[DoDiODev]

Summary

config-ui/package.json still lists @ahooksjs/use-url-state, but nothing
imports it any more. The last useUrlState call was replaced by
react-router's useLocation in #7841 (Aug 2024).

The package is not just dead weight. It pulls in decode-uri-component
0.2.2 through query-string@6:

config-ui
└─ @ahooksjs/use-url-state@3.5.1
   └─ query-string@6.14.1
      └─ decode-uri-component@0.2.2

That version is affected by two advisories:

• GHSA-vcc3-ghjq-m6fr: medium, fixed in 0.5.0
• GHSA-qr28-fpjm-wq7f: high, fixed in 0.5.1

Both describe denial of service on malformed percent-encoded input.
Because the code is never bundled, there is no actual exposure. Security
scanners still flag it, though. Dependabot cannot raise a fix for it
either: from 0.3.0 onwards decode-uri-component is ESM-only, while
query-string@6 loads it with require(). A resolutions override would
therefore break.

This PR removes the dependency (yarn remove @ahooksjs/use-url-state).
That also drops query-string, decode-uri-component, filter-obj,
split-on-first and strict-uri-encode from yarn.lock. ahooks stays,
because it is a direct dependency.

Does this close any open issues?

N/A

Screenshots

N/A (no UI change)

Other Information

• No runtime change: the vite build output (dist/) is byte-identical
  before and after this change.
• Verified locally in config-ui: tsc, eslint . (0 errors), yarn build
  and yarn test (80/80) pass.
• Fork CI on the same change (golangci-lint, unit-test, e2e on MySQL and
  PostgreSQL, config-ui, license header, Grafana check; 14/14 jobs green):
  https://github.com/DoDiODev/devlake/actions/runs/41605205365