Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

update npm packages

Testing Instructions

review

Actual result BEFORE applying this Pull Request

npm audit report

@humanfs/node <0.16.8
Severity: moderate
humanfs: Recursive copy follows symlinked files and copies data from outside the source tree - GHSA-p498-v437-472g
fix available via npm audit fix
node_modules/@humanfs/node

browserslist <=4.28.6
Severity: high
Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM - GHSA-c83g-rgw3-j3cx
Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) - GHSA-73wf-gq98-2v4g
fix available via npm audit fix
node_modules/browserslist

colord <2.9.4
Severity: moderate
Colord: Slow rejection of oversized malformed color strings - GHSA-2wm5-q62r-hmrv
fix available via npm audit fix
node_modules/colord

deepmerge-ts <8.0.0
Severity: high
DeepmergeTS has stack exhaustion when merging recursive object graphs - GHSA-ggr8-5vv4-36mx
fix available via npm audit fix
node_modules/deepmerge-ts
html-to-text 10.0.0
Depends on vulnerable versions of deepmerge-ts
node_modules/html-to-text
mailparser 2.3.1 - 3.9.19
Depends on vulnerable versions of html-to-text
Depends on vulnerable versions of nodemailer
node_modules/mailparser

esbuild 0.27.3 - 0.28.0
esbuild allows arbitrary file read when running the development server on Windows - GHSA-g7r4-m6w7-qqqr
fix available via npm audit fix --force
Will install esbuild@0.28.2, which is a breaking change
node_modules/esbuild

fast-uri 3.0.0 - 3.1.5
Severity: high
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references - GHSA-5jgf-p345-68v8
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization - GHSA-f65p-4m7j-42xc
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding - GHSA-fph4-wmhf-6fwf
fast-uri vulnerable to host confusion via percent-encoded scheme normalization - GHSA-jqff-g426-hqxp
fix available via npm audit fix
node_modules/fast-uri

js-yaml 4.0.0 - 4.3.1
Severity: high
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - GHSA-2883-xcg3-v3hh
fix available via npm audit fix
node_modules/js-yaml

mysql2 <=3.23.0
Severity: high
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials - GHSA-3f6p-5ww8-9rcr
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS - GHSA-rgwj-5xj2-c3m3
fix available via npm audit fix
node_modules/mysql2

nanoid <3.3.18
Severity: high
nanoid: custom generators can loop indefinitely when size is zero - GHSA-2v37-7h3g-55p8
fix available via npm audit fix
node_modules/nanoid

nodemailer <=9.1.0
Severity: high
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature - GHSA-8m3c-c648-2xjj
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain - GHSA-wmmp-3585-3rmp
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list - GHSA-2x7j-588g-ccc2
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain - GHSA-cc9r-2j5m-2m83
fix available via npm audit fix
node_modules/mailparser/node_modules/nodemailer
node_modules/nodemailer
smtp-server 2.0.0 - 3.19.5
Depends on vulnerable versions of nodemailer
node_modules/smtp-server

postcss-selector-parser 7.1.0 - 7.1.2
postcss-selector-parser allows denial of service through uncontrolled AST recursion - GHSA-w9m9-85wc-3x92
fix available via npm audit fix
node_modules/postcss-selector-parser

qs 2.2.5 - 6.15.3
Severity: moderate
qs array-limit bypass via bracket-key comma parsing - GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - GHSA-4mjr-xmp4-gh2g
fix available via npm audit fix
node_modules/qs

15 vulnerabilities (2 low, 4 moderate, 9 high)

To address issues that do not require attention, run:
npm audit fix

To address all issues (including breaking changes), run:
npm audit fix --force

Expected result AFTER applying this Pull Request

npm audit fix

added 1 package, removed 6 packages, changed 24 packages, and audited 804 packages in 5s

212 packages are looking for funding
run npm fund for details

npm audit report

esbuild 0.27.3 - 0.28.0
esbuild allows arbitrary file read when running the development server on Windows - GHSA-g7r4-m6w7-qqqr
fix available via npm audit fix --force
Will install esbuild@0.28.2, which is a breaking change
node_modules/esbuild

1 low severity vulnerability

added: npm update tinymce-i18n --save from pr #48432

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed