build: resolve npm audit advisories

[antobinary]

What

Npm audit fixes

Applied in two passes:

1. npm audit fix — every non-breaking resolution. This alone cleared both
   criticals (shell-quote, websocket-driver) and most highs.
2. The upgrades npm could not apply on its own:
   • copy-webpack-plugin ^12.0.2 -> ^14.0.0 (clears serialize-javascript)
   • webpack-dev-server ^4.15.1 -> ^6.0.0 (clears sockjs, uuid, and the
     webpack-dev-server source-disclosure advisory)
   • watch ^1.0.2 -> ^0.13.0 (see below)

The watch change is not a mistake

It looks like a downgrade, and it is — but it is npm's own resolution for these
advisories, not a hand-picked version. The watch 1.x line depends on exec-sh,
which pulls a prototype-pollution advisory in merge; the 0.13 line does not.
npm audit reports the fix for all three (watch, exec-sh, merge) as
watch@0.13.0.

It also brings this repo in line with the majority: twelve of the fifteen plugin
repos already specify ^0.13.0. Only this one, media-popout and tour were
on 1.x.

watch backs a single convenience script, lint:watch (watch 'yarn lint'),
which is not used by CI or by any build or packaging step.

Scope

Everything changed here is build tooling. None of it ships in the bundle — the
plugin deploys a single bundled JS file, and these packages exist only to
produce it. The value is build-time supply-chain integrity rather than a runtime
exposure.

Testing

Against Node 24.20.0:

• npm ci — PASS
• npx tsc — PASS
• npm run lint — PASS
• npm run build-bundle — PASS
• npm run test:unit:coverage — PASS (vitest, full suite green)
• npm audit — 0 vulnerabilities

webpack-dev-server 6 is a major bump with breaking config changes, and a
successful production build does not exercise the dev-server path at all. It was
verified separately by starting the dev server and confirming the custom
setupMiddlewares / devServer.app.get('/manifest.json') route still answers
200 with the correct body.

The Playwright suite (npm test / test-chromium-ci) was not run — it needs a
live BigBlueButton server. Worth a run in CI on this branch before merge, since
this repo is the only one with browser-level coverage.

Notes for review

The package-lock.json diff is large because the whole dev dependency tree was
re-resolved. package.json is the meaningful diff: three version bumps.

[imdt-claudiop]

Requesting one change before this merges.

The webpack-dev-server 4 to 6 upgrade needs the matching webpack.config.js migration that went into bigbluebutton/bbb-plugin-picture-in-picture#45. onBeforeSetupMiddleware was removed in webpack-dev-server 5, so on 6.0.0 the dev server refuses to start:

[webpack-cli] Invalid options object. Dev Server has been initialized using an options object that does not match the API schema.
 - options has an unknown property 'onBeforeSetupMiddleware'. These properties are valid:
   object { allowedHosts?, bonjour?, client?, compress?, devMiddleware?, headers?, historyApiFallback?, host?, hot?, ipc?, liveReload?, onListening?, open?, port?, proxy?, server?, app?, setupExitSignals?, setupMiddlewares?, static?, watchFiles?, webSocketServer? }

Reproduced on Node 24.9.0: npm start exits with code 2 on this branch, while the same command on the base branch (webpack-dev-server 4.15.2) starts and stays up. Only the dev server path is affected, so CI stays green and npm run build-bundle is unaffected, which is why this is easy to miss.

The fix is the one already applied in the reference PR:

setupMiddlewares: (middlewares, devServer) => {
  if (!devServer) {
    throw new Error('webpack-dev-server is not defined');
  }
  // ... existing routes ...

  return middlewares;
},

Everything else checks out: npm install is clean with no lockfile drift, npm install is clean with no lockfile drift, and npx tsc, npm run lint and npm run build-bundle (producing dist/BbbPluginPickRandomUser.js) all pass.

Two other notes:

1. The audit is not fully resolved on this branch. It goes from 36 vulnerabilities (20 high, 2 critical) down to 3 moderate, all in the vitest toolchain (vitest, @vitest/mocker, @vitest/coverage-v8, via GHSA-82fw-gwwq-j7x9). They are dev-only, and npm audit --omit=dev is clean, so this is not urgent. Clearing them means a vitest major bump, which touches the test suite and is arguably its own PR. Either way, worth deciding deliberately rather than leaving the title promising more than the diff delivers.
2. watch ^1.0.2 to ^0.13.0 looks like a downgrade because it is one, but it is correct: it drops the vulnerable exec-sh chain, and 0.13.0 is what picture-in-picture already carries.