chore(deps): cyclonedx-npm 6.0.0 — clears the last remaining npm high

[rubenvdlinde]

@cyclonedx/cyclonedx-npm 4.2.1 → 6.0.0 — shell injection via an unsanitised --workspace argument (affected 2.1.0 - 4.2.1). This was the only remaining high-severity npm advisory on development after the php_codesniffer CVE fix (#2371).

npm audit --package-lock-only on development:

	critical	high	moderate	low
before	0	1	7	5
after	0	0	7	5

Reachability: this repo passes no --workspace, so the advisory was not exploitable here. Bumped anyway because it is cheap and the SBOM step runs this binary directly.

Verification

CI is node 20 / npm 10.8.2; local npm 11 prunes entries CI requires, so the lockfile was regenerated with npx npm@10.8.2.

• npx npm@10.8.2 ci → rc=0, lockfile md5 identical afterwards.
• The bump is genuinely exercised. CI runs npx @cyclonedx/cyclonedx-npm, which resolves the local devDependency — that binary now reports 6.0.0. The exact CI command succeeded (rc=0), producing a valid CycloneDX specVersion 1.5 SBOM with 652 components — identical to the 4.2.1 baseline, so the major bump changed the tool without changing the artifact.
• npm run build rc=0 · npm run lint rc=0 · check:specs rc=0 · test:l10n rc=0 · jest (npm test) rc=0. All baselined on untouched development first.
• Licence from the lockfile: cyclonedx-npm 6.0.0 is Apache-2.0. vue3-apexcharts is 1.8.0 MIT — still the pre-proprietary line, untouched here.

Note: npm run build also rewrites docs/features.json and removes a stale js/ bundle; those were reverted so this PR contains only package.json + package-lock.json.

[github-actions]

Quality Report — ConductionNL/openregister @ 86eca82

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
composer			✅	✅ 173/173
npm			✅	✅ 713/713
PHPUnit					✅
Newman					✅
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 13:35 UTC

Download the full PDF report from the workflow artifacts.