[ThieryMichel]

Vulnerability fixes

This PR fixes 131 of 153 npm advisories and all 51 Composer advisories that yarn audit and composer audit report on main. The 22 npm advisories left have no fix that fits the current dependency ranges; each one is explained below.

Lockfile	main	This PR
yarn.lock	153 (1 critical, 60 high, 70 moderate, 22 low)	22 (7 high, 11 moderate, 4 low)
api/composer.lock	51 (1 critical, 10 high, 14 moderate, 7 low, 19 unrated)	0

Counts are unique advisories (GHSA or CVE IDs), so they can be matched against Dependabot alerts.

Scope. All of these are in the repository's own lockfiles: dev tooling, Storybook, and the demo API in api/. The published package has no lockfile, so apps that install @api-platform/admin resolve their own versions. Its dependency ranges are unchanged apart from the new @marmelab/query-string dependency. react-admin stays at ^5.15.5, so apps can still resolve 5.15.5, which pulls in the vulnerable decode-uri-component.

All vulnerability resolutions are removed from package.json. Every fix here comes from a lockfile refresh or a dependency bump.

Fixed: npm (yarn.lock)

131 of 153 advisories reported by yarn audit on main are fixed.

Package	Advisories	From → To	How
@storybook/core	1 critical, 1 high	8.6.17 → 8.6.19	storybook 8.6.15 → 8.6.19
@babel/plugin-transform-modules-systemjs	1 high	7.25.9 → 7.29.8	Lockfile refresh (in range)
@remix-run/router	1 high, 1 moderate	1.23.0, 6.30.1 → removed	Removed the react-router ^6 resolution (v7 no longer uses it)
axios	14 high, 21 moderate, 1 low	1.15.0 → 1.21.0	Lockfile refresh (in range)
brace-expansion	5 high, 2 moderate, 1 low	1.1.11, 2.0.1 → 1.1.21, 2.1.7, 5.0.12	Lockfile refresh (in range)
browserslist	2 high	4.28.1 → 4.29.5	Lockfile refresh (in range)
compression	1 high	1.7.4 → removed	Replaced serve with http-server
cross-spawn	1 high	7.0.3 → 7.0.6	Lockfile refresh (in range)
decode-uri-component	1 high, 1 moderate	0.2.2 → removed	react-admin 5.15.6 (ra-core dropped query-string)
dompurify	1 high, 10 moderate, 6 low	3.3.3 → 3.4.17	Lockfile refresh (in range)
fast-uri	8 high, 2 moderate, 2 low	3.0.3 → 3.1.9	Lockfile refresh (in range)
glob	1 high, 1 moderate	10.4.5 → 14.0.4	rimraf 5 → 6
joi	2 high, 2 moderate, 2 low	17.13.3 → 17.13.9	Lockfile refresh (in range)
js-yaml	3 high, 2 moderate	3.14.1, 4.1.0 → 3.15.2, 4.3.2	Lockfile refresh (in range)
minimatch	3 high	3.1.2, 5.1.6, 9.0.5 → 3.1.5, 5.1.9, 9.0.9, 11.0.5	Lockfile refresh (in range)
nanoid	3 high, 1 moderate	3.3.7 → 3.3.20	Lockfile refresh (in range)
postcss	2 high, 2 moderate	8.4.47 → 8.5.32	Lockfile refresh (in range)
serialize-javascript	1 high, 1 moderate, 1 low	6.0.2 → removed	terser-webpack-plugin 5.6 no longer depends on it
source-map-js	1 high	1.2.1 → 1.2.2	Lockfile refresh (in range)
ws	1 high, 1 moderate	8.18.0 → 8.22.2	Lockfile refresh (in range)
@babel/helpers	1 moderate	7.26.0 → 7.29.13	Lockfile refresh (in range)
ajv	1 moderate	6.12.6, 8.12.0, 8.17.1 → 6.15.0, 8.20.0	Lockfile refresh (in range)
baseline-browser-mapping	1 moderate	2.9.19 → 2.11.35	Lockfile refresh (in range)
follow-redirects	1 moderate	1.15.11 → 1.16.3	Lockfile refresh (in range)
postcss-selector-parser	1 moderate, 1 low	6.1.2 → 6.1.6	Lockfile refresh (in range)
qs	4 moderate	6.14.2 → 6.17.1	Lockfile refresh (in range)
react-router	3 moderate	6.30.1 → 7.18.5	Removed the react-router ^6 resolution (now v7)
@babel/core	1 low	7.26.0 → 7.29.13	Lockfile refresh (in range)
@tootallnate/once	1 low	2.0.0 → 2.0.1	Lockfile refresh (in range)
diff	1 low	4.0.2 → 4.0.4	Lockfile refresh (in range)
on-headers	1 low	1.0.2 → removed	Replaced serve with http-server

Fixed: Composer (api/composer.lock, demo API)

All 51 advisories reported by composer audit on main are fixed; composer audit on this branch reports none.

Package	Advisories	From → To	How
twig/twig	1 critical, 3 high, 5 moderate, 4 low, 2 unrated	v3.11.2 → v3.30.0	composer update
symfony/http-foundation	2 high, 1 moderate, 2 unrated	v7.1.7 → v6.4.50	composer update, aligned to the app's Symfony 6.4 constraint
symfony/monolog-bridge	1 high	v6.4.4 → v6.4.49	composer update
symfony/security-http	3 high, 2 moderate, 2 unrated	v7.4.3 → v6.4.50	composer update, aligned to the app's Symfony 6.4 constraint
symfony/yaml	1 high, 3 low, 1 unrated	v6.4.3 → v6.4.50	composer update
api-platform/core	2 moderate	v4.1.5 → v4.1.30	composer.json floor raised to ^4.1.30
symfony/cache	1 moderate	v6.4.4 → v6.4.50	composer update
symfony/routing	2 moderate, 1 unrated	v6.4.5 → v6.4.50	composer update
symfony/runtime	1 moderate, 1 unrated	v6.4.14 → v6.4.41	composer update
symfony/config	1 unrated	v7.4.3 → v6.4.50	composer update, aligned to the app's Symfony 6.4 constraint
symfony/expression-language	1 unrated	v6.4.3 → v6.4.48	composer update
symfony/filesystem	1 unrated	v7.4.0 → v6.4.50	composer update, aligned to the app's Symfony 6.4 constraint
symfony/http-client	2 unrated	v7.4.3 → v6.4.50	composer update, aligned to the app's Symfony 6.4 constraint
symfony/http-kernel	1 unrated	v6.4.31 → v6.4.50	composer update
symfony/serializer	3 unrated	v6.4.25 → v6.4.50	composer update
symfony/validator	1 unrated	v6.4.11 → v6.4.50	composer update

Not fixed

Package	Advisories	Version	Pulled in by	Why it is not fixed	Way out
undici	5 high, 8 moderate, 3 low	5.29.0	jsonld 8 → @digitalbazaar/http-client 3, both directly and through @api-platform/api-doc-parser	Fixed in undici 6.29.1, but http-client 3 requires ^5. jsonld 9 moves to http-client 4 (undici 6), but api-doc-parser 0.16.12 still requires jsonld ^8.3.3.	api-doc-parser main already requires jsonld ^9 (api-platform/api-doc-parser#183), but that isn't released yet. Once it is, bump it and jsonld to ^9 here. undici is only used by Node.js code; browser builds swap it out through http-client's browser field.
@fastify/busboy	1 high, 1 moderate	2.1.1	undici 5 (same path)	Dependency of undici 5.	Goes away with undici 6.
webpack-dev-middleware	1 high	6.1.3	@storybook/builder-webpack5	Fixed in 7.4.6, but Storybook's webpack builder requires ^6.1.2, still true in Storybook 10.	Switch Storybook to the Vite builder (@storybook/react-vite). Only storybook dev uses it.
minimatch	1 moderate	9.0.9	@typescript-eslint/* 7 → typescript-estree	Fixed in 11.0.1. Even the latest typescript-eslint (8.72.2) requires ^10.2.2.	Wait for a typescript-eslint release. Only used by lint.
uuid	1 moderate	8.3.2, 9.0.1	@storybook/addon-actions; jest-junit and nyc through @storybook/test-runner	Fixed in 11.1.1. Every @storybook/test-runner release still requires jest-junit ^16 and nyc ^15.	Storybook 9 removes the addon-actions path. The test-runner paths need upstream releases. Only affects uuid's v3/v5/v6 called with a buf argument.
deepmerge	1 low	4.3.1	jest, fork-ts-checker-webpack-plugin	No patched version has been published.	None available yet.

Other changes needed for these fixes

• restDataProvider imported query-string without declaring it, and ra-core 5.15.6 no longer installs it. It now imports @marmelab/query-string, which has the same API and is what ra-data-simple-rest uses, and declares it in dependencies.
• This repo now develops and tests against react-router v7. The library only uses useParams, which works the same in v6 and v7; apps keep whichever version react-admin's range (^6.28.1 || ^7.1.1) gives them.
• serve is replaced with http-server. storybook:serve now takes its port from the caller; CI already passes -p 3000.
• Storybook 8.6.19 listens on 127.0.0.1 by default, so the dev image now runs it with --host 0.0.0.0, and compose.yaml publishes port 3000 on the host's 127.0.0.1 only.
• api/composer.json: api-platform/core raised to ^4.1.30, and config.platform.php set to 8.2.0. A few Symfony components that had been resolved to 7.x are aligned with the app's 6.4.* constraint.

Verification

• yarn test (74/74), tsc --noEmit, eslint src and storybook build pass.
• composer audit reports no advisories.
• The Storybook interaction tests run in CI.