chore: Dependency updates 24/03/2026 by AshCorr · Pull Request #3352 · guardian/gateway

AshCorr · 2026-03-24T15:01:12Z

What does this change?

Updates various dependencies in Gateway to their latest versions, its been a while so theres been quite a few major dependency upgrades.

I've skipped the following dependency updates:

Typescript v6: Its way too early to upgrade to this dependency yet, we have a ton of peer dependency violations at the moment. We'll need to wait for a lot more of our dependencies to support TS6 before we can use it.
Eslint v10: See Tracking: ESLint v10 support for @guardian/eslint-config csnx#2316
@guardian/ophan-tracker-js v2.8: Being done in Update Ophan tracker library #3343
openid-client v6: Theres some breaking changes in this version that we haven't investigated yet.

How has this change been tested?

Deployed to CODE, tried creating a new account with passcode and social, signing in with passcode and social, and also deleting my account. Everything seems to be working as expected.

AshCorr · 2026-03-24T15:03:13Z

@@ -1,14 +1,10 @@
 import { writeFileSync } from 'node:fs';
-import zodToJsonSchema from 'zod-to-json-schema';


We were previously using https://github.com/StefanTerdell/zod-to-json-schema to generate the JSON schema however this dependency has been deprecated.

As of November 2025, this project will no longer be receiving updates. Zod v4 natively supports generating JSON schemas, so I recommend you switch to the new major, or better yet, a decent language ;)

Zod now supports natively generating a JSON schema so we don't need it anymore.

or we could migrate the whole thing to rust I guess

Lets finish the db migration first.

AshCorr · 2026-03-24T15:05:54Z

 const log = (...messages) => logIt(messages);
 const warn = (...messages) => logIt(messages, red);
-const prompt = (...messages) => logIt(messages, yellow);
+const localPrompt = (...messages) => logIt(messages, yellow);


As of upgrading @guardian/eslint-config it seems like the no-redeclare rule has been enabled, which now complains because prompt is an existing global in browsers

AshCorr · 2026-03-24T15:07:59Z

 					advertising, and disable the sharing of data with partners for
-					personalised advertising purposes by clicking the "Privacy settings"
-					link in the footer of every page of our site.
+					personalised advertising purposes by clicking the &quot;Privacy


As of upgrading @guardian/eslint-config it seems like the react/no-unescaped-entities rule has been enabled which requires us to escape special characters such as "

AshCorr · 2026-03-24T15:09:24Z

 		...(structuredError?.severity === 'CSRF'
 			? [
-					<p>
+					<p key={'CSRF'}>


Ditto the previous eslint comments about react/jsx-key which requires elements created in an iterator to have a key set.

AshCorr · 2026-03-24T15:10:19Z

 								return (
-									<InformationBoxText isGoogleOneTap={isGoogleOneTap}>
+									<InformationBoxText
+										key={index}


Its not recommended to use index here, but we don't have another ID that we can use for creating these elements.

AshCorr · 2026-03-24T15:12:54Z

 	margin: 0;
 `;

+const ConditionalIframeThemeWrapper = ({


Ditto the previous eslint comments, although this time about react-hooks/static-components. This rule requires us to not create React components from within a function, apparently this makes them more efficient as it doesn't have to re-render the entire component each time.

AshCorr · 2026-03-24T15:15:01Z

 	path,
 }: {
-	req: Request;
+	req: Request<{ token: string }>;


Upgrading to the latest version of @types/express introduces a change where query parameters become a string | string[] type, instead of a string type unless we specify the type of query parameters ourselves.

AshCorr · 2026-03-24T15:15:31Z

-		const { clientId, useOktaClassic } = res.locals.queryParams;
+	handleAsyncErrors(
+		async (req: Request<{ token: string }>, res: ResponseWithRequestState) => {
+			const { token: encryptedRecoveryToken } = req.params;


Theres a lot of diffs in this function, but its all indentation changes.

AshCorr · 2026-03-24T15:16:19Z

+			req: Request<{ emailType: string; data: string; token: string }>,
+			res: ResponseWithRequestState,
+		) => {
+			const { emailType, data, token } = req.params;


Again all just indentation changes in this function beyond this point.

AshCorr · 2026-03-24T15:17:01Z

 			'prefer-const': 'error',

+			// Requires some significant refactors to PasswordForm and SignedInAs components
+			'react-hooks/set-state-in-effect': 'off',


This rule got enabled when we upgraded our eslint config versions, it seems like it would take some significant refactors to comply with it though.

AshCorr · 2026-03-24T15:17:15Z

 	// but still allows us to see the issues and fix them
 	rules: {
 		binaries: 'warn',
-		classMembers: 'warn',


Knip no longer supports this option in the latest major version.

AshCorr · 2026-03-24T15:17:46Z

-	}),
+	handleAsyncErrors(
+		async (req: Request<{ token: string }>, res: ResponseWithRequestState) => {
+			const { token } = req.params;


All indentation changes in this function.

github-actions · 2026-03-24T15:30:58Z

Deploy build 11560 of `identity:identity-gateway` to CODE

All deployment options

From guardian/actions-riff-raff.

AshCorr · 2026-03-24T16:36:20Z

 		"@eslint/js": "^9.39.4",
 		"@guardian/eslint-config": "14.0.0",
 		"@guardian/prettier": "^10.0.0",
-		"@playwright/test": "^1.58.2",


For some reason the latest version of playwright can't handle intercepting redirects properly. This test hangs in the latest version of Playwright.

Its potentially related to this issue? microsoft/playwright#39823

ioannakok · 2026-03-26T09:36:29Z

+    "overrides": {
+      "minimatch@3.1.2": "3.1.4",
+      "minimatch@>=9.0.0 <9.0.7": "9.0.7",
+      "flatted@3.3.3": "3.4.2",


Perhaps remove this as well from the overrides for consistency with the other package.json?

ioannakok · 2026-03-26T09:36:45Z

🥳

AshCorr commented Mar 24, 2026

View reviewed changes

AshCorr force-pushed the ash/dependencies-24032026 branch from ca381b4 to 7be7adc Compare March 24, 2026 15:23

AshCorr added the maintenance Departmental tracking: maintenance work, not a fix or a feature label Mar 24, 2026

AshCorr force-pushed the ash/dependencies-24032026 branch from 7be7adc to 4a7ed6b Compare March 24, 2026 15:28

AshCorr added the run_tests Run Playwright & Chromatic label Mar 24, 2026

AshCorr force-pushed the ash/dependencies-24032026 branch from 4a7ed6b to 989188e Compare March 24, 2026 15:46

AshCorr added run_tests Run Playwright & Chromatic and removed run_tests Run Playwright & Chromatic labels Mar 24, 2026

AshCorr marked this pull request as ready for review March 24, 2026 15:48

AshCorr requested a review from a team as a code owner March 24, 2026 15:48

chore: Dependency updates 24/03/2026

0ff894d

AshCorr force-pushed the ash/dependencies-24032026 branch from 989188e to 0ff894d Compare March 24, 2026 15:57

AshCorr commented Mar 24, 2026

View reviewed changes

AshCorr added run_tests Run Playwright & Chromatic and removed run_tests Run Playwright & Chromatic labels Mar 24, 2026

chore: Revert Playwright upgrade

f435350

AshCorr force-pushed the ash/dependencies-24032026 branch from 6606af6 to f435350 Compare March 25, 2026 08:48

AshCorr removed the run_tests Run Playwright & Chromatic label Mar 25, 2026

AshCorr added the run_tests Run Playwright & Chromatic label Mar 25, 2026

chore: Remove override on Flatted

f6eef29

AshCorr added run_tests Run Playwright & Chromatic and removed run_tests Run Playwright & Chromatic labels Mar 25, 2026

ioannakok reviewed Mar 26, 2026

View reviewed changes

Comment thread src/client/lib/hooks/useAdFreeCookie.ts

ioannakok reviewed Mar 26, 2026

View reviewed changes

ioannakok previously approved these changes Mar 26, 2026

View reviewed changes

chore: remove flatted override in CDK

7530941

AshCorr dismissed ioannakok’s stale review via 7530941 March 26, 2026 09:44

AshCorr added run_tests Run Playwright & Chromatic and removed run_tests Run Playwright & Chromatic labels Mar 26, 2026

Merge branch 'main' into ash/dependencies-24032026

cf680ff

AshCorr added run_tests Run Playwright & Chromatic and removed run_tests Run Playwright & Chromatic labels Mar 26, 2026

ioannakok approved these changes Mar 26, 2026

View reviewed changes

AshCorr merged commit 2db6fcb into main Mar 26, 2026
34 checks passed

AshCorr deleted the ash/dependencies-24032026 branch March 26, 2026 10:28

		@@ -1,14 +1,10 @@
		import { writeFileSync } from 'node:fs';
		import zodToJsonSchema from 'zod-to-json-schema';

Uh oh!

Conversation

AshCorr commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this change?

How has this change been tested?

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AshCorr Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ioannakok commented Mar 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AshCorr commented Mar 24, 2026 •

edited

Loading

AshCorr Mar 24, 2026 •

edited

Loading

github-actions Bot commented Mar 24, 2026 •

edited

Loading