Production Release 2025-12-16

[tackley]

Chores

• chore(deps): update all non-major dependencies #1601
• chore(deps): update actions/checkout action to v6.0.1 #1602
• chore(deps): update dependency eslint-plugin-react-hooks to v7 #1603
• chore(deps): update all non-major dependencies #1605
• chore(deps): update all non-major dependencies #1606
• chore(deps): update node.js to v24 #1610
• chore(deps): update graphqlcodegenerator monorepo (major) #1609
• chore(deps): update dependency immer to v11 #1607
• chore(deps): update dependency vitest to v4 #1608
• chore(deps): update all non-major dependencies #1613
• chore: remove some build warnings #1612

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Deprecated by its maintainer: npm node-domexception Reason: Use your platform's native DOMException instead From: pnpm-lock.yaml → npm/@graphql-codegen/cli@6.1.0 → npm/node-domexception@1.0.0 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-domexception@1.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[github-actions]

[puLL-Merge] - brave/ads-ui@1604

Description

This PR updates multiple dependencies across the project, including both GitHub Actions workflows and npm packages. Major updates include:

• GitHub Actions: actions/checkout v6.0.0 → v6.0.1, actions/setup-node v6.0.0 → v6.1.0, actions/stale v10.1.0 → v10.1.1
• Node version: 22.21.1 → 24.11.1
• Key dependencies: Material-UI components, GraphQL codegen, React, Immer, testing tools (Vitest), and numerous development dependencies

The update touches workflow definitions, package manifests, and extensively updates the lock file.

Security Hotspots

1. Node.js Major Version Upgrade (Medium Risk)

   • Location: .node-version, package.json engines
   • Issue: Upgrading from Node 22 to Node 24 is a major version jump that could introduce breaking changes or expose new vulnerabilities. The engine requirement now accepts Node 20+ (">=20") which may be too permissive.
   • Recommendation: Thoroughly test the application on Node 24 before deploying to production. Consider being more specific about the minimum version (e.g., ">=24.11.1").

2. GraphQL Package Updates with Breaking Changes (Medium Risk)

   • Location: @graphql-tools/* packages, graphql-ws@6.0.6
   • Issue: Multiple major version updates in GraphQL tooling ecosystem (@graphql-codegen/* 5.x → 6.x, graphql-ws 5.x → 6.x) could introduce security-relevant behavior changes in authentication, authorization, or query parsing.
   • Recommendation: Review release notes for all GraphQL-related packages for security-relevant changes, particularly around query parsing and execution.

3. Indirect Dependency Changes (Low-Medium Risk)

   • Location: pnpm-lock.yaml (extensive changes)
   • Issue: Numerous transitive dependencies have changed. Some notable ones include authentication/network libraries that could have security implications.
   • Recommendation: Run npm audit or pnpm audit to check for known vulnerabilities in the new dependency tree.

Privacy Hotspots

1. Matomo Analytics Tracker (Low Risk)
   • Location: @jonkoops/matomo-tracker-react@0.7.0
   • Issue: The package is deprecated according to the lock file. While not a direct privacy issue, using deprecated packages for analytics could lead to unpatched privacy vulnerabilities.
   • Recommendation: Consider migrating to a maintained analytics solution or forking/maintaining this package if it's essential.

Changes

Changes

.github/workflows/ (Deploy and CI workflows)

• Updated actions/checkout from v6.0.0 to v6.0.1 across all workflows
• Updated actions/setup-node from v6.0.0 to v6.1.0 across all workflows
• Updated actions/stale from v10.1.0 to v10.1.1

.node-version

• Upgraded Node.js from 22.21.1 to 24.11.1

package.json

• Core Dependencies:
  • @mui/* packages: 7.3.5 → 7.3.6
  • immer: 10.2.0 → 11.0.1 (major version bump)
  • react, react-dom: 19.2.1 → 19.2.3
• DevDependencies:
  • @graphql-codegen/*: 5.x → 6.x (major version bumps)
  • vitest: 3.2.4 → 4.0.15 (major version bump)
  • vite: 7.2.6 → 7.2.7
  • typescript-eslint: 8.48.0 → 8.49.0
  • eslint-plugin-react-hooks: 6.1.1 → 7.0.1 (major version bump)
  • prettier: 3.7.3 → 3.7.4
  • Various other minor/patch updates

pnpm-lock.yaml

• Massive update to the lock file reflecting all dependency changes
• New packages introduced: @inquirer/* family, @envelop/* packages, @graphql-hive/signal
• Removed packages: Various deprecated or replaced dependencies
• Updated transitive dependencies across the entire tree

sequenceDiagram
    participant Dev as Developer
    participant GH as GitHub Actions
    participant Node as Node.js 24
    participant NPM as pnpm
    participant App as Application

    Dev->>GH: Push code
    GH->>GH: actions/checkout@v6.0.1
    GH->>Node: actions/setup-node@v6.1.0
    Node->>NPM: pnpm install (with updated deps)
    NPM->>NPM: Install MUI 7.3.6
    NPM->>NPM: Install React 19.2.3
    NPM->>NPM: Install Vitest 4.0.15
    NPM->>NPM: Install GraphQL codegen 6.x
    NPM->>App: Build application
    App->>GH: Run tests
    GH->>GH: Deploy (if staging/production)

Loading