Skip to content

fix(deps): security upgrades — 49→13 vulnerabilities + materialize-css removal#987

Merged
tariqksoliman merged 586 commits into
NASA-AMMOS:developmentfrom
JPL-Devin:development
May 26, 2026
Merged

fix(deps): security upgrades — 49→13 vulnerabilities + materialize-css removal#987
tariqksoliman merged 586 commits into
NASA-AMMOS:developmentfrom
JPL-Devin:development

Conversation

@tariqksoliman
Copy link
Copy Markdown
Member

@tariqksoliman tariqksoliman commented May 26, 2026

With Devin: JPL-Devin#86

Purpose

  • Resolve security vulnerabilities across 8 direct dependency upgrades and ~20 transitive dependency overrides
  • Remove abandoned materialize-css (4 moderate XSS vulns) by migrating Toast to @base-ui/react
  • Reduce vulnerability count from 49 (1 critical, 21 high, 21 moderate, 6 low) down to 13 (0 critical, 2 high, 1 moderate, 10 low)
  • All remaining 13 vulns have NO fix available upstream (abandoned packages or deep transitive with no patched version)

Proposed Changes

Commit 1: 5 core dependency security upgrades (TDD verified)

  • [FIX] sequelize ^6.33.0 → ^6.37.8 (CVE-2026-30951 SQL injection)
  • [FIX] sharp ^0.31.2 → ^0.33.0 (GHSA-54xq-cgqr-rpm3 libwebp heap buffer overflow)
  • [FIX] requests 2.32.3 → 2.33.0 in python-environment.yml (credential leak + insecure temp-file)
  • [FIX] webpack-dev-server 4.15.2 → ^5.2.1 (dev-only CVEs, https → server config migration)
  • [FIX] Remove deprecated turf@^3.0.14, migrate 3 DrawTool files to @turf/turf@^6.5.0 with targeted named imports

Commit 2: Test restructuring + turf import cleanup

  • [ADD] Unit tests: tests/unit/sequelize.spec.js, tests/unit/sharp.spec.js, tests/unit/turf.spec.js
  • [ADD] E2E tests: tests/e2e/api/sequelize-orm.spec.js, tests/e2e/api/sharp-imaging.spec.js, tests/e2e/tools/draw-turf-geometry.spec.js
  • [CHANGE] DrawTool files: import * as turf → targeted named imports (bbox, difference)

Commit 3: 35 additional vulnerability fixes

  • [FIX] react-pdf ^7.7.3 → ^10.4.1 (HIGH — pdfjs-dist JS execution vuln)
    • Updated PDFViewer.js worker path: .js → .mjs
    • Added pdfjs 5.x worker file (public/workers/pdf.worker.min.mjs)
  • [FIX] uuid ^9.0.0 → ^11.1.1 (MODERATE — buffer bounds check)
  • [FIX] ws 8.18.3 → ~8.21.0 (MODERATE — memory disclosure)
  • [FIX] npm overrides for 20 transitive dependencies:
    • CRITICAL: protobufjs ^7.5.8 (arbitrary code execution — 9 advisories)
    • HIGH: @babel/plugin-transform-modules-systemjs ^7.29.0, braces ^3.0.3, micromatch ^4.0.8, picomatch ^2.3.2, lodash ^4.17.24, serialize-javascript ^7.0.3, minimatch ^3.1.4, brace-expansion ^1.1.13, underscore ^1.13.8, svgo ^3.3.3
    • MODERATE: follow-redirects ^1.15.12, postcss ^8.5.10, ajv ^6.14.0/^8.18.0, dottie ^2.0.7, yaml ^2.8.3, qs ^6.15.2, diff ^4.0.4, elliptic ^6.6.1

Commit 4: Replace materialize-css with base-ui Toast

  • [FIX] Remove materialize-css (abandoned/archived, 4 moderate XSS vulns)
  • [CHANGE] Upgrade @base-ui-components/react (deprecated) → @base-ui/react ^1.5.0
  • [ADD] ToastRenderer.jsx — base-ui Toast viewport with inline styles
  • [ADD] toastManager.js — global toast manager singleton for imperative API
  • [CHANGE] Toast.js — rewritten to use base-ui toastManager.add() instead of M.toast()
  • [CHANGE] essence.js — WebSocket toasts migrated from M.toast() → Toast.error()/Toast.dismissAll()
  • [CHANGE] TimeUI.js — 5 error toasts migrated from M.toast() → Toast.error()
  • [CHANGE] Button.jsx, IconButton.jsx, Modal.jsx — import paths updated for package rename
  • [CHANGE] attributions.js — Materialize attribution replaced with Base UI
  • [CHANGE] mmgisUI.css — toast CSS removed (now inline in ToastRenderer)

Remaining 13 vulnerabilities (all NO FIX available)

  • html2pug/html-minifier (2 HIGH) — skipped per plan
  • showdown (1 MODERATE) — ReDoS, no upstream fix
  • georaster/georaster-stack cluster (10 LOW) — bundles webpack 4 internally

Issues

Testing

  • 586 unit tests passing (PLAYWRIGHT_TEST_UNIT_ONLY=true npx playwright test tests/unit)
  • 9 CI tests passing (PLAYWRIGHT_TEST_UNIT_ONLY=true npx playwright test tests/ci)
  • ESLint clean on all modified source files (only pre-existing warnings)
  • detect-secrets scan clean on all new/modified files
  • npm audit: 49 → 13 vulnerabilities (0 critical, reduced from 21 to 2 high, 0 moderate from materialize)

devin-ai-integration Bot and others added 30 commits May 1, 2026 00:37
@devin-ai-integration @tariqksoliman
chore: remove separated tools offset logic from Globe_.js
9145ec4 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@tariqksoliman
Merge pull request #51 from JPL-Devin/devin/1777593443-react-separate…
44dd110 
…d-tools

feat: rewrite separated tools system from jQuery to React components
@devin-ai-integration @tariqksoliman
merge: resolve version bump conflicts with development
fb5cd9a 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: skip _makeHistogram on mobile (no timeline slider, timestamps un…
acf4844 
…set)

_makeHistogram renders inside the timeline slider which doesn't exist
on mobile. Without it, _timelineStartTimestamp is NaN, causing
'Invalid time value' RangeError at toISOString().

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile TimeUI — populate expanded rows, fix Invalid date, fix pa…
38a33a6 
…nel height

- TimeUI.js attachEvents: use _initialStart/_initialEnd on mobile (same
  as desktop) instead of L_.TimeControl_ which isn't set yet at init time.
  Fixes 'Invalid date' in start/end time inputs.
- TimeUI.js fina: set expanded=true on mobile and call _populateExpandedRows()
  so year/month/day/hour rows actually render. Removed position:absolute and
  pointer-events:none overrides.
- Toolbar.jsx: set tool panel height to 217px (TimeUI.height) instead of
  45% viewport — matches actual TimeUI content height.
- UserInterfaceMobile_.css: expanded content flows naturally (position:relative),
  hide start time inputs, allow overflow scroll, flex-wrap topbar.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile TimeUI justify-content center, restore toolbar border-bottom
a797683 
- Add justify-content: center to #mmgisTimeUIMain on mobile
- Remove border-bottom: none override so toolbar keeps its default border

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile TimeUI overflow hidden, scalebar/compass fixed at 40px of…
7f15338 
…fset

- #timeUI overflow-y: hidden (was auto, causing 2px scroll)
- Scalebar/compass/map controls stay at fixed 40px offset (above toolbar)
  regardless of tool panel state — no longer shift up by pxIsTools

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Implement multi-tier knowledge architecture
3c83375 
- Restructure AGENTS.md from 745 lines to 106 lines (Tier 1: essential context)
- Create knowledge/ directory with 30+ wiki-style documentation files (Tier 2: deep knowledge)
- Create knowledge/reference/ with 8 detailed reference files (Tier 3: lookup material)
- Move AI-GETTING-STARTED.md and AI-DEVELOPMENT.md to knowledge/
- Update all file references in .specify/templates and blueprints
- Create knowledge/README.md as the full knowledge base index
- Create knowledge/reference/README.md as reference material index

Three-tier knowledge discovery system:
  Tier 1: AGENTS.md (~106 lines) - scannable in <2 minutes
  Tier 2: knowledge/*.md - deep knowledge on architecture, tools, APIs, DB, infra
  Tier 3: knowledge/reference/*.md - coding conventions, API reference, troubleshooting

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@github-actions
chore: bump version to 4.3.29-20260501 [version bump]
87a7aec
@devin-ai-integration @tariqksoliman
fix: mobile toolbar active button style matches desktop, fix icon ali…
496a080 
…gnment

- All mobile toolbar buttons (ToolButton, MobileCoordButton, MobileTimeUIToggle)
  now use display:flex with align-items/justify-content center for proper
  vertical icon centering
- MobileCoordButton: changed 'active' class to 'toolButtonActive' to match
  the global CSS active style (color-mmgis + color-i background)
- Removed inline color overrides so CSS .toolButtonActive takes effect

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Add Devin knowledge notes from past MMGIS sessions
8fd634a 
Include curated lessons learned from past Devin sessions:
- CI/CD: ignore build-arm64/amd64 failures, focus on required checks
- Child sessions: no separate PRs when consolidating
- ENV triple-update rule (.env, sample.env, ENVs.md)
- Error handling: use logger with infrastructure_error for fatal startup errors
- Path traversal security: stay within /Missions, handle subpath serving
- Database initialization architecture and migration patterns
- API authentication behavior across AUTH modes
- Auto-generated MMGIS concept index

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile toolbar active button style, icon alignment, tool deactiv…
2d85aee 
…ation

- Active toolbar buttons get desktop-matching margin (1px 0) and
  border-radius (8px) via .toolButton.toolButtonActive CSS rule
- Removed line-height: 40px from .toolButton (flex centering handles
  vertical alignment, line-height was pushing icons up)
- MobileCoordButton now watches activeToolName store and deactivates
  when another tool opens (fixes coords staying active)
- MobileTimeUIToggle sets activeToolName='MobileTimeUI' when opening
  so coords/other buttons can detect it and deactivate
- MobileTimeUIToggle clears activeToolName when closing
- Both custom buttons skip self-deactivation via name check

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Fix cross-references: convert backtick refs to markdown links, add De…
7037f8c 
…vin knowledge notes

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile toolbar icon height 40px, button margins for active padding
9834d3d 
- #toolbar .toolButton i: height 40px fixes icon vertical alignment
- #toolbar .toolButton: margin 0 2px gives spacing between buttons
- #toolbar .toolButton.toolButtonActive: margin 1px 2px so active
  background has visual padding around the icon

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Rename knowledge/ to .knowledge/ for consistency with .specify/ conve…
6d9fd1e 
…ntion

Dot-prefix signals agent infrastructure (not source code), consistent with
.specify/, .github/, .vscode/ conventions. All cross-references updated.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: mobile toolbar icon line-height 40px, active button padding via …
4ceedc5 
…height

- Coord and TimeUI button <i> icons get line-height: 40px
- Active buttons: height 34px (vs 40px toolbar) creates visual padding
  around the active background, centered by flex align-items
- Buttons get margin: 0 1px for horizontal spacing

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Fix broken cross-reference: 06.2 -> 06.1-configure-rest-api.md
6fe729f 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: close active tool + cancel deferred cleanup in MobileCoordButton…
59db76d 
…/TimeUI

- MobileCoordButton: call closeActiveTool() before opening, destroy
  _pendingCloseTool if set, increment _closeSeq to cancel deferred
  tools.innerHTML clear
- MobileTimeUIToggle: same _pendingCloseTool + _closeSeq fix after
  closeActiveTool() to prevent 420ms deferred cleanup from wiping
  #timeUI after it's placed in #tools
- Removed redundant closeActiveTool() from MobileCoordButton close path
  (was being called after destroy, not needed)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: active mobile toolbar buttons 34x34px (square)
9bcd546 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Drastically compress .knowledge/ — keep only unique agent content
c36d4aa 
Remove 33 wiki files that duplicate docs/pages/ content.
Remove 9 reference/ files derivable from source code.
Keep only 5 files (down from 46):
  - AI-GETTING-STARTED.md (agent setup walkthrough)
  - AI-DEVELOPMENT.md (spec-kit workflow)
  - conventions-and-gotchas.md (naming, code style, common issues)
  - 12-devin-knowledge-notes.md (CI, auth, DB init, security gotchas)
  - README.md (index pointing to docs/pages/ for everything else)

Principle: don't duplicate docs/ — only keep what's uniquely agent-optimized.
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Rename to knowledge-notes.md, remove Devin branding and fork-specific…
2fba855 
… CI section

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: hide mmgis-map-logo on mobile
b1dbde7 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Restore Database Safety Rules for AI Agents section in AGENTS.md
e1b7ff2 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: shift compass and map scale 6px to the right (both mobile and de…
a8974a4 
…sktop)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Add back Important Instructions, code pattern templates, and detailed…
0ffb0bf 
… project structure

- Important Instructions in AGENTS.md: MCP tools, hot-reload, Reference Mission
- .knowledge/code-patterns.md: full directory tree with key directory annotations,
  plus copy-paste templates for Express routes, Sequelize models, Tool plugins,
  and WebSocket handlers

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@tariqksoliman
Merge pull request #50 from JPL-Devin/devin/1777590638-mobile-ui-fixes
276a848 
fix: mobile UI improvements — menu, panel toggles, toolbar, scalebar, TimeUI
@devin-ai-integration @tariqksoliman
Update project structure trees to reflect current filesystem
0f5ad2d 
Add missing directories: tests/, .knowledge/, .specify/, .github/, views/,
private/, spice/, build/, examples/, scripts/middleware.js.
Both abbreviated (AGENTS.md) and detailed (.knowledge/code-patterns.md) trees
now match the actual repo layout.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@github-actions
chore: bump version to 4.3.30-20260501 [version bump]
5f5f116
@devin-ai-integration @tariqksoliman
Add Layers_.js to project structure (key singleton L_)
4f03727 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
Fix project structure: correct API layout, frontend modules, code tem…
ca46225 
…plates

API/Backend/ uses feature-domain modules (Draw/, Users/, Config/, etc.)
with setup.js + routes/ + models/ per feature — not APIs/ or Databases/.
Frontend essence/ has Components/, Helpers/, LandingPage/, mmgisAPI/,
services/ — not Ancillary/. Basics/ includes all singletons (Globe_,
Formulae_, ToolController_, Viewer_, ComponentController_, Test_).
Code templates updated to match actual patterns (setup.js, module.exports).

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
devin-ai-integration Bot and others added 25 commits May 21, 2026 22:47
@devin-ai-integration @tariqksoliman
fix: preserve Error stack traces in sanitized log output
827b1a6 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: expand safeHTML allowlist + apply auth rate limiter unconditionally
d16d791 
- Sanitize.js: add ul, li tags and id attribute to allowlist for
  IdentifierTool cursor info compatibility
- users.js: remove token-reauth bypass from authLimiter to prevent
  crafted-cookie abuse; rate limit applies to all /login requests

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@tariqksoliman
Merge branch 'NASA-AMMOS:development' into development
0e63af5
@devin-ai-integration @tariqksoliman
refactor: convert validate-workflows to Playwright test for consistency
f833cad 
Renamed .test.js to .spec.js (matches testMatch pattern) and
converted from plain Node script to Playwright test.describe/test
structure so it runs via npm test like all other tests.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
feat: add npm run test:ci script for CI validation tests
a7f8343 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix(test): handle AUTH=none in mmgis-api login guard
d6f66e0 
loginIfRequired now skips login for both AUTH=off and AUTH=none,
preventing timeout when no login form is rendered.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: preserve newlines/tabs in sanitizeForLog for readable stack traces
1a5939c 
The control character regex now excludes \n (0x0A), \r (0x0D), and
\t (0x09) so stack traces and multi-line messages remain readable
in development mode.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@tariqksoliman
Merge pull request #84 from JPL-Devin/devin/1779400019-security-fixes
9b3e4a0 
fix(security): apply 7 Sonar security recommendations with TDD
@tariqksoliman
Merge branch 'NASA-AMMOS:development' into development
1c4af89
@devin-ai-integration @tariqksoliman
fix(map): expose L_.Map_ before makeLayers to prevent race condition
420815c 
AJAX callbacks fired by makeLayers → captureVector → $.getJSON can
resolve and access L_.Map_.map.getZoom() while L_.Map_ is still null
because L_.fina() hasn't run yet.

Setting L_.Map_ = this immediately before the makeLayers call ensures
the Leaflet map instance is available to any callback. L_.fina() will
still reassign to the same value later, so there is no conflict.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@github-actions
chore: bump version to 5.0.14-20260526 [version bump]
cb9c459
@tariqksoliman
Merge pull request #85 from JPL-Devin/devin/1779811890-map-early-expose
6d1cd74 
fix(map): expose L_.Map_ before makeLayers to prevent race condition
@tariqksoliman
Merge branch 'NASA-AMMOS:development' into development
955f805
@devin-ai-integration @tariqksoliman
fix(deps): upgrade 5 dependencies for security and deprecation fixes
aa6611a 
Security upgrades:
- sequelize ^6.33.0 → ^6.37.8 (HIGH — SQL injection CVE-2026-30951)
- sharp ^0.31.2 → ^0.33.0 (HIGH — libwebp heap buffer overflow GHSA-54xq-cgqr-rpm3)
- requests 2.32.3 → 2.33.0 (MODERATE — credential leak + insecure temp-file)

Dev-tool security upgrade:
- webpack-dev-server 4.15.2 → ^5.2.1 (MODERATE — dev-only CVEs)
  - Migrated 'https' config to 'server' option for v5 compatibility

Deprecated package removal:
- Removed turf ^3.0.14, migrated DrawTool imports to @turf/turf ^6.5.0
  - DrawTool.js: removed unused turf import
  - DrawTool_Drawing.js: merged turf + @turf/turf imports into single @turf/turf
  - DrawTool_Editing.js: migrated import to @turf/turf
  - Functions used (bbox, difference) are API-compatible in @turf/turf v6

Added TDD test coverage:
- tests/unit/dependency-upgrades.spec.js (11 tests)
- tests/e2e/api/dependency-upgrades.spec.js (7 tests)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
refactor: targeted turf imports + split tests into domain-specific files
4c6128e 
Turf import changes:
- DrawTool_Drawing.js: import { bbox as turfBbox, difference as turfDifference }
- DrawTool_Editing.js: import { bbox as turfBbox }
- Updated all call sites to use named imports instead of namespace

Test reorganization (first-class additions to test suite):
- tests/unit/sequelize.spec.js — Sequelize ORM module tests
- tests/unit/sharp.spec.js — Sharp image processing tests
- tests/unit/turf.spec.js — @turf/turf geometry function tests
- tests/e2e/api/sequelize-orm.spec.js — Sequelize-backed API endpoint tests
- tests/e2e/api/sharp-imaging.spec.js — Sharp tile compositing middleware tests
- tests/e2e/tools/draw-turf-geometry.spec.js — Draw tool turf geometry tests

Also fixed detect-secrets false positive (removed postgres:// URL from test)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix(deps): resolve 35 additional vulnerabilities (49→14 remaining)
75c4b82 
Direct dependency upgrades:
- react-pdf ^7.7.3 → ^10.4.1 (HIGH — pdfjs-dist JS execution vuln)
  - Updated PDFViewer.js worker path: .js → .mjs (react-pdf 9+ change)
  - Added new pdfjs 5.x worker file (pdf.worker.min.mjs)
- uuid ^9.0.0 → ^11.1.1 (MODERATE — buffer bounds check)
  - Verified CJS require pattern still works with v11
- ws 8.18.3 → ~8.21.0 (MODERATE — memory disclosure)

npm overrides for transitive dependencies:
- protobufjs ^7.5.8 (was CRITICAL — 9 advisories incl. arbitrary code exec)
- @babel/plugin-transform-modules-systemjs ^7.29.0 (HIGH — malicious input)
- braces ^3.0.3, micromatch ^4.0.8, picomatch ^2.3.2 (HIGH — ReDoS)
- lodash ^4.17.24 (HIGH — prototype pollution)
- serialize-javascript ^7.0.3 (HIGH — RCE)
- minimatch ^3.1.4, brace-expansion ^1.1.13 (HIGH/MODERATE — ReDoS)
- follow-redirects ^1.15.12 (MODERATE — credential leak)
- postcss ^8.5.10, svgo ^3.3.3, yaml ^2.8.3 (MODERATE)
- dottie ^2.0.7, diff ^4.0.4, qs ^6.15.2, underscore ^1.13.8
- elliptic ^6.6.1, ajv ^6.14.0/^8.18.0

Remaining 14 vulns are all NO FIX available:
- html2pug/html-minifier (skipped per plan)
- materialize-css, showdown (abandoned upstream)
- georaster/georaster-stack cluster (bundled webpack 4, 10 LOW)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
refactor: replace materialize-css with base-ui Toast
1d99822 
- Remove materialize-css dependency (abandoned, 4 moderate XSS vulns)
- Upgrade @base-ui-components/react (deprecated) → @base-ui/react ^1.5.0
- Rewrite Toast.js to use base-ui global toast manager pattern
- Add ToastRenderer.jsx with inline styles (viewport + toast variants)
- Add toastManager.js singleton for imperative Toast API
- Migrate raw M.toast() calls in essence.js (WebSocket toasts)
- Migrate raw M.toast() calls in TimeUI.js (5 error toasts)
- Update base-ui import paths in Button, IconButton, Modal components
- Update attributions.js (Materialize → Base UI)
- Remove toast CSS from mmgisUI.css (now inline in ToastRenderer)

Vulnerability count: 14 → 13 (materialize-css XSS vulns eliminated)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: merge toastManager into Toast.js, fix TimeUI.js import path
81f5739 
- Remove separate toastManager.js — export toastManager from Toast.js
- Fix TimeUI.js import: 4 levels up → 3 levels up (correct relative path)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: toast dismissAll crash, position top-center, reduce text size
acbcdf5 
- Fix dismissAll: track active IDs in a Set (toastManager.toasts is
  not accessible outside React context)
- Move viewport from bottom to top-center
- Reduce font size to 13px, tighter padding
- Ensure variant border-left color renders via inline style

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: toast title renders as span, fix type lookup and timeout field
48b99d4 
- Render Toast.Title as <span> instead of default <h2> (fixes oversized text)
- Read toast.type instead of toast.data?.type (fixes variant borders never showing)
- Use 'timeout' instead of 'duration' (correct base-ui API field name)

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
feat: add fade+slide transition to toasts
f7197e3 
Enter: fade in + ease down from -12px
Exit: fade out + ease down to +12px
Uses base-ui data-starting-style/data-ending-style attributes

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
style: bump toast font size 13px → 14px
7585bd8 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
style: toast viewport top 12px → 48px
2954dca 
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@devin-ai-integration @tariqksoliman
fix: prevent activeIds Set from growing unbounded
7456ef6 
Schedule cleanup of each toast ID after its timeout + 500ms buffer.
Consolidate add logic into shared addToast() helper.

Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
@tariqksoliman
Merge pull request #86 from JPL-Devin/devin/1779813894-dep-security-u…
0944e5f 
…pgrades

fix(deps): security upgrades — 49→13 vulnerabilities + materialize-css removal
@tariqksoliman tariqksoliman self-assigned this May 26, 2026
@tariqksoliman tariqksoliman added the dependencies Pull requests that update a dependency file label May 26, 2026
@tariqksoliman tariqksoliman merged commit b8484fb into NASA-AMMOS:development May 26, 2026
4 of 7 checks passed
@github-project-automation github-project-automation Bot moved this to Done in MMGIS May 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@tariqksoliman tariqksoliman

Labels

dependencies Pull requests that update a dependency file

Projects

MMGIS
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tariqksoliman