• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Updates npm build-tooling dependencies and resolves all npm audit findings.

• npm audit fix resolved 9 vulnerabilities (browserslist, deepmerge-ts/html-to-text/mailparser chain, fast-uri, mysql2, postcss-selector-parser, qs, @humanfs/node) — transitive or in-range, no manual changes needed.
• esbuild 0.27.7 → 0.28.2, fixing GHSA-g7r4-m6w7-qqqr (arbitrary file read via esbuild's dev server on Windows). Flagged as a semver-major bump by npm, but the changelog shows only install-script/tooling changes, not JS API changes.
• tinymce 8.8.2 → 8.9.0, choices.js 11.2.1 → 11.2.4, sa11y 4.4.1 → 5.0.9 (major), and the full @codemirror/* family (autocomplete, commands, lang-html, lang-markdown, language, lint, search, state, view) to their latest in-range versions.

Each package was reviewed individually against its actual usage in this repo (not just changelog headlines) before updating — no breaking changes intersect with how Joomla consumes any of them. Full details/verdicts per package are documented separately.

No PHP/JS source changes; only package.json, package-lock.json, and plugins/editors/tinymce/tinymce.xml (its <version> is written automatically by the plg_editors_tinymce build task to match the bundled TinyMCE version).

Testing Instructions

1. Checkout this branch.
2. Run npm install (this also triggers a full production build via this repo's install script).
3. Run npm audit — expect 0 vulnerabilities.
4. Run npm run build:dev -- -a or npm run build -- -a — expect exit code 0, all build tasks green, no new errors (pre-existing Sass/Bootstrap deprecation warnings are unrelated).
5. Manually smoke-test the affected UI, since a clean build doesn't prove runtime behavior:

• TinyMCE editor: loads, toolbar/sidebar render and resize, image insert + alt text, light/dark skins.
• CodeMirror editor: syntax highlighting per language mode, autocomplete/bracket-closing, search-and-replace panel, fold gutter, undo/redo, read-only toggle. On macOS, note the toggle-block-comment shortcut moved from Alt-A to Ctrl-A (CodeMirror upstream change, not a bug).
• Fancy-select fields (tags field, menu type/parent pickers): no incorrect auto-highlight on dropdown open, Enter-to-add-custom-term still works.
• Accessibility checker (plg_system_jooa11y): load a front-end page with ?jooa11y=1, confirm the panel and tooltips render correctly.

Actual result BEFORE applying this Pull Request

npm audit reports 10 vulnerabilities (2 low, 2 moderate, 6 high). tinymce, choices.js, sa11y, and the @codemirror/* packages are behind their latest available versions.

Expected result AFTER applying this Pull Request

npm audit reports 0 vulnerabilities. All reviewed packages are updated to their latest available (in-range, or reviewed-and-bumped-range for sa11y) versions, with no functional regressions in the TinyMCE editor, CodeMirror editor, fancy-select fields, or accessibility checker.

Link to documentations

Please select:

• No documentation changes for guide.joomla.org needed
• No documentation changes for manual.joomla.org needed