fix(deps): security bumps for 54 Dependabot alerts

[rtBot]

Summary

Lockfile-only security bumps resolving 54 of 64 open Dependabot alerts (npm package-lock.json + composer composer.lock). All same-major, no manifest range changes, no source edits. Includes the CRITICAL shell-quote alert (#113).

npm (package-lock.json) — npm update --package-lock-only

package	old → new	alerts	severity
shell-quote	1.8.3 → 1.9.0	#113	CRITICAL
axios	1.13.5 → 1.18.1	#71,74,82,83,85,86,87,88,96,97,105,109,110,111,112,114,118,132	high/med/low
dompurify	3.3.2 → 3.4.11	#72,76,77,78,121,123,124,125,127,128,130	med/low
form-data	4.0.5 → 4.0.6	#131	high
tmp	0.2.5 → 0.2.7	#103	high
simple-git	3.33.0 → 3.36.0	#95	high
basic-ftp	5.2.0 → 5.3.1	#63,67	high
fast-uri	3.1.0 → 3.1.3	#92,93	high
fast-xml-builder	1.1.4 → 1.2.0	#91	high
fast-xml-parser	5.5.6 → 5.9.3	#64,79	med
@babel/plugin-transform-modules-systemjs	7.28.5 → 7.29.7	#94	high
@babel/core (top)	7.29.0 → 7.29.7	—	low
lodash	4.17.23 → 4.18.1	#65,66	high/med
lodash-es	4.17.23 → 4.18.1	#59,60	high/med
webpack-dev-server	5.2.3 → 5.2.5	#99	med
serialize-javascript	7.0.4 → 7.0.6	#100	med
follow-redirects	1.15.11 → 1.16.0	#70	med
launch-editor	2.12.0 → 2.14.1	#129	med
ip-address	10.1.0 → 10.2.0	#81	med
yaml	1.10.2 → 1.10.3	#53	med
picomatch	2.3.1 → 2.3.2 & 4.0.3 → 4.0.4	#51,62	med

composer (composer.lock) — reused Dependabot-generated lock

package	old → new	alerts	severity
aws/aws-sdk-php	3.369.37 → 3.371.4	#56 (GHSA-27qh-8cxx-2cr5)	high

Applied the Dependabot lock from branch dependabot/composer/aws/aws-sdk-php-3.371.4; composer.json is byte-identical (content-hash matches), so this is the exact lock Dependabot generated. It also carries incidental in-range transitive bumps guzzlehttp/psr7 2.8.0→2.9.0 and symfony/filesystem v6.4.30→v6.4.34.

Why these are safe

All bumps are within the existing semver ranges in package.json/composer.json (same-major, no breaking range changes), produced by npm update --package-lock-only and a reused Dependabot composer.lock respectively.

How tested

Lockfile-only — NOT built/installed locally (disk-constrained; composer cannot be run in this environment). npm install/build and composer install were not executed locally. Please verify in CI. Both package-lock.json and composer.lock validate as JSON.

Residual risk — 10 alerts NOT fixed (require review)

alert	package	reason not fixed
#113→done	—	(CRITICAL fixed above)
#120	markdown-it	MAJOR 12 → 14 required; out of safe scope
#101	uuid	MAJOR 8/9 → 11 required; out of safe scope
#102	qs	patched 6.15.2 capped by express ~6.14.0 range; unreachable without major change
#126	dompurify	no patched version published
#138	@babel/core	nested 7.25.7 pinned by @wordpress/scripts; cannot bump without upstream change
#115, #116	guzzlehttp/psr7	need ≥2.10.2; only 2.9.0 reachable from available Dependabot lock; cannot regenerate composer.lock (composer unavailable)
#136	guzzlehttp/psr7	needs 2.12.1; same as above
#133, #134	guzzlehttp/guzzle	need 7.12.1; no Dependabot lock reaches it (stays 7.10.0); cannot regenerate composer.lock

DO NOT auto-merge — pending CI.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.