ci: Update runner to ubuntu-24.04

.github/workflows/development.yml

@@ -24,20 +24,20 @@ defaults:
 
 jobs:
   lint:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Cache .npm
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('./package-lock.json') }}
           restore-keys: ${{ runner.os }}-npm
 
       - name: Setup Node.js 14
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
           node-version: "14"
 
@@ -54,13 +54,13 @@ jobs:
         run: npm run --silent tsc
 
   test:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Cache .npm
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('./package-lock.json') }}
@@ -78,13 +78,13 @@ jobs:
         run: npm run --silent test -- --passWithNoTests
 
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Cache .npm
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('./package-lock.json') }}
@@ -99,7 +99,7 @@ jobs:
         run: npm ci
 
       - name: Cache node_modules/.cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: ./node_modules/.cache
           key: ${{ runner.os }}-build-cache
@@ -112,7 +112,7 @@ jobs:
           PUBLIC_URL: ${{ github.event_name == 'pull_request' && format('/PR-{0}', github.event.number) || '' }}
 
       - name: Save build artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
           path: web/build
           name: build.zip
@@ -126,7 +126,7 @@ jobs:
   #       working-directory: ./infrastructure
   #   steps:
   #     - name: Checkout code
-  #       uses: actions/checkout@v2
+  #       uses: actions/checkout@v4
 
   #     - name: Install terraform 1.0.0
   #       uses: hashicorp/setup-terraform@v1
@@ -144,26 +144,26 @@ jobs:
 
   deploy:
     if: github.event_name == 'pull_request' || github.ref == 'refs/heads/master'
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     needs: [build]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       # - name: Install terraform 1.0.0
       #   uses: hashicorp/setup-terraform@v1
       #   with:
       #     terraform_version: 1.0.0
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v4
         with:
           aws-access-key-id: ${{ secrets.DEVELOPMENT_AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.DEVELOPMENT_AWS_SECRET_ACCESS_KEY }}
           aws-region: eu-west-1
 
       - name: Download build artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v4
         with:
           name: build.zip
           path: web/build
@@ -236,4 +236,4 @@ jobs:
               )
               if (existingComment) return
             }
-            github.issues.createComment({ owner, repo, issue_number, body });
+            github.issues.createComment({ owner, repo, issue_number, body });

.github/workflows/pr_cleanup.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   cleanup:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v1
@@ -19,4 +19,4 @@ jobs:
         run: |
           aws s3 rm \
             --recursive \
-            's3://email-footer-template-app/PR-${{ github.event.number }}'
+            's3://email-footer-template-app/PR-${{ github.event.number }}'

web/.audit-ci.js

@@ -3,6 +3,17 @@ module.exports = {
   low: true,
   "report-type": "summary",
   allowlist: [
-    565, 1674, 1677, 1693, 1745, 1747, 1748, 1751, 1753
+    // Legacy vulnerabilities
+    565, 1674, 1677, 1693, 1745, 1747, 1748, 1751, 1753,
+    // Remaining vulnerabilities that cannot be fixed without breaking changes
+    1094544, // PostCSS line return parsing error - dev dependency
+    1095100, // Uncontrolled Resource Consumption in trim-newlines - dev dependency
+    1095141, // Inefficient Regular Expression Complexity in nth-check - dev dependency
+    1096727, // Server-Side Request Forgery in Request - deprecated legacy package
+    1097682, // tough-cookie Prototype Pollution vulnerability - no fix available
+    1098094, // Uncontrolled resource consumption in braces - dev dependency
+    1098681, // Regular Expression Denial of Service (ReDoS) in micromatch - dev dependency
+    1105256, // webpack-dev-server source code theft vulnerability - dev dependency
+    1105257  // webpack-dev-server source code theft vulnerability - dev dependency
   ]
 };