chore: address cve issues

[colinscz]

🔗 Linked issue

❓ Type of change

• 📖 Documentation (updates to the documentation, readme or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

• Addresses latest react vulnerabilities
• Aligns used Typescript version across workspace
• Remove unused packages in Nuxt demo app dev dependencies

📝 Checklist

• I have linked an issue or discussion.
• It's submitted to the main branch
• When resolving a specific issue, it's referenced in the PR's title (e.g. fix #xxx[,#xxx], where "xxx" is the issue number)
• I have updated the documentation accordingly.
• All tests are passing
• New/updated tests are included
• I have updated the "upcoming" section inside docs/changelog.md explaining the changes I contributed

If adding a new feature, the PR's description includes:

• A convincing reason for adding this feature (to avoid wasting your time, it's best to open a suggestion issue first and wait for approval before working on it)

Other information:

[colinscz]

@ibirrer @pennal I updated the packages, but seems now the angular output has an issue with the value accessor and some typings. React and vue output and libs seems to build fine. I found it weird that the date-fns is only listed as a peer but is necessary for some of the web components. Not sure about this.

[pennal]

@ibirrer @pennal I updated the packages, but seems now the angular output has an issue with the value accessor and some typings. React and vue output and libs seems to build fine. I found it weird that the date-fns is only listed as a peer but is necessary for some of the web components. Not sure about this.

This is exactly the issue I have been experiencing. The moment you change one of the packages (not sure which one tbh) the build breaks and there is an issue with the typings. Could we just avoid upgrading the other packages, and try to force the react update? In theory these new versions are all compatible with the old ones so should be possible to massage the package-lock to work with these

EDIT: The more I look at this, the more I believe we should just update the CVE-related libs and leave the rest for another PR.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/six-group/six-webcomponents/@six-group/ui-library@463

npm i https://pkg.pr.new/six-group/six-webcomponents/@six-group/ui-library-angular@463

npm i https://pkg.pr.new/six-group/six-webcomponents/@six-group/ui-library-react@463

npm i https://pkg.pr.new/six-group/six-webcomponents/@six-group/ui-library-vue@463

commit: c946f3e