Fix/dependabot issues

[AhmarZaidi]

Fixes: https://github.com/rtCamp/support/issues/300

One Moderate and one Low Severity Issues FIxed:

• Moderate: https://github.com/rtCamp/godam/security/dependabot/101
• Low: https://github.com/rtCamp/godam/security/dependabot/104

Skipped Updates

• webpack-dev-server: It could only be updated via npm overrides since even the latest version v31.5.0 of @wordpress/scripts uses webpack-dev-server v4.15.1. Updating it this way could cause compatibility issues. The dependabot issue will be resolved once @wordpress/scripts updates it's dependencies to use webpack-dev-server v5.2.1 or newer. Related dependabot issues:
  • https://github.com/rtCamp/godam/security/dependabot/71
  • https://github.com/rtCamp/godam/security/dependabot/70
• https://github.com/rtCamp/godam/security/dependabot/95
  • This issue affects Quill: 2.0.3 which is the latest version so updating it is not an option

Tested

• Activation & deactivation
• Transcoding & bulk re-transcoding video & images
• Creating, deleting folders and moving files
• Attaching virtual media to post using godam video block
• Adding and removing API key
• Adding custom thumbnails
• Adding video editor layer

[Copilot]

Pull request overview

This PR addresses Dependabot security alerts by updating transitive npm dependencies and refreshing the vendored jQuery UI draggable bundle used by the media library assets.

Changes:

• Bump qs in package-lock.json to 6.14.2.
• Update vendored jQuery UI draggable bundle from 1.14.1 to 1.14.2 and repoint the media-library entry to the new path.
• Update .distignore to match the new vendored jQuery UI directory.

Reviewed changes

Copilot reviewed 10 out of 29 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package-lock.json	Updates transitive dependency (qs) to remediate Dependabot alert(s).
assets/src/libs/jquery-ui-1.14.2.draggable/package.json	Updates vendored jQuery UI metadata to 1.14.2.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.js	Updates vendored jQuery UI source to v1.14.2.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.min.js	Adds/updates minified jQuery UI bundle v1.14.2.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.css	Updates vendored jQuery UI CSS bundle header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.min.css	Updates vendored minified CSS header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.structure.css	Updates vendored structure CSS header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.structure.min.css	Updates vendored minified structure CSS header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.theme.css	Updates vendored theme CSS header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/jquery-ui.theme.min.css	Updates vendored minified theme CSS header/version.
assets/src/libs/jquery-ui-1.14.2.draggable/index.html	Adds upstream demo page for the vendored jQuery UI bundle.
assets/src/libs/jquery-ui-1.14.2.draggable/external/jquery/jquery.js	Adds vendored jQuery copy referenced by the demo page.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_ffffff_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_cc0000_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_777777_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_777620_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_555555_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/images/ui-icons_444444_256x240.png	Updates/adds vendored jQuery UI theme icon sprite.
assets/src/libs/jquery-ui-1.14.2.draggable/LICENSE.txt	Adds upstream license text for the vendored jQuery UI bundle.
assets/src/libs/jquery-ui-1.14.2.draggable/AUTHORS.txt	Adds upstream authors list for the vendored jQuery UI bundle.
assets/src/libs/jquery-ui-1.14.1.draggable/jquery-ui.min.js	Removes old vendored minified jQuery UI bundle v1.14.1.
assets/src/js/media-library/index.js	Switches media-library build to import jQuery UI from the new vendored directory.
.distignore	Updates ignored vendored directory from 1.14.1 to 1.14.2.

Comments suppressed due to low confidence (1)

assets/src/libs/jquery-ui-1.14.2.draggable/package.json:74

• This package.json (and its devDependencies/scripts) appears to be upstream build metadata for jQuery UI rather than something the plugin uses. If it isn’t referenced by the build here, consider omitting it from the vendored copy to avoid unnecessary maintenance surface and confusion about what dependencies are actually used by this repo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.