Dedupe & update idp service JS dependencies

[pascalwengerter]

Description

1. pnpm dedupe — removed 35 duplicate packages
2. pnpm update — updated all direct dependencies within semver ranges (axios, i18next, typescript, @babel/core, etc.)
3. Added pnpm.overrides for serialize-javascript@<7.0.3 → >=7.0.3 to fix the high-severity RCE vulnerability in transitive deps of css-minimizer-webpack-plugin and workbox-webpack-plugin

Related Issue

• Fixes Address dependabot alert for services/idp #2460

[rhafer]

@pascalwengerter the licensechecker is failing with:

Package "i18next-conv@15.1.2" is licensed under "Custom: LICENSE.MD" which is not permitted by the --onlyAllow flag. Exiting.

I guess it's just a matter of updating services/idp/license-checker-clarifications.json with the new version number.

[pascalwengerter]

@pascalwengerter the licensechecker is failing with:

Package "i18next-conv@15.1.2" is licensed under "Custom: LICENSE.MD" which is not permitted by the --onlyAllow flag. Exiting.

I guess it's just a matter of updating services/idp/license-checker-clarifications.json with the new version number.

@rhafer thanks for the swift reply, addressed that and found another JS-related improvement 🤓

[rhafer]

Small note about the used image. Looks good otherwise.

[rhafer]

Good catch. I think we should switch to "quay.io/opencloudeu/nodejs-ci:24" though. (That is also what we use in the builds steps in CI)

[rhafer]

@pascalwengerter Sorry for the inconvenience, but I think you need to rebase the PR on top of latest main once more. We added some change regarding branch protection to the CI recently that prevent this PR from being merged. A rebase should fix that.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pascalwengerter]

@pascalwengerter Sorry for the inconvenience, but I think you need to rebase the PR on top of latest main once more. We added some change regarding branch protection to the CI recently that prevent this PR from being merged. A rebase should fix that.

@rhafer no problem, could've rebased before adding the comment earlier. Done so now