(8.1) OTOOLS-115: Remove and upgrade vulnerable dependencies

[sencha-digit]

Jira

OTOOLS-115 — Sencha ExtGen and Cmd uses library with known vulnerabilities (customer portal ticket 60478)

Findings

npm audit reported 15 vulnerabilities in packages/ext-gen (3 high) and 6 in packages/ext-build (3 high), and a freshly generated app reported 6 more (3 high), including the customer's original complaint: @sencha/ext-webpack-plugin → cross-spawn-with-kill → cross-spawn <6.0.6 (ReDoS, GHSA-3xgq-45jj-v275, "no fix available"). A Kiuwan scan additionally flagged CVE-2007-1536 — a false positive triggered by jsdevel strings inside the is-file package, a dependency of node-find-folder.

Root cause

• node-find-folder@0.1.32 (unmaintained) pulled is-file (the Kiuwan flag) and a stale glob@7 → minimatch@3.1.2 → brace-expansion@1.1.12 chain — used in exactly two files just to locate a folder named view.
• glob was declared by ext-gen but never used; uuid@^3 and underscore@^1.9/lodash ranges predated fixed releases.
• prompt-list/prompt-input/prompt-confirm are abandoned upstream; their toggle-array prototype-pollution advisories have no fixed versions.
• Generated apps had no defense against the vulnerable transitive cross-spawn pulled by @sencha/ext-webpack-plugin (separate repo).

Fix

• Removed node-find-folder from ext-gen and ext-build; replaced with a local fs-based findFolder() in both generate/viewpackage.js files (with a clear error when no view folder exists).
• Removed unused glob from ext-gen.
• Removed uuid; v4 UUIDs now come from a dependency-free crypto.randomBytes helper (works on all Node versions, including the Node 14 build machine).
• Replaced the three prompt-* packages with the maintained prompts behind a same-API shim (packages/ext-gen/prompt.js) — all 17 interactive call sites unchanged.
• Bumped cross-spawn → ^7.0.6, lodash → ^4.18.1, underscore → ^1.13.8; declared semver explicitly (previously satisfied only transitively via cross-spawn 6, which dropped it in v7 — latent breakage fixed).
• Generated-app templates: added "overrides": { "cross-spawn": "^6.0.6", "replace": { "minimatch": "^3.1.5" } } (productizes the workaround documented on the Jira ticket). webpack-dev-server stays at ^4.2.1 deliberately — wds 5/6 require Node ≥18.12/≥22.15 and would break users on Node 12–16.

Verification

• Clean reinstall + npm audit: 0 vulnerabilities in ext-build-generate-app; ext-gen and ext-build each show only 2 moderates that trace to the published @sencha/ext-build-generate-app@8.0.0 (registry copy still declares uuid@^3) — they clear automatically when the three packages publish together from this change.
• Generated a fresh app (ext-gen app -a -t moderndesktop): highs eliminated (cross-spawn@6.0.6 overridden confirmed in the tree); dev server boots and serves HTTP 200; ext-gen viewpackage settings -t basic exercises the new findFolder() and generates all files correctly; app.json gets a valid v4 uniqueId.
• Node 14.21.3 / npm 6.14.18 (build machine parity, via Docker): npm install clean with no engine errors, all changed files parse and run, prompt shim / findFolder / UUID helper verified, CLI works.

Known residual

Generated apps retain 3 moderate advisories, all one cluster: webpack-dev-server@4 + its sockjs → uuid transitives. No fix exists inside the wds 4/5 lines; clearing them requires webpack-dev-server@6, which needs Node ≥22.15. Users on Node ≥22 can opt in by bumping webpack-dev-server to ^6.0.0 in their generated app.

🤖 Generated with Claude Code