fix: resolve E2E test dependency graph failures

[noce-nick]

Summary

• Correct the Turborepo dependency graph so E2E runtime applications and generated workspace artifacts build in the required order.
• Align React workspace dependencies and security-related dependency overrides.
• Pin the Azure Storage Queue dependency in the workspace catalog.

Verification

• pnpm run test:e2e
• pnpm run test:acceptance
• pnpm run test:coverage
• pnpm run build
• pnpm run audit

Summary by Sourcery

Resolve E2E build dependency graph issues and align workspace dependencies with updated, secure catalog versions, including new Azure Storage Queue catalog entry and React stack upgrades.

Bug Fixes:

• Ensure staff role repository tests compare IDs as strings to match Mongoose document behavior.
• Fix Turborepo workspace configuration so E2E, mock servers, and queue storage apps build and run in the correct dependency order.

Enhancements:

• Align React and React DOM workspace dependencies to the shared catalog versions.
• Update vitest, React Router DOM, axios, and several other shared dependencies and overrides to newer, audited versions.
• Add Azure Storage Queue to the workspace catalog and consume it via catalog in the service queue storage package.

Build:

• Adjust Turborepo config across multiple apps and packages to correct the dependency graph for E2E and runtime builds.

Tests:

• Update test mocks in the staff role repository tests to reflect the current Mongoose ID type handling.

Chores:

• Update audit configuration to defer remediation for a React Router 7.x advisory until the planned v8 migration.
• Refresh pnpm lockfile, Snyk configuration, and dependency overrides to align with updated security baselines.

• Resolves CVE-2026-42334 — Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection

[sourcery-ai]

Reviewer's Guide

Aligns workspace dependency catalog/overrides, centralizes React and Azure Storage Queue versions, and fixes E2E/turbo build graph plus a staff-role repository test to resolve dependency graph and runtime issues.

Flow diagram for corrected Turbo E2E build dependency graph

flowchart TD
  subgraph Core_services
    server_mongodb_memory_mock[server-mongodb-memory-mock]
    server_oauth2_mock[server-oauth2-mock]
    service_queue_storage[ocom service-queue-storage]
  end

  e2e_tests[ocom-verification e2e-tests]

  server_mongodb_memory_mock --> e2e_tests
  server_oauth2_mock --> e2e_tests
  service_queue_storage --> e2e_tests

  e2e_tests --> acceptance_ui_build[acceptance UI build/tests]

Loading

File-Level Changes

Change	Details	Files
Update shared catalog and overrides to new vetted dependency versions and add security-related audit metadata.	Bump Vitest-related packages in catalog and overrides from 4.1.8 to 4.1.10. Upgrade mongoose, react-router-dom, react, and react-dom in the catalog to newer compatible versions. Relax and bump versions for axios, postcss, svgo, brace-expansion, ip-address, fast-uri, websocket-driver and several other libraries in overrides. Add @azure/storage-queue to the catalog and include new @opentelemetry/propagator-jaeger override. Extend auditConfig ignore list with a react-router 7.x advisory to be handled after v8 migration.	pnpm-workspace.yaml pnpm-lock.yaml
Standardize React and Azure Storage Queue usage across workspaces by sourcing from the shared catalog.	Switch acceptance UI React and React DOM dependencies to use "catalog:" instead of local version pins. Update serenity framework devDependency on React to use "catalog:". Change service-queue-storage to depend on @azure/storage-queue via "catalog:". Update ui-core to depend on React, React DOM, and React Router DOM via "catalog:".	packages/ocom-verification/acceptance-ui/package.json packages/cellix/serenity-framework/package.json packages/cellix/service-queue-storage/package.json packages/cellix/ui-core/package.json
Fix staff-role repository test to correctly handle stringified MongoDB document IDs.	Adjust ModelMock.findById test stub to compare against String(staffRoleDoc._id) rather than the raw _id value.	packages/ocom/persistence/src/datasources/domain/user/staff-role/staff-role.repository.test.ts
Align turbo build/test pipelines with the corrected dependency graph for E2E and mock apps.	Update turbo.json configurations for mongodb-memory and oauth2 mock apps, E2E tests, and queue-storage app to reflect new dependency ordering and pipeline requirements.	apps/server-mongodb-memory-mock/turbo.json apps/server-oauth2-mock/turbo.json packages/ocom-verification/e2e-tests/turbo.json packages/ocom/service-queue-storage/turbo.json
Synchronize Snyk configuration with the refreshed dependency set and security fixes.	Update .snyk policy to reflect new dependency versions and security posture, including the Mongoose CVE remediation mentioned in the PR description.	.snyk

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

Fixed security issues:

• @opentelemetry/propagator-jaeger (link)

• @vitest/browser (link)

• axios (link)

• fast-uri (link)

• mongoose (link) · Dashboard

• postcss (link)

• react-router (link)

• svgo (link)

• websocket-driver (link)

• React and react-dom are now sourced from the catalog in several packages; consider standardizing remaining packages that still pin React versions directly to "catalog:" for consistency and easier central version management.

• The updated staff-role.repository test now uses String(staffRoleDoc._id) for ID comparison; if _id can be a non-primitive (e.g., ObjectId), consider normalizing via toString() or adjusting the mock type to avoid subtle mismatches between test and runtime behavior.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- React and react-dom are now sourced from the catalog in several packages; consider standardizing remaining packages that still pin React versions directly to "catalog:" for consistency and easier central version management.
- The updated staff-role.repository test now uses String(staffRoleDoc._id) for ID comparison; if _id can be a non-primitive (e.g., ObjectId), consider normalizing via toString() or adjusting the mock type to avoid subtle mismatches between test and runtime behavior.

## Individual Comments

### Comment 1
<location path="pnpm-workspace.yaml" line_range="141" />
<code_context>
   immutable: 3.8.3
   launch-editor: ^2.14.1
-  'react-router-dom@7.15.0>react-router': 7.15.1
+  'react-router-dom@7.18.0>react-router': 8.3.0
   sequelize: 6.37.8
   smol-toml: 1.6.1
</code_context>
<issue_to_address>
**issue (bug_risk):** Mapping react-router-dom 7.18.0 to react-router 8.3.0 may create version skew and potential runtime issues.

`react-router-dom` 7.x is designed to work with `react-router` 7.x. Pinning `react-router` 8.3.0 under `react-router-dom@7.18.0` may introduce subtle incompatibilities if peer requirements don’t match. Consider keeping them on the same major unless this pairing has been explicitly tested and verified.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[noce-nick]

@sourcery-ai review

[sourcery-ai]

Hey - I've left some high level feedback:

Fixed security issues:

• @opentelemetry/propagator-jaeger (link)

• @vitest/browser (link)

• axios (link)

• fast-uri (link)

• mongoose (link) · Dashboard

• postcss (link)

• react-router (link)

• svgo (link)

• websocket-driver (link)

• Now that React and react-dom are sourced from the catalog in several workspaces, consider also centralizing related typings (e.g. @types/react) and any remaining direct React version pins to avoid subtle version drift across packages.

• You’ve moved @azure/storage-queue to the catalog; review other Azure client libraries in the workspace (e.g. @azure/identity, @azure/storage-blob) for similar catalog usage to keep cross-service versions aligned and simplify future upgrades.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Now that React and react-dom are sourced from the catalog in several workspaces, consider also centralizing related typings (e.g. @types/react) and any remaining direct React version pins to avoid subtle version drift across packages.
- You’ve moved @azure/storage-queue to the catalog; review other Azure client libraries in the workspace (e.g. @azure/identity, @azure/storage-blob) for similar catalog usage to keep cross-service versions aligned and simplify future upgrades.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}