NXT-20662: Update package dependencies to fix security vulnerabilities

[alexandrumorariu]

Enact-DCO-1.0-Signed-off-by: Alexandru Morariu alexandru.morariu@lgepartner.com

Checklist

• I have read and understand the contribution guide
• A CHANGELOG entry is included
• At least one test case is included for this feature or bug fix
• Documentation was added or is not needed
• This is an API breaking change

Issue Resolved / Feature Added

Update package dependencies to fix security vulnerabilities

Resolution

• @enact/core, @enact/i18n, @enact/spotlight, @enact/ui ^5.5.1 → ^5.6.0 All samples except the root package.json
• @enact/webos ^5.5.1 → ^5.6.0 Samples that use it (e.g. the all-samples apps, pattern-layout, pattern-ls2request, tutorial-kitten-browser)
• @enact/agate ^3.2.0 → ^3.3.0 All agate/* samples
• @enact/limestone ^1.10.1 → ^1.12.0 All limestone/* samples and tutorial-typescript
• react, react-dom ^19.2.7 → ^19.3.0 All samples
• @reduxjs/toolkit ^2.12.0 → ^2.13.0 Redux-based samples in agate/ and ui/, plus limestone/all-samples
• @reduxjs/toolkit ^2.3.0 → ^2.13.0 in five limestone samples: pattern-locale-switching, pattern-ls2request-camera, pattern-routable-panels, pattern-virtualgridlist-api and pattern-virtuallist-preserving-focus.
• query-string ^9.4.1 → ^9.5.1 The all-samples apps and limestone/pattern-layout
• query-string ^9.4.0 → ^9.5.1 agate/pattern-layout
• react-router ^8.1.0 → ^8.4.0 agate/, limestone/ and ui/ all-samples
• hls.js ^1.6.16 → ^1.7.3 limestone/all-samples and limestone/pattern-video-player-custom
• readdirp ^5.0.0 → ^5.1.1 Root package.json
• @types/node ^26.1.0 → ^26.6.3 tutorial-typescript
• @types/react ^19.2.17 → ^19.3.0 tutorial-typescript
• @types/react-dom ^19.2.3 → ^19.3.0 tutorial-typescript
• ilib ^14.21.2 → ^14.22.0 ui/spotlight-sandbox

Bigger jumps worth reviewing

• ui/spotlight-sandbox, react-router ^7.13.1 → ^8.4.0
• @enact/ui pinned 4.9.4 → ^5.6.0

Additional Considerations

Moonstone and Sandstone are unchanged as support for those libraries was interrupted.

Links

NXT-20662

Comments

[dan-ichim-lgp]

The title and description say this fixes security vulnerabilities, but no advisory or affected package is named, and Resolution is empty. The diff bumps the agate, limestone, and ui samples to Enact ^5.6.0, Agate ^3.3.0, Limestone ^1.12.0, React ^19.3.0, and Redux Toolkit ^2.13.0. Moonstone and sandstone are unchanged and still depend on Enact 4 and React 18. Please say whether that is intentional, and list the bumps that did land.

The changelog checkbox is unchecked. CHANGELOG.md already has generic unreleased lines, and this PR also moves react-router from 7 to 8 and @enact/ui from 4.9.4 to ^5.6.0. Please add those.

[dan-ichim-lgp]

This is a major bump from ^7.13.1. The sample imports HashRouter, Routes, Route, and useNavigate. React Router 8 also requires Node >= 22.22.0. Please confirm the sandbox still routes, and mention this major in the description. The other samples were already on ^8.1.0 and only move to ^8.4.0.

[alexandrumorariu]

It works

[dan-ichim-lgp]

This was pinned to 4.9.4 while the sample already depended on Enact 5 and Limestone 1.x. Moving it to ^5.6.0 matches the rest of the sample, and the same pin is removed in limestone/pattern-virtualgridlist-api/package.json. Please call out this major in the description and confirm both samples still run.

[alexandrumorariu]

It works

[daniel-stoian-lgp]

LGTM