ENG-5629 Fix workflow-use dependency vulnerabilities (#170)

* Fix workflow-use dependency vulnerabilities

* Address dependency review feedback

Author: sauravpanda

.github/workflows/lint.yml

@@ -87,7 +87,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'npm'
           cache-dependency-path: extension/package-lock.json
 
@@ -157,7 +157,7 @@ jobs:
   #     - name: Setup Node.js
   #       uses: actions/setup-node@v4
   #       with:
-  #         node-version: '20'
+  #         node-version: '22'
   #         cache: 'npm'
   #         cache-dependency-path: extension/package-lock.json
   #

.github/workflows/publish.yml

@@ -55,4 +55,8 @@ jobs:
       - uses: astral-sh/setup-uv@v5
       - run: uv run ruff check --no-fix --select PLE # check only for syntax errors
       - run: uv build
+      # Use pip intentionally: unlike uv, it cannot apply this project's local
+      # dependency overrides and therefore validates the published wheel graph.
+      - name: Verify wheel dependencies resolve without uv overrides
+        run: uvx --from pip pip install --dry-run --ignore-installed dist/*.whl
       - run: uv publish --token ${{ secrets.PYPI_API_TOKEN }}

extension/package-lock.json

@@ -41,14 +41,19 @@
     "eslint-plugin-react-refresh": "0.4.24",
     "tw-animate-css": "1.3.4",
     "typescript": "5.8.3",
-    "wxt": "0.20.7"
+    "wxt": "0.21.4"
   },
   "overrides": {
     "shell-quote": "1.10.0",
     "node-forge": "1.4.0",
-    "tar": "7.5.20",
+    "tar": "7.5.21",
     "rollup": "4.62.2",
-    "js-yaml": "4.3.0",
+    "@babel/core": "7.29.6",
+    "ajv@6": "6.14.0",
+    "brace-expansion@1": "1.1.18",
+    "brace-expansion@2": "2.1.4",
+    "brace-expansion@5": "5.0.9",
+    "js-yaml": "4.3.1",
     "minimatch@3": "3.1.5",
     "minimatch@9": "9.0.9",
     "minimatch@10": "10.2.5",
@@ -59,6 +64,7 @@
     "tmp": "0.2.7",
     "uuid": "11.1.1",
     "vite": "6.4.3",
+    "nanoid": "3.3.18",
     "postcss": "8.5.24",
     "ws": "8.21.0"
   }

extension/package.json

@@ -1,14 +1,14 @@
 // import { eventWithTime } from 'rrweb'; // Type not directly available
 import { EventType, IncrementalSource } from "@rrweb/types";
-import {
+import type {
   StoredCustomClickEvent,
   StoredCustomInputEvent,
   StoredCustomKeyEvent,
   StoredEvent,
   StoredRrwebEvent,
   StoredExtractionEvent,
 } from "../lib/types";
-import {
+import type {
   ClickStep,
   InputStep,
   KeyPressStep,
@@ -18,7 +18,7 @@ import {
   Workflow,
   ExtractStep,
 } from "../lib/workflow-types";
-import {
+import type {
   HttpEvent,
   HttpRecordingStartedEvent,
   HttpRecordingStoppedEvent,

extension/src/entrypoints/background.ts

@@ -22,6 +22,7 @@ function getXPath(element: HTMLElement): string {
   if (siblings) {
     for (let i = 0; i < siblings.length; i++) {
       const sibling = siblings[i];
+      if (!sibling) continue;
       if (sibling === element) {
         return `${getXPath(
           element.parentElement as HTMLElement
@@ -744,6 +745,7 @@ function handleSelectChange(event: Event) {
     const allOptions: Array<{text: string, value: string}> = [];
     for (let i = 0; i < targetElement.options.length; i++) {
       const option = targetElement.options[i];
+      if (!option) continue;
       allOptions.push({
         text: option.text.trim(),
         value: option.value

extension/src/entrypoints/content.ts

@@ -1,5 +1,5 @@
 import React, { useEffect, useRef } from "react";
-import {
+import type {
   ClickStep,
   InputStep,
   KeyPressStep,

extension/src/entrypoints/sidepanel/components/event-viewer.tsx

@@ -1,12 +1,12 @@
 import React, {
   createContext,
-  ReactNode,
   useCallback,
   useContext,
   useEffect,
   useState,
 } from "react";
-import { Workflow } from "../../../lib/workflow-types"; // Adjust path as needed
+import type { ReactNode } from "react";
+import type { Workflow } from "../../../lib/workflow-types";
 
 type WorkflowState = {
   workflow: Workflow | null;

extension/src/entrypoints/sidepanel/context/workflow-provider.tsx

@@ -1,4 +1,4 @@
-import { Workflow } from "./workflow-types"; // Assuming Workflow is in this path
+import type { Workflow } from "./workflow-types";
 
 // Types for events sent via HTTP to the Python server