Fusion Framework — AG Grid 36, Security Hardening & Dependency Maintenance

[odinr]

Fusion Framework — AG Grid 36, Security Hardening, and Dependency Maintenance

This release is lighter on headlines than the React 19 drop, but it earns its keep: AG Grid makes a major leap to v36, 31 security advisories got cleared from the audit log, and a handful of library updates keep the supply chain honest.

---

🏎️ AG Grid 36 + AG Charts 14

Breaking — requires migration for AG Grid consumers.

@equinor/fusion-framework-module-ag-grid and @equinor/fusion-framework-react-ag-grid move to AG Grid 36 (~36.0.1), and @equinor/fusion-framework-react-ag-charts moves to AG Charts 14 (~14.0.1) — the required companion version.

AG Grid 36 ships a significant DOM and theming overhaul. Things to review before upgrading:

• DOM structure overhaul — scrolling containers merged into a single container. CSS selectors targeting layout containers (pinned columns, sticky rows) will need updating.
• Theme/RTL class placement — theme and RTL classes now set on a parent element. CSS like .ag-root-wrapper.ag-rtl { ... } must become .ag-rtl .ag-root-wrapper { ... }.
• ValidationModule removed from AllCommunityModule / AllEnterpriseModule bundles. Call enableDevValidations() explicitly in dev if you need full diagnostics.
• TypeScript minimum raised to 5.8.3.
• createTheme() no longer bundles button and column-drop styles — re-add via .withPart(buttonStyleQuartz) / .withPart(columnDropStyleBordered) if needed.
• New features: Calculated Columns, Show Values As, Automatic Column Generation.

👉 See the AG Grid 36 migration guide and AG Charts 14 migration guide for the full list.

Peer dependency range updated from >=35.1.0 to >=36.0.0. If you pin a specific AG Grid version in your app, bump it.

---

🔐 Security — 31 → 1 vulnerability

31 open security advisories on main cleared in three targeted PRs — none requiring code changes, all via pnpm overrides or direct dep bumps:

Severity	Package	Fix
HIGH ×3	undici	Overrides → 7.28.0 / 8.5.0 (TLS bypass, WebSocket DoS, SOCKS5 routing)
HIGH	ws	Override → 7.5.11 (memory exhaustion DoS)
HIGH	http-proxy-middleware	Bump → ^4.1.1 in vite-plugin-api-service (multipart injection)
HIGH	langsmith	Override → 0.8.3 (deserialization of untrusted manifest)
HIGH	linkify-it	Override → 5.0.1 (match scan quadratic DoS)
MODERATE ×9	undici, http-proxy-middleware, dompurify ×4, markdown-it, brace-expansion, js-yaml	Various overrides
LOW ×4	dompurify ×3, uuid	Overrides / implicit via langsmith bump
LOW	@babel/core	Tracked — resolves with react-router v8 upgrade (#4971)

The one remaining advisory (@babel/core LOW via @react-router/dev) has no independent fix — it clears automatically when the react-router v8 upgrade lands.

---

🤖 AI / LangChain

@equinor/fusion-framework-module-ai and the CLI AI plugins (ai-base, ai-chat, ai-index) bump @langchain/core from 1.1.49 → 1.2.3 and langchain from 1.4.5 → 1.5.3. Routine maintenance; no API changes.

---

🛠️ CLI & Tooling

• adm-zip → ^0.6.0 (#5002 adjacent) — fixes CVE-2026-39244 (decompression bomb).
• semver → 7.8.5 — patch bug fix.
• vite → 8.1.5 — security hardening on server.fs.deny, new caseSensitive glob option, WASM ESM integration, various HMR/CSS/SSR fixes.

---

⚠️ Breaking Changes at a Glance

Change	Affects	Action
AG Grid 36 DOM overhaul	fusion-framework-module-ag-grid, fusion-framework-react-ag-grid	Review AG Grid 36 migration guide
AG Charts 14 required	fusion-framework-react-ag-charts	Bump charts alongside grid
TypeScript minimum 5.8.3	AG Grid consumers	Ensure TypeScript ≥ 5.8.3
ValidationModule removed from bundle	Dev teams using AG Grid validation	Call enableDevValidations() explicitly

---

📦 Released Packages

Package	Version	Type
@equinor/fusion-framework-module-ag-grid	37.0.0	major
@equinor/fusion-framework-react-ag-charts	15.0.0	major
@equinor/fusion-framework-react-ag-grid	37.0.0	major
@equinor/fusion-framework-cli	15.1.8	patch
@equinor/fusion-framework-vite-plugin-api-service	2.0.3	patch
@equinor/fusion-framework-vite-plugin-spa	4.0.13	patch
@equinor/fusion-framework-module-ai	6.0.1	patch
@equinor/fusion-framework-module-msal	10.0.1	patch
@equinor/fusion-framework-module-analytics	3.0.1	patch
@equinor/fusion-framework	8.0.10	patch
@equinor/fusion-framework-app	11.0.10	patch
@equinor/fusion-framework-dev-server	2.0.14	patch
@equinor/fusion-framework-dev-portal	8.0.0	patch (dep cascade)
@equinor/fusion-framework-react-app	12.0.2	patch
CLI AI plugins (ai-base, ai-chat, ai-index)	4.0.5 / 3.0.5 / 3.0.6	patch

---

🔗 Key PRs

• AG Grid 36 + AG Charts 14 — #4907, #4906
• Security: undici / ws / http-proxy-middleware — #5002
• Security: langsmith / brace-expansion / uuid — #5003
• Security: dompurify / markdown-it / linkify-it / js-yaml — #5004
• Release PR — #4997

---

🤖 Beep Bopp — Release notes assembled by Fusion Assistant. AG Grid 36 won't upgrade itself, but at least the audit log is finally quiet.