chore(deps): clear all critical + high npm advisories and CVE-2026-67434

[rubenvdlinde]

What this clears

npm audit --package-lock-only on development (the Dependabot alert count is computed on the stale default branch main and is meaningless for this branch):

	critical	high	moderate	low	total
before	1	2	7	5	15
after	0	0	5	5	10

composer audit --locked: 1 advisory → 0.

What was bumped

package	from	to	clears
vitest	1.6.1	^3.2.7	CRITICAL — Vitest UI arbitrary file read/exec (<=3.2.5)
@vitest/coverage-v8	1.6.1	^3.2.7	same advisory; kept on the same version as vitest
@cyclonedx/cyclonedx-npm	4.2.1	^6.0.0	HIGH — shell injection via --workspace (2.1.0 - 4.2.1)
vite (transitive)	5.4.21	7.3.6	HIGH — server.fs.deny bypass, GHSA-fx2h-pf6j-xcff (<=6.4.2)
@vitejs/plugin-vue	5.2.4	^6.0.0	not an advisory — required to keep the tree consistent, see below
squizlabs/php_codesniffer	3.13.5	3.13.6	CVE-2026-67434 / GHSA-hmqg-cxww-wqhq, OS command injection (<3.13.6)

3.2.7 rather than vitest 4: it is outside every current advisory range and one major less disruptive.

Why @vitejs/plugin-vue had to move too

This one is not cosmetic and not optional. @vitejs/plugin-vue@5 declares peer vite ^5.0.0 || ^6.0.0. Once the vitest bump let npm hoist a single vite@7.3.6 (which @nextcloud/vue → vue-router@5.2.0 independently requires at ^7.3.0 || ^8.0.0), that peer became unsatisfiable and npm ls reported ELSPROBLEMS / invalid: vite@7.3.6 — on a plugin that vitest.config.js genuinely requires at line 40. @vitejs/plugin-vue@6 declares ^5 || ^6 || ^7 || ^8, which makes the single hoisted vite valid for every consumer. Verified after the bump: no vite-related entries in npm ls --all.

Removed the blanket minimatch: ^3.1.2 override

test-exclude@7 (pulled in by @vitest/coverage-v8 3.x) does const { minimatch } = require('minimatch') — the v10 named export. Forcing v3's bare-function export yields TypeError: minimatch is not a function. Deleted the line rather than widening it to >=, which would force v10 on everything. Confirmed nothing in the tree now resolves below 3.1.2: present versions are 3.1.5, 9.0.9, 10.2.6.

Verification — every exit code, measured locally

All lockfile operations used npx --yes npm@10.8.2 to match CI (node 20 / npm 10.8.2). Local npm 11 prunes optional entries CI's npm 10 demands, so a bare npm install would have produced a lockfile that fails npm ci in CI.

step	rc	notes
npm@10.8.2 install --no-audit --no-fund	0
npm@10.8.2 ci --no-audit --no-fund	0	1260 packages
lockfile md5 before/after ci	—	d304cad4… → d304cad4… unchanged (npm-version hazard check)
npm run test:unit (vitest)	0	32 files, 330 passed — identical to baseline
npm run test:coverage	0	statements 9.87%
bash tests/coverage-ratchet.sh vitest coverage-vitest/coverage-summary.json	0	baseline is seeded, not null (vitest: 1.03); 9.87% > 1.03% → ratchets up
npm run build	0	webpack 5.109.2, 24 bundles emitted into js/
npm run lint	0	0 errors, 1274 warnings — identical error count to baseline
npm run check:manifest (CI frontend-check leg)	0	Ajv PASS
npm run check:vue3-compile (CI frontend-check leg)	0	229 components, 0 failed
npm run test:l10n (CI frontend-check leg)	0	316 files, en/nl key sets match
npx @cyclonedx/cyclonedx-npm --package-lock-only --ignore-npm-errors --output-file … --spec-version 1.5 --omit dev	0	exact CI command; output has specVersion 1.5, 567 components, CLI reports 6.0.0
composer audit --locked	0	"No security vulnerability advisories found"
vendor/bin/phpcs --version	—	3.13.6
composer phpcs	1	⚠️ pre-existing red — see below

phpcs positive control

A green checker that cannot fail is not evidence. Dropped a deliberately non-conforming lib/ZzPhpcsProbe.php, ran composer phpcs: rc=2, 19 errors and 2 warnings reported against the probe. Deleted the probe, re-ran: back to rc=1 (the pre-existing error below). git status afterwards shows only package.json, package-lock.json, composer.lock.

Pre-existing failure, not caused by this PR

composer phpcs exits 1 on a single error:

FILE: lib/Controller/Iv3TaakveldController.php
 66 | ERROR | All arguments in calls to internal code must use named parameters

I did not have a phpcs baseline for this repo (no vendor/ in a fresh worktree), so rather than assume, I A/B'd it: reverted composer.lock to the base commit, reinstalled to get phpcs 3.13.5, and re-ran — same rc=1, same single error. So the 3.13.6 bump did not introduce it. Deliberately not fixed here; a dependency PR is the wrong place for a named-parameters refactor.

Deliberately not bumped

• 5 remaining moderate advisories — dompurify, fast-xml-parser, @toast-ui/editor, @nextcloud/eslint-plugin, @conduction/nextcloud-vue. Out of scope for a critical+high sweep; @conduction/nextcloud-vue in particular is pinned to 2.2.0-vue3.3 and moving it is a separate, behaviour-affecting change.
• 5 remaining low advisories — all one chain under node-polyfill-webpack-plugin; clearing them needs a major bump of that package, which touches the webpack build.
• vitest 4 — 3.2.7 already sits outside every advisory range.

Licence check (read from the lockfile, not the manifest)

vitest 3.2.7 MIT · @vitest/coverage-v8 3.2.7 MIT · vite 7.3.6 MIT · @vitejs/plugin-vue 6.0.8 MIT · @cyclonedx/cyclonedx-npm 6.0.0 Apache-2.0. Cross-checked against the installed tree.

vue3-apexcharts is 1.8.0 / MIT and apexcharts is 4.7.0 / MIT — both unchanged from the base commit, i.e. vue3-apexcharts has not drifted to 1.9.0, which went proprietary.

[github-actions]

Quality Report — ConductionNL/procest @ 87deff6

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
composer			✅	✅ 100/100
npm			✅	✅ 552/552
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					✅

---

Quality workflow — 2026-08-06 12:24 UTC

Download the full PDF report from the workflow artifacts.