fix: deps & config (#15126)

packages/backend/server/package.json

@@ -45,27 +45,28 @@
     "@node-rs/argon2": "^2.0.2",
     "@node-rs/crc32": "^1.10.6",
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/core": "^2.7.1",
-    "@opentelemetry/exporter-prometheus": "^0.218.0",
-    "@opentelemetry/exporter-zipkin": "^2.7.1",
-    "@opentelemetry/host-metrics": "^0.38.3",
-    "@opentelemetry/instrumentation": "^0.218.0",
-    "@opentelemetry/instrumentation-graphql": "^0.66.0",
-    "@opentelemetry/instrumentation-http": "^0.218.0",
-    "@opentelemetry/instrumentation-ioredis": "^0.66.0",
-    "@opentelemetry/instrumentation-nestjs-core": "^0.64.0",
-    "@opentelemetry/instrumentation-socket.io": "^0.65.0",
-    "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-metrics": "^2.7.1",
-    "@opentelemetry/sdk-node": "^0.218.0",
-    "@opentelemetry/sdk-trace-node": "^2.7.1",
-    "@opentelemetry/semantic-conventions": "^1.38.0",
+    "@opentelemetry/core": "^2.8.0",
+    "@opentelemetry/exporter-prometheus": "^0.219.0",
+    "@opentelemetry/exporter-zipkin": "^2.8.0",
+    "@opentelemetry/host-metrics": "^0.39.0",
+    "@opentelemetry/instrumentation": "^0.219.0",
+    "@opentelemetry/instrumentation-graphql": "^0.67.0",
+    "@opentelemetry/instrumentation-http": "^0.219.0",
+    "@opentelemetry/instrumentation-ioredis": "^0.67.0",
+    "@opentelemetry/instrumentation-nestjs-core": "^0.65.0",
+    "@opentelemetry/instrumentation-socket.io": "^0.66.0",
+    "@opentelemetry/resources": "^2.8.0",
+    "@opentelemetry/sdk-metrics": "^2.8.0",
+    "@opentelemetry/sdk-node": "^0.219.0",
+    "@opentelemetry/sdk-trace-base": "^2.8.0",
+    "@opentelemetry/sdk-trace-node": "^2.8.0",
+    "@opentelemetry/semantic-conventions": "^1.41.1",
     "@prisma/client": "^6.6.0",
     "@prisma/instrumentation": "^6.7.0",
     "@queuedash/api": "^3.16.0",
     "@react-email/components": "^0.5.7",
     "@socket.io/redis-adapter": "^8.3.0",
-    "bullmq": "5.77.6",
+    "bullmq": "^5.79.0",
     "commander": "^13.1.0",
     "cookie-parser": "^1.4.7",
     "cross-env": "^10.1.0",
@@ -83,7 +84,7 @@
     "html-validate": "^9.0.0",
     "htmlrewriter": "^0.0.12",
     "http-errors": "^2.0.0",
-    "ioredis": "^5.8.2",
+    "ioredis": "^5.11.1",
     "is-mobile": "^5.0.0",
     "jose": "^6.1.3",
     "jsonwebtoken": "^9.0.3",

packages/frontend/core/src/modules/code-block-preview-renderer/bridge.spec.ts

@@ -1,3 +1,6 @@
+/**
+ * @vitest-environment happy-dom
+ */
 import { beforeEach, describe, expect, test, vi } from 'vitest';
 
 const { mermaidRender, typstRender } = vi.hoisted(() => ({
@@ -5,14 +8,30 @@ const { mermaidRender, typstRender } = vi.hoisted(() => ({
   typstRender: vi.fn(),
 }));
 
-const { domPurifySanitize } = vi.hoisted(() => ({
-  domPurifySanitize: vi.fn((value: unknown) => {
+const { domPurifySanitize, sanitizeSvgForMock } = vi.hoisted(() => {
+  const sanitizeSvgForMock = (value: unknown) => {
     if (typeof value !== 'string') {
       return '';
     }
-    return value.replace(/<script[\s\S]*?<\/script>/gi, '');
-  }),
-}));
+    if (
+      typeof DOMParser === 'undefined' ||
+      typeof XMLSerializer === 'undefined'
+    ) {
+      return value;
+    }
+
+    const doc = new DOMParser().parseFromString(value, 'image/svg+xml');
+    doc.querySelectorAll('script').forEach(element => {
+      element.remove();
+    });
+    return new XMLSerializer().serializeToString(doc.documentElement);
+  };
+
+  return {
+    domPurifySanitize: vi.fn(sanitizeSvgForMock),
+    sanitizeSvgForMock,
+  };
+});
 
 vi.mock(
   '@affine/core/modules/code-block-preview-renderer/platform-backend',
@@ -33,12 +52,7 @@ import { renderMermaidSvg, renderTypstSvg, sanitizeSvg } from './bridge';
 describe('preview render bridge', () => {
   beforeEach(() => {
     vi.clearAllMocks();
-    domPurifySanitize.mockImplementation((value: unknown) => {
-      if (typeof value !== 'string') {
-        return '';
-      }
-      return value.replace(/<script[\s\S]*?<\/script>/gi, '');
-    });
+    domPurifySanitize.mockImplementation(sanitizeSvgForMock);
   });
 
   test('uses worker renderers and sanitizes preview svg output', async () => {

packages/frontend/media-capture-playground/package.json

@@ -21,7 +21,7 @@
     "express-rate-limit": "^7.1.5",
     "fs-extra": "^11.3.0",
     "lodash-es": "^4.17.23",
-    "multer": "^2.0.2",
+    "multer": "^2.2.0",
     "react": "^19.2.1",
     "react-dom": "^19.2.1",
     "react-markdown": "^10.1.0",