Updates & Audit Fixes

.changeset/strong-candies-sniff.md

@@ -0,0 +1,5 @@
+---
+"@itwin/changed-elements-react": minor
+---
+
+Update to iTwinJs packages 5.10.2. Fix audit vulnerabilities.

.github/workflows/CI.yaml

@@ -21,10 +21,10 @@ jobs:
         version: 10.12.4
         run_install: false
 
-    - name: Use Node.js 22.21.1
+    - name: Use Node.js 24.11.1
       uses: actions/setup-node@v4
       with:
-        node-version: 22.21.1
+        node-version: 24.11.1
         cache: "pnpm"
 
     - name: Install dependencies

.github/workflows/dependabot-push.yml

@@ -21,12 +21,12 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: 24
           cache: 'pnpm'
 
       # Install pnpm
       - name: Install pnpm
-        run: npm install -g pnpm@10.12.4
+        run: npm install -g pnpm@10.30.1
 
       # Install dependencies
       - name: Install dependencies

.github/workflows/release-workflow.yml

@@ -25,10 +25,10 @@ jobs:
         version: 10.12.4
         run_install: false
 
-    - name: Use Node.js 22
+    - name: Use Node.js 24
       uses: actions/setup-node@v4
       with:
-        node-version: 22
+        node-version: 24
         registry-url: https://registry.npmjs.org/
         cache: "pnpm"
 

package.json

@@ -18,19 +18,19 @@
   "engines": {
     "pnpm": ">=10",
     "npm": "<0",
-    "node": ">=22"
+    "node": ">=24"
   },
   "dependencies": {
-    "@changesets/cli": "^2.27.11",
+    "@changesets/cli": "^2.31.0",
     "@changesets/types": "6.0.0",
-    "@types/node": "^22.0.0",
-    "@typescript-eslint/eslint-plugin": "^7.4.0",
-    "@typescript-eslint/parser": "^7.4.0",
-    "eslint": "^8.57.0",
-    "eslint-plugin-react": "^7.35.2",
+    "@types/node": "^24.13.2",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "eslint": "^8.57.1",
+    "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^4.6.2",
     "npm-run-all": "^4.1.5",
-    "ts-node": "^10.9.1",
+    "ts-node": "^10.9.2",
     "typescript": "~5.5.4"
   },
   "pnpm": {
@@ -44,7 +44,12 @@
     "overrides": {
       "happy-dom@<=20.8.9": ">=20.8.9",
       "@remix-run/router@<=1.23.1": ">=1.23.2",
-      "tmp@<0.2.6": ">=0.2.6"
+      "tmp@<0.2.6": ">=0.2.6",
+      "ws@<7.5.11": ">=7.5.11",
+      "form-data@<4.0.6": ">=4.0.6",
+      "dompurify@<=3.4.10": ">=3.4.11",
+      "@google-cloud/storage@<7.21.0": ">=7.21.0",
+      "uuid@<11.1.1": ">=11.1.1"
     }
   },
   "devDependencies": {

packages/changed-elements-react/package.json

@@ -42,18 +42,18 @@
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@itwin/appui-abstract": "^5.1.7",
+    "@itwin/appui-abstract": "^5.10.2",
     "@itwin/components-react": "^5.15.0",
-    "@itwin/core-bentley": "^5.1.7",
-    "@itwin/core-common": "^5.1.7",
-    "@itwin/core-frontend": "^5.1.7",
-    "@itwin/core-geometry": "^5.1.7",
+    "@itwin/core-bentley": "^5.10.2",
+    "@itwin/core-common": "^5.10.2",
+    "@itwin/core-frontend": "^5.10.2",
+    "@itwin/core-geometry": "^5.10.2",
     "@itwin/core-react": "^5.15.0",
-    "@itwin/core-orbitgt": "^5.1.7",
-    "@itwin/presentation-common": "^5.1.7",
+    "@itwin/core-orbitgt": "^5.10.2",
+    "@itwin/presentation-common": "^5.10.2",
     "@itwin/presentation-components": "^5.12.8",
     "@itwin/presentation-core-interop": "^1.3.4",
-    "@itwin/presentation-frontend": "^5.1.7",
+    "@itwin/presentation-frontend": "^5.10.2",
     "@itwin/unified-selection": "^1.5.1",
     "@itwin/unified-selection-react": "^1.0.1",
     "@testing-library/react": "^16.2.0",
@@ -72,21 +72,21 @@
     "react-redux": "^7.2.2",
     "redux": "^4.1.0",
     "typescript": "~5.5.4",
-    "vite": "^5.4.20",
+    "vite": "^6.4.3",
     "vitest": "^3.2.6"
   },
   "peerDependencies": {
-    "@itwin/appui-abstract": "^5.1.7",
+    "@itwin/appui-abstract": "^5.10.2",
     "@itwin/components-react": "^5.15.0",
-    "@itwin/core-bentley": "^5.1.7",
-    "@itwin/core-common": "^5.1.7",
-    "@itwin/core-frontend": "^5.1.7",
-    "@itwin/core-geometry": "^5.1.7",
+    "@itwin/core-bentley": "^5.10.2",
+    "@itwin/core-common": "^5.10.2",
+    "@itwin/core-frontend": "^5.10.2",
+    "@itwin/core-geometry": "^5.10.2",
     "@itwin/core-react": "^5.15.0",
-    "@itwin/core-orbitgt": "^5.1.7",
-    "@itwin/presentation-common": "^5.1.7",
+    "@itwin/core-orbitgt": "^5.10.2",
+    "@itwin/presentation-common": "^5.10.2",
     "@itwin/presentation-components": "^5.12.8",
-    "@itwin/presentation-frontend": "^5.1.7",
+    "@itwin/presentation-frontend": "^5.10.2",
     "react": "^18.0.0",
     "react-dom": "^18.0.0"
   },

packages/test-app-backend/package.json

@@ -15,20 +15,20 @@
     "@types/express": "5.0.0"
   },
   "dependencies": {
-    "@itwin/core-backend": "^5.1.7",
-    "@itwin/core-bentley": "^5.1.7",
-    "@itwin/core-common": "^5.1.7",
-    "@itwin/core-quantity": "^5.1.7",
-    "@itwin/ecschema-rpcinterface-common": "^5.1.7",
-    "@itwin/ecschema-rpcinterface-impl": "^5.1.7",
-    "@itwin/express-server": "^5.1.7",
-    "@itwin/imodels-access-backend": "^6.0.1",
-    "@itwin/imodels-client-authoring": "^6.0.1",
-    "@itwin/object-storage-azure": "^3.0.2",
-    "@itwin/presentation-backend": "^5.1.7",
-    "@itwin/presentation-common": "^5.1.7",
+    "@itwin/core-backend": "^5.10.2",
+    "@itwin/core-bentley": "^5.10.2",
+    "@itwin/core-common": "^5.10.2",
+    "@itwin/core-quantity": "^5.10.2",
+    "@itwin/ecschema-rpcinterface-common": "^5.10.2",
+    "@itwin/ecschema-rpcinterface-impl": "^5.10.2",
+    "@itwin/express-server": "^5.10.2",
+    "@itwin/imodels-access-backend": "^6.1.2",
+    "@itwin/imodels-client-authoring": "^6.2.1",
+    "@itwin/object-storage-azure": "^3.1.2",
+    "@itwin/presentation-backend": "^5.10.2",
+    "@itwin/presentation-common": "^5.10.2",
     "@types/dotenv-flow": "^3.2.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^24.0.0",
     "dotenv-flow": "^3.2.0",
     "express": "^4.22.2",
     "inversify": "^7.9.1",

packages/test-app-backend/src/RPC/FallbackIModelReadRpcImpl.ts

@@ -0,0 +1,67 @@
+/*---------------------------------------------------------------------------------------------
+* Copyright (c) Bentley Systems, Incorporated. All rights reserved.
+* See LICENSE.md in the project root for license terms and full copyright notice.
+*--------------------------------------------------------------------------------------------*/
+import path from "path";
+import { CheckpointManager, IModelHost, SnapshotDb } from "@itwin/core-backend";
+import { IModelStatus } from "@itwin/core-bentley";
+import { IModelConnectionProps, IModelError, IModelRpcOpenProps } from "@itwin/core-common";
+import { IModelReadRpcImpl } from "@itwin/core-backend/lib/cjs/rpc-impl/IModelReadRpcImpl";
+import { RpcTrace } from "@itwin/core-backend/lib/cjs/rpc/tracing";
+
+/**
+ * Falls back to local standalone snapshot open when exact V2 checkpoint is missing.
+ * This avoids acquiring Hub briefcase ids in the fallback path.
+ */
+export class FallbackIModelReadRpcImpl extends IModelReadRpcImpl {
+  public override async getConnectionProps(tokenProps: IModelRpcOpenProps): Promise<IModelConnectionProps> {
+    try {
+      return await super.getConnectionProps(tokenProps);
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : "";
+      const isMissingV2Checkpoint =
+        error instanceof IModelError &&
+        error.errorNumber === IModelStatus.NotFound &&
+        message.includes("V2 checkpoint not found");
+
+      if (!isMissingV2Checkpoint) {
+        throw error;
+      }
+
+      const iTwinId = tokenProps.iTwinId;
+      const iModelId = tokenProps.iModelId;
+      const changeset = tokenProps.changeset;
+      if (!iTwinId || !iModelId || !changeset) {
+        throw error;
+      }
+
+      const checkpoint = {
+        iTwinId,
+        iModelId,
+        changeset,
+        accessToken: RpcTrace.expectCurrentActivity.accessToken,
+      };
+
+      const key = CheckpointManager.getKey(checkpoint);
+      const existing = SnapshotDb.tryFindByKey(key);
+      if (existing) {
+        return existing.toJSON();
+      }
+
+      const localFile = path.join(
+        IModelHost.cacheDir,
+        "rpc-fallback-checkpoints",
+        iModelId,
+        `${changeset.id}.bim`,
+      );
+
+      await CheckpointManager.downloadCheckpoint({
+        checkpoint,
+        localFile,
+      });
+
+      const db = SnapshotDb.openFile(localFile, { key });
+      return db.toJSON();
+    }
+  }
+}

packages/test-app-backend/src/main.ts

@@ -16,6 +16,7 @@ import { PresentationRpcInterface } from "@itwin/presentation-common";
 import { config } from "dotenv-flow";
 import { ChangesRpcImpl } from "./RPC/ChangesRpcImpl";
 import { ChangesRpcInterface } from "./RPC/ChangesRpcInterface";
+import { FallbackIModelReadRpcImpl } from "./RPC/FallbackIModelReadRpcImpl";
 
 config({ path: "../test-app-frontend" });
 
@@ -37,6 +38,7 @@ void (async () => {
   });
   Presentation.initialize();
   ECSchemaRpcImpl.register();
+  RpcManager.registerImpl(IModelReadRpcInterface, FallbackIModelReadRpcImpl);
   RpcManager.registerImpl(ChangesRpcInterface, ChangesRpcImpl);
   const rpcConfig = BentleyCloudRpcManager.initializeImpl(
     { info: { title: "test-app-backend", version: "v1.0" } },

packages/test-app-frontend/package.json

@@ -16,31 +16,31 @@
   },
   "dependencies": {
     "@bentley/icons-generic-webfont": "^1.0.34",
-    "@itwin/appui-abstract": "^5.1.7",
+    "@itwin/appui-abstract": "^5.10.2",
     "@itwin/appui-layout-react": "^4.8.3",
     "@itwin/appui-react": "^5.15.0",
     "@itwin/changed-elements-react": "workspace:*",
     "@itwin/components-react": "^5.15.0",
-    "@itwin/core-bentley": "^5.1.7",
-    "@itwin/core-common": "^5.1.7",
-    "@itwin/core-frontend": "^5.1.7",
-    "@itwin/core-i18n": "^5.1.7",
+    "@itwin/core-bentley": "^5.10.2",
+    "@itwin/core-common": "^5.10.2",
+    "@itwin/core-frontend": "^5.10.2",
+    "@itwin/core-i18n": "^5.10.2",
     "@itwin/core-react": "^5.15.0",
-    "@itwin/core-orbitgt": "^5.1.7",
-    "@itwin/ecschema-metadata": "^5.1.7",
-    "@itwin/ecschema-rpcinterface-common": "^5.1.7",
+    "@itwin/core-orbitgt": "^5.10.2",
+    "@itwin/ecschema-metadata": "^5.10.2",
+    "@itwin/ecschema-rpcinterface-common": "^5.10.2",
     "@itwin/imodel-components-react": "^5.15.0",
-    "@itwin/imodels-access-frontend": "^6.0.1",
-    "@itwin/imodels-client-management": "^6.0.1",
+    "@itwin/imodels-access-frontend": "^6.1.2",
+    "@itwin/imodels-client-management": "^6.2.1",
     "@itwin/itwinui-icons-react": "^2.11.0",
     "@itwin/itwinui-illustrations-react": "^2.1.0",
     "@itwin/itwinui-layouts-css": "^0.4.0",
     "@itwin/itwinui-layouts-react": "^0.4.1",
     "@itwin/itwinui-react": "^3.19.4",
-    "@itwin/presentation-common": "^5.1.7",
+    "@itwin/presentation-common": "^5.10.2",
     "@itwin/presentation-components": "^5.12.8",
     "@itwin/presentation-core-interop": "^1.3.4",
-    "@itwin/presentation-frontend": "^5.1.7",
+    "@itwin/presentation-frontend": "^5.10.2",
     "@itwin/presentation-shared": "^1.2.3",
     "@itwin/unified-selection": "^1.5.1",
     "@itwin/unified-selection-react": "^1.0.1",
@@ -54,11 +54,11 @@
     "react": "^18.0.0",
     "react-dom": "18.0.0",
     "react-redux": "^7.2.2",
-    "react-router-dom": "^6.11.2",
+    "react-router-dom": "^6.30.4",
     "redux": "^4.1.0",
     "sass": "^1.62.1",
     "typescript": "~5.5.4",
-    "vite": "^5.4.20",
+    "vite": "^6.4.3",
     "vite-plugin-static-copy": "^2.3.2",
     "vite-tsconfig-paths": "^5.1.4"
   }