chore(deps): update dependencies and fix security vulnerabilities (#2342)

* chore(deps): update dependencies and fix security vulnerabilities

Update TypeScript 4.9 → 5.4. Update Zod 3 → 4. Update nodemailer 6 → 7. Update @typescript-eslint
packages to v7. Update xml2js, undici, lodash, axios, swr, winston- Add pnpm.overrides for
transitive dependency vulnerabilities

* chore: fix import ordering for TypeScript 5.4 compatibility

prettier-plugin-organize-imports behaves differently with TypeScript 5.4 vs 4.9, causing CI
formatting checks to fail. This reformats imports to match the ordering expected by the plugin with
the upgraded TS version.

.eslintrc.js

@@ -16,6 +16,7 @@ module.exports = {
     },
   },
   rules: {
+    '@typescript-eslint/no-explicit-any': 'warn', // disable the rule for now to replicate previous behavior
     '@typescript-eslint/camelcase': 0,
     '@typescript-eslint/no-use-before-define': 0,
     'jsx-a11y/no-noninteractive-tabindex': 0,

package.json

@@ -46,7 +46,7 @@
     "@types/ua-parser-js": "^0.7.36",
     "@types/wink-jaro-distance": "^2.0.2",
     "ace-builds": "1.43.4",
-    "axios": "1.13.2",
+    "axios": "1.13.3",
     "axios-rate-limit": "1.4.0",
     "bcrypt": "6.0.0",
     "bowser": "2.13.1",
@@ -67,13 +67,13 @@
     "gravatar-url": "3.1.0",
     "http-proxy-agent": "^7.0.2",
     "https-proxy-agent": "^7.0.6",
-    "lodash": "4.17.21",
+    "lodash": "4.17.23",
     "mime": "3",
     "next": "^14.2.35",
     "node-cache": "5.1.2",
     "node-gyp": "9.3.1",
     "node-schedule": "2.1.1",
-    "nodemailer": "6.10.0",
+    "nodemailer": "7.0.12",
     "openpgp": "6.3.0",
     "pg": "8.16.3",
     "pug": "3.0.3",
@@ -98,20 +98,20 @@
     "sharp": "^0.33.4",
     "sqlite3": "5.1.7",
     "swagger-ui-express": "4.6.2",
-    "swr": "2.3.7",
+    "swr": "2.3.8",
     "tailwind-merge": "^2.6.0",
     "typeorm": "0.3.28",
     "ua-parser-js": "^1.0.35",
-    "undici": "^7.16.0",
+    "undici": "^7.18.2",
     "validator": "^13.15.23",
     "web-push": "3.6.7",
     "wink-jaro-distance": "^2.0.0",
-    "winston": "3.18.3",
+    "winston": "3.19.0",
     "winston-daily-rotate-file": "4.7.1",
-    "xml2js": "0.4.23",
+    "xml2js": "0.5.0",
     "yamljs": "0.3.0",
     "yup": "0.32.11",
-    "zod": "3.24.2"
+    "zod": "4.3.6"
   },
   "devDependencies": {
     "@commitlint/cli": "17.4.4",
@@ -130,7 +130,7 @@
     "@types/mime": "3",
     "@types/node": "22.10.5",
     "@types/node-schedule": "2.1.8",
-    "@types/nodemailer": "6.4.7",
+    "@types/nodemailer": "7",
     "@types/react": "^18.3.3",
     "@types/react-dom": "^18.3.0",
     "@types/react-transition-group": "4.4.12",
@@ -139,12 +139,12 @@
     "@types/swagger-ui-express": "4.1.8",
     "@types/validator": "^13.15.10",
     "@types/web-push": "3.6.4",
-    "@types/xml2js": "0.4.11",
+    "@types/xml2js": "0.4.14",
     "@types/yamljs": "0.2.31",
     "@types/yup": "0.29.14",
-    "@typescript-eslint/eslint-plugin": "5.54.0",
-    "@typescript-eslint/parser": "5.54.0",
-    "autoprefixer": "10.4.22",
+    "@typescript-eslint/eslint-plugin": "7.18.0",
+    "@typescript-eslint/parser": "7.18.0",
+    "autoprefixer": "10.4.23",
     "baseline-browser-mapping": "^2.8.32",
     "commitizen": "4.3.1",
     "copyfiles": "2.4.1",
@@ -171,16 +171,12 @@
     "ts-node": "10.9.2",
     "tsc-alias": "1.8.16",
     "tsconfig-paths": "4.2.0",
-    "typescript": "4.9.5"
+    "typescript": "5.4.5"
   },
   "engines": {
     "node": "^22.0.0",
     "pnpm": "^10.0.0"
   },
-  "overrides": {
-    "sqlite3/node-gyp": "8.4.1",
-    "@types/express-session": "1.18.2"
-  },
   "config": {
     "commitizen": {
       "path": "./node_modules/cz-conventional-changelog"
@@ -207,6 +203,10 @@
       "cypress",
       "sharp",
       "sqlite3"
-    ]
+    ],
+    "overrides": {
+      "sqlite3>node-gyp": "8.4.1",
+      "@types/express-session": "1.18.2"
+    }
   }
 }

server/entity/User.ts

@@ -5,11 +5,11 @@ import { Watchlist } from '@server/entity/Watchlist';
 import type { QuotaResponse } from '@server/interfaces/api/userInterfaces';
 import PreparedEmail from '@server/lib/email';
 import type { PermissionCheckOptions } from '@server/lib/permissions';
-import { hasPermission, Permission } from '@server/lib/permissions';
+import { Permission, hasPermission } from '@server/lib/permissions';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
-import { AfterDate } from '@server/utils/dateHelpers';
 import { DbAwareColumn } from '@server/utils/DbColumnHelper';
+import { AfterDate } from '@server/utils/dateHelpers';
 import bcrypt from 'bcrypt';
 import { randomUUID } from 'crypto';
 import path from 'path';

server/lib/notifications/agents/discord.ts

@@ -2,12 +2,12 @@ import { IssueStatus, IssueTypeName } from '@server/constants/issue';
 import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import type { NotificationAgentDiscord } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
 import {
-  hasNotificationType,
   Notification,
+  hasNotificationType,
   shouldSendAdminNotification,
 } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';

server/lib/notifications/agents/email.ts

@@ -4,7 +4,7 @@ import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import PreparedEmail from '@server/lib/email';
 import type { NotificationAgentEmail } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import type { EmailOptions } from 'email-templates';
 import path from 'path';

server/lib/notifications/agents/gotify.ts

@@ -3,7 +3,7 @@ import type { NotificationAgentGotify } from '@server/lib/settings';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
-import { hasNotificationType, Notification } from '..';
+import { Notification, hasNotificationType } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';
 import { BaseAgent } from './agent';
 

server/lib/notifications/agents/ntfy.ts

@@ -3,7 +3,7 @@ import type { NotificationAgentNtfy } from '@server/lib/settings';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
-import { hasNotificationType, Notification } from '..';
+import { Notification, hasNotificationType } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';
 import { BaseAgent } from './agent';
 

server/lib/notifications/agents/pushbullet.ts

@@ -3,12 +3,12 @@ import { MediaStatus } from '@server/constants/media';
 import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import type { NotificationAgentPushbullet } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
 import {
-  hasNotificationType,
   Notification,
+  hasNotificationType,
   shouldSendAdminNotification,
 } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';

server/lib/notifications/agents/pushover.ts

@@ -3,12 +3,12 @@ import { MediaStatus } from '@server/constants/media';
 import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import type { NotificationAgentPushover } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
 import {
-  hasNotificationType,
   Notification,
+  hasNotificationType,
   shouldSendAdminNotification,
 } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';

server/lib/notifications/agents/slack.ts

@@ -3,7 +3,7 @@ import type { NotificationAgentSlack } from '@server/lib/settings';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
-import { hasNotificationType, Notification } from '..';
+import { Notification, hasNotificationType } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';
 import { BaseAgent } from './agent';
 

server/lib/notifications/agents/telegram.ts

@@ -3,12 +3,12 @@ import { MediaStatus } from '@server/constants/media';
 import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import type { NotificationAgentTelegram } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
 import {
-  hasNotificationType,
   Notification,
+  hasNotificationType,
   shouldSendAdminNotification,
 } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';

server/lib/notifications/agents/webhook.ts

@@ -5,7 +5,7 @@ import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import axios from 'axios';
 import { get } from 'lodash';
-import { hasNotificationType, Notification } from '..';
+import { Notification, hasNotificationType } from '..';
 import type { NotificationAgent, NotificationPayload } from './agent';
 import { BaseAgent } from './agent';
 

server/lib/notifications/agents/webpush.ts

@@ -5,7 +5,7 @@ import MediaRequest from '@server/entity/MediaRequest';
 import { User } from '@server/entity/User';
 import { UserPushSubscription } from '@server/entity/UserPushSubscription';
 import type { NotificationAgentConfig } from '@server/lib/settings';
-import { getSettings, NotificationAgentKey } from '@server/lib/settings';
+import { NotificationAgentKey, getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import webpush from 'web-push';
 import { Notification, shouldSendAdminNotification } from '..';

server/models/Tv.ts

@@ -7,6 +7,7 @@ import type {
   TmdbTvSeasonResult,
 } from '@server/api/themoviedb/interfaces';
 import type Media from '@server/entity/Media';
+import type { Video } from './Movie';
 import type {
   Cast,
   Crew,
@@ -24,7 +25,6 @@ import {
   mapVideos,
   mapWatchProviders,
 } from './common';
-import type { Video } from './Movie';
 
 interface Episode {
   id: number;

server/routes/index.ts

@@ -12,9 +12,9 @@ import { Permission } from '@server/lib/permissions';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { checkUser, isAuthenticated } from '@server/middleware/auth';
-import { mapWatchProviderDetails } from '@server/models/common';
 import { mapProductionCompany } from '@server/models/Movie';
 import { mapNetwork } from '@server/models/Tv';
+import { mapWatchProviderDetails } from '@server/models/common';
 import overrideRuleRoutes from '@server/routes/overrideRule';
 import settingsRoutes from '@server/routes/settings';
 import watchlistRoutes from '@server/routes/watchlist';

server/routes/user/index.ts

@@ -17,7 +17,7 @@ import type {
   UserResultsResponse,
   UserWatchDataResponse,
 } from '@server/interfaces/api/userInterfaces';
-import { hasPermission, Permission } from '@server/lib/permissions';
+import { Permission, hasPermission } from '@server/lib/permissions';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { isAuthenticated } from '@server/middleware/auth';

src/components/Layout/UserDropdown/index.tsx

@@ -11,7 +11,7 @@ import { CogIcon, UserIcon } from '@heroicons/react/24/solid';
 import axios from 'axios';
 import type { LinkProps } from 'next/link';
 import Link from 'next/link';
-import { forwardRef, Fragment } from 'react';
+import { Fragment, forwardRef } from 'react';
 import { useIntl } from 'react-intl';
 
 const messages = defineMessages('components.Layout.UserDropdown', {