fix: replace serve with http-server to resolve production CVEs (#9655)

Author: deleonio

packages/tools/benchmark-tests/.knip.json

@@ -1,14 +1,14 @@
 {
 	"$schema": "https://unpkg.com/knip@5/schema.json",
-	"ignore": ["public/{assets,components,theme}/**", "tests/hydration.webdriver.ts"],
+	"ignore": ["tests/hydration.webdriver.ts"],
 	"ignoreDependencies": [
 		"@public-ui/components",
 		"@public-ui/theme-default",
 		"@wdio/local-runner",
 		"@wdio/mocha-framework",
 		"@wdio/spec-reporter",
 		"chromedriver",
-		"serve"
+		"http-server"
 	],
 	"project": ["tests/**/*.ts"]
 }

packages/tools/benchmark-tests/package.json

@@ -50,7 +50,7 @@
 		"prettier": "3.8.1",
 		"prettier-plugin-organize-imports": "4.3.0",
 		"rimraf": "6.1.3",
-		"serve": "14.2.5",
+		"http-server": "14.1.0",
 		"typescript": "5.9.3"
 	}
 }

packages/tools/benchmark-tests/playwright.config.js

@@ -20,7 +20,7 @@ export default defineConfig({
 		},
 	],
 	webServer: {
-		command: 'npx serve -p 3000',
+		command: 'npx http-server -p 3000',
 		cwd: 'public',
 		reuseExistingServer: false,
 		url: 'http://localhost:3000',

packages/tools/visual-tests/.knip.json

@@ -1,6 +1,6 @@
 {
 	"$schema": "https://unpkg.com/knip@5/schema.json",
-	"ignoreDependencies": ["@public-ui/sample-react", "serve"],
+	"ignoreDependencies": ["@public-ui/sample-react", "http-server"],
 	"rules": {
 		"classMembers": "warn"
 	}

packages/tools/visual-tests/package.json

@@ -34,8 +34,8 @@
 		"@axe-core/playwright": "4.11.1",
 		"@public-ui/sample-react": "workspace:*",
 		"axe-html-reporter": "2.2.11",
-		"portfinder": "1.0.38",
-		"serve": "14.2.5"
+		"http-server": "14.1.0",
+		"portfinder": "1.0.38"
 	},
 	"devDependencies": {
 		"@babel/eslint-parser": "7.28.6",

packages/tools/visual-tests/playwright.config.js

@@ -73,7 +73,7 @@ export default defineConfig({
 
 	/* Run your local dev server before starting the tests */
 	webServer: {
-		command: `npx serve -p ${PORT}`,
+		command: `npx http-server -p ${PORT}`,
 		cwd: path.resolve(BUILD_PATH),
 		url: BASE_URL,
 		reuseExistingServer: false,

packages/tools/visual-tests/src/index.js

@@ -77,7 +77,7 @@ void (async () => {
 
 		if (process.env.KOLIBRI_CLEANUP === '0') {
 			console.log('Skipping cleanup up build folder.');
-			console.log(`You can serve this build with "npx serve ${buildPath}".`);
+			console.log(`You can serve this build with "npx http-server ${buildPath}".`);
 		} else {
 			console.log('Cleaning up build folder …');
 			fs.rmSync(buildPath, { recursive: true, force: true });