chore: Merge upstream/2026 06 19#633
Merged
Merged
Conversation
* update designer to use node 22 and webpack 5 * update runner to use node 22 * update submitter to use node 22 * update submitter to node 22 * update model to node 22, update babel to compile to node 22 and remove unnecessary polyfills * remove unnecessary babel polyfills for node 22 * update queue model to target node 22 * update webpack-dev-server * update browserlist, govuk-jsx paths * add process.env.REACT_LOG_LEVEL as reactEnvVariable * Use browserlist matching govuk design system * update webpack copy plugin to latest * force serialize-javascript resolution to 7.0.5 * fix: resolve ajv ReDoS vulnerability (GHSA-2g4f-4pwh-qvx6) by upgrading affected packages. also removed standard format/lint library since eslint/prettier is used instead. * add seralize-javascript resolution to fix RCE vuln (GHSA-5c6j-r48x-rmvq) * use govuk-frontend scss import rather than importing from node_modules * add @hapi/eslint-plugin * remove core-js polyfill for jest and prevent circular dep error * use entry mode for useBuiltIns to resolve windows bug * bump deps to resolve GHSA-q8mj-m7cp-5q26, GHSA-79cf-xcqc-c78w, GHSA-58qx-3vcg-4xpx * add ws 8.21.0 resolution for GHSA-58qx-3vcg-4xpx vuln
* Introduce extension point to facilitate secure form submissions * Improve typings
…6-19 # Conflicts: # queue-model/package.json # runner/src/server/plugins/engine/models/submission/WebhookModel.ts # runner/src/server/plugins/engine/pluginHandlers/files/prehandlers/handleUpload.ts # runner/src/server/services/statusService.ts # runner/src/server/services/upload/uploadService.ts # runner/src/server/services/webhookService.ts # submitter/package.json # yarn.lock
Dashue
force-pushed
the
merge-upstream/2026-06-19
branch
3 times, most recently
from
f850359 to
4b0ffeb
Compare
Dashue
force-pushed
the
merge-upstream/2026-06-19
branch
from
4b0ffeb to
8a8bf74
Compare
ebadian
previously approved these changes
Jun 22, 2026
http-proxy-middleware@2.0.9 – http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass (moderate severity) GHSA-64mm-vxmg-q3vj (+2 squashed commit) Fix formdata vulnerability form-data@4.0.5 – form-data: CRLF injection in form-data via unescaped multipart field names and filenames (high severity) GHSA-hmw2-7cc7-3qxx Fix shell-quote vulnerability shell-quote@1.8.3 – shell-quote quote() does not escape newlines in object .op values (critical severity) GHSA-w7jw-789q-3m8p
Dashue
force-pushed
the
merge-upstream/2026-06-19
branch
from
8a8bf74 to
2b7090d
Compare
ebadian
approved these changes
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merging upstream containing