Fixathon ICU - remove npm vulnerabilities from production version (#28999)

* fix high vulnerability present in braces

* remove vulnerabilities from pdfjs-dis and update types for node and react

* adapt the pdf preview file to the lib new version

* lock the estree version to a compatible version

* use minified version of worker and adjust webpack to support extension for ESM module process

* get working the pdf preview

* adjust jest to use babel correctly

* override asn1.js lib to keep working version

* upgrade semver version to a secure version

* remove no longer needed changes

* fix linter issues

* fix merge conflicts

* sync package-lock

* fix conflicts

* adjust lock to npm ci

webapp/channels/jest.config.js

@@ -41,8 +41,11 @@ const config = {
         ['jest-junit', {outputDirectory: 'build', outputName: 'test-results.xml'}],
     ],
     transformIgnorePatterns: [
-        'node_modules/(?!react-native|react-router|p-queue|p-timeout|@mattermost/compass-components|@mattermost/compass-icons|cidr-regex|ip-regex)',
+        'node_modules/(?!react-native|react-router|pdfjs-dist|p-queue|p-timeout|@mattermost/compass-components|@mattermost/compass-icons|cidr-regex|ip-regex)',
     ],
+    transform: {
+        '^.+\\.(js|jsx|ts|tsx|mjs)$': 'babel-jest',
+    },
     setupFiles: ['jest-canvas-mock'],
     setupFilesAfterEnv: ['<rootDir>/src/tests/setup_jest.ts'],
     testEnvironment: 'jsdom',

webapp/channels/package.json

@@ -56,7 +56,7 @@
     "memoize-one": "6.0.0",
     "moment-timezone": "0.5.38",
     "p-queue": "7.3.0",
-    "pdfjs-dist": "3.11.174",
+    "pdfjs-dist": "4.4.168",
     "popper.js": "1.16.1",
     "process": "0.11.10",
     "prop-types": "15.8.1",
@@ -87,7 +87,7 @@
     "redux-thunk": "2.4.2",
     "regenerator-runtime": "0.13.10",
     "rudder-sdk-js": "1.0.16",
-    "semver": "7.3.8",
+    "semver": "7.5.2",
     "serialize-error": "8.0.1",
     "shallow-equals": "1.0.0",
     "smooth-scroll-into-view-if-needed": "1.1.33",
@@ -121,8 +121,8 @@
     "@types/luxon": "3.0.2",
     "@types/mark.js": "8.11.6",
     "@types/marked": "0.7.4",
-    "@types/node": "18.18.13",
-    "@types/react": "17.0.71",
+    "@types/node": "18.19.59",
+    "@types/react": "17.0.83",
     "@types/react-beautiful-dnd": "13.1.2",
     "@types/react-bootstrap": "0.32.35",
     "@types/react-color": "3.0.6",

webapp/channels/src/components/pdf_preview.tsx

@@ -3,6 +3,8 @@
 
 import debounce from 'lodash/debounce';
 import type {PDFDocumentProxy, PDFPageProxy} from 'pdfjs-dist';
+import * as pdfjsLib from 'pdfjs-dist/legacy/build/pdf.mjs';
+import 'pdfjs-dist/build/pdf.worker.min.mjs';
 import type {RenderParameters} from 'pdfjs-dist/types/src/display/api';
 import React from 'react';
 
@@ -166,11 +168,7 @@ export default class PDFPreview extends React.PureComponent<Props, State> {
 
     getPdfDocument = async () => {
         try {
-            const PDFJS = await import('pdfjs-dist');
-            const worker = await import('pdfjs-dist/build/pdf.worker.entry.js');
-            PDFJS.GlobalWorkerOptions.workerSrc = worker;
-
-            const pdf = await PDFJS.getDocument({
+            const pdf = await pdfjsLib.getDocument({
                 url: this.props.fileUrl,
                 cMapUrl: getSiteURL() + '/static/cmaps/',
                 cMapPacked: true,

webapp/channels/webpack.config.js

@@ -141,6 +141,7 @@ var config = {
             crypto: require.resolve('crypto-browserify'),
             stream: require.resolve('stream-browserify'),
             buffer: require.resolve('buffer/'),
+            process: require.resolve('process/browser.js'),
         },
     },
     performance: {
@@ -149,7 +150,7 @@ var config = {
     target: 'web',
     plugins: [
         new webpack.ProvidePlugin({
-            process: 'process/browser',
+            process: 'process/browser.js',
         }),
         new MiniCssExtractPlugin({
             filename: '[name].[contenthash].css',

webapp/package.json

@@ -22,7 +22,7 @@
     "react-intl": "6.6.2"
   },
   "devDependencies": {
-    "@babel/core": "7.21.8",
+    "@babel/core": "7.22.0",
     "@babel/preset-env": "7.21.5",
     "@babel/preset-react": "7.18.6",
     "@babel/preset-typescript": "7.21.5",
@@ -94,7 +94,11 @@
     "react-transition-group": {
       "react": "17.0.2",
       "react-dom": "17.0.2"
-    }
+    },
+    "braces": "3.0.3",
+    "cheerio": "1.0.0-rc.12",
+    "@types/estree": "0.0.51",
+    "asn1.js": "5.4.1"
   },
   "workspaces": [
     "channels",