Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

1. Bumps tinymce to 8.9.1 (there is no change at all in this release for the open source release of tinymce

2. Fixes 2 moderate and 2 high security issues

colord  <2.9.4
Severity: moderate
Colord: Slow rejection of oversized malformed color strings - https://github.com/advisories/GHSA-2wm5-q62r-hmrv
fix available via `npm audit fix`
node_modules/colord

js-yaml  4.0.0 - 4.3.1
Severity: high
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources - https://github.com/advisories/GHSA-2883-xcg3-v3hh
fix available via `npm audit fix`
node_modules/js-yaml

nodemailer  <=9.1.0
Severity: high
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature - https://github.com/advisories/GHSA-8m3c-c648-2xjj
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain - https://github.com/advisories/GHSA-wmmp-3585-3rmp
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list - https://github.com/advisories/GHSA-2x7j-588g-ccc2
Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domain - https://github.com/advisories/GHSA-cc9r-2j5m-2m83
fix available via `npm audit fix`
node_modules/nodemailer
  smtp-server  2.0.0 - 3.19.5
  Depends on vulnerable versions of nodemailer
  node_modules/smtp-server

4 vulnerabilities (2 moderate, 2 high)

Testing Instructions

apply pr, npm i, then npm audit to check no security issues reported

Actual result BEFORE applying this Pull Request

4 vulnerabilities (2 moderate, 2 high)

Expected result AFTER applying this Pull Request

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed