chore: upgrade dependencies with critical and high vulnerabilities

CHANGELOG.md

@@ -12,13 +12,24 @@ You can also check the
 ## Unreleased
 
 - Features
+
   - Add SPARQL endpoints in the OpenTelemetry traces
   - Add Sentry integration back
+
+- Dependency Upgrades
+
+  - Upgrade to Next.js 15
+  - Upgrade to Typescript 5.7
+  - Upgraded dependencies and package resolutions of transitive dependency to
+    address critical vulnerabilities
+
 - Refactoring
   - Incorporate the Swiss-Federal-CI library into this repository.
 - Fixes
+
   - Sanitize urls for links in tables
   - Improve CSP header configuration
+
 - Maintenance
   - Remove Google Analytics integration (it is no longer in use)
   - Set Maptiler API key from `MAPTILER_API_KEY` environment variable at
@@ -28,6 +39,8 @@ You can also check the
   - Remove LINDASOld endpoint configurations
 - Documentation
   - added publiccode.yml for discoverability
+  - Remove npm package publish workflow
+  - Replace rollup build to esbuild for the embed script
 
 ### 6.4.0 – 2026-03-13
 

app/charts/map/wms-utils.ts

@@ -129,6 +129,8 @@ export const parseWMSContent = (content: string, endpoint: string) => {
     ignoreAttributes: false,
     attributeNamePrefix: "",
     parseAttributeValue: true,
+    processEntities: false, // Disable entity processing for trusted sources
+    htmlEntities: true, // But still decode standard HTML entities like &​amp;
   });
 
   const wmsData = parser.parse(content) as WMSData;

app/charts/map/wmts-utils.ts

@@ -223,6 +223,8 @@ export const parseWMTSContent = (content: string, endpoint: string) => {
     ignoreAttributes: false,
     attributeNamePrefix: "",
     parseAttributeValue: true,
+    processEntities: false, // Disable entity processing for trusted sources
+    htmlEntities: true, // But still decode standard HTML entities like &​amp;
   });
   const parsed = parser.parse(content) as WMTSData;
   const attributes = {

app/next-env.d.ts

@@ -1,5 +1,6 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
+/// <reference path="./.next/types/routes.d.ts" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/pages/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/pages/api-reference/config/typescript for more information.

app/next.config.js

@@ -5,7 +5,6 @@ const withBundleAnalyzer = require("@next/bundle-analyzer")({
   enabled: process.env.ANALYZE === "true",
 });
 const withMDX = require("@next/mdx")();
-const withPreconstruct = require("@preconstruct/next");
 const { withSentryConfig } = require("@sentry/nextjs");
 const { IgnorePlugin } = require("webpack");
 
@@ -40,19 +39,14 @@ if (process.env.NEXT_PUBLIC_SENTRY_DSN) {
 }
 
 module.exports = withSentryConfig(
-  withPreconstruct(
-    withBundleAnalyzer(
-      withMDX({
-        output: "standalone",
+  withBundleAnalyzer(
+    withMDX({
+      output: "standalone",
         i18n: {
           locales,
           defaultLocale,
         },
 
-        experimental: {
-          instrumentationHook: true,
-        },
-
         headers: async () => {
           // See https://content-security-policy.com/ & https://developers.google.com/tag-platform/security/guides/csp
           const isDev = process.env.NODE_ENV === "development";
@@ -228,7 +222,6 @@ module.exports = withSentryConfig(
         },
       })
     ),
-    { silent: true },
-    { hideSourcemaps: true }
-  )
-);
+  { silent: true },
+  { hideSourcemaps: true }
+);

app/package.json

@@ -1,14 +1,6 @@
 {
   "name": "@interactivethings/visualize-app",
   "version": "3.4.9",
-  "publishConfig": {
-    "access": "public"
-  },
-  "main": "dist/interactivethings-visualize-app.cjs.js",
-  "module": "dist/interactivethings-visualize-app.esm.js",
-  "files": [
-    "dist"
-  ],
   "scripts": {
     "build": "yarn workspace @visualize-admin/visualization-tool run build"
   },
@@ -43,16 +35,15 @@
     "@mui/material": "^5.17.1",
     "@mui/styles": "5.17.1",
     "@mui/utils": "^5.17.1",
-    "@next/bundle-analyzer": "^11.0.1",
-    "@next/mdx": "^11.0.1",
+    "@next/bundle-analyzer": "^15.0.0",
+    "@next/mdx": "^15.0.0",
     "@open-iframe-resizer/core": "1.6.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/exporter-trace-otlp-http": "^0.211.0",
     "@opentelemetry/resources": "^2.5.0",
     "@opentelemetry/sdk-node": "^0.211.0",
     "@opentelemetry/sdk-trace-node": "^2.5.0",
     "@opentelemetry/semantic-conventions": "^1.39.0",
-    "@preconstruct/next": "^3.0.1",
     "@prisma/client": "^4.10.1",
     "@rdfjs/data-model": "^2.0.2",
     "@rdfjs/namespace": "^2.0.1",
@@ -98,7 +89,7 @@
     "dotenv": "^16.0.3",
     "dotenv-cli": "^6.0.0",
     "exceljs": "^4.4.0",
-    "fast-xml-parser": "^4.5.2",
+    "fast-xml-parser": "^5.5.12",
     "file-saver": "^2.0.5",
     "flexsearch": "^0.6.32",
     "fp-ts": "^2.8.2",
@@ -171,17 +162,6 @@
     "wonka": "4.0.15",
     "zustand": "^4.1.1"
   },
-  "peerDependencies": {
-    "@babel/runtime": "^7.8.4",
-    "next": "^13.0.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
-  },
-  "preconstruct": {
-    "entrypoints": [
-      "./index.ts"
-    ]
-  },
   "devDependencies": {
     "@graphql-codegen/cli": "^1.19.4",
     "@graphql-codegen/typescript": "^1.22.3",

app/utils/chart-config/versioning.ts

@@ -1520,7 +1520,13 @@ export const chartConfigMigrations: Migration[] = [
       const newConfig = { ...config, version: "4.4.0" };
 
       if (newConfig.fields.segment) {
-        newConfig.fields.segment.showValuesMapping = {};
+        newConfig.fields = {
+          ...newConfig.fields,
+          segment: {
+            ...newConfig.fields.segment,
+            showValuesMapping: {},
+          },
+        };
       }
 
       return newConfig;
@@ -1529,7 +1535,11 @@ export const chartConfigMigrations: Migration[] = [
       const newConfig = { ...config, version: "4.3.0" };
 
       if (newConfig.fields.segment) {
-        delete newConfig.fields.segment.showValuesMapping;
+        const { showValuesMapping, ...segment } = newConfig.fields.segment;
+        newConfig.fields = {
+          ...newConfig.fields,
+          segment,
+        };
       }
 
       return newConfig;

knip.config.ts

@@ -1,5 +1,4 @@
 import { KnipConfig } from "knip";
-import mdx from "knip/dist/compilers/mdx";
 
 const config: KnipConfig = {
   paths: {
@@ -67,7 +66,6 @@ const config: KnipConfig = {
     // Used in load tests.
     "@types/k6",
     // Do we still need this?
-    "babel-core",
     "@babel/standalone",
     "@babel/runtime",
     "core-js",
@@ -78,7 +76,7 @@ const config: KnipConfig = {
     unresolved: "warn",
   },
   compilers: {
-    mdx: mdx.compiler,
+    mdx: true,
   },
 };
 

package.json

@@ -12,14 +12,13 @@
   "license": "BSD-3-Clause",
   "private": true,
   "scripts": {
-    "dev": "preconstruct dev && NODE_OPTIONS=\"--inspect --openssl-legacy-provider \" next ./app",
-    "dev:ssl": "preconstruct dev && NODE_OPTIONS=\"--inspect --openssl-legacy-provider \" next dev --experimental-https ./app",
-    "dev:mitmproxy": "preconstruct dev && HTTP_PROXY=http://localhost:8080 NODE_EXTRA_CA_CERTS=~/.mitmproxy/mitmproxy-ca-cert.pem GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE='' NO_PROXY='localhost,127.0.0.1' next ./app",
-    "dev:rollup": "rollup -c rollup.config.js --watch",
+    "dev": "NODE_OPTIONS=\"--inspect --openssl-legacy-provider \" next ./app",
+    "dev:ssl": "NODE_OPTIONS=\"--inspect --openssl-legacy-provider \" next dev --experimental-https ./app",
+    "dev:mitmproxy": "HTTP_PROXY=http://localhost:8080 NODE_EXTRA_CA_CERTS=~/.mitmproxy/mitmproxy-ca-cert.pem GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE='' NO_PROXY='localhost,127.0.0.1' next ./app",
+    "dev:embed": "esbuild embed/index.tsx --bundle --format=iife --global-name=VisualizeEmbed --define:process.env.NODE_ENV=\"\\\"production\\\"\" --outfile=app/public/dist/embed.js --watch",
     "db:migrate:dev": "DATABASE_URL=postgres://postgres:password@localhost:5432/visualization_tool prisma db push",
     "db:migrate": "[ -z \"$DATABASE_URL\" ] && echo 'Bypassing database migration, DATABASE_URL not set' || prisma db push",
-    "build": "yarn graphql:codegen && lingui compile && rollup -c rollup.config.js && yarn storybook:build && yarn generate-json-schema && next build ./app",
-    "build:npm": "yarn graphql:codegen && lingui compile && BABEL_ENV=NPM_PACKAGE preconstruct build",
+    "build": "yarn graphql:codegen && lingui compile && esbuild embed/index.tsx --bundle --minify --format=iife --global-name=VisualizeEmbed --define:process.env.NODE_ENV=\"\\\"production\\\"\" --outfile=app/public/dist/embed.js && yarn storybook:build && yarn generate-json-schema && next build ./app",
     "start": "yarn db:migrate && GLOBAL_AGENT_ENVIRONMENT_VARIABLE_NAMESPACE='' NO_PROXY='localhost,127.0.0.1' next start ./app -p $PORT",
     "typecheck": "tsc --noEmit -p ./app && tsc --noEmit -p ./embed",
     "lint": "eslint app -c .eslintrc.json",
@@ -35,14 +34,13 @@
     "test:ui": "vitest --ui --root $(pwd)/app",
     "setup:dev": "yarn && yarn locales:compile && yarn db:migrate:dev",
     "postversion": "git push --follow-tags",
-    "release:npm": "yarn build:npm && yarn publish app",
     "e2e:dev": "E2E_BASE_URL=http://localhost:3000 yarn playwright test",
     "e2e:dev:ssl": "E2E_BASE_URL=https://localhost:3000 yarn playwright test",
     "e2e:ui": "E2E_BASE_URL=http://localhost:3000 yarn playwright test --ui",
     "e2e:ui:ssl": "E2E_BASE_URL=https://localhost:3000 yarn playwright test --ui",
     "e2e": "playwright test",
     "cube": "NODE_ENV=development ts-node app/scripts/cube.ts",
-    "dev:circular-deps": "madge --warning --extensions js,jsx,ts,tsx -b ./app -c ./app/pages/ --ts-config ./app/tsconfig.json | bun scripts/circular-deps-analysis.ts -",
+    "dev:circular-deps": "madge --warning --extensions js,jsx,ts,tsx -b ./app -c ./app/pages/ --ts-config ./app/tsconfig.json | tsx scripts/circular-deps-analysis.ts -",
     "github:codegen": "node k6/performance-tests/generate-github-actions.mjs",
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build -o app/public/storybook",
@@ -51,21 +49,16 @@
     "wms-wmts-providers:scrape": "curl https://raw.githubusercontent.com/geoadmin/web-mapviewer/refs/heads/develop/packages/mapviewer/src/modules/menu/components/advancedTools/ImportCatalogue/external-providers.json | prettier --parser json > ./app/charts/map/wms-wmts-providers.json"
   },
   "dependencies": {
-    "@babel/runtime": "^7.11.2",
+    "@babel/runtime": "^7.26.0",
     "@cozy/cli-tree": "^0.3.0",
     "core-js": "^3.15.1",
-    "next": "14.2.35",
+    "next": "15",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "ts-brand": "^0.2.0",
     "ts-node": "^10.9.2"
   },
   "devDependencies": {
-    "@babel/core": "^7.12.9",
-    "@preconstruct/cli": "^2.7.0",
-    "@rollup/plugin-json": "^4.1.0",
-    "@rollup/plugin-node-resolve": "^13.0.0",
-    "@rollup/plugin-replace": "^2.3.3",
     "@storybook/addon-essentials": "8.6.12",
     "@storybook/addon-interactions": "8.6.12",
     "@storybook/addon-links": "8.6.12",
@@ -81,9 +74,7 @@
     "@typescript-eslint/utils": "^5.35.1",
     "@vitest/coverage-v8": "3.1.4",
     "@vitest/ui": "3.1.4",
-    "vitest": "^3.1.4",
     "argparse": "^2.0.1",
-    "babel-core": "^7.0.0-bridge.0",
     "babel-plugin-macros": "^3.0.0",
     "eslint": "^8.57.1",
     "eslint-config-next": "^14.2.23",
@@ -94,33 +85,34 @@
     "fs-extra": "^10.0.0",
     "import-move-codemod": "^0.0.3",
     "knip": "^5.42.0",
-    "madge": "^6.1.0",
+    "madge": "^8.0.0",
     "prettier": "^3.4.2",
-    "rollup": "^2.52.2",
-    "rollup-plugin-babel": "^4.3.3",
-    "rollup-plugin-commonjs": "^10.1.0",
-    "rollup-plugin-node-builtins": "^2.1.2",
-    "rollup-plugin-terser": "^7.0.2",
+    "esbuild": "^0.25.0",
     "storybook": "8.6.12",
     "tsx": "^4.19.2",
-    "typescript": "4.9.5"
+    "typescript": "^5.7.0",
+    "vitest": "^3.1.4"
   },
   "workspaces": [
     ".",
     "app"
   ],
-  "preconstruct": {
-    "packages": [
-      "app"
-    ]
-  },
   "cacheDirectories": [
     "node_modules",
     "app/.next/cache"
   ],
   "resolutions": {
-    "@babel/core": "^7.14.6",
-    "@babel/parser": "^7.14.6"
+    "@babel/core": "^7.26.0",
+    "@babel/parser": "^7.26.0",
+    "@babel/traverse": "^7.23.2",
+    "minimist": "^1.2.6",
+    "pbkdf2": "^3.1.3",
+    "sha.js": "^2.4.12",
+    "cipher-base": "^1.0.5",
+    "handlebars": "^4.7.9",
+    "elliptic": "^6.6.1",
+    "form-data": "^4.0.4",
+    "fast-xml-parser": "^5.5.12"
   },
   "bugs": {
     "url": "https://github.com/visualize-admin/visualization-tool/issues"