[CB] Bump NPM dependencies (#4186)

* dbeaver/pro#8307 updates yarn lock

* updates eslint

* updates graphql libs

* updates @types/whatwg-mimetype

* updates whatwg-mimetype

* covers evaluate with unit tests

* updates subscript

* removes Rollup CVE

* removes CVE for storybook

* removes CVE for koa

* removes CVE for minimatch

* removes CVE for ajv

* removes redundant types

* cleanup

* updates yarn.lock

* reverts eslint

* updates yarn.lock

* updates yarn lock

* reverts subscript version

* fixes immutable CVE

* fixes serialize-javascript CVE

* updates yarn lock

---------

Co-authored-by: mr-anton-t <42037741+mr-anton-t@users.noreply.github.com>
Co-authored-by: Daria Marutkina <125263541+dariamarutkina@users.noreply.github.com>
Co-authored-by: Serge Rider <serge@jkiss.org>

webapp/common-react/@dbeaver/react-tests/src/vitest.setup.ts

@@ -1,6 +1,6 @@
 /*
  * CloudBeaver - Cloud Database Manager
- * Copyright (C) 2020-2025 DBeaver Corp and others
+ * Copyright (C) 2020-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0.
  * you may not use this file except in compliance with the License.
@@ -10,5 +10,5 @@ import { WebSocket } from 'ws';
 import '@testing-library/jest-dom/vitest';
 
 // different machine has its own timezones and some tests can fail because of it
-process.env.TZ = 'UTC';
+process.env['TZ'] = 'UTC';
 globalThis.WebSocket = WebSocket as any;

webapp/package.json

@@ -19,7 +19,11 @@
     "lodash": ">=4.17.23",
     "@isaacs/brace-expansion": ">=5.0.1",
     "axios": ">= 1.13.5",
-    "minimatch": ">=10.2.1"
+    "minimatch": ">=10.2.3",
+    "rollup": ">=4.59.0",
+    "koa": ">=2.16.4",
+    "immutable": ">=4.3.8",
+    "serialize-javascript": ">=7.0.3"
   },
   "scripts": {
     "test": "dbeaver-test",

webapp/packages/core-blocks/src/ObjectPropertyInfo/evaluate.test.ts

@@ -0,0 +1,71 @@
+/*
+ * CloudBeaver - Cloud Database Manager
+ * Copyright (C) 2020-2026 DBeaver Corp and others
+ *
+ * Licensed under the Apache License, Version 2.0.
+ * you may not use this file except in compliance with the License.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import { evaluate } from './evaluate.js';
+
+describe('evaluate', () => {
+  it('should evaluate simple boolean expressions', () => {
+    expect(evaluate('true', {})).toBe(true);
+    expect(evaluate('false', {})).toBe(false);
+  });
+
+  it('should evaluate comparison operators', () => {
+    expect(evaluate('1 == 1', {})).toBe(true);
+    expect(evaluate('1 != 2', {})).toBe(true);
+    expect(evaluate('2 > 1', {})).toBe(true);
+    expect(evaluate('1 < 2', {})).toBe(true);
+  });
+
+  it('should evaluate logical operators', () => {
+    expect(evaluate('true && true', {})).toBe(true);
+    expect(evaluate('true || false', {})).toBe(true);
+    expect(evaluate('!false', {})).toBe(true);
+    expect(evaluate('false || false', {})).toBe(false);
+    expect(evaluate('true && false', {})).toBe(false);
+    expect(evaluate('!(true && false)', {})).toBe(true);
+  });
+
+  it('should access object properties', () => {
+    const object = { enabled: true, value: 42, name: 'test' };
+    expect(evaluate('object.enabled == true', object)).toBe(true);
+    expect(evaluate('object.value > 40', object)).toBe(true);
+    expect(evaluate('object.name == "test"', object)).toBe(true);
+    expect(evaluate("object.name != 'other'", object)).toBe(true);
+    expect(evaluate("object.name == 'test'", object)).toBe(true);
+  });
+
+  it('should handle nested object properties', () => {
+    const obj = { config: { enabled: true, level: 5 } };
+    expect(evaluate('object.config.enabled == true', obj)).toBe(true);
+    expect(evaluate('object.config.level >= 5', obj)).toBe(true);
+  });
+
+  it('should handle undefined and null', () => {
+    const obj = { value: undefined, empty: null };
+    expect(evaluate('object.value == undefined', obj)).toBe(true);
+    expect(evaluate('object.empty == null', obj)).toBe(true);
+  });
+
+  it('should handle missing properties as undefined', () => {
+    const obj = { existing: 'value' };
+    expect(evaluate('object.missing == undefined', obj)).toBe(true);
+  });
+
+  it('should return false for invalid expressions', () => {
+    expect(() => evaluate('invalid syntax @@#', {})).toThrowError();
+  });
+
+  it('should coerce non-boolean results to boolean', () => {
+    expect(evaluate('1', {})).toBe(true);
+    expect(evaluate('0', {})).toBe(false);
+    expect(evaluate('"text"', {})).toBe(true);
+    expect(evaluate('""', {})).toBe(false);
+  });
+});

webapp/packages/core-blocks/src/ObjectPropertyInfo/evaluate.ts

@@ -25,5 +25,5 @@ export function evaluate(expression: string, object: Record<string, any>): boole
     object,
   };
   const result = fn(context);
-  return result;
+  return !!result;
 }

webapp/packages/core-sdk/package.json

@@ -38,13 +38,13 @@
     "@cloudbeaver/core-cli": "workspace:*",
     "@cloudbeaver/tsconfig": "workspace:*",
     "@dbeaver/cli": "workspace:*",
-    "@graphql-codegen/add": "^5",
-    "@graphql-codegen/cli": "^5",
-    "@graphql-codegen/near-operation-file-preset": "^3",
-    "@graphql-codegen/typescript": "^4",
+    "@graphql-codegen/add": "^6",
+    "@graphql-codegen/cli": "^6",
+    "@graphql-codegen/near-operation-file-preset": "^4",
+    "@graphql-codegen/typescript": "^5",
     "@graphql-codegen/typescript-graphql-files-modules": "^3",
     "@graphql-codegen/typescript-graphql-request": "^6",
-    "@graphql-codegen/typescript-operations": "^4",
+    "@graphql-codegen/typescript-operations": "^5",
     "@parcel/watcher": "^2",
     "graphql": "^16",
     "graphql-tag": "^2",

webapp/packages/core-utils/package.json

@@ -32,7 +32,7 @@
     "underscore": "^1",
     "uuid": "^13",
     "vitest": "^4",
-    "whatwg-mimetype": "^4",
+    "whatwg-mimetype": "^5",
     "zod": "^4",
     "zod-validation-error": "^5"
   },
@@ -44,8 +44,7 @@
     "@dbeaver/react-tests": "workspace:*",
     "@types/md5": "^2",
     "@types/underscore": "^1",
-    "@types/uuid": "^11",
-    "@types/whatwg-mimetype": "^3",
+    "@types/whatwg-mimetype": "^5",
     "rimraf": "^6",
     "typescript": "^5",
     "vitest": "^4",

webapp/packages/core-utils/src/parseMIME.ts

@@ -1,11 +1,11 @@
 /*
  * CloudBeaver - Cloud Database Manager
- * Copyright (C) 2020-2024 DBeaver Corp and others
+ * Copyright (C) 2020-2026 DBeaver Corp and others
  *
  * Licensed under the Apache License, Version 2.0.
  * you may not use this file except in compliance with the License.
  */
-import MIMEType from 'whatwg-mimetype';
+import { MIMEType } from 'whatwg-mimetype';
 
 export function parseMIME(serialized: string): MIMEType {
   return new MIMEType(serialized);

webapp/packages/eslint-config/package.json

@@ -36,6 +36,6 @@
   },
   "resolutions": {
     "eslint-plugin-storybook": ">=10.1.10",
-    "storybook": ">=10.1.10"
+    "storybook": ">=10.2.10"
   }
 }

webapp/packages/plugin-gis-viewer/package.json

@@ -42,7 +42,6 @@
     "@cloudbeaver/core-cli": "workspace:*",
     "@cloudbeaver/tsconfig": "workspace:*",
     "@types/leaflet": "^1",
-    "@types/proj4": "^2.19.0",
     "@types/react": "^19",
     "@types/wellknown": "^0",
     "leaflet": "^1",

webapp/packages/storybook/package.json

@@ -31,6 +31,6 @@
     "vite": "^7"
   },
   "resolutions": {
-    "storybook": ">=10.1.10"
+    "storybook": ">=10.2.10"
   }
 }