deps: [M3-9471] - Clean up unnecessary package resolutions

[bill-akamai]

Description 📝

This PR removes unnecessary package resolutions from the root package.json. After checking each resolution with pnpm why -r, the cookie and nanoid packages are now naturally resolving to newer versions. node-fetch, yaml, and semver still use dependencies that rely on outdated versions, so those resolutions are being retained for now.

🗑️ Resolutions removed:

cookie pinned version: ^0.7.0

Packages are resolving to 0.7.2

Relevant PR(s):

• deps: [M3-8782] - Patch cookie version #11434

Dependabot alert(s):

• https://github.com/linode/manager/security/dependabot/131

Jira ticket(s):

• https://jira.linode.com/browse/M3-8782

---

nanoid pinned version: ^3.3.8

Packages are resolving to 3.3.11

Relevant PR(s):

• deps: [M3-9082, M3-9083] - Dependabot Fixes #11510

Dependabot alert(s):

• https://github.com/linode/manager/security/dependabot/137

Jira ticket(s):

• https://jira.linode.com/browse/M3-9083

---

📌 Resolutions still needed:

node-fetch pinned version: ^2.6.7

recompose 0.30.0
└─┬ fbjs 0.8.18
  └─┬ isomorphic-fetch 2.2.1
    └── node-fetch 1.7.3

Relevant PR(s):

• Update dependencies to address Dependabot alerts #7014
• Fixes StackScript Create UI following MUI v5 Changes #8696

Dependabot alert(s):

• There's been several over the years: https://github.com/linode/manager/pulls?q=is%3Apr+is%3Aclosed+author%3Aapp%2Fdependabot+node-fetch

Jira ticket(s):

• No associated Jira tickets found

---

yaml pinned version: ^2.3.0

@emotion/react 11.13.5
└─┬ @emotion/babel-plugin 11.13.5
  └─┬ babel-plugin-macros 3.1.0
    └─┬ cosmiconfig 7.1.0
      └── yaml 1.10.2

Relevant PR(s):

• chore: Resolve yaml dependabot alert CVE-2023-2251 #9156

Dependabot alert(s):

• GHSA-f9xv-q969-pqx4

Jira ticket(s):

• No associated Jira tickets found

---

semver pinned version: ^7.5.2

eslint-plugin-react 7.37.4
└── semver 6.3.1

Relevant PR(s):

• chore: Resolve open dependabot alerts and clean up packages #9425

Dependabot alert(s):

• https://github.com/linode/manager/security/dependabot/79

Jira ticket(s):

• No associated Jira tickets found

---

Changes 🔄

• Removed 2 package resolutions from package.json (cookie and nanoid)

Verification steps

• Fully reset dependencies with pnpm clean && pnpm install && pnpm bootstrap
• Run pnpm why -r cookie and pnpm why -r nanoid to ensure they're resolving to versions higher than those previously pinned
• Make sure app works! Build it, look for any errors, check unit tests, etc.

Author Checklists

As an Author, to speed up the review process, I considered 🤔

👀 Doing a self review
❔ Our contribution guidelines
🤏 Splitting feature into small PRs
➕ Adding a changeset
🧪 Providing/improving test coverage
🔐 Removing all sensitive information from the code and PR description
🚩 Using a feature flag to protect the release
👣 Providing comprehensive reproduction steps
📑 Providing or updating our documentation
🕛 Scheduling a pair reviewing session
📱 Providing mobile support
♿ Providing accessibility support

• I have read and considered all applicable items listed above.

As an Author, before moving this PR from Draft to Open, I confirmed ✅

• All unit tests are passing
• [x TypeScript compilation succeeded without errors
• Code passes all linting rules

[bill-akamai]

I'm not necessarily seeing this error... can others confirm? Totally a matter of preference but import React just looks cleaner to me than import * as React.

@hkhalil-akamai I agree with you that import React from 'react'; looks cleaner. This style of import fixed some linting issues that showed up after I removed the resolutions however, since it appears that we need some of these resolutions after all I reverted these changes. It must have stemmed from using the newer version of either node-fetch, yaml, or semver. We can revisit once those are actually ready to be replace if we do need to update the import style then.

It looks like we'll be able to remove node-fetch if we can remove recompose from our codebase. I saw @bnussman-akamai has already done some of this work before and there are only a few references left to this package so it looks possible to remove in a separate ticket.

[linode-gh-bot]

Cloud Manager UI test results

🔺 1 failing test on test run #16 ↗︎

❌ Failing	✅ Passing	↪️ Skipped	🕐 Duration
1 Failing	566 Passing	5 Skipped	112m 1s

Details

Failing Tests
	Spec	Test
❌	smoke-community-stackscripts.spec.ts	Cloud Manager Cypress Tests→Community Stackscripts integration tests » Community Stackscripts integration tests

Troubleshooting

Use this command to re-run the failing tests:

pnpm cy:run -s "cypress/e2e/core/stackscripts/smoke-community-stackscripts.spec.ts"