fix: remediate September 2026 security findings

package.json

@@ -39,8 +39,8 @@
     "@hookform/resolvers": "^4.1.3",
     "@popperjs/core": "^2.11.8",
     "@sprig-technologies/sprig-browser": "^2.39.0",
-    "@storybook/addon-actions": "7.6.20",
-    "@storybook/react": "7.6.20",
+    "@storybook/addon-actions": "8.6.18",
+    "@storybook/react": "8.6.18",
     "@stripe/react-stripe-js": "1.16.5",
     "@stripe/stripe-js": "1.54.2",
     "@tinymce/tinymce-react": "^6.3.0",
@@ -122,14 +122,14 @@
     "remark-breaks": "^3.0.3",
     "remark-frontmatter": "^4.0.1",
     "remark-gfm": "^3.0.1",
-    "remark-gfm-v4": "npm:remark-gfm@^4.0.1",
+    "@topcoder-platform/remark-gfm-v4": "npm:remark-gfm@4.0.1",
     "remark-parse": "^11.0.0",
     "remove": "^0.1.5",
     "sanitize-html": "^2.17.6",
     "sass": "^1.95.0",
     "styled-components": "^5.3.11",
     "swr": "^1.3.0",
-    "tc-auth-lib": "topcoder-platform/tc-auth-lib#v2.0",
+    "@topcoder-platform/tc-auth-lib": "topcoder-platform/tc-auth-lib#56996006ee5918b3e77fc5a8ab005ae738b4de12",
     "tinymce": "^7.9.1",
     "typescript": "5.5.4",
     "universal-navigation": "https://github.com/topcoder-platform/universal-navigation#master",
@@ -146,12 +146,12 @@
     "@babel/runtime": "^7.28.4",
     "@craco/craco": "^7.1.0",
     "@jackwilsdon/craco-use-babelrc": "1.0.0",
-    "@storybook/addon-essentials": "7.6.20",
-    "@storybook/addon-interactions": "7.6.20",
-    "@storybook/addon-links": "7.6.20",
-    "@storybook/blocks": "7.6.20",
-    "@storybook/preset-create-react-app": "7.6.20",
-    "@storybook/react-webpack5": "7.6.20",
+    "@storybook/addon-essentials": "8.6.18",
+    "@storybook/addon-interactions": "8.6.18",
+    "@storybook/addon-links": "8.6.18",
+    "@storybook/blocks": "8.6.18",
+    "@storybook/preset-create-react-app": "8.6.18",
+    "@storybook/react-webpack5": "8.6.18",
     "@storybook/testing-library": "^0.2.2",
     "@testing-library/jest-dom": "^5.17.0",
     "@testing-library/react": "^13.4.0",
@@ -214,7 +214,7 @@
     "sass-loader": "^13.3.3",
     "serve": "^14.2.5",
     "start-server-and-test": "^2.1.3",
-    "storybook": "7.6.21",
+    "storybook": "8.6.18",
     "style-loader": "^3.3.4",
     "systemjs-webpack-interop": "^2.3.7",
     "tsconfig-paths-webpack-plugin": "^4.2.0",
@@ -246,6 +246,7 @@
     "react-scripts/webpack-dev-server": "5.2.6",
     "string-width": "4.2.0",
     "node-fetch": "2.6.7",
+    "**/postcss/nanoid": "3.3.18",
     "nth-check": "2.0.1",
     "lodash.mergewith": "4.6.2"
   },

src/apps/campus/src/pages/leaderboard/CampusLeaderboardPage.spec.tsx

@@ -359,12 +359,14 @@ describe('CampusLeaderboardPage', () => {
             name: /View participation history for testaws1/i,
         }))
 
-        const isChallengeLink = (link: HTMLElement): boolean => Boolean(
-            link.getAttribute('href')
-                ?.startsWith('https://review.example.test'),
-        )
+        const expectedChallengeNames = new Set([
+            'Submitted last',
+            'Submitted first',
+            'Registered last, never submitted',
+            'Registered first, never submitted',
+        ])
         const challengeNames = screen.getAllByRole('link')
-            .filter(isChallengeLink)
+            .filter(link => expectedChallengeNames.has(link.textContent ?? ''))
             .map(link => link.textContent)
 
         expect(challengeNames)

src/apps/customer-portal/src/pages/assistants/TopScoutPage/components/ChatThread/MarkdownText.tsx

@@ -1,11 +1,11 @@
 import { AnchorHTMLAttributes, FC } from 'react'
-import remarkGfm from 'remark-gfm-v4'
 
 import { MarkdownTextPrimitive } from '@assistant-ui/react-markdown'
+import remarkGfm from '@topcoder-platform/remark-gfm-v4'
 
 import styles from './MarkdownText.module.scss'
 
-// remark-gfm-v4 is aliased to remark-gfm@4 (see package.json) instead of the
+// The scoped remark-gfm-v4 dependency is aliased to remark-gfm@4 (see package.json) instead of the
 // shared `remark-gfm@^3.0.1` top-level pin: @assistant-ui/react-markdown
 // vendors its own react-markdown@10/unified@11 pipeline, which remark-gfm@3
 // (built for unified@9/10) isn't guaranteed to parse tables correctly

src/apps/work/src/lib/utils/navigation.utils.spec.ts

@@ -1,4 +1,4 @@
-import { decodeToken } from 'tc-auth-lib'
+import { decodeToken } from '@topcoder-platform/tc-auth-lib'
 
 import type { Project } from '../models'
 
@@ -7,7 +7,7 @@ import {
     buildProjectLandingPath,
 } from './navigation.utils'
 
-jest.mock('tc-auth-lib', () => ({
+jest.mock('@topcoder-platform/tc-auth-lib', () => ({
     decodeToken: jest.fn(),
 }))
 

src/apps/work/src/lib/utils/permissions.utils.spec.ts

@@ -1,4 +1,4 @@
-import { decodeToken } from 'tc-auth-lib'
+import { decodeToken } from '@topcoder-platform/tc-auth-lib'
 
 import type {
     Challenge,
@@ -17,7 +17,7 @@ import {
     getProjectMemberRole,
 } from './permissions.utils'
 
-jest.mock('tc-auth-lib', () => ({
+jest.mock('@topcoder-platform/tc-auth-lib', () => ({
     decodeToken: jest.fn(),
 }))
 

src/apps/work/src/lib/utils/permissions.utils.ts

@@ -1,4 +1,4 @@
-import { decodeToken } from 'tc-auth-lib'
+import { decodeToken } from '@topcoder-platform/tc-auth-lib'
 
 import { PROJECT_ROLES } from '../constants'
 import { PROJECT_MEMBER_INVITE_STATUS } from '../constants/project-roles.constants'

src/apps/work/src/pages/challenges/ChallengeEditorPage/ChallengeEditorPage.spec.tsx

@@ -40,7 +40,7 @@ import { ChallengeEditorPage } from './ChallengeEditorPage'
 
 var mockWorkAppContext: Context<WorkAppContextModel>
 
-jest.mock('tc-auth-lib', () => ({
+jest.mock('@topcoder-platform/tc-auth-lib', () => ({
     decodeToken: jest.fn(),
 }))
 

src/apps/work/src/pages/projects/ProjectsListPage/ProjectsListPage.spec.tsx

@@ -19,7 +19,7 @@ jest.mock('react-toastify', () => ({
         error: jest.fn(),
     },
 }))
-jest.mock('tc-auth-lib', () => ({
+jest.mock('@topcoder-platform/tc-auth-lib', () => ({
     decodeToken: jest.fn(),
 }))
 jest.mock('../../../lib/services/resources.service', () => ({

src/declarations.d.ts

@@ -1,4 +1,4 @@
-declare module 'tc-auth-lib'
+declare module '@topcoder-platform/tc-auth-lib'
 declare module 'city-timezones'
 
 declare module '*.svg' {

src/libs/core/lib/auth/authentication-functions/authentication.functions.ts

@@ -1,6 +1,6 @@
-import { configureConnector, decodeToken, getFreshToken } from 'tc-auth-lib'
 import cookies from 'browser-cookies'
 
+import { configureConnector, decodeToken, getFreshToken } from '@topcoder-platform/tc-auth-lib'
 import { EnvironmentConfig, ToolTitle } from '~/config'
 
 import { PlatformRoute } from '../../router'

src/libs/core/lib/auth/token-functions/token.functions.ts

@@ -1,4 +1,4 @@
-import { decodeToken } from 'tc-auth-lib'
+import { decodeToken } from '@topcoder-platform/tc-auth-lib'
 
 import { authInitializeAsync } from '../authentication-functions'
 import { logError } from '../../logger'