fix(root): resolve high @faker-js/faker vulnerability fixes NV-8815

apps/api/migrations/encrypt-api-keys/encrypt-api-keys-migration.spec.ts

@@ -4,7 +4,7 @@
 import { ChannelTypeEnum } from '@novu/stateless';
 import { UserSession } from '@novu/testing';
 import { expect } from 'chai';
 import { createHash } from 'crypto';
 
 import { encryptApiKeysMigration } from './encrypt-api-keys-migration';
 
@@ -30,8 +30,8 @@
 
     for (let i = 0; i < 2; i += 1) {
       await environmentRepository.create({
         identifier: 'identifier' + i,
-        name: faker.name.jobTitle(),
+        name: faker.person.jobTitle(),
         _organizationId: session.organization._id,
         apiKeys: [
           {
@@ -75,7 +75,7 @@
   it('should validate migration idempotence', async () => {
     await pruneIntegration({ environmentRepository });
 
     const data = {
       providerId: 'sendgrid',
       channel: ChannelTypeEnum.EMAIL,
       active: false,
@@ -83,8 +83,8 @@
 
     for (let i = 0; i < 2; i += 1) {
       await environmentRepository.create({
         identifier: 'identifier' + i,
-        name: faker.name.jobTitle(),
+        name: faker.person.jobTitle(),
         _organizationId: session.organization._id,
         apiKeys: [
           {

apps/api/package.json

@@ -151,7 +151,7 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "devDependencies": {
-    "@faker-js/faker": "^6.0.0",
+    "@faker-js/faker": "^10.5.0",
     "@nestjs/cli": "11.0.23",
     "@nestjs/schematics": "11.1.0",
     "@nestjs/testing": "11.1.27",

apps/api/src/app/subscribers/unit/update-subscriber-channel.spec.ts

@@ -424,11 +424,11 @@
 
   it('should update deviceTokens without duplication on channel creation (addChannelToSubscriber)', async () => {
     const subscriberId = SubscriberRepository.createObjectId();
     const test = await subscriberRepository.create({
-      firstName: faker.name.firstName(),
-      lastName: faker.name.lastName(),
+      firstName: faker.person.firstName(),
+      lastName: faker.person.lastName(),
       email: faker.internet.email(),
-      phone: faker.phone.phoneNumber(),
+      phone: faker.phone.number(),
       _environmentId: session.environment._id,
       _organizationId: session.organization._id,
       subscriberId,

apps/dashboard/package.json

@@ -166,7 +166,7 @@
     "@clerk/backend": "^3.4.11",
     "@clerk/shared": "^4.23.0",
     "@clerk/testing": "^2.0.31",
-    "@faker-js/faker": "^9.5.0",
+    "@faker-js/faker": "^10.5.0",
     "@hookform/devtools": "^4.3.0",
     "@novu/dal": "workspace:*",
     "@novu/ee-auth": "workspace:*",

apps/dashboard/tests/utils/environment-service.ts

@@ -1,9 +1,9 @@
 import { faker } from '@faker-js/faker';
 import { EnvironmentEntity, EnvironmentRepository, LayoutRepository, NotificationGroupRepository } from '@novu/dal';
 import { createHash } from 'crypto';
 
 export class EnvironmentService {
   constructor() {}
 
   private async createEnvironment(
     organizationId: string,
@@ -18,7 +18,7 @@
 
     return await environmentRepository.create({
       identifier: faker.string.uuid(),
-      name: name ?? faker.name.jobTitle(),
+      name: name ?? faker.person.jobTitle(),
       _organizationId: organizationId,
       ...(parentId && { _parentId: parentId }),
       apiKeys: [
@@ -47,7 +47,7 @@
 
     const environment = await this.createEnvironment(organizationId, userId, name, parentId);
 
     let parentGroup;
 
     if (parentId) {
       parentGroup = await notificationGroupRepository.findOne({

apps/worker/package.json

@@ -70,7 +70,7 @@
     "uuid": "^11.1.1"
   },
   "devDependencies": {
-    "@faker-js/faker": "^6.0.0",
+    "@faker-js/faker": "^10.5.0",
     "@nestjs/cli": "11.0.23",
     "@nestjs/schematics": "11.1.0",
     "@nestjs/testing": "11.1.27",

apps/worker/src/app/workflow/services/standard.worker.spec.ts

@@ -36,7 +36,7 @@
 } from '@novu/testing';
 import { expect } from 'chai';
 import { formatISO } from 'date-fns';
 import { setTimeout } from 'timers/promises';
 import { v4 as uuid } from 'uuid';
 import { SharedModule } from '../../shared/shared.module';
 import { HandleLastFailedJob, RunJob, RunJobCommand, SetJobAsFailed, WebhookFilterBackoffStrategy } from '../usecases';
@@ -46,36 +46,36 @@
 let standardQueueService: StandardQueueService;
 let standardWorker: StandardWorker;
 
 const mockFeatureFlagsService = {
   getFlag: async () => false,
 } as unknown as FeatureFlagsService;
 
 const mockOrganizationRepository = {
   findOne: async () => ({ _id: 'mock-org-id', apiServiceLevel: 'free' }),
 } as unknown as CommunityOrganizationRepository;
 
 const mockSqsService = {
   getQueueUrl: () => undefined,
   getProducer: () => undefined,
   getClient: () => ({}) as any,
   isConfigured: () => false,
   send: async () => {},
   sendBulk: async () => {},
 } as unknown as SqsService;
 
 const mockLogger = {
   setContext: () => {},
   debug: () => {},
   info: () => {},
   warn: () => {},
   error: () => {},
 } as unknown as PinoLogger;
 
 const mockSchedulerService = {
   isConfigured: () => false,
   createDelayedFire: async () => {},
   deleteSchedule: async () => {},
 } as unknown as EventBridgeSchedulerService;
 
 describe('Standard Worker', () => {
   let jobRepository: JobRepository;
@@ -102,13 +102,13 @@
     const userService = new UserService();
 
     const card = {
-      firstName: faker.name.firstName(),
-      lastName: faker.name.lastName(),
+      firstName: faker.person.firstName(),
+      lastName: faker.person.lastName(),
     };
     const userEntity: Partial<UserEntity> = {
       lastName: card.lastName,
       firstName: card.firstName,
-      email: `${card.firstName}_${card.lastName}_${faker.datatype.uuid()}@gmail.com`.toLowerCase(),
+      email: `${card.firstName}_${card.lastName}_${faker.string.uuid()}@gmail.com`.toLowerCase(),
       profilePicture: `https://randomuser.me/api/portraits/men/${Math.floor(Math.random() * 60) + 1}.jpg`,
       tokens: [],
       password: 'asd#Faf4fd',
@@ -557,7 +557,7 @@
       }) as typeof originalClearInterval;
 
       // Force the first post-claim operation of RunJob.execute to fail.
       const stepRunRepository = Reflect.get(runJob, 'stepRunRepository') as {
         create: (...createArgs: unknown[]) => Promise<unknown>;
       };
       const originalCreate = stepRunRepository.create;

libs/dal/package.json

@@ -26,7 +26,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.382.0",
     "@aws-sdk/s3-request-presigner": "^3.382.0",
-    "@faker-js/faker": "^6.0.0",
+    "@faker-js/faker": "^10.5.0",
     "@novu/shared": "workspace:*",
     "class-transformer": "0.5.1",
     "cross-fetch": "^3.0.4",

libs/testing/package.json

@@ -23,7 +23,7 @@
   "dependencies": {
     "@clerk/backend": "^3.4.11",
     "@clerk/shared": "^4.12.2",
-    "@faker-js/faker": "^6.0.0",
+    "@faker-js/faker": "^10.5.0",
     "@novu/dal": "workspace:*",
     "@novu/shared": "workspace:*",
     "JSONStream": "^1.3.5",

libs/testing/src/environment.service.ts

@@ -1,7 +1,7 @@
 import { faker } from '@faker-js/faker';
 import { EnvironmentEntity, EnvironmentRepository } from '@novu/dal';
 import { IApiRateLimitMaximum } from '@novu/shared';
 import { createHash } from 'crypto';
 import { v4 as uuid } from 'uuid';
 
 enum EnvironmentsEnum {
@@ -23,7 +23,7 @@
 
     return await this.environmentRepository.create({
       identifier: uuid(),
-      name: name ?? faker.name.jobTitle(),
+      name: name ?? faker.person.jobTitle(),
       _organizationId: organizationId,
       ...(parentId && { _parentId: parentId }),
       apiKeys: [

libs/testing/src/notification-template.service.ts

@@ -162,7 +162,7 @@ export class NotificationTemplateService {
     const data = {
       _notificationGroupId: override.noGroupId ? undefined : groups[0]._id,
       _environmentId: this.environmentId,
-      name: override.name ?? faker.name.jobTitle(),
+      name: override.name ?? faker.person.jobTitle(),
       _organizationId: this.organizationId,
       _creatorId: this.userId,
       active: true,
@@ -172,7 +172,7 @@ export class NotificationTemplateService {
       description: faker.commerce.productDescription().slice(0, 90),
       triggers: override.triggers ?? [
         {
-          identifier: `test-event-${faker.datatype.uuid()}`,
+          identifier: `test-event-${faker.string.uuid()}`,
           type: 'event',
           variables: [{ name: 'firstName' }, { name: 'lastName' }, { name: 'urlVariable' }],
         },

libs/testing/src/organization.service.ts

@@ -10,14 +10,14 @@ export class OrganizationService {
     if (options) {
       return await this.organizationRepository.create({
         logo: faker.image.avatar(),
-        name: faker.company.companyName(),
+        name: faker.company.name(),
         ...options,
       });
     }
 
     return await this.organizationRepository.create({
       logo: faker.image.avatar(),
-      name: faker.company.companyName(),
+      name: faker.company.name(),
     });
   }
 

libs/testing/src/subscribers.service.ts

@@ -37,10 +37,10 @@ export class SubscribersService {
     }
 
     return await this.subscriberRepository.create({
-      lastName: faker.name.lastName(),
-      firstName: faker.name.firstName(),
+      lastName: faker.person.lastName(),
+      firstName: faker.person.firstName(),
       email: faker.internet.email(),
-      phone: faker.phone.phoneNumber(),
+      phone: faker.phone.number(),
       _environmentId: this._environmentId,
       _organizationId: this._organizationId,
       subscriberId: SubscriberRepository.createObjectId(),

libs/testing/src/user.service.ts

@@ -14,8 +14,8 @@ export class UserService {
   async createTestUser(): Promise<UserEntity> {
     const user = await this.createUser({
       email: this.randomEmail(),
-      firstName: faker.name.firstName(),
-      lastName: faker.name.lastName(),
+      firstName: faker.person.firstName(),
+      lastName: faker.person.lastName(),
       password: this.testPassword(),
     });
 
@@ -34,8 +34,8 @@ export class UserService {
 
     const user = await this.userRepository.create({
       email: normalizeEmail(userEntity?.email ?? faker.internet.email()),
-      firstName: userEntity?.firstName ?? faker.name.firstName(),
-      lastName: userEntity?.lastName ?? faker.name.lastName(),
+      firstName: userEntity?.firstName ?? faker.person.firstName(),
+      lastName: userEntity?.lastName ?? faker.person.lastName(),
       password: passwordHash,
       profilePicture: `https://randomuser.me/api/portraits/men/${Math.floor(Math.random() * 60) + 1}.jpg`,
       tokens: [],

libs/testing/src/user.session.ts

@@ -108,15 +108,15 @@
 
   private async initializeCommunity(options: UserSessionOptions = {}) {
     const card = {
-      firstName: faker.name.firstName(),
-      lastName: faker.name.lastName(),
+      firstName: faker.person.firstName(),
+      lastName: faker.person.lastName(),
     };
 
     const userService = new UserService();
     const userEntity: Partial<UserEntity> = {
       lastName: card.lastName,
       firstName: card.firstName,
-      email: `${card.firstName}_${card.lastName}_${faker.datatype.uuid()}@gmail.com`.toLowerCase(),
+      email: `${card.firstName}_${card.lastName}_${faker.string.uuid()}@gmail.com`.toLowerCase(),
       profilePicture: `https://randomuser.me/api/portraits/men/${Math.floor(Math.random() * 60) + 1}.jpg`,
       tokens: [],
       password: TEST_USER_PASSWORD,
@@ -307,7 +307,7 @@
       parentId
     );
 
     let parentGroup;
     if (parentId) {
       parentGroup = await this.notificationGroupRepository.findOne({
         _environmentId: parentId,
@@ -390,7 +390,7 @@
     try {
       // is not linked
       this.organization = await organizationService.createOrganization(orgId);
     } catch (e) {
       // is already linked
       this.organization = (await organizationService.getOrganization(orgId)) as OrganizationEntity;
     }

libs/testing/src/workflow-override.service.ts

@@ -21,7 +21,7 @@ export class WorkflowOverrideService {
     const tenant = await this.tenantRepository.create({
       _organizationId: organizationId,
       _environmentId: environmentId,
-      identifier: faker.datatype.uuid(),
+      identifier: faker.string.uuid(),
       name: 'name_123',
       data: { test1: 'test value1', test2: 'test value2' },
     });