SK-2839: pin dependency versions and harden CI against supply chain attacks

.github/workflows/CI.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: 14.17.6
 
       - name: install node_modules
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Run spellcheck
         run: npm run spellcheck

.github/workflows/beta-release.yml

@@ -19,7 +19,7 @@ jobs:
           node-version: 14.17.6
           registry-url: 'https://registry.npmjs.org'
 
-      - run: npm install
+      - run: npm install --ignore-scripts
 
       - name: install modules
         run: npm install

.github/workflows/internal-release.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/setup-node@v1
         with:
           node-version: 14.17.6
-      - run: npm install
+      - run: npm install --ignore-scripts
 
       - name: npm build
         run: npm run build

.github/workflows/main.yml

@@ -15,7 +15,7 @@ jobs:
           node-version: 14.17.6
 
       - name: install node_modules
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Run tests
         run: npm run test

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
         with:
           node-version: 14.17.6
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install
+      - run: npm install --ignore-scripts
 
       - name: install modules
         run: npm install

.npmrc

@@ -0,0 +1 @@
+ignore-scripts=true

package.json

@@ -36,57 +36,57 @@
     "npm": ">=6.0"
   },
   "devDependencies": {
-    "@babel/cli": "^7.20.7",
-    "@babel/core": "^7.9.6",
-    "@babel/plugin-proposal-class-properties": "^7.10.1",
-    "@babel/plugin-proposal-decorators": "^7.10.1",
-    "@babel/plugin-proposal-object-rest-spread": "^7.10.1",
-    "@babel/plugin-transform-runtime": "^7.10.1",
-    "@babel/preset-env": "^7.9.6",
+    "@babel/cli": "7.26.4",
+    "@babel/core": "7.26.0",
+    "@babel/plugin-proposal-class-properties": "7.18.6",
+    "@babel/plugin-proposal-decorators": "7.25.9",
+    "@babel/plugin-proposal-object-rest-spread": "7.20.7",
+    "@babel/plugin-transform-runtime": "7.25.9",
+    "@babel/preset-env": "7.26.0",
     "@babel/preset-react": "7.12.13",
-    "@babel/preset-typescript": "^7.10.1",
-    "@babel/runtime": "^7.26.10",
-    "@testing-library/jest-dom": "^6.4.5",
-    "@testing-library/react": "^13.0.0",
-    "@types/jest": "^29.5.12",
-    "@types/jquery-mask-plugin": "^1.14.3",
-    "@types/minimatch": "^3.0.5",
-    "@types/node": "^14.0.5",
-    "@types/react": "^18.0.14",
-    "@typescript-eslint/eslint-plugin": "^5.32.0",
-    "@typescript-eslint/parser": "^5.32.0",
-    "babel-loader": "^9.1.2",
-    "clean-webpack-plugin": "^4.0.0-alpha.0",
-    "compression-webpack-plugin": "^8.0.1",
-    "cspell": "^4.2.8",
-    "eslint": "^8.31.0",
-    "eslint-config-airbnb-base": "^15.0.0",
-    "eslint-config-airbnb-typescript": "^16.0.0",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-import-resolver-typescript": "^3.4.0",
-    "eslint-plugin-import": "^2.25.4",
-    "eslint-plugin-prettier": "^4.2.1",
-    "eslint-plugin-react": "^7.30.1",
-    "eslint-plugin-react-hooks": "^4.6.0",
-    "fork-ts-checker-webpack-plugin": "^6.3.2",
-    "html-webpack-plugin": "^5.5.0",
-    "jest": "^28.1.3",
-    "jest-environment-jsdom": "^28.1.3",
-    "prettier": "^2.7.1",
-    "react": "^18.1.0",
-    "react-dom": "^18.1.0",
-    "ts-jest": "^28.0.7",
-    "typescript": "^4.7.4",
-    "webpack": "^5.51.1",
-    "webpack-bundle-analyzer": "^4.4.2",
-    "webpack-cli": "^5.1.4",
-    "webpack-dev-server": "^5.2.2",
-    "webpack-manifest-plugin": "^4.0.2",
-    "webpack-merge": "^5.8.0"
+    "@babel/preset-typescript": "7.26.0",
+    "@babel/runtime": "7.28.2",
+    "@testing-library/jest-dom": "6.6.3",
+    "@testing-library/react": "13.4.0",
+    "@types/jest": "29.5.14",
+    "@types/jquery-mask-plugin": "1.14.6",
+    "@types/minimatch": "3.0.5",
+    "@types/node": "14.18.63",
+    "@types/react": "18.3.17",
+    "@typescript-eslint/eslint-plugin": "5.62.0",
+    "@typescript-eslint/parser": "5.62.0",
+    "babel-loader": "9.2.1",
+    "clean-webpack-plugin": "4.0.0",
+    "compression-webpack-plugin": "8.0.1",
+    "cspell": "4.2.8",
+    "eslint": "8.57.1",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-config-airbnb-typescript": "16.2.0",
+    "eslint-config-prettier": "8.10.0",
+    "eslint-import-resolver-typescript": "3.7.0",
+    "eslint-plugin-import": "2.31.0",
+    "eslint-plugin-prettier": "4.2.1",
+    "eslint-plugin-react": "7.37.2",
+    "eslint-plugin-react-hooks": "4.6.2",
+    "fork-ts-checker-webpack-plugin": "6.5.3",
+    "html-webpack-plugin": "5.6.3",
+    "jest": "28.1.3",
+    "jest-environment-jsdom": "28.1.3",
+    "prettier": "2.8.8",
+    "react": "18.3.1",
+    "react-dom": "18.3.1",
+    "ts-jest": "28.0.8",
+    "typescript": "4.9.5",
+    "webpack": "5.97.1",
+    "webpack-bundle-analyzer": "4.10.2",
+    "webpack-cli": "5.1.4",
+    "webpack-dev-server": "5.2.2",
+    "webpack-manifest-plugin": "4.1.1",
+    "webpack-merge": "5.10.0"
   },
   "dependencies": {
-    "skyflow-js": "^2.4.4",
-    "uuid": "^9.0.0"
+    "skyflow-js": "^2.7.8",
+    "uuid": "9.0.1"
   },
   "peerDependencies": {
     "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",