4
+        uses: cypress-io/github-action@18016a55674bd02cabf197de5762a1710cb5577c # v7.4.9
         with:
+          install: false
           record: ${{ env.CYPRESS_RECORD_KEY != 0 }}
           start: npm run start-ci
           wait-on: http://localhost:8000

.github/workflows/e2e-web.yml

@@ -15,7 +15,7 @@ on:
 jobs:
   build-client:
     name: Build
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     steps:
       - name: Checkout Source Files
@@ -27,10 +27,10 @@ jobs:
           repository: freeCodeCamp/client-config
           path: client-config
 
-      - name: Use Node.js 16.x
+      - name: Use Node.js 22.x
         uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3
         with:
-          node-version: 16.x
+          node-version: 22.x
 
       - name: Set freeCodeCamp Environment Variables
         run: cp sample.env .env
@@ -48,26 +48,26 @@ jobs:
         run: tar -cf client-artifact.tar client/public
 
       - name: Upload Client Artifact
-        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # tag=v3
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: client-artifact
           path: client-artifact.tar
 
       - name: Upload Webpack Stats
-        uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # tag=v3
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: webpack-stats
           path: client/public/stats.json
 
   cypress-run:
     name: Test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     needs: build-client
     strategy:
       fail-fast: false
       matrix:
         browsers: [chrome, firefox, electron]
-        node-version: [16.x]
+        node-version: [22.x]
         include:
           - browsers: electron
             spec: cypress/e2e/default/learn/challenges/projects.js
@@ -95,7 +95,7 @@ jobs:
       - name: Checkout Source Files
         uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3
 
-      - uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # tag=v3
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: client-artifact
 
@@ -104,14 +104,6 @@ jobs:
           tar -xf client-artifact.tar
           rm client-artifact.tar
 
-      - name: Downgrade Firefox
-        run: |
-          curl https://ftp.mozilla.org/pub/firefox/releases/101.0/linux-x86_64/en-US/firefox-101.0.tar.bz2 --output firefox-101.0.tar.bz2
-          tar -xjf firefox-101.0.tar.bz2
-          sudo mv firefox /opt/
-          sudo mv /usr/bin/firefox /usr/bin/firefox_old
-          sudo ln -s /opt/firefox/firefox /usr/bin/firefox
-
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@8c91899e586c5b171469028077307d293428b516 # tag=v3
         with:
@@ -130,9 +122,13 @@ jobs:
       - name: Seed Database
         run: npm run seed
 
+      - name: Install matching Cypress binary
+        run: node cypress-install.js
+
       - name: Cypress run
-        uses: cypress-io/github-action@v4
+        uses: cypress-io/github-action@18016a55674bd02cabf197de5762a1710cb5577c # v7.4.9
         with:
+          install: false
           record: ${{ env.CYPRESS_RECORD_KEY != 0 }}
           start: npm run start-ci
           wait-on: http://localhost:8000

.github/workflows/i18n-validate-builds.yml

@@ -11,7 +11,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files

.github/workflows/i18n-validate-prs.yml

@@ -12,7 +12,7 @@ jobs:
     if: ${{ github.event.pull_request.user.login == 'camperbot' && contains(github.event.pull_request.title, 'chore(i18n,learn)') }}
     strategy:
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files

.github/workflows/node.js-find-unused.yml

@@ -12,12 +12,12 @@ permissions:
 jobs:
   lint:
     name: Find Unused
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files

.github/workflows/node.js-tests-upcoming.yml

@@ -18,12 +18,12 @@ permissions:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files
@@ -53,12 +53,12 @@ jobs:
   test:
     name: Test
     needs: lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files

.github/workflows/node.js-tests.yml

@@ -16,12 +16,12 @@ permissions:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files
@@ -61,12 +61,12 @@ jobs:
   test:
     name: Test
     needs: lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files
@@ -95,12 +95,12 @@ jobs:
   test-upcoming:
     name: Test Upcoming Changes
     needs: lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
 
     steps:
       - name: Checkout Source Files
@@ -130,12 +130,12 @@ jobs:
   test-localization:
     name: Localize
     needs: lint
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16.x]
+        node-version: [22.x]
         locale: [chinese, espanol]
 
     steps:

.github/workflows/security-dependencies.yml

@@ -0,0 +1,26 @@
+name: Security dependency audit
+on:
+  pull_request:
+  push:
+    branches: [dev]
+permissions:
+  contents: read
+jobs:
+  dependencies:
+    runs-on: ubuntu-24.04
+    env:
+      CYPRESS_INSTALL_BINARY: '0'
+      PUPPETEER_SKIP_DOWNLOAD: '1'
+      GATSBY_TELEMETRY_DISABLED: '1'
+      HUSKY: '0'
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci --no-audit
+      - run: npm audit --audit-level=moderate
+      - run: npm run test:frontend-compat
+      - run: node --test tools/legacy-compat/cypress.test.cjs
+      - run: node --test tools/minimatch-compat/index.test.cjs

.gitignore

@@ -216,3 +216,4 @@ client/i18n/locales/**/trending.json
 
 ### UI Components ###
 tools/ui-components/dist
+tools/ui-components/storybook-static

.npmrc

@@ -1 +1,3 @@
 CYPRESS_INSTALL_BINARY=0
+install-links=true
+legacy-peer-deps=true