chore(): Fix dependencies (#13932)

.changeset/tame-eels-cover.md

@@ -0,0 +1,19 @@
+---
+"@medusajs/medusa": patch
+"@medusajs/test-utils": patch
+"@medusajs/analytics-posthog": patch
+"@medusajs/file-s3": patch
+"@medusajs/notification-sendgrid": patch
+"@medusajs/draft-order": patch
+"@medusajs/framework": patch
+"@medusajs/utils": patch
+"create-medusa-app": patch
+"@medusajs/telemetry": patch
+"@medusajs/admin-bundler": patch
+"@medusajs/admin-vite-plugin": patch
+"@medusajs/icons": patch
+"@medusajs/toolbox": patch
+"@medusajs/ui": patch
+---
+
+chore(): Fix dependencies vulnerabilities

integration-tests/http/package.json

@@ -33,7 +33,7 @@
     "@medusajs/user": "workspace:^",
     "@medusajs/utils": "workspace:^",
     "@medusajs/workflow-engine-inmemory": "workspace:*",
-    "form-data": "^4.0.0",
+    "form-data": "^4.0.4",
     "jsonwebtoken": "^9.0.2",
     "pg": "^8.11.3"
   },

package.json

@@ -23,7 +23,7 @@
     "@types/node": "^20.12.11",
     "@typescript-eslint/eslint-plugin": "^6.19.0",
     "@typescript-eslint/parser": "^6.19.0",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "axios-mock-adapter": "^1.19.0",
     "cross-env": "^7.0.3",
     "eslint": "^8.23.0",

packages/admin/admin-bundler/src/commands/serve.ts

@@ -42,7 +42,7 @@ export async function serve(options: ServeOptions) {
     res.setHeader("Vary", "Origin, Cache-Control")
   }
 
-  router.use(compression())
+  router.use(compression() as any)
 
   router.get("/", sendHtml)
   router.use(

packages/admin/admin-vite-plugin/package.json

@@ -41,7 +41,7 @@
     "@babel/traverse": "7.25.6",
     "@babel/types": "7.25.6",
     "@medusajs/admin-shared": "2.11.2",
-    "chokidar": "3.5.3",
+    "chokidar": "^3.5.3",
     "fdir": "6.1.1",
     "magic-string": "0.30.5",
     "outdent": "^0.8.0",

packages/cli/create-medusa-app/package.json

@@ -27,7 +27,7 @@
     "slugify": "^1.6.6",
     "uuid": "^9.0.0",
     "validator": "^13.15.20",
-    "wait-on": "^7.0.1",
+    "wait-on": "^9.0.1",
     "winston": "^3.9.0"
   },
   "devDependencies": {

packages/cli/create-medusa-app/src/utils/logger.ts

@@ -1,7 +1,7 @@
 import winston from "winston"
 
 const consoleTransport = new winston.transports.Console({
-  format: winston.format.printf((log) => log.message),
+  format: winston.format.printf((log) => log.message as string),
 })
 const options = {
   transports: [consoleTransport],

packages/core/framework/package.json

@@ -77,7 +77,7 @@
     "ioredis": "^5.4.1",
     "jest": "^29.7.0",
     "rimraf": "^5.0.1",
-    "supertest": "^4.0.2",
+    "supertest": "^7.1.4",
     "typescript": "^5.6.2",
     "vite": "^5.4.14"
   },
@@ -102,7 +102,7 @@
     "jsonwebtoken": "^9.0.2",
     "lodash.memoize": "^4.1.2",
     "morgan": "^1.9.1",
-    "path-to-regexp": "^0.1.12",
+    "path-to-regexp": "^8.2.0",
     "tsconfig-paths": "^4.2.0",
     "zod": "3.25.76",
     "zod-validation-error": "3.5.1"

packages/core/framework/src/http/routes-finder.ts

@@ -1,5 +1,6 @@
-import pathToRegexp from "path-to-regexp"
+import { pathToRegexp } from "path-to-regexp"
 import type { MiddlewareVerb, RouteVerb } from "./types"
+import { isString } from "@medusajs/utils"
 
 export class RoutesFinder<
   T extends
@@ -35,9 +36,17 @@ export class RoutesFinder<
    * Register route for lookup
    */
   add(route: T) {
+    // Doing a replacement for backwards compatibility with the old path-to-regexp with express 4
+    let normalizedPath = route.matcher
+    if (isString(route.matcher)) {
+      // Replace /* with {*splat} (wildcard matches zero or more path segments)
+      normalizedPath = normalizedPath.replace(/\/\*/g, "{*splat}")
+      // Replace /path* (no slash before asterisk) with /path{*splat}
+      normalizedPath = normalizedPath.replace(/(\w)\*/g, "$1{*splat}")
+    }
     this.#routes.push({
       ...route,
-      matchRegex: pathToRegexp(route.matcher),
+      matchRegex: pathToRegexp(normalizedPath).regexp,
     })
   }
 

packages/core/framework/src/http/utils/http-compression.ts

@@ -24,7 +24,7 @@ export function shouldCompressResponse(
   }
 
   // fallback to standard filter function
-  return compression.filter(req, res)
+  return compression.filter(req as any, res as any)
 }
 
 export function compressionOptions(

packages/core/utils/package.json

@@ -31,7 +31,7 @@
     "@swc/jest": "^0.2.36",
     "@types/autocannon": "^7.12.5",
     "@types/express": "^4.17.21",
-    "autocannon": "^7.15.0",
+    "autocannon": "^8.0.0",
     "expect-type": "^0.20.0",
     "express": "^4.21.0",
     "jest": "^29.7.0",

packages/design-system/icons/package.json

@@ -35,17 +35,17 @@
     "@testing-library/dom": "^9.3.1",
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
-    "@types/jsdom": "^21.1.1",
+    "@types/jsdom": "^27.0.0",
     "@types/react": "^18.3.2",
     "@types/react-dom": "^18.2.25",
     "esbuild": "^0.25.0",
     "eslint": "^8.40.0",
-    "jsdom": "^22.1.0",
+    "jsdom": "^27.1.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "resize-observer-polyfill": "^1.5.1",
     "rimraf": "^5.0.1",
-    "rollup": "^3.26.0",
+    "rollup": "^4.28.1",
     "rollup-plugin-esbuild": "^5.0.0",
     "rollup-plugin-ts": "^3.2.0",
     "rollup-plugin-visualizer": "^5.9.2",

packages/design-system/toolbox/package.json

@@ -14,7 +14,7 @@
     "@svgr/plugin-jsx": "8.0.1",
     "@svgr/plugin-prettier": "8.0.1",
     "@svgr/plugin-svgo": "8.0.1",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "axios-retry": "^3.1.9",
     "commander": "^11.0.0",
     "dotenv": "^16.4.5",

packages/design-system/ui/package.json

@@ -56,7 +56,7 @@
     "@testing-library/jest-dom": "^5.16.5",
     "@testing-library/react": "^14.0.0",
     "@testing-library/user-event": "^14.4.3",
-    "@types/jsdom": "^21.1.1",
+    "@types/jsdom": "^27.0.0",
     "@types/react": "^18.3.2",
     "@types/react-dom": "^18.2.25",
     "@vitejs/plugin-react": "^4.2.1",
@@ -65,7 +65,7 @@
     "chromatic": "^6.20.0",
     "eslint": "^8.40.0",
     "eslint-plugin-storybook": "^10.0.1",
-    "jsdom": "^22.1.0",
+    "jsdom": "^27.1.0",
     "postcss": "^8.4.38",
     "prop-types": "^15.8.1",
     "react": "^18.3.1",

packages/medusa-telemetry/package.json

@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@babel/runtime": "^7.26.10",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "axios-retry": "^3.1.9",
     "boxen": "^5.0.1",
     "ci-info": "^3.2.0",

packages/medusa-test-utils/package.json

@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@types/express": "^4.17.21",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "express": "^4.21.0",
     "get-port": "^5.1.1",
     "randomatic": "^3.1.1"

packages/medusa/package.json

@@ -58,7 +58,7 @@
     "@types/multer": "^2.0.0",
     "jest": "^29.7.0",
     "rimraf": "^5.0.1",
-    "supertest": "^4.0.2",
+    "supertest": "^7.1.4",
     "typescript": "^5.6.2",
     "yalc": "^1.0.0-pre.53"
   },
@@ -133,7 +133,7 @@
   "peerDependencies": {
     "@medusajs/framework": "2.11.2",
     "@swc/core": "^1.7.28",
-    "posthog-node": "^4.17.1",
+    "posthog-node": "^5.11.0",
     "react-dom": "^18.3.1",
     "yalc": "^1.0.0-pre.53"
   },

packages/modules/providers/analytics-posthog/package.json

@@ -29,7 +29,7 @@
     "@swc/core": "^1.7.28",
     "@swc/jest": "^0.2.36",
     "jest": "^29.7.0",
-    "posthog-node": "^4.17.1",
+    "posthog-node": "^5.11.0",
     "rimraf": "^5.0.1",
     "typescript": "^5.6.2"
   },

packages/modules/providers/file-s3/package.json

@@ -29,7 +29,7 @@
     "@medusajs/framework": "2.11.2",
     "@swc/core": "^1.7.28",
     "@swc/jest": "^0.2.36",
-    "axios": "^1.12.0",
+    "axios": "^1.13.1",
     "jest": "^29.7.0",
     "rimraf": "^5.0.1",
     "typescript": "^5.6.2"

packages/modules/providers/notification-sendgrid/package.json

@@ -34,7 +34,7 @@
     "typescript": "^5.6.2"
   },
   "dependencies": {
-    "@sendgrid/mail": "^8.1.3"
+    "@sendgrid/mail": "^8.1.6"
   },
   "peerDependencies": {
     "@medusajs/framework": "2.11.2"

packages/plugins/draft-order/package.json

@@ -54,7 +54,7 @@
     "@medusajs/icons": "2.11.2",
     "@medusajs/test-utils": "2.11.2",
     "@medusajs/types": "2.11.2",
-    "@medusajs/ui": "4.0.25",
+    "@medusajs/ui": "4.0.26",
     "@medusajs/ui-preset": "2.11.2",
     "@swc/core": "^1.7.28",
     "@types/lodash": "^4.17.15",
@@ -78,7 +78,7 @@
     "@medusajs/framework": "2.11.2",
     "@medusajs/icons": "2.11.2",
     "@medusajs/test-utils": "2.11.2",
-    "@medusajs/ui": "4.0.25",
+    "@medusajs/ui": "4.0.26",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "6.20.1"

www/apps/api-reference/package.json

@@ -26,7 +26,7 @@
     "clsx": "^2.0.0",
     "docs-ui": "*",
     "docs-utils": "*",
-    "jsdom": "^22.1.0",
+    "jsdom": "^27.1.0",
     "json-schema": "^0.4.0",
     "json-stringify-pretty-compact": "^4.0.0",
     "next": "15.3.5",
@@ -53,7 +53,7 @@
   },
   "devDependencies": {
     "@next/bundle-analyzer": "15.3.5",
-    "@types/jsdom": "^21.1.1",
+    "@types/jsdom": "^27.0.0",
     "@types/mapbox__rehype-prism": "^0.8.0",
     "@types/mdx": "^2.0.13",
     "@types/node": "20.4.5",