Update dependencies and fix tests (part 1)

.github/workflows/integration_test.yml

@@ -45,10 +45,10 @@ jobs:
       shell: bash -l {0}
       run: docker pull ${{ env.APP_IMAGE_TAG }}
     -
-      name: Use Node JS 20
+      name: Use Node JS 24
       uses: actions/setup-node@master
       with:
-        node-version: 20
+        node-version: 24
     -
       name: Install JS dependencies
       run: |

.github/workflows/unit_test.yml

@@ -55,10 +55,10 @@ jobs:
         docker run -v "${{ github.workspace }}/output:/tmp/output" --user nobody ${{ env.APP_IMAGE_TAG }} /bin/bash scripts/run_backend_tests.sh
       continue-on-error: true
     -
-      name: Use Node JS 20
+      name: Use Node JS 24
       uses: actions/setup-node@main
       with:
-        node-version: 20
+        node-version: 24
     -
       name: Install JS dependencies
       run: |

Dockerfile

@@ -49,6 +49,9 @@
 
 WORKDIR /kb/dev_container/narrative
 
+RUN curl -sL https://deb.nodesource.com/setup_24.x | bash - && \
+    apt-get install -y nodejs
+
 RUN mkdir -p /kb/deployment/ui-common/ && \
     mkdir -p /tmp/narrative && \
     # install JS deps

kbase-extension/static/kbase/js/common/cellComponents/tabs/infoTab.js

@@ -183,6 +183,13 @@
                 };
 
                 try {
+                    // A valid description must be a string. Anything else (e.g. an object
+                    // with a non-function toString) is treated as invalid. Older versions of
+                    // DOMPurify threw on such input, newer versions coerce it silently.
+                    // To keep with the older style, we continue to throw the error here.
+                    if (typeof descriptionText !== 'string') {
+                        throw new Error('App description is not a string');
+                    }
                     const node = document.createElement('div');
                     node.innerHTML = sanitize(descriptionText);
                     // After sanitization and fixing, we want the raw html string back.

package.json

@@ -8,30 +8,30 @@
         "node": ">=20"
     },
     "devDependencies": {
-        "@babel/traverse": "7.28.0",
-        "@eslint/eslintrc": "3.3.1",
-        "@eslint/js": "9.33.0",
+        "@babel/traverse": "8.0.4",
+        "@eslint/eslintrc": "3.3.6",
+        "@eslint/js": "10.0.1",
         "@lodder/grunt-postcss": "^3.1.1",
-        "@wdio/browserstack-service": "9.19.1",
-        "@wdio/cli": "9.19.1",
-        "@wdio/local-runner": "^9.10.1",
-        "@wdio/mocha-framework": "9.19.1",
+        "@wdio/browserstack-service": "9.30.0",
+        "@wdio/cli": "9.30.0",
+        "@wdio/local-runner": "^9.30.0",
+        "@wdio/mocha-framework": "9.30.0",
         "@wdio/selenium-standalone-service": "^8.15.0",
-        "@wdio/spec-reporter": "9.19.1",
-        "autoprefixer": "10.4.21",
-        "axios": "1.11.0",
+        "@wdio/spec-reporter": "9.29.1",
+        "autoprefixer": "10.5.4",
+        "axios": "1.18.1",
         "bootstrap-sass": "^3.4.3",
-        "chrome-launcher": "^1.2.0",
-        "chromedriver": "139.0.0",
-        "commander": "14.0.0",
-        "cssnano": "7.1.0",
-        "ejs": "^3.1.10",
-        "eslint": "9.33.0",
+        "chrome-launcher": "^1.2.1",
+        "chromedriver": "151.0.1",
+        "commander": "15.0.0",
+        "cssnano": "8.0.2",
+        "ejs": "^6.0.1",
+        "eslint": "10.7.0",
         "eslint-config-prettier": "10.1.8",
-        "expect-webdriverio": "^5.0.5",
-        "glob": "11.0.3",
-        "globals": "16.3.0",
-        "grunt": "^1.6.1",
+        "expect-webdriverio": "^5.7.0",
+        "glob": "13.0.6",
+        "globals": "17.7.0",
+        "grunt": "^1.6.2",
         "grunt-cli": "^1.5.0",
         "grunt-contrib-concat": "^2.1.0",
         "grunt-contrib-copy": "^1.0.0",
@@ -40,36 +40,36 @@
         "grunt-shell": "^4.0.0",
         "grunt-stylelint": "^0.20.1",
         "husky": "^9.1.7",
-        "jasmine-ajax": "^4.0.0",
-        "jasmine-core": "^5.8.0",
+        "jasmine-ajax": "^5.0.0",
+        "jasmine-core": "^5.9.0",
         "jasmine-jquery": "^2.1.1",
         "jquery-migrate": "^1.4.1",
         "karma": "^6.4.4",
-        "karma-brief-reporter": "^0.2.2",
+        "karma-brief-reporter": "^0.3.0",
         "karma-chrome-launcher": "^3.2.0",
         "karma-coverage": "^2.2.1",
         "karma-es6-shim": "^1.0.0",
         "karma-firefox-launcher": "^2.1.3",
         "karma-jasmine": "^5.1.0",
-        "karma-jasmine-html-reporter": "^2.1.0",
+        "karma-jasmine-html-reporter": "^2.2.0",
         "karma-jasmine-matchers": "^5.0.0",
         "karma-mocha-reporter": "^2.2.5",
         "karma-requirejs": "^1.1.0",
         "karma-safari-launcher": "^1.0.0",
-        "lint-staged": "16.1.5",
+        "lint-staged": "17.2.0",
         "load-grunt-tasks": "^5.1.0",
         "msw": "^0.40.2",
-        "postcss": "8.5.6",
+        "postcss": "8.5.22",
         "postcss-cli": "11.0.1",
-        "postcss-discard-comments": "^7.0.0",
+        "postcss-discard-comments": "^8.0.1",
         "postcss-scss": "^4.0.9",
         "postcss-unprefix": "^2.1.4",
-        "prettier": "3.6.2",
-        "puppeteer": "24.16.1",
-        "requirejs": "^2.3.7",
-        "sass": "1.90.0",
+        "prettier": "3.9.6",
+        "puppeteer": "25.3.0",
+        "requirejs": "^2.3.8",
+        "sass": "1.101.6",
         "selenium-standalone": "10.0.2",
-        "selenium-webdriver": "4.35.0",
+        "selenium-webdriver": "4.46.0",
         "string-template": "^1.0.0",
         "string.prototype.endswith": "^1.0.2",
         "string.prototype.startswith": "^1.0.1",
@@ -78,8 +78,8 @@
         "stylelint-config-recommended": "17.0.0",
         "stylelint-config-sass-guidelines": "^12.0.0",
         "stylelint-config-standard": "39.0.0",
-        "terser": "5.43.1",
-        "webdriverio": "^9.0.0"
+        "terser": "5.49.0",
+        "webdriverio": "^9.30.0"
     },
     "dependencies": {
         "bluebird": "3.7.2",
@@ -92,24 +92,24 @@
         "datatables.net-bs": "1.13.4",
         "datatables.net-buttons": "2.3.6",
         "datatables.net-buttons-bs": "2.4.1",
-        "dompurify": "3.2.6",
+        "dompurify": "3.4.12",
         "dropzone": "5.9.3",
         "file-saver": "1.3.4",
-        "follow-redirects": "1.15.11",
+        "follow-redirects": "1.16.0",
         "font-awesome": "4.7.0",
         "google-code-prettify": "1.0.5",
         "handlebars": "^4.7.8",
         "jquery": "2.2.4",
         "jquery-nearest": "1.4.0",
-        "jquery-ui": "1.14.1",
+        "jquery-ui": "1.14.2",
         "jquery.tipsy": "1.0.3",
         "js-yaml": "3.14.1",
         "kbase-common-js": "https://github.com/kbase/kbase-common-js/archive/refs/tags/v2.16.0.tar.gz",
         "kbase-sdk-clients-js": "https://github.com/eapearson/kbase-sdk-clients-js/archive/refs/tags/v0.5.1.tar.gz",
         "kbase-service-clients-js": "https://github.com/kbase/kbase-service-clients-js/archive/refs/tags/v3.3.4.tar.gz",
         "kbase-ui-plugin-catalog": "https://github.com/kbase/kbase-ui-plugin-catalog/archive/refs/tags/v2.2.5.tar.gz",
         "numeral": "2.0.6",
-        "plotly.js-dist-min": "3.1.0",
+        "plotly.js-dist-min": "3.7.0",
         "pure-uuid": "1.8.1",
         "require-css": "0.1.10",
         "require-yaml": "github:m90/require-yaml",
@@ -120,7 +120,7 @@
         "select2-bootstrap-theme": "0.1.0-beta.10",
         "spark-md5": "3.0.2",
         "text": "github:requirejs/text",
-        "underscore": "1.13.7",
+        "underscore": "1.13.8",
         "word-wrap": "1.2.5"
     },
     "browserslist": [

test/unit/spec/nbextensions/appCell2/widgets/appCellWidget-spec.js

@@ -7,6 +7,7 @@ define([
     'common/runtime',
     'common/semaphore',
     'common/ui',
+    'narrativeConfig',
     'testUtil',
     'narrativeMocks',
     '/test/data/jobsData',
@@ -21,6 +22,7 @@ define([
     Runtime,
     Semaphore,
     UI,
+    Config,
     TestUtil,
     Mocks,
     JobsData,
@@ -134,6 +136,30 @@ define([
         },
     ];
 
+    /**
+     * Stubs the NarrativeMethodStore and Catalog service calls that the app cell makes
+     * while loading its spec (via getAppSpec). The widget uses the AMD kb_service clients,
+     * which issue jsonrpc-1.1 requests through jQuery.ajax, so we intercept those with
+     * jasmine.Ajax rather than spying on the (unrelated) window globals.
+     */
+    function stubAppSpecRequests() {
+        Mocks.mockJsonRpc1Call({
+            url: Config.url('narrative_method_store'),
+            body: /get_method_full_info/,
+            response: methodFullInfo,
+        });
+        Mocks.mockJsonRpc1Call({
+            url: Config.url('narrative_method_store'),
+            body: /get_method_spec/,
+            response: [appSpec.spec],
+        });
+        Mocks.mockJsonRpc1Call({
+            url: Config.url('catalog'),
+            body: /get_exec_aggr_stats/,
+            response: [],
+        });
+    }
+
     function generateCellData() {
         return TestUtil.JSONcopy({
             cell_type: 'code',
@@ -304,19 +330,6 @@ define([
             readonly: false,
             getAuthToken: () => 'fake_token',
         };
-        spyOn(window, 'NarrativeMethodStore').and.returnValue({
-            get_method_full_info: () => {
-                return Promise.resolve(methodFullInfo);
-            },
-            get_method_spec: () => {
-                return Promise.resolve([appSpec.spec]);
-            },
-        });
-        spyOn(window, 'Catalog').and.returnValue({
-            get_exec_aggr_stats: () => {
-                return Promise.resolve([]);
-            },
-        });
         return ctx.appCellWidgetInstance;
     }
 
@@ -353,6 +366,8 @@ define([
 
     describe('The AppCellWidget instance', () => {
         beforeEach(function () {
+            jasmine.Ajax.install();
+            stubAppSpecRequests();
             Jupyter.notebook = {
                 writable: true,
             };
@@ -378,6 +393,7 @@ define([
         });
 
         afterEach(() => {
+            jasmine.Ajax.uninstall();
             TestUtil.clearRuntime();
             Jupyter.notebook = null;
             Jupyter.narrative = null;

test/unit/spec/util/DisplaySpec.js

@@ -122,10 +122,13 @@ define(['jquery', 'util/display', 'narrativeConfig', 'util/string'], (
                 const properId = $('<div>').text(userId).html();
                 expect($nameTarget[0].innerHTML).toContain(fullName);
                 expect($nameTarget[0].innerHTML).toContain(properId);
+                // The username is HTML-escaped before being placed in the href, so the
+                // link points at the escaped id (not the raw, XSS-prone value). Both the
+                // href and the link text use the escaped form.
                 expect($nameTarget[0].innerHTML).toContain(
                     ' (<a href="' +
                         profilePageUrl +
-                        userId +
+                        properId +
                         '" target="_blank">' +
                         properId +
                         '</a>)'