[PROD] - Security fixes & clean up #394

kkartunov · 2025-12-10T09:10:45Z

https://topcoder.atlassian.net/browse/PM-2626

…odules PM-2749 - upgrade major node modules

github-actions · 2025-12-10T09:11:04Z

src/lib/app-context/auth-config.model.ts

 export interface AuthConfig {
-  user: AuthUser
-  profileCompletionData: ProfileCompletionData
+  user?: AuthUser


[❗❗ correctness]
Making user optional in the AuthConfig interface could lead to runtime errors if the rest of the codebase assumes user is always defined. Ensure that all usages of AuthConfig handle the case where user is undefined.

github-actions · 2025-12-10T09:11:04Z

src/lib/app-context/auth-config.model.ts

-  user: AuthUser
-  profileCompletionData: ProfileCompletionData
+  user?: AuthUser
+  profileCompletionData?: ProfileCompletionData


[❗❗ correctness]
Making profileCompletionData optional in the AuthConfig interface could lead to runtime errors if the rest of the codebase assumes profileCompletionData is always defined. Ensure that all usages of AuthConfig handle the case where profileCompletionData is undefined.

github-actions · 2025-12-10T09:11:10Z

src/lib/components/Accordion.svelte

+              role="button"
+              tabindex="0"
+              on:click={() => toggleItem(item)}
+              on:keydown={(ev) => ev.key === 'Enter' && toggleItem(item)}


[⚠️ accessibility]
The on:keydown event handler should also handle the 'Space' key to improve accessibility, as it is a common key for activating buttons. Consider updating the condition to (ev) => (ev.key === 'Enter' || ev.key === ' ') && toggleItem(item).

github-actions · 2025-12-10T09:11:14Z

src/lib/components/Banner.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better modularity and to avoid global namespace pollution. However, using as * can still lead to namespace conflicts. Consider using a specific namespace instead of * to prevent potential issues in larger projects.

github-actions · 2025-12-10T09:11:17Z

src/lib/components/Button.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better modularity and avoiding global namespace pollution. However, using as * imports all variables into the global scope, which can lead to similar issues as @import. Consider importing only the necessary variables or using a namespace to avoid potential conflicts.

github-actions · 2025-12-10T09:11:23Z

src/lib/components/LinksMenu.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * negates some of these benefits by making all variables and mixins globally available. Consider using a namespace instead to maintain encapsulation and improve maintainability.

github-actions · 2025-12-10T09:11:36Z

src/lib/components/LinksMenu.svelte


  function itemHasHoverMenu(menuItem: NavMenuItem) {
-    return menuItem.children?.length || menuItem.description;
+    return !!(menuItem.children?.length) || !!menuItem.description;


[💡 readability]
The use of double negation !! is unnecessary here and can reduce readability. Consider using Boolean() for clarity.

github-actions · 2025-12-10T09:11:36Z

src/lib/components/LinksMenu.svelte

    }

-    hoveredElement = ev.target;
+    hoveredElement = ev.currentTarget as HTMLElement ?? undefined;


[💡 readability]
Using ev.currentTarget as HTMLElement ?? undefined is redundant. ev.currentTarget should always be an HTMLElement in this context. Consider simplifying to ev.currentTarget as HTMLElement.

github-actions · 2025-12-10T09:11:39Z

src/lib/components/Maintenance.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for modularity and avoiding global namespace pollution. However, using as * reintroduces the risk of namespace conflicts. Consider using a specific namespace instead of * to maintain modularity benefits.

github-actions · 2025-12-10T09:11:45Z

src/lib/components/MobileMenu.svelte

 <div class={styles.mobileMenuWrap} transition:fade={{duration: 200}}>
  <TopNavbar style="primary" showLogo={false}>
-    <div class={styles.closeIcon} slot="right" on:click={handleClose} on:keydown={() => {}}>
+    <div class={styles.closeIcon} role="button" tabindex="0" slot="right" on:click={handleClose} on:keydown={() => {}}>


[⚠️ accessibility]
The on:keydown handler is currently an empty function. This could lead to unexpected behavior if users attempt to interact with the button using the keyboard. Consider implementing keyboard accessibility by handling key events such as Enter or Space to trigger handleClose.

github-actions · 2025-12-10T09:11:51Z

src/lib/components/PopupMenu.svelte

   * @param el
   */
-  function unBindEvents(el: HTMLElement = targetEl) {
+  function unBindEvents(el: HTMLElement | undefined = targetEl) {


[⚠️ correctness]
The change to allow el to be undefined in the unBindEvents function signature is appropriate given the default value of targetEl. However, ensure that all calls to unBindEvents handle the possibility of undefined correctly, especially if the function is used elsewhere in the codebase.

github-actions · 2025-12-10T09:11:51Z

src/lib/components/PopupMenu.svelte

    }

-    el.dataset.targetKey = undefined
+    delete el.dataset.targetKey


[⚠️ correctness]
Using delete el.dataset.targetKey instead of setting it to undefined is a better approach as it removes the attribute entirely, which is more semantically correct and avoids leaving an empty attribute. Ensure this change is consistent with any logic that checks for the presence of data-target-key.

github-actions · 2025-12-10T09:11:57Z

src/lib/components/SubMenu.module.scss

-@import 'lib/styles/mixins.scss';
-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/colors.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * defeats this purpose by exposing all members to the global scope. Consider using specific namespaces instead of as * to maintain encapsulation.

github-actions · 2025-12-10T09:11:57Z

src/lib/components/SubMenu.module.scss

-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/colors.scss';
+@use 'lib/styles/mixins.scss' as *;
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Using @use 'lib/styles/fonts.scss' as *; exposes all members globally, which can lead to conflicts and maintenance challenges. It's recommended to use a specific namespace to keep the scope limited and avoid potential issues.

github-actions · 2025-12-10T09:11:57Z

src/lib/components/SubMenu.module.scss

-@import 'lib/styles/colors.scss';
+@use 'lib/styles/mixins.scss' as *;
+@use 'lib/styles/fonts.scss' as *;
+@use 'lib/styles/colors.scss' as *;


[⚠️ maintainability]
The @use 'lib/styles/colors.scss' as *; statement exposes all members globally, which can lead to conflicts and maintenance challenges. Consider using a specific namespace to keep the scope limited and avoid potential issues.

github-actions · 2025-12-10T09:12:01Z

src/lib/components/SubMenu.svelte


  function handleNavigation(ev: MouseEvent, menuItem: NavMenuItem) {
-    if (typeof navigationHandler === 'function') {
+    if (typeof navigationHandler === 'function' && menuItem.url) {


[⚠️ maintainability]
The added check menuItem.url ensures that menuItem.url is defined before attempting to use it in navigationHandler. This is a good improvement for preventing potential runtime errors. However, consider adding a more explicit error handling or logging mechanism if menuItem.url is undefined, to aid in debugging and provide better feedback.

github-actions · 2025-12-10T09:12:07Z

src/lib/components/TopNavbar.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/mixins.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better modularity and to avoid potential conflicts. However, using as * can negate some of the benefits of @use by exposing all variables and mixins globally. Consider importing only the specific mixins or variables needed to maintain encapsulation and prevent unintended side effects.

github-actions · 2025-12-10T09:12:11Z

src/lib/components/VerticalSeparator.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/mixins.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better modularity and to avoid namespace conflicts. However, using as * can negate some of these benefits by polluting the global namespace. Consider importing only the necessary mixins explicitly to maintain modularity and avoid potential conflicts.

github-actions · 2025-12-10T09:12:15Z

src/lib/components/forms/InputWrap.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * negates some of these benefits by exposing all variables and mixins globally. Consider using a specific namespace instead of * to maintain encapsulation and avoid potential conflicts.

github-actions · 2025-12-10T09:12:20Z

src/lib/components/modals/Modal.module.scss

@@ -1,5 +1,5 @@
-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/mixins.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * effectively negates this benefit by importing all members into the global scope. Consider importing only the specific members needed to maintain encapsulation.

github-actions · 2025-12-10T09:12:20Z

src/lib/components/modals/Modal.module.scss

-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/mixins.scss';
+@use 'lib/styles/fonts.scss' as *;
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Similar to the previous line, using @use 'lib/styles/mixins.scss' as * imports all members into the global scope, which can lead to namespace conflicts and reduced maintainability. It's better to import only the necessary members.

github-actions · 2025-12-10T09:12:24Z

src/lib/components/modals/Modal.svelte

  <div class={classnames(styles.modalWrap, $$props.class, size && `size-${size}`)}>
    <div class={styles.modalContainer}>
-      <div class={styles.modalOverlay} transition:fade={{duration: 200}} on:click={() => isVisible = false} on:keydown={() => {}} />
+      <div class={styles.modalOverlay} role="button" tabindex="0" transition:fade={{duration: 200}} on:click={() => isVisible = false} on:keydown={() => {}} />


[💡 maintainability]
The on:keydown handler is currently an empty function. If this is intentional, consider removing it to avoid confusion, or implement the desired functionality.

github-actions · 2025-12-10T09:12:24Z

src/lib/components/modals/Modal.svelte

            class={styles.closeBtn}
-            on:click={() => isVisible = ''}
+            on:click={() => isVisible = false}
            on:keydown={() => {}}


[💡 maintainability]
The on:keydown handler is an empty function. If no functionality is intended, consider removing it to improve code clarity.

github-actions · 2025-12-10T09:12:28Z

src/lib/components/sticky/Sticky.svelte

  let elYOffset = 0;

  function handleScroll() {
+    if (!elRef) {


[💡 maintainability]
The check for elRef being undefined is a good addition to prevent errors, but consider initializing elRef to null instead of undefined for better clarity and consistency with DOM element references.

github-actions · 2025-12-10T09:12:28Z

src/lib/components/sticky/Sticky.svelte

  }

  onMount(() => {
+    if (!elRef) {


[💡 maintainability]
The check for elRef being undefined is a good addition to prevent errors, but consider initializing elRef to null instead of undefined for better clarity and consistency with DOM element references.

github-actions · 2025-12-10T09:12:32Z

src/lib/components/tool-selector/ToolMenu.module.scss

-@import 'lib/styles/mixins.scss';
-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/colors.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * negates some of the benefits of @use by exposing all variables and mixins globally. Consider using specific namespaces or importing only what is necessary to maintain encapsulation.

github-actions · 2025-12-10T09:12:38Z

src/lib/components/tool-selector/ToolMenu.svelte

  import styles from './ToolMenu.module.scss';

-  let navMenuItems = getToolSelectorItems();
+  let navMenuItems: NavMenuItem[] = getToolSelectorItems() ?? [];


[⚠️ correctness]
The use of the nullish coalescing operator (??) to default getToolSelectorItems() to an empty array is a good practice for ensuring navMenuItems is always iterable. However, ensure that getToolSelectorItems() is expected to return null or undefined in some cases, as this could mask potential issues where the function fails to return the expected data.

github-actions · 2025-12-10T09:12:38Z

src/lib/components/tool-selector/ToolMenu.svelte

  <InlineSvg src="/assets/tools/sprite.svg" />
  {#each navMenuItems as section, sectionIndex}
-    <div class={classnames(styles.toolSection, styles[section.label?.toLowerCase()])}>
+    {#if section}


[⚠️ correctness]
The added if check for section ensures that the block is only rendered when section is truthy. This is a good safeguard, but verify that navMenuItems is expected to contain falsy values, as this could indicate an issue with data integrity.

github-actions · 2025-12-10T09:12:38Z

src/lib/components/tool-selector/ToolMenu.svelte


      <div class={styles.toolGroups}>
-        {#each section.children as group}
+        {#each section.children ?? [] as group}


[⚠️ correctness]
Using the nullish coalescing operator (??) to default section.children to an empty array is a good practice for ensuring the each block is always iterable. However, confirm that section.children is expected to be null or undefined, as this could hide potential data issues.

github-actions · 2025-12-10T09:12:38Z

src/lib/components/tool-selector/ToolMenu.svelte


            <div class={styles.toolNavItems}>
-              {#each group.children as navItem}
+              {#each group.children ?? [] as navItem}


[⚠️ correctness]
The use of the nullish coalescing operator (??) to default group.children to an empty array ensures that the each block is always iterable. Ensure that group.children is expected to be null or undefined, as this could mask potential data issues.

github-actions · 2025-12-10T09:12:42Z

src/lib/components/tool-selector/ToolSelector.svelte

+  tabindex="0"
  bind:this={elRef}
  on:click={() => popupIsVisible = true}
  on:keydown={() => {}}


[⚠️ accessibility]
The on:keydown handler is currently a no-op. If the intention is to make the element accessible via keyboard, consider implementing meaningful keyboard interactions, such as toggling popupIsVisible on Enter or Space key presses.

github-actions · 2025-12-10T09:12:48Z

src/lib/components/user-area/UserArea.svelte

    $ctx.auth = {...$ctx.auth, ready: false};
    const authUser = await fetchUserProfile();
-    $ctx.auth = {...$ctx.auth, ready: true, user: authUser};
+    $ctx.auth = {...$ctx.auth, ready: true, user: authUser ?? undefined};


[💡 readability]
Using the nullish coalescing operator (??) to default authUser to undefined is unnecessary here, as authUser will already be undefined if fetchUserProfile() returns null or undefined. Consider removing ?? undefined for clarity.

github-actions · 2025-12-10T09:12:54Z

src/lib/components/user-area/UserAvatar.svelte


  let initials: string = '';
-  $: initials = user['initials'] ?? (
+  $: initials = (


[⚠️ correctness]
The use of as any to access user.initials can lead to potential runtime errors if the user object does not have the expected structure. Consider refining the type definition of AuthUser to include initials if it's a common property, or use a type guard to safely access it.

github-actions · 2025-12-10T09:12:54Z

src/lib/components/user-area/UserAvatar.svelte

+  tabindex="0"
  bind:this={elRef}
  on:click={() => popupIsVisible = true}
  on:keydown={() => {}}


[💡 maintainability]
The on:keydown handler is currently a no-op. If this is intended for accessibility, consider implementing keyboard navigation support or removing it if not needed.

github-actions · 2025-12-10T09:12:58Z

src/lib/components/user-area/UserMenu.module.scss

-@import 'lib/styles/mixins.scss';
-@import 'lib/styles/fonts.scss';
-@import 'lib/styles/colors.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * defeats this purpose by exposing all members globally. Consider using specific namespaces or importing only the necessary members to maintain encapsulation.

github-actions · 2025-12-10T09:13:05Z

src/lib/footer-navigation/FooterNavigation.module.scss

@@ -1,5 +1,5 @@
-@import 'lib/styles/mixins.scss';
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/mixins.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better encapsulation and avoiding global namespace pollution. However, using as * negates some of these benefits by still exposing all variables and mixins globally. Consider using specific namespaces instead of as * to maintain encapsulation and avoid potential conflicts.

github-actions · 2025-12-10T09:13:05Z

src/lib/footer-navigation/FooterNavigation.module.scss

-@import 'lib/styles/mixins.scss';
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/mixins.scss' as *;
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Similar to the previous line, using @use 'lib/styles/fonts.scss' as *; exposes all variables and mixins globally, which can lead to conflicts and makes the code harder to maintain. It's recommended to use a specific namespace instead of as * to take full advantage of the @use directive's encapsulation.

github-actions · 2025-12-10T09:13:10Z

src/lib/functions/auth-jwt.ts

 * @returns Value of property or undefined
 */
 export function getAuthJwtDomainProp<T = string|undefined>(prop: string): T {
  const propRegex = new RegExp(`^https?:\/\/.*\/${prop}$`, 'i');


[❗❗ security]
The regular expression ^https?:\/\/.*\/${prop}$ could potentially match unintended URLs if prop contains special regex characters. Consider escaping prop to ensure it is treated as a literal string.

github-actions · 2025-12-10T09:13:10Z

src/lib/functions/auth-jwt.ts

 * @returns {Authorization: 'Bearer'} or {}
 */
-export function getRequestAuthHeaders() {
+export function getRequestAuthHeaders(): Partial<{ Authorization : string }> {


[💡 readability]
The return type Partial<{ Authorization : string }> is technically correct, but it might be clearer to use Record<string, string> or { Authorization?: string } to explicitly indicate that the Authorization key is optional.

github-actions · 2025-12-10T09:13:14Z

src/lib/functions/auth.routes-filters.ts

 */
 export const filterRoutesByUserRole = (routes: NavMenuItem) => {
-  const userRoles = getUserAppRoles();
+  const userRoles = getUserAppRoles() ?? [];


[⚠️ correctness]
Using the nullish coalescing operator (??) to default userRoles to an empty array is a good approach to handle null or undefined values. However, ensure that getUserAppRoles() does not return other falsy values like false or 0 that might need different handling.

github-actions · 2025-12-10T09:13:17Z

src/lib/functions/tool-selector-menu.provider.ts


  const filtered = filterRoutesByUserRole(menu);
-  return filtered?.children
+  return filtered?.children ?? [];


[⚠️ correctness]
Using the nullish coalescing operator (??) to default to an empty array is a good approach for handling potential undefined values. However, ensure that filtered.children is always expected to be an array or undefined. If filtered.children could be null, this change will still work correctly, but it's important to confirm the expected types.

github-actions · 2025-12-10T09:13:22Z

src/lib/functions/user-profile.provider.ts


 // store fetched data in a local cache (de-duplicate immediate api calls)
-const localCache = {};
+const localCache: any = {};


[⚠️ maintainability]
Using any for localCache can lead to potential type safety issues. Consider defining a more specific type for localCache to ensure better type checking and maintainability.

github-actions · 2025-12-10T09:13:22Z

src/lib/functions/user-profile.provider.ts


 // get the user roles that match the config/auth's user roles definitions
-export const getUserAppRoles = (): AuthUser['roles'] | undefined => {
+export const getUserAppRoles = (): AuthUser['roles'] => {


[⚠️ correctness]
The return type of getUserAppRoles was changed to AuthUser['roles'], which is non-nullable. Ensure that the function logic aligns with this change and that it always returns a valid roles array, even if empty.

github-actions · 2025-12-10T09:13:22Z

src/lib/functions/user-profile.provider.ts

 * @returns Promise<AuthUser>
 */
-export const fetchUserProfile = async (): Promise<AuthUser> => {
+export const fetchUserProfile = async (): Promise<AuthUser | undefined> => {


[💡 maintainability]
The return type of fetchUserProfile was changed to Promise<AuthUser | undefined>, but the JSDoc comment still states Promise<AuthUser>. Update the JSDoc to reflect the correct return type.

github-actions · 2025-12-10T09:13:22Z

src/lib/functions/user-profile.provider.ts



-  let resolve: (value: AuthUser) => void;
+  let resolve: (value: AuthUser) => void = () => {};


[💡 readability]
The initialization of resolve with an empty function () => {} is potentially misleading. Consider using null or a more descriptive placeholder to indicate that it will be assigned later.

github-actions · 2025-12-10T09:13:29Z

src/lib/mobile-navigation/MobileNavigation.svelte

 </script>

-<div class={styles.menuBtn} on:click={() => menuIsVisible = true} on:keydown={() => {}}>
+<div class={styles.menuBtn} role="button" tabindex="0" on:click={() => menuIsVisible = true} on:keydown={() => {}}>


[⚠️ maintainability]
The on:keydown handler is currently an empty function. If this is intentional, consider removing it to avoid confusion. If it's meant to handle keyboard interactions, ensure it has the appropriate logic to improve accessibility.

github-actions · 2025-12-10T09:13:34Z

src/lib/styles/_colors.scss


 @function color($base, $shade: default) {
-  $color: map-get(map-get($colors, $base), $shade);
+  $color: map.get(map.get($colors, $base), $shade);


[⚠️ maintainability]
The change from map-get to map.get is correct for using the @use syntax, but ensure that the sass:map module is supported in all environments where this code will run, as it requires Dart Sass. If compatibility with other Sass implementations is needed, consider maintaining backward compatibility.

github-actions · 2025-12-10T09:13:40Z

src/lib/tool-navigation/ToolNavigation.module.scss

@@ -1,4 +1,4 @@
-@import 'lib/styles/fonts.scss';
+@use 'lib/styles/fonts.scss' as *;


[⚠️ maintainability]
Switching from @import to @use is a good practice for better modularity and to avoid global namespace pollution. However, using as * imports all the variables and mixins into the global scope, which can still lead to namespace conflicts. Consider importing only the necessary parts explicitly to improve maintainability.

github-actions · 2025-12-10T09:13:42Z

src/lib/tool-navigation/tool-nav-separator/ToolNavSeparator.svelte

+    role="button"
+    tabindex="0"
+    on:click={toggleMainMenu}
+    on:keydown={() => {}}


[⚠️ accessibility]
The on:keydown handler is currently an empty function. Consider implementing functionality to handle keyboard interactions, such as triggering toggleMainMenu on Enter or Space key presses, to improve accessibility for keyboard users.

github-actions · 2025-12-10T09:13:45Z

src/lib/utils/classnames.ts

+  const tokens: string[] = [];
+
+  for (const arg of args) {
+    if (typeof arg !== 'string' || !arg.trim()) {


[💡 readability]
The check typeof arg !== 'string' || !arg.trim() can be simplified to !arg || typeof arg !== 'string' || !arg.trim(). This ensures that null and undefined are filtered out immediately, improving clarity.

github-actions · 2025-12-10T09:13:50Z

src/lib/utils/fonts.ts

 ];

-let previousLoadPromise;
+let previousLoadPromise: Promise<void> | undefined;


[⚠️ correctness]
The type annotation Promise<void> | undefined for previousLoadPromise is a good addition for clarity. However, ensure that all usages of previousLoadPromise handle the undefined case appropriately to avoid potential runtime errors.

github-actions · 2025-12-10T09:13:50Z

src/lib/utils/fonts.ts

      const firstLink = document.getElementsByTagName('link')[0];
-      firstLink.parentNode.insertBefore(link, firstLink);
+      const parent = firstLink?.parentNode ?? document.head;
+      parent.insertBefore(link, firstLink ?? null);


[💡 readability]
The use of firstLink ?? null as the second argument in insertBefore is technically correct, but using null as a fallback might not be necessary since insertBefore can handle null by appending the node to the end of the parent. Consider simplifying to parent.insertBefore(link, firstLink);.

github-actions · 2025-12-10T09:13:59Z

src/lib/utils/paths.ts

 * @returns NavMenuItem.children
 */
-export const toMarketingHostUrls = ({ children = [] }: NavMenuItem, depth?: number) => {
+export const toMarketingHostUrls = ({ children = [] }: NavMenuItem, depth: number = 0) => {


[⚠️ correctness]
The change from an optional depth parameter to a default value of 0 is a good improvement for clarity and avoids potential undefined issues. However, ensure that all calls to toMarketingHostUrls are updated accordingly if they relied on depth being optional.

github-actions · 2025-12-10T09:13:59Z

src/lib/utils/paths.ts

  // safe escape if things get out of control
  if (depth >= 9) {
-    return
+    return children


[⚠️ correctness]
Returning children instead of undefined when depth >= 9 is a safer approach, ensuring that the function consistently returns an array. However, verify that this change does not affect any logic that might have relied on the previous behavior.

github-actions · 2025-12-10T09:14:08Z

src/lib/utils/routes.ts

+export const filterRoutes = (
+  navMenuItem: NavMenuItem,
+  filter: (n: NavMenuItem) => boolean,
+  depth: number = 0


[💡 maintainability]
The default value for depth is set to 0, which is fine, but consider documenting or ensuring that the caller is aware of this default behavior, especially if the function is used in contexts where depth control is critical.

github-actions · 2025-12-10T09:14:08Z

src/lib/utils/routes.ts

+  navMenuItem: NavMenuItem,
+  filter: (n: NavMenuItem) => boolean,
+  depth: number = 0
+): NavMenuItem | undefined => {


[⚠️ correctness]
The return type of filterRoutes is now NavMenuItem | undefined. Ensure that all consumers of this function handle the undefined case appropriately to avoid potential runtime errors.

github-actions · 2025-12-10T09:14:08Z

src/lib/utils/routes.ts

 * @returns NavMenuItem.children
 */
-export const activateAuthenticatedRoutes = (isAuthenticated: boolean, { children = [] }: NavMenuItem, depth?: number) => {
+export const activateAuthenticatedRoutes = (isAuthenticated: boolean, { children = [] }: NavMenuItem, depth: number = 0): NavMenuItem[] => {


[⚠️ correctness]
The return type of activateAuthenticatedRoutes is now explicitly NavMenuItem[]. Verify that this change aligns with the expected usage of this function throughout the codebase, as it may affect how the function's output is processed.

github-actions · 2025-12-10T09:14:09Z

src/lib/utils/routes.ts

    }
-  })(0, navMenu)
+    return undefined;
+  })(0, navMenu) ?? [];


[⚠️ correctness]
The use of ?? [] ensures that matchRoutes always returns an array, which is a good practice. However, ensure that this behavior is consistent with the expectations of any code that relies on matchRoutes returning undefined in some cases.

github-actions · 2025-12-10T09:14:09Z

src/lib/utils/routes.ts

+  const activeRouteTrail = matchRoutes({ children: navMenuItems } as NavMenuItem, locationHref).filter(Boolean)

-  return typeof trailLevel === 'number' ? activeRouteTrail?.slice(trailLevel, 1) : activeRouteTrail
+  return typeof trailLevel === 'number' ? activeRouteTrail.slice(trailLevel, trailLevel + 1) : activeRouteTrail


[⚠️ correctness]
The slice operation in getActiveRoute now uses trailLevel + 1 as the end index, which is correct for extracting a single element. Ensure that this logic is consistent with the intended behavior of the function, especially if trailLevel can be out of bounds.

github-actions · 2025-12-10T09:14:16Z

src/main.ts


  const appContext = ctx.get('appContext');
+  if (!appContext) {
+    throw new Error(`Navigation #${targetId} is missing context!`);


[⚠️ maintainability]
The check for appContext being falsy and throwing an error is good for ensuring that the context is present. However, consider adding more context to the error message to help with debugging, such as including the targetId or additional state information.

github-actions · 2025-12-10T09:14:16Z

src/main.ts

  if (method === 'init') {
-    init.call(null, ...args)
+    const [targetId, cfg] = args as [string, NavigationAppProps?];
+    init(targetId, cfg ?? {} as NavigationAppProps)


[⚠️ correctness]
The use of as [string, NavigationAppProps?] for type assertion is potentially unsafe if the args array does not match the expected structure. Consider adding runtime checks to ensure args has the expected length and types before destructuring.

github-actions · 2025-12-10T09:14:16Z

src/main.ts

  else if (method === 'destroy') {
-    destroy.call(null, ...args);
+    const [targetId] = args as [string];
+    destroy(targetId);


[⚠️ correctness]
The type assertion as [string] assumes that args will always have a string as the first element. Consider adding a runtime check to validate this assumption to prevent potential runtime errors.

github-actions · 2025-12-10T09:14:16Z

src/main.ts

  else if (method === 'trigger') {
-    appPubSub.publish.call(appPubSub, ...args);
+    const [name, data] = args as [string, unknown];
+    appPubSub.publish(name, data);


[⚠️ correctness]
The type assertion as [string, unknown] assumes that args will always have a string and an unknown type. Consider adding runtime checks to validate these assumptions to prevent potential runtime errors.

github-actions · 2025-12-10T09:14:16Z

src/main.ts

-  const tcUnivNavConfig = (window[globalName] ?? {}) as any;
-  const queue = tcUnivNavConfig.q ?? [];
+  const globalName = (('TcUnivNavConfig' in window && (window as any).TcUnivNavConfig) || 'tcUniNav') as string;
+  const tcUnivNavConfig = ((globalName in window && (window as any)[globalName]) ?? {}) as { q?: unknown[] };


[⚠️ correctness]
The use of as { q?: unknown[] } assumes that tcUnivNavConfig will have a property q that is an array. Consider adding a check to ensure q is an array before proceeding to avoid potential runtime errors.

github-actions · 2025-12-10T09:14:20Z

types/src/lib/app-context/auth-config.model.d.ts

 export interface AuthConfig {
-    user: AuthUser;
-    profileCompletionData: ProfileCompletionData;
+    user?: AuthUser;


[❗❗ correctness]
Making user optional in the AuthConfig interface might lead to runtime errors if the rest of the codebase assumes user is always present. Ensure that all usages of AuthConfig handle the case where user is undefined.

github-actions · 2025-12-10T09:14:20Z

types/src/lib/app-context/auth-config.model.d.ts

-    user: AuthUser;
-    profileCompletionData: ProfileCompletionData;
+    user?: AuthUser;
+    profileCompletionData?: ProfileCompletionData;


[❗❗ correctness]
Making profileCompletionData optional in the AuthConfig interface might lead to runtime errors if the rest of the codebase assumes profileCompletionData is always present. Ensure that all usages of AuthConfig handle the case where profileCompletionData is undefined.

github-actions · 2025-12-10T09:14:27Z

types/src/lib/functions/auth.routes-filters.d.ts

 * @return {NavMenuItem} The filtered menu items based on the user roles
 */
-export declare const filterRoutesByUserRole: (routes: NavMenuItem) => any;
+export declare const filterRoutesByUserRole: (routes: NavMenuItem) => NavMenuItem | undefined;


[❗❗ correctness]
The return type has been changed from any to NavMenuItem | undefined, which improves type safety. Ensure that all usages of filterRoutesByUserRole handle the possibility of an undefined return value to prevent runtime errors.

github-actions · 2025-12-10T09:14:32Z

types/src/lib/functions/user-profile.provider.d.ts

+export type fetchUserProfileFn = () => AuthUser | null;
+export declare const getJwtUserhandle: () => AuthUser["handle"] | undefined;
+export declare const getJwtUserRoles: () => AuthUser["roles"] | undefined;
+export declare const getUserAppRoles: () => AuthUser["roles"];


[❗❗ correctness]
The return type of getUserAppRoles was changed from AuthUser['roles'] | undefined to AuthUser['roles']. If undefined is a possible value in some cases, this change might lead to runtime errors. Ensure that undefined is not a valid return value, or handle it appropriately.

github-actions · 2025-12-10T09:14:32Z

types/src/lib/functions/user-profile.provider.d.ts

 * @returns Promise<AuthUser>
 */
-export declare const fetchUserProfile: () => Promise<AuthUser>;
+export declare const fetchUserProfile: () => Promise<AuthUser | undefined>;


[❗❗ correctness]
The return type of fetchUserProfile was changed to Promise<AuthUser | undefined>. Ensure that all consumers of this function handle the potential undefined value to prevent runtime errors.

github-actions · 2025-12-10T09:14:36Z

types/src/lib/utils/classnames.d.ts

@@ -1 +1,2 @@
-export declare const classnames: (...args: string[]) => string;
+export type ClassValue = string | false | null | undefined;
+export declare const classnames: (...args: ClassValue[]) => string;


[⚠️ correctness]
The change to use ClassValue[] instead of string[] in the classnames function signature improves type safety by allowing more flexible input types. However, ensure that the implementation of the classnames function correctly handles these new types (false, null, undefined) to avoid unexpected behavior or runtime errors.

github-actions · 2025-12-10T09:14:39Z

types/src/lib/utils/cookies.d.ts

@@ -1,3 +1,3 @@
 export declare const getCookieValue: (name: string) => any;
-export declare const checkCookie: (cookieName: string, value?: any) => boolean;
+export declare const checkCookie: (cookieName: string, value?: any) => true | undefined;


[❗❗ correctness]
The return type of checkCookie has been changed from boolean to true | undefined. This change implies that the function will never return false, which might be misleading if the function is expected to indicate the absence of a cookie or a mismatch in value. Consider whether this change accurately reflects the intended behavior and if it might lead to confusion or incorrect assumptions in the codebase.

github-actions · 2025-12-10T09:14:43Z

types/src/lib/utils/fonts.d.ts

@@ -1 +1 @@
-export declare const checkAndLoadFonts: () => Promise<any>;
+export declare const checkAndLoadFonts: () => Promise<void>;


[⚠️ correctness]
Changing the return type from Promise<any> to Promise<void> improves type safety by explicitly indicating that the function does not return a value. Ensure that all usages of checkAndLoadFonts are updated accordingly to handle this change.

github-actions · 2025-12-10T09:14:48Z

types/src/lib/utils/routes.d.ts

 * @returns NavMenuItem
 */
-export declare const filterRoutes: (navMenuItem: NavMenuItem, filter: (n: NavMenuItem) => boolean, depth?: number) => any;
+export declare const filterRoutes: (navMenuItem: NavMenuItem, filter: (n: NavMenuItem) => boolean, depth?: number) => NavMenuItem | undefined;


[⚠️ correctness]
The return type of filterRoutes has been changed from any to NavMenuItem | undefined. This is a positive change for type safety, but ensure that all usages of filterRoutes handle the possibility of undefined being returned to prevent potential runtime errors.

github-actions · 2025-12-10T09:14:54Z

vite.config.ts

+        css: {
+          preprocessorOptions: {
+            scss: {
+              silenceDeprecations: ["legacy-js-api"],


[⚠️ maintainability]
The silenceDeprecations option is used to suppress warnings for deprecated features. Ensure that this is a temporary measure and that there is a plan to address the deprecation warnings, as relying on deprecated features can lead to future maintenance issues.

vas3a and others added 3 commits December 9, 2025 15:54

PM-2749 - upgrade major node modules

1b72923

remove nudge

680e530

Merge pull request #393 from topcoder-platform/PM-2749_major-update-m…

af5248c

…odules PM-2749 - upgrade major node modules

github-actions bot reviewed Dec 10, 2025

View reviewed changes

kkartunov merged commit 23b4bfc into master Dec 10, 2025
12 checks passed

github-actions bot reviewed Dec 10, 2025

View reviewed changes

		@@ -1,4 +1,4 @@
		@import 'lib/styles/fonts.scss';
		@use 'lib/styles/fonts.scss' as *;

		@@ -1,4 +1,4 @@
		@import 'lib/styles/mixins.scss';
		@use 'lib/styles/mixins.scss' as *;



		let resolve: (value: AuthUser) => void;
		let resolve: (value: AuthUser) => void = () => {};

		@@ -1 +1 @@
		export declare const checkAndLoadFonts: () => Promise<any>;
		export declare const checkAndLoadFonts: () => Promise<void>;

[PROD] - Security fixes & clean up #394

[PROD] - Security fixes & clean up #394

Uh oh!

Conversation

kkartunov commented Dec 10, 2025

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot Dec 10, 2025

Choose a reason for hiding this comment