NXT-20662: Update package dependencies to fix security vulnerabilities

[alexandrumorariu]

Enact-DCO-1.0-Signed-off-by: Alexandru Morariu alexandru.morariu@lgepartner.com

Checklist

• I have read and understand the contribution guide
• A CHANGELOG entry is included
• At least one test case is included for this feature or bug fix
• I have run automated testing and it is passed
• Documentation was added or is not needed
• This is an API breaking change

Issue Resolved / Feature Added

Update package dependencies to fix security vulnerabilities

Resolution

Additional Considerations

Updated major versions:
dotenv: ^17.4.2 --> ^18.0.5 no breaking changes (https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)

• react, react-dom ^19.2.8 → ^19.3.0 Root and all 21 samples
• @reduxjs/toolkit ^2.12.0 → ^2.13.0 event-logger, qa-virtualgridlist, qa-virtualgridlistnative-preserve-focus, qa-virtuallist
• react-is^19.2.8 → ^19.3.0 sampler
• @enact/storybook-utils ^8.0.3 → ^8.0.4 sampler
• @github-ui/storybook-addon-performance-panel ^1.1.4 → ^1.3.0 sampler
• storybook ^10.5.10 → ^10.6.1 sampler
• @storybook/react-webpack5 ^10.5.10 → ^10.6.1 sampler
• storybook-addon-pseudo-states |^10.5.10 → ^10.6.1 sampler
• dotenv ^17.4.2 → ^18.0.5 sampler

The Storybook patch file was renamed from storybook+10.5.10.patch to storybook+10.6.1.patch, to match the new Storybook version.

Links

NXT-20662

Comments

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.60%. Comparing base (cdeceeb) to head (448f802).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #876   +/-   ##
========================================
  Coverage    85.60%   85.60%           
========================================
  Files          118      118           
  Lines         4495     4495           
  Branches      1226     1226           
========================================
  Hits          3848     3848           
  Misses         503      503           
  Partials       144      144           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dan-ichim-lgp]

The title and description say this fixes security vulnerabilities, but no advisory or affected package is named, and Resolution is empty. The diff is a dependency bump: React and ReactDOM to ^19.3.0, Storybook to 10.6.1, dotenv to ^18.0.5, and Redux Toolkit to ^2.13.0. Please list those bumps and drop the security claim unless a specific advisory is included.
Please also add the Enact-DCO sign-off in Comments.

[dan-ichim-lgp]

This entry does not match the diff. dotenv in the sampler moves from 17 to 18, which is a major bump, and the published react / react-dom range now starts at 19.3.0. Please name those changes here.

[alexandrumorariu]

Done

[dan-ichim-lgp]

^19.3.0 no longer accepts React 19.2.x. @enact/core, @enact/ui, @enact/spotlight, and @enact/i18n still declare ^19.2.8, which 19.3.0 satisfies, so one copy can still be hoisted. Apps that stay on 19.2.8 will no longer satisfy this published dependency. If 19.3.0 is only the installed version, keep the range at ^19.2.8. If 19.3.0 is the new minimum, call that out in the changelog.

[alexandrumorariu]

Done