[stable34] Fix npm audit

[nextcloud-command]

Audit report

No fixable problems found (0 unfixable, 30 only fixable manually using --force)

[ChristophWurst]

@coderabbitai review for any suspicious bumps, like dependencies updated without a purpose, because it says "0 unfixable"

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr view 1062 --repo nextcloud/recommendations --json title,body,baseRefName,headRefName,files
echo "---DIFF---"
gh pr diff 1062 --repo nextcloud/recommendations > /tmp/pr.diff
wc -l /tmp/pr.diff
cat /tmp/pr.diff

Length of output: 287539

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr diff 1062 --repo nextcloud/recommendations -- package-lock.json > /tmp/lock.diff || true
wc -l /tmp/lock.diff
# Show only version-change lines
rg -n '^[+-]\s*"version"' /tmp/lock.diff | head -100
echo "---resolved lines---"
rg -n '^[+-]\s*"resolved"' /tmp/lock.diff | head -100
echo "---package name headers---"
rg -n '^[+-]\s*"node_modules/' /tmp/lock.diff | head -100

Length of output: 767

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr diff 1062 --repo nextcloud/recommendations > /tmp/full.diff
wc -l /tmp/full.diff
awk '/^diff --git a\/package-lock.json/{flag=1} /^diff --git a\/(?!package-lock.json)/{flag=0} flag' /tmp/full.diff > /tmp/lock.diff 2>/dev/null || true
# fallback with sed since awk regex lookahead not supported in POSIX awk
python3 - <<'EOF'
import re
with open('/tmp/full.diff') as f:
    content = f.read()
parts = re.split(r'(?=^diff --git )', content, flags=re.M)
for p in parts:
    if p.startswith('diff --git a/package-lock.json'):
        with open('/tmp/lock.diff','w') as out:
            out.write(p)
        break
EOF
wc -l /tmp/lock.diff
grep -n '"version"' /tmp/lock.diff | head -200
echo "---resolved---"
grep -n '"resolved"' /tmp/lock.diff | head -200

Length of output: 14003

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr view 1062 --repo nextcloud/recommendations --json files --jq '.files[].path'
echo "---check package.json diff (should be none)---"
gh pr diff 1062 --repo nextcloud/recommendations | grep -c '^diff --git a/package.json' || true

Length of output: 846

---

@ChristophWurst: I checked the package-lock.json diff closely — package.json itself is untouched, so no direct dependency ranges changed. All the version bumps are transitive/dev-dependency updates within the same major version (i.e., these are compatible per existing semver ranges, likely resolved via npm install/npm update rather than a manual pin change):

• @babel/* packages (code-frame, compat-data, core, generator, helper-*, parser, template, traverse, types) → all consolidated to 7.29.7 (previously a mix of 7.27.x–7.29.3). This is a dev-only build toolchain dependency.
• dompurify 3.4.2 → 3.4.11 (patch releases, includes known XSS hardening fixes)
• fast-xml-parser 4.5.6 → 4.5.7
• form-data 4.0.5 → 4.0.6
• hasown 2.0.2 → 2.0.4
• http-proxy-middleware 2.0.9 → 2.0.10
• js-yaml 4.1.1 → 4.3.0
• launch-editor 2.9.1 → 2.14.1
• shell-quote 1.8.4 → 1.9.0
• webpack-dev-server 5.2.5 → 5.2.6

None of these are major-version jumps, none appear to be arbitrary/unrelated bumps, and the same list of updates appears twice in the lockfile (once for the root workspace, once duplicated for a nested workspace entry), which is expected lockfile structure and not a sign of duplication issues.

Given that "0 unfixable" in the audit report, these transitive bumps were likely picked up by regenerating the lockfile (e.g., npm install) against the existing package.json ranges rather than npm audit fix --force, so they naturally resolved to the latest compatible patch/minor versions — several of which (dompurify, form-data, fast-xml-parser) do correspond to published security advisories. I don't see any suspicious or unrelated bumps (e.g., unrelated major version jumps, unexpected new packages, or unrelated dependency additions) in this diff.

The compiled js/recommendations-*.js and .map/.license files are just the expected build artifacts reflecting these updated transitive dependencies (webpack chunk hashes changed accordingly).