Fix dependabot alerts in monorepo (high, remaining critical)

apps/demos/package.json

@@ -31,7 +31,7 @@
         "@vue/shared": "^3.2.47",
         "canvg": "4.0.3",
         "cldr-core": "40.0.0",
-        "cldr-data": "36.0.1",
+        "cldr-data": "36.0.4",
         "cldr-dates-full": "40.0.0",
         "cldr-numbers-full": "40.0.0",
         "cldrjs": "0.5.5",
@@ -128,7 +128,7 @@
         "express": "4.21.1",
         "glob": "11.1.0",
         "globals": "catalog:",
-        "gulp": "4.0.2",
+        "gulp": "5.0.1",
         "gulp-clean": "0.4.0",
         "gulp-minify": "3.1.0",
         "gulp-replace": "1.1.4",

apps/react-storybook/package.json

@@ -32,7 +32,7 @@
     "prop-types": "15.8.1",
     "react": "18.0.0",
     "react-dom": "18.0.0",
-    "storybook": "7.6.19",
+    "storybook": "10.1.4",
     "typescript": "4.9.5"
   }
 }

e2e/bundlers/package.json

@@ -12,7 +12,7 @@
     "cldrjs": "0.5.5",
     "jquery": "catalog:",
     "minimist": "1.2.8",
-    "parcel": "2.12.0",
+    "parcel": "2.16.1",
     "rimraf": "3.0.2",
     "rollup": "4.22.4",
     "vite": "5.4.19",

e2e/wrappers/package.json

@@ -56,15 +56,15 @@
     "@angular-devkit/build-angular": "^19.2.5",
     "@angular/cli": "^19.2.5",
     "@angular/compiler-cli": "^19.2.0",
-    "@eslint/js": "^9.21.0",
+    "@eslint/js": "^9.39.1",
     "@types/jasmine": "~5.1.0",
     "@types/react": "^19.0.10",
     "@types/react-dom": "^19.0.4",
     "@vitejs/plugin-react": "^4.3.4",
     "@vitejs/plugin-vue": "^5.2.1",
-    "eslint": "^9.21.0",
-    "eslint-plugin-react-hooks": "^5.1.0",
-    "eslint-plugin-react-refresh": "^0.4.19",
+    "eslint": "^9.39.1",
+    "eslint-plugin-react-hooks": "^7.0.1",
+    "eslint-plugin-react-refresh": "^0.4.24",
     "globals": "^15.15.0",
     "jasmine-core": "~5.6.0",
     "karma": "~6.4.0",

package.json

@@ -51,7 +51,7 @@
     "shelljs": "0.8.5",
     "shx": "0.4.0",
     "source-map": "0.7.4",
-    "tar-fs": "3.0.9",
+    "tar-fs": "3.1.1",
     "ts-node": "10.9.2",
     "vue": "3.4.27",
     "yargs": "17.7.2"
@@ -66,7 +66,15 @@
       "form-data@<2.5.4": "2.5.5",
       "form-data@>=4.0.0 <4.0.4": "^4.0.5",
       "pbkdf2@<=3.1.2": "^3.1.3",
-      "sha.js@<=2.4.11": "^2.4.12"
+      "sha.js@<=2.4.11": "^2.4.12",
+      "terser@<4.8.1": "^4.8.1",
+      "braces@<3.0.3": "^3.0.3",
+      "glob@<10.5.0": "^13.0.0",
+      "semver@<5.7.2": "^7.7.3",
+      "json5@<1.0.2": "^2.2.3",
+      "rollup@<2.79.2": "^4.53.3",
+      "lodash": "^4.17.21",
+      "axios": "^1.12.0"
     }
   },
   "packageManager": "pnpm@9.15.4"

packages/devextreme-angular/gulpfile.js

@@ -30,7 +30,7 @@ const { angularConfig } = require('../../tools/generators-config');
 gulp.task('clean.metadata', gulp.series(() => {
   const { outputFolderPath } = buildConfig.tools.metadataGenerator;
 
-  return del([outputFolderPath]);
+  return del.deleteAsync([outputFolderPath]);
 }));
 
 gulp.task('generate.metadata', gulp.series('clean.metadata', (done) => {
@@ -49,7 +49,7 @@ gulp.task('clean.generatedComponents', (done) => {
   const { outputFolderPath } = buildConfig.tools.componentGenerator;
   const { skipFromCleaningFiles } = buildConfig.components;
 
-  del.sync([
+  del.deleteSync([
     `${outputFolderPath}/*/**`,
     ...skipFromCleaningFiles.flatMap((keepPattern) => {
       const pathParts = keepPattern.match(/[\*\/]$/) ? keepPattern.split('/') : [keepPattern];
@@ -169,8 +169,8 @@ gulp.task('build.license-headers', () => {
 });
 
 gulp.task('clean.dist', () => {
-  del.sync([`${buildConfig.components.outputPath}/*.*`]);
-  return del([buildConfig.components.outputPath]);
+  del.deleteSync([`${buildConfig.components.outputPath}/*.*`]);
+  return del.deleteAsync([buildConfig.components.outputPath]);
 });
 
 gulp.task('build.ngc', () => {
@@ -256,7 +256,7 @@ gulp.task('generate', gulp.series(
 gulp.task('clean.tests', () => {
   const outputFolderPath = buildConfig.components.testsPath;
 
-  return del([outputFolderPath]);
+  return del.deleteAsync([outputFolderPath]);
 });
 
 gulp.task('generate-component-names', (done) => {

packages/devextreme-angular/package.json

@@ -50,17 +50,17 @@
     "core-js": "2.6.12",
     "cross-env": "7.0.3",
     "css-loader": "6.10.0",
-    "del": "2.2.2",
+    "del": "8.0.1",
     "devextreme-metadata": "workspace:*",
     "eslint": "catalog:",
     "eslint-config-devextreme": "1.1.5",
     "eslint-plugin-import": "catalog:",
     "eslint-migration-utils": "workspace:*",
-    "gulp": "4.0.2",
+    "gulp": "5.0.1",
     "gulp-header": "2.0.9",
     "gulp-replace": "0.6.1",
     "gulp-sourcemaps": "2.6.5",
-    "gulp-typescript": "4.0.2",
+    "gulp-typescript": "5.0.1",
     "jasmine": "5.4.0",
     "karma": "6.4.4",
     "karma-chrome-launcher": "3.2.0",

packages/devextreme-scss/gulpfile.js

@@ -10,7 +10,7 @@ const env = require('../devextreme/build/gulp/env-variables.js');
 const del = require('del');
 
 gulp.task('clean', function(callback) {
-    del.sync([
+    del.deleteSync([
         '../devextreme/artifacts/css/**',
         '../devextreme/scss/bundles/**'
     ], { force: true });

packages/devextreme-scss/package.json

@@ -3,8 +3,8 @@
   "type": "module",
   "devDependencies": {
     "clean-css": "5.3.3",
-    "del": "2.2.2",
-    "gulp": "4.0.2",
+    "del": "8.0.1",
+    "gulp": "5.0.1",
     "gulp-autoprefixer": "10.0.0",
     "gulp-cache": "1.1.3",
     "gulp-plumber": "1.2.1",

packages/devextreme/build/gulp/aspnet.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const gulp = require('gulp');
-const merge = require('merge-stream');
+const merge = require('ordered-read-streams');
 const rename = require('gulp-rename');
 const headerPipes = require('./header-pipes.js');
 const compressionPipes = require('./compression-pipes.js');

packages/devextreme/build/gulp/localization.js

@@ -110,7 +110,7 @@ const getMessages = function(directory, locale) {
 };
 
 gulp.task('clean-cldr-data', function() {
-    return del('js/__internal/core/localization/cldr-data/**', { force: true });
+    return del.deleteAsync('js/__internal/core/localization/cldr-data/**', { force: true });
 });
 
 gulp.task('generate-community-locales', () => {

packages/devextreme/build/gulp/npm.js

@@ -5,7 +5,7 @@ require('./ts');
 const eol = require('gulp-eol');
 const gulp = require('gulp');
 const gulpIf = require('gulp-if');
-const merge = require('merge-stream');
+const merge = require('ordered-read-streams');
 const through = require('through2');
 const replace = require('gulp-replace');
 const lazyPipe = require('lazypipe');

packages/devextreme/build/gulp/state_manager/remove_development_state_manager_modules.js

@@ -26,7 +26,7 @@ const removeDevelopmentStateManagerModules = (targetPath) => {
         patterns.push(`!${path.join(targetPath, type, STATE_MANAGER_PROD_FOLDER_PATH)}/**`);
     });
 
-    del.sync(patterns);
+    del.deleteSync(patterns);
 }
 
 const createRemoveDevelopmentStateManagerModulesTask = (targetPath) => (done) => {

packages/devextreme/build/gulp/transpile.js

@@ -113,7 +113,7 @@ const transpileTs = (compiler, src) => {
 };
 
 const transpileTsClean = () =>
-    async() => await del(TS_OUTPUT_BASE_DIR, { force: true });
+    async() => await del.deleteAsync(TS_OUTPUT_BASE_DIR, { force: true });
 
 
 const createTranspileTask = (input, output, pipes) =>

packages/devextreme/build/gulp/vectormap.js

@@ -7,7 +7,7 @@ const rename = require('gulp-rename');
 const concat = require('gulp-concat');
 const tap = require('gulp-tap');
 const gulpIf = require('gulp-if');
-const merge = require('merge-stream');
+const merge = require('ordered-read-streams');
 const template = require('gulp-template');
 
 const context = require('./context.js');
@@ -31,7 +31,7 @@ gulp.task('vectormap-utils', function() {
 });
 
 gulp.task('vectormap-data', gulp.series('vectormap-utils', function() {
-    const stream = merge();
+    const stream = [];
     const processFiles = require(path.join('../..', VECTORMAP_UTILS_RESULT_PATH, 'dx.vectormaputils.node.js')).processFiles;
 
     if(!fs.existsSync(VECTORMAP_DATA_RESULT_PATH)) {
@@ -47,7 +47,7 @@ gulp.task('vectormap-data', gulp.series('vectormap-utils', function() {
         files.forEach(file => {
             const data = fs.readFileSync(path.join(VECTORMAP_DATA_RESULT_PATH, file), 'utf8');
 
-            stream.add(
+            stream.push(
                 gulp.src('build/gulp/vectormapdata-template.jst')
                     .pipe(template({ data: data }))
                     .pipe(rename(file))
@@ -56,7 +56,7 @@ gulp.task('vectormap-data', gulp.series('vectormap-utils', function() {
             );
         });
     });
-    return stream;
+    return merge(stream);
 }));
 
 function patchVectorMapUtilsStream(stream, isMinify) {

packages/devextreme/build/gulp/vendor.js

@@ -3,7 +3,7 @@
 const gulp = require('gulp');
 const path = require('path');
 const rename = require('gulp-rename');
-const merge = require('merge-stream');
+const merge = require('ordered-read-streams');
 const compressionPipes = require('./compression-pipes.js');
 const context = require('./context');
 

packages/devextreme/gulpfile.js

@@ -9,7 +9,7 @@ const shell = require('gulp-shell');
 const { REMOVE_NON_PRODUCTION_MODULE } = require('./build/gulp/context');
 
 gulp.task('clean', function(callback) {
-    require('del').sync([
+    require('del').deleteSync([
         'artifacts/**',
         '!artifacts',
         '!artifacts/css',

packages/devextreme/package.json

@@ -102,7 +102,7 @@
     "cross-env": "7.0.3",
     "cssom": "0.5.0",
     "csstype": "3.1.3",
-    "del": "2.2.2",
+    "del": "8.0.1",
     "devextreme-aspnet-data": "5.0.0",
     "devextreme-cldr-data": "1.0.3",
     "devextreme-exceljs-fork": "^4.4.4",
@@ -133,7 +133,7 @@
     "glob": "11.1.0",
     "globalize": "1.7.0",
     "globals": "catalog:",
-    "gulp": "4.0.2",
+    "gulp": "5.0.1",
     "gulp-autoprefixer": "10.0.0",
     "gulp-babel": "8.0.0",
     "gulp-cache": "1.1.3",
@@ -151,7 +151,7 @@
     "gulp-jsbeautifier": "2.1.2",
     "gulp-json-editor": "2.6.0",
     "gulp-multi-process": "1.4.0",
-    "gulp-notify": "4.0.0",
+    "gulp-notify": "5.0.0",
     "gulp-plumber": "1.2.1",
     "gulp-remote-src": "0.4.4",
     "gulp-rename": "1.4.0",
@@ -176,7 +176,7 @@
     "lazypipe": "1.0.2",
     "looks-same": "7.3.0",
     "map-stream": "0.0.7",
-    "merge-stream": "2.0.0",
+    "ordered-read-streams": "2.0.0",
     "minimist": "1.2.8",
     "nconf": "0.12.1",
     "normalize-path": "3.0.0",