deps: update python dependencies

.github/workflows/django.yml

@@ -27,28 +27,22 @@ jobs:
         uses: actions/setup-python@v5
         with:
           python-version: '3.12'
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.8.0
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: '20.x'
+          node-version: '22.x'
+          cache: 'pnpm'
       - name: Setup Postgres
         env:
           PGPASSWORD: postgres
           PGHOSTADDR: 127.0.0.1
         run: |
           psql -c 'create database django;' -U postgres
           psql -c 'create database django_test;' -U postgres
-      - name: Cache node modules
-        uses: actions/cache@v4
-        env:
-          cache-name: cache-node-modules
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package.json') }}
-          restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-
-            ${{ runner.os }}-build-
-            ${{ runner.os }}-
       - name: Cache pip packages
         uses: actions/cache@v4
         env:
@@ -61,13 +55,11 @@ jobs:
             ${{ runner.os }}-build-
             ${{ runner.os }}-
       - name: Install Dependencies
-        env:
-          UV_PROJECT_ENVIRONMENT: "/home/runner/.local"
         run: |
           sudo apt update
           sudo apt install -y gdal-bin
           sudo apt install libsqlite3-mod-spatialite
-          npm install
+          pnpm install --frozen-lockfile
           pip install uv
           uv sync --all-groups
           uv add coveralls
@@ -76,14 +68,14 @@ jobs:
           PGPASSWORD: postgres
           PGHOSTADDR: 127.0.0.1
         run: |
-          DJANGO_SETTINGS_MODULE='tests.project.travis' py.test --cov
-          python manage.py makemigrations --dry-run --check --noinput
-          isort --diff -c adhocracy4 tests
-          flake8 adhocracy4 tests --exclude migrations,settings
-          npm run lint
+          DJANGO_SETTINGS_MODULE='tests.project.travis' uv run py.test --cov
+          uv run python manage.py makemigrations --dry-run --check --noinput
+          uv run isort --diff -c adhocracy4 tests
+          uv run flake8 adhocracy4 tests --exclude migrations,settings
+          pnpm run lint
       - name: Run Frontend Tests
         run: |
-          npm test
+          pnpm test
       - name: Check Coverage File
         run: |
           echo "Checking if .coverage file exists..."

.gitignore

@@ -13,7 +13,6 @@
 
 # Node
 node_modules
-package-lock.json
 
 # dev
 .idea/

.npmrc

@@ -0,0 +1,2 @@
+strict-peer-dependencies=false
+auto-install-peers=true

CHANGELOG.md

@@ -14,8 +14,16 @@ This project (not yet) adheres to [Semantic Versioning](https://semver.org/spec/
 
 ### Fixed
 
+### Security
+
+- Dependencies: update Python packages to fix security vulnerabilities:
+  Django 5.2.14 → 5.2.16, bleach 6.3.0 → 6.4.0,
+  django-allauth 65.12.1 → 65.18.0, requests 2.32.5 → 2.34.2,
+  black 25.9.0 → 26.5.1, pytest 8.4.2 → 9.1.1
+
 ### Changed
 
+- Dependencies: use pnpm for more secure package management
 
 ## aplus-v2607.1
 

Makefile

@@ -29,7 +29,7 @@ help:
 
 .PHONY: install
 install:
-	npm install
+	pnpm install
 	@if [ ! -f $(VIRTUAL_ENV)/bin/pip ]; then python3 -m venv $(VIRTUAL_ENV); fi
 	@if ! command -v uv --version; then \
 	$(VIRTUAL_ENV)/bin/pip install pipx; \
@@ -38,7 +38,7 @@ install:
 	uv sync --all-groups
 .PHONY: clean
 clean:
-	if [ -f package-lock.json ]; then rm package-lock.json; fi
+	if [ -f pnpm-lock.yaml ]; then rm pnpm-lock.yaml; fi
 	if [ -d node_modules ]; then rm -rf node_modules; fi
 	if [ -d venv ]; then rm -rf venv; fi
 
@@ -47,14 +47,14 @@ lint:
 	EXIT_STATUS=0; \
 	$(VIRTUAL_ENV)/bin/isort --diff -c $(SOURCE_DIRS) ||  EXIT_STATUS=$$?; \
 	$(VIRTUAL_ENV)/bin/flake8 $(SOURCE_DIRS) --exclude migrations,settings ||  EXIT_STATUS=$$?; \
-	npm run lint ||  EXIT_STATUS=$$?; \
+	pnpm run lint ||  EXIT_STATUS=$$?; \
 	$(VIRTUAL_ENV)/bin/python manage.py makemigrations --dry-run --check --noinput || EXIT_STATUS=$$?; \
 	exit $${EXIT_STATUS}
 
 .PHONY: lint-quick
 lint-quick:
 	EXIT_STATUS=0; \
-	npm run lint-staged || EXIT_STATUS=$$?; \
+	pnpm run lint-staged || EXIT_STATUS=$$?; \
 	$(VIRTUAL_ENV)/bin/python manage.py makemigrations --dry-run --check --noinput || EXIT_STATUS=$$?; \
 	exit $${EXIT_STATUS}
 
@@ -69,13 +69,13 @@ lint-python-files:
 .PHONY: lint-fix
 lint-fix:
 	EXIT_STATUS=0; \
-	npm run lint-fix ||  EXIT_STATUS=$$?; \
+	pnpm run lint-fix ||  EXIT_STATUS=$$?; \
 	exit $${EXIT_STATUS}
 
 .PHONY: test
 test:
 	$(VIRTUAL_ENV)/bin/pytest --reuse-db
-	npm run testNoCov
+	pnpm run testNoCov
 
 .PHONY: pytest
 pytest:
@@ -92,16 +92,16 @@ pytest-clean:
 
 .PHONY: jstest
 jstest:
-	npm run test
+	pnpm run test
 
 .PHONY: jstest-nocov
 jstest-nocov:
-	npm run testNoCov
+	pnpm run testNoCov
 
 .PHONY: jstest-debug
 jstest-debug:
-	npm run testDebug
+	pnpm run testDebug
 
 .PHONY: jstest-updateSnapshots
 jstest-updateSnapshots:
-	npm run updateSnapshots
+	pnpm run updateSnapshots

docs/development.md

@@ -26,22 +26,33 @@ Activate the virtualenv in both project and adhocracy4.
 
     source venv/bin/activate
 
-Ensure that
-your `~/.npmrc` contains as `prefix` some location you can write.
-
-    echo "prefix = $HOME/.npmprefix" > ~/.npmrc
-
 Start development mode:
 
     cd ../$PROJECT
     pip install -e ../adhocracy4/
-    npm link ../adhocracy4
+
+If your project uses pnpm:
+
+    pnpm link ../adhocracy4
+
+If your project still uses npm:
+
+    npm install ../adhocracy4
 
 Leave development mode:
 
     cd $PROJECT
+
+If your project uses pnpm:
+
+    pnpm unlink adhocracy4
+    pnpm install
+
+If your project uses npm:
+
     npm unlink adhocracy4
     npm install
+
     pip install -r requirements.txt
 
 Local installation
@@ -53,5 +64,5 @@ automatically update if you change somehting on the adhocracy4 code
 
     cd $PROJECT
     vim package.json # remove adhocracy requirement
-    npm install ../adhocracy4
+    pnpm add ../adhocracy4
     pip install ../adhocracy4

eslint.config.js

@@ -0,0 +1,88 @@
+import js from '@eslint/js'
+import importX from 'eslint-plugin-import-x'
+import jsxA11y from 'eslint-plugin-jsx-a11y'
+import n from 'eslint-plugin-n'
+import promise from 'eslint-plugin-promise'
+import react from 'eslint-plugin-react'
+import reactHooks from 'eslint-plugin-react-hooks'
+import jest from 'eslint-plugin-jest'
+import globals from 'globals'
+
+export default [
+  js.configs.recommended,
+  importX.configs['flat/recommended'],
+
+  {
+    plugins: {
+      'jsx-a11y': jsxA11y,
+    },
+    rules: jsxA11y.configs.recommended.rules,
+  },
+
+  n.configs['flat/recommended'],
+  n.configs['flat/recommended'],
+  promise.configs['flat/recommended'],
+  react.configs.flat.recommended,
+  reactHooks.configs.flat.recommended,
+
+  {
+    files: ['**/*.jest.js', '**/*.jest.jsx'],
+    ...jest.configs['flat/recommended'],
+  },
+
+  {
+    languageOptions: {
+      ecmaVersion: 'latest',
+      sourceType: 'module',
+      globals: {
+        ...globals.browser,
+        ...globals.commonjs,
+        ...globals.es2021,
+        ...globals.jquery,
+      },
+    },
+    settings: {
+      react: {
+        version: 'detect',
+      },
+      'import-x/core-modules': ['django'],
+      'import-x/resolver': {
+        node: {
+          extensions: ['.js', '.jsx'],
+          moduleDirectory: ['node_modules', 'node_modules/.pnpm'],
+        },
+      },
+    },
+    rules: {
+      'jsx-quotes': ['error', 'prefer-double'],
+      'jsx-a11y/no-onchange': 'off',
+      'react/prop-types': 'off',
+      'n/no-missing-require': 'off',
+      'n/no-unsupported-features/es-syntax': 'off',
+      'n/no-unsupported-features/node-builtins': 'off',
+      'n/no-missing-import': 'off',
+      'n/no-unpublished-import': 'off',
+      'n/no-extraneous-import': 'off',
+      'import-x/named': 'off',
+      'no-unused-vars': 'warn',
+      'jest/valid-title': 'off',
+      'jest/no-identical-title': 'off',
+      'jest/no-export': 'off',
+      'react-hooks/refs': 'off',
+      'no-restricted-syntax': ['error', 'TemplateLiteral'],
+    },
+  },
+
+  {
+    files: ['**/*.jest.js', '**/*.jest.jsx', '**/__mocks__/*.js'],
+    languageOptions: {
+      globals: {
+        ...globals.jest,
+      },
+    },
+  },
+
+  {
+    ignores: ['node_modules/', 'venv/'],
+  },
+]

jest.config.js → jest.config.cjs

@@ -53,7 +53,10 @@ const config = {
     '^.+\\.[t|j]sx?$': 'babel-jest'
   },
   transformIgnorePatterns: [
-    '[/\\\\]node_modules[/\\\\](?!' +
+    '[/\\\\]node_modules[/\\\\]\\.pnpm[/\\\\].+[/\\\\]node_modules[/\\\\](?!' +
+      esModules +
+      ').+\\.(js|jsx|mjs|cjs|ts|tsx)$',
+    '[/\\\\]node_modules[/\\\\](?!\\.pnpm[/\\\\])(?!' +
       esModules +
       ').+\\.(js|jsx|mjs|cjs|ts|tsx)$'
   ],