Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) fixes 6 moderate and 1 high security vulnerabilities in development and 4 high severity security vulnerabilities in non-development dependencies reported by npm audit by using npm audit fix.

This includes an update of TinyMCE to version 8.10.1.

The TinyMCE language files have already been updated to the latest available version with PR #48758 .

In addition, this PR here updates the version requirements in the package.json file to the versions in the package-lock.json file.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

If not done before, run composer install and npm ci.

1. Run npm audit to check all dependencies and check the result.
2. Run npm audit --omit dev to check only non-development dependencies and check the result.

Actual result BEFORE applying this Pull Request

1. npm audit

# npm audit report

@vue/server-renderer  <=3.5.41
Severity: high
@vue/server-renderer: XSS via missing CR in attribute-name blacklist - https://github.com/advisories/GHSA-g2v6-rqmx-r4w6
Depends on vulnerable versions of vue
fix available via `npm audit fix`
node_modules/@vue/server-renderer
  vue  3.2.13 - 3.5.41
  Depends on vulnerable versions of @vue/server-renderer
  node_modules/vue

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install shepherd.js@15.3.0, which is a breaking change
node_modules/deepmerge
  @rollup/plugin-node-resolve  >=8.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/@rollup/plugin-node-resolve
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

fast-uri  3.0.0 - 3.1.8
Severity: moderate
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding - https://github.com/advisories/GHSA-w74x-v6f9-j3xg
fast-uri vulnerable to improper path equivalence in relative reference normalization - https://github.com/advisories/GHSA-xhq7-xmqj-769h
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization - https://github.com/advisories/GHSA-wjr9-j795-jxcr
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references - https://github.com/advisories/GHSA-333x-w4r6-6crp
fix available via `npm audit fix`
node_modules/fast-uri

nodemailer  3.0.0 - 10.1.3
Severity: moderate
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing - https://github.com/advisories/GHSA-39m8-27wv-hr27
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient - https://github.com/advisories/GHSA-8c8m-p3m8-cjg8
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient - https://github.com/advisories/GHSA-m943-m63m-w62w
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name - https://github.com/advisories/GHSA-85x2-q946-cp5h
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service - https://github.com/advisories/GHSA-4ffr-jq9g-5ffx
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped - https://github.com/advisories/GHSA-g73g-hqqh-jr95
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service - https://github.com/advisories/GHSA-4g23-2xm8-66gc
fix available via `npm audit fix`
node_modules/mailparser/node_modules/nodemailer
node_modules/nodemailer
  mailparser  2.3.1 - 3.9.42
  Depends on vulnerable versions of nodemailer
  node_modules/mailparser
  smtp-server  2.0.0 - 3.19.15
  Depends on vulnerable versions of nodemailer
  node_modules/smtp-server

postcss-selector-parser  7.0.0 - 7.1.5
Severity: moderate
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion - https://github.com/advisories/GHSA-rj75-hqrm-r3gf
fix available via `npm audit fix`
node_modules/postcss-selector-parser

qs  6.7.0 - 6.16.0
Severity: moderate
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) - https://github.com/advisories/GHSA-6pq8-jhm2-2vcw
fix available via `npm audit fix`
node_modules/qs

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js

systeminformation  <=5.33.15
Severity: high
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net - https://github.com/advisories/GHSA-4vjg-vx72-qq4g
systeminformation has prototype pollution in `networkStats()` via the interface name - https://github.com/advisories/GHSA-7648-jmwf-vw7j
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks - https://github.com/advisories/GHSA-3f7j-7jwc-fxfj
fix available via `npm audit fix`
node_modules/systeminformation

tinymce  8.5.1 - 8.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization - https://github.com/advisories/GHSA-mf2p-h6hf-fcwm
fix available via `npm audit fix`
node_modules/tinymce

15 vulnerabilities (4 low, 6 moderate, 5 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

2. npm audit --omit dev

# npm audit report

@vue/server-renderer  <=3.5.41
Severity: high
@vue/server-renderer: XSS via missing CR in attribute-name blacklist - https://github.com/advisories/GHSA-g2v6-rqmx-r4w6
Depends on vulnerable versions of vue
fix available via `npm audit fix`
node_modules/@vue/server-renderer
  vue  3.2.13 - 3.5.41
  Depends on vulnerable versions of @vue/server-renderer
  node_modules/vue

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install vuex-persist@2.3.0, which is a breaking change
node_modules/deepmerge
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

source-map-js  1.0.0 - 1.2.1
Severity: high
source-map-js allows event-loop denial of service through indexed source-map section offsets - https://github.com/advisories/GHSA-68fv-2mgg-jv7q
fix available via `npm audit fix`
node_modules/source-map-js

tinymce  8.5.1 - 8.9.2
Severity: high
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization - https://github.com/advisories/GHSA-mf2p-h6hf-fcwm
fix available via `npm audit fix`
node_modules/tinymce

7 vulnerabilities (3 low, 4 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

1. npm audit

# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install @rollup/plugin-node-resolve@7.1.3, which is a breaking change
node_modules/deepmerge
  @rollup/plugin-node-resolve  >=8.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/@rollup/plugin-node-resolve
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

4 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

2. npm audit --omit dev

# npm audit report

deepmerge  >=4.2.0
deepmerge mergeObject() allows prototype poisoning of returned objects - https://github.com/advisories/GHSA-gcqx-w48m-w2h4
fix available via `npm audit fix --force`
Will install shepherd.js@15.3.0, which is a breaking change
node_modules/deepmerge
  shepherd.js  7.2.0 - 12.0.0-alpha.13
  Depends on vulnerable versions of deepmerge
  node_modules/shepherd.js
  vuex-persist  >=3.0.0
  Depends on vulnerable versions of deepmerge
  node_modules/vuex-persist

3 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed