chore: remove deprecated inflight dependency from API Catalog UI and Node.js onboarding enabler tooling

[balhar-jakub]

Summary

inflight@1.0.6 is present in the lockfiles for the API Catalog UI and Node.js onboarding enabler through obsolete build and test tooling.

The npm package is deprecated because it retains entries for unique in-flight-operation keys and can leak memory in a long-lived Node.js process:

This module is not supported, and leaks memory. Do not use it.

This is not currently exploitable through a deployed API Layer endpoint. The affected dependency is not directly imported by application code and is reached through local/CI build and test tooling. However, it should be removed as dependency hygiene and to eliminate the unsupported package from SBOM and scanner findings.

Affected workspaces

API Catalog UI

Current dependency chain:

Jest 29.x
  -> test-exclude 6.x
     -> glob 7.x
        -> inflight 1.0.6

inflight is not used by the browser application bundle or API request processing. It is pulled in by Jest-related test and coverage tooling.

The durable remediation requires upgrading Jest and its companion packages to a version that resolves test-exclude with a modern glob release.

Current constraint:

• Jest cannot yet be upgraded to v30 because the UI test suite still depends on Enzyme, which is incompatible with the intended Jest migration.

Node.js onboarding enabler

Current dependency paths include:

eslint 2.x
  -> glob 7.x
     -> inflight 1.0.6

gulp-istanbul
  -> istanbul 0.4.x
     -> glob 5.x
        -> inflight 1.0.6

gulp-mocha
  -> mocha
     -> glob 8.x
        -> inflight 1.0.6

These are development-only dependencies, used for linting, test execution, and coverage generation. The published Node.js enabler does not directly import or execute inflight.

Proposed remediation

API Catalog UI

1. Migrate Enzyme-based tests to React Testing Library.
2. Remove Enzyme-specific dependencies and configuration.
3. Upgrade Jest and related packages together to a supported current version.
4. Regenerate package-lock.json with the repository-pinned npm version.
5. Verify that the resolved dependency tree no longer contains inflight.

Node.js onboarding enabler

1. Replace the obsolete ESLint 2 / gulp-eslint stack with a supported ESLint configuration.
2. Replace gulp-istanbul / Istanbul 0.x with a maintained coverage solution such as c8 or modern Istanbul tooling.
3. Review whether Gulp-based Mocha execution can be simplified or replaced while preserving the current test and coverage behavior.
4. Regenerate package-lock.json.
5. Verify that the resolved dependency tree no longer contains inflight.

Acceptance criteria

• inflight is absent from api-catalog-ui/frontend/package-lock.json.
• inflight is absent from onboarding-enabler-nodejs/package-lock.json.
• No production source directly imports inflight.
• API Catalog UI lint, unit tests, and production build pass.
• Node.js onboarding enabler lint, targeted tests, and full test suite pass.
• npm ci --ignore-scripts --no-audit --no-fund succeeds in both workspaces.
• npm ls inflight --all reports no installed inflight dependency in both workspaces.

Notes

Do not use an npm overrides entry to force a replacement for inflight. There is no compatible patched inflight release, and forcing a modern glob version beneath consumers that require glob@5 or glob@7 can cause breaking runtime/tooling behavior. The correct fix is to upgrade or replace the parent tooling that introduces the old glob dependency.