[stable33] Fix npm audit

[nextcloud-command]

Audit report

No fixable problems found (0 unfixable, 30 only fixable manually using --force)

[ChristophWurst]

@coderabbitai review for any suspicious bumps, like dependencies updated without a purpose, because it says "0 unfixable"

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
gh pr view 1063 --repo nextcloud/recommendations --json title,body,files,additions,deletions
echo "---DIFF package.json---"
gh pr diff 1063 --repo nextcloud/recommendations -- package.json 2>/dev/null || true
echo "---FILES---"
gh pr view 1063 --repo nextcloud/recommendations --json files --jq '.files[].path'

Length of output: 2044

---

🏁 Script executed:

#!/bin/bash
gh pr diff 1063 --repo nextcloud/recommendations -- package-lock.json

Length of output: 426

---

🏁 Script executed:

#!/bin/bash
gh pr diff 1063 --repo nextcloud/recommendations > /tmp/pr.diff
wc -l /tmp/pr.diff
sed -n '/diff --git a\/package-lock.json/,/diff --git a\/js/p' /tmp/pr.diff | head -500

Length of output: 22668

---

@ChristophWurst I reviewed the diff for #1063. Findings:

• package.json is unchanged — only package-lock.json (and the regenerated js/recommendations-* dist bundles/maps/license files) were touched. That's consistent with running npm install/npm audit fix without --force, which only re-resolves versions within the semver ranges already declared in package.json.
• Every bumped package is a patch or minor version bump, no majors, no new packages added, no name/scope changes, and all resolve from the official registry.npmjs.org with valid integrity hashes:
  • Dev/build-toolchain only ("dev": true / "peer": true): the entire @babel/* family (7.27–7.29 → 7.29.7), webpack-dev-server 5.2.5→5.2.6, launch-editor 2.9.1→2.14.1, http-proxy-middleware 2.0.9→2.0.10, js-yaml 4.1.1→4.3.0, shell-quote 1.8.4→1.9.0.
  • Runtime deps: dompurify 3.4.2→3.4.11, fast-xml-parser 4.5.6→4.5.7, form-data 4.0.5→4.0.6, hasown 2.0.2→2.0.4.
• dompurify is the notable runtime bump since it's shipped in the built JS and is security-sensitive (XSS sanitization); the jump to 3.4.11 covers several patch-level security fixes, which fits the audit-fix narrative.

I don't see any suspicious or unrelated bumps (e.g., unexpected major version jumps, unpinned ranges, or packages unrelated to the audit). Everything appears to be transitive dependency resolution triggered by npm audit fix, matching the "0 unfixable" report in the PR description.

[resolve]