chore(#9759): uplift dependency versions

[jkuester]

Description

Docs PR: medic/cht-docs#1754

Package changes

Changed @tsconfig/node20 to @tsconfig/node22

Targeting our current node version. Updated the cht-datasource tsconfig.json.

Added q as a dev-dependency in admin

This was needed for the unit tests which were piggy-backing on q in the root node_modules. This broke, though, because I guess q was no longer getting pulled in transitively.

Removed diff

It was added in this commit, but I cannot figure out where it was ever being used... 🤔

Major version bumps

@faker-js/faker - 8 > 9

Checked migration guide. Nothing concerning as long as we are not using any deprecated functions.

@types/node 20 > 22

Should be safe as Node 22 is now our base version.

cht-conf 3 > 4

Just dropping support for Node < 18.

inquirer 9 > 12

We do not seem to be affected by any breaking changes:

• https://github.com/SBoudrias/Inquirer.js/releases/tag/inquirer%4010.0.0
• https://github.com/SBoudrias/Inquirer.js/releases/tag/inquirer%4011.0.0
• https://github.com/SBoudrias/Inquirer.js/releases/tag/inquirer%4012.0.0

mocha 10 > 11

Just dropping support for older Node versions.

node-html-parser 6 > 7

Now targeting es6. Should not impact us since this is only used in api.

nyc 15 > 17

Just dropping support for older Node versions.

rate-limiter-flexible 3 > 5

Just dropping support for older Node versions:

• https://github.com/animir/node-rate-limiter-flexible/releases/tag/v4.0.0
• https://github.com/animir/node-rate-limiter-flexible/releases/tag/v5.0.0

shellcheck 2 > 3

Just dropping support for older Node versions.

uuid 8 > 10

Mostly just dropping support for old Node versions.

• https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md#900-2022-09-05
• https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md#1000-2024-06-07

There are issues with going to version 11+. Have logged #9769

sinon 16 > 18

Just dropping support for old Node versions and removing some deprecated code that does not affect us.

We will need to do some migration work to get to 19+, so I have logged #9768

helmet 3 > 8

Not super clear why we were so behind on this one. Helmet 4 changed some things, but none of those seem to affect us (at least not anymore).

• https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md#400---2020-08-02
• https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md#500---2022-01-02
• https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md#600---2022-08-26
• https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md#700---2023-05-06
• https://github.com/helmetjs/helmet/blob/main/CHANGELOG.md#800

Code review checklist

• Backwards compatible: Works with existing data and configuration or includes a migration. Any breaking changes documented in the release notes.

License

The software is provided under AGPL-3.0. Contributions to this project are accepted under the same license.

[jkuester]

@dianabarsan can you look at this when you have some time? Mostly it is straightforward, but you might pay special attention to:

• helmet - not sure why we were so far behind (maybe we used to use features that broke in 4.x). But as things are now, I don't see anything preventing us from upgrading. Anyway, an upgrade seems less risky than just staying on the super old version....
• select2 - In webapp we had this pinned to 4.0.3 with warnings in the docs to not upgrade this. However, everything seemed to work fine for me when I bumped this to 4.0.13. 🤷 (I did spend a bunch of time tinkering with different versions of jquery, but ended up having to leave that one at 3.5.1 since that was the only version that worked for both select2 and enketo-core.... When we update to the latest enketo version, we should be able to bump to jquery 3.7 since that should fix the select2 issue.)

[dianabarsan]

Really appreciate you doing this work!