Npm audit

[antobinary]

What

Npm audit fixes

Commit 1 — build: resolve npm audit advisories

Build tooling only, nothing that ships:

1. npm audit fix — every non-breaking resolution. This alone cleared both
   criticals (shell-quote, websocket-driver) and most highs.
2. The upgrades npm could not apply on its own:
   • copy-webpack-plugin ^12.0.2 -> ^14.0.0 (clears serialize-javascript)
   • webpack-dev-server ^4.15.1 -> ^6.0.0 (clears sockjs, uuid, and the
     webpack-dev-server source-disclosure advisory)
   • watch ^1.0.2 -> ^0.13.0

The watch change looks like a downgrade and is — but it is npm's own
resolution, not a hand-picked version. The 1.x line depends on exec-sh, which
pulls a prototype-pollution advisory in merge; 0.13 does not, and npm audit
reports the fix for all three as watch@0.13.0. It also matches the twelve
sibling repos already on ^0.13.0. It backs only the lint:watch convenience
script.

Commit 2 — build: upgrade shepherd.js 12 -> 15

shepherd.js ^12.0.5 -> ^15.3.0, clearing the last two high advisories: a
stack exhaustion in deepmerge-ts and the shepherd.js advisory itself. No
earlier release fixes them, so this is the only route to a clean audit.

Please read: commit 2 changes shipped code

Unlike everything else in this PR — and everything in the equivalent PRs on the
other fourteen plugins — shepherd.js is a runtime dependency. It is the tour
UI library itself, and it does ship in the bundle. This is a three-major jump.

It is kept as its own commit so it can be dropped independently if you would
rather take the build-tooling fixes now and handle the library separately. Doing
so leaves the repo at 2 high advisories rather than 0.

What was verified:

• Shepherd.Tour, Shepherd.on and Shepherd.off — the entire API surface
  src/tour/component.tsx uses — are all still present on the default export.
• The shepherd.js/dist/css/shepherd.css import path is unchanged.
• tsc, eslint and the production bundle all pass.

What was not verified: anything visual or behavioural. Three majors of a
tour UI library can change markup, theming, step positioning or overlay
behaviour in ways no build or typecheck will catch, and this could not be
exercised without a live BigBlueButton server.

Please walk through the actual tour on a real server before this ships.

Testing

Against Node 24.20.0, at the tip of the branch:

• npm ci — PASS
• npx tsc — PASS
• npm run lint — PASS
• npm run build-bundle — PASS
• npm audit — 0 vulnerabilities

webpack-dev-server 6 is a major bump with breaking config changes, and a
successful production build does not exercise the dev-server path at all. It was
verified separately by starting the dev server and confirming the custom
setupMiddlewares / devServer.app.get('/manifest.json') route still answers
200 with the correct body.

Notes for review

The package-lock.json diff is large because the whole dev dependency tree was
re-resolved. package.json is the meaningful diff: four version bumps across
the two commits.

[imdt-claudiop]

Leaving this as a comment rather than an approval, because one item here goes beyond what a build test can cover.

The build side checks out. On Node 24.9.0: npm audit goes from 49 vulnerabilities (28 high, 2 critical) on the base branch to 0, npm install is clean with no lockfile drift, npx tsc and npm run lint pass, npm run build-bundle produces dist/TourPlugin.js, and npm start still serves (this repo's webpack.config.js already uses setupMiddlewares, so the dev-server upgrade needs no config change).

What differs from bigbluebutton/bbb-plugin-picture-in-picture#45, which only moved copy-webpack-plugin and webpack-dev-server, is the shepherd.js ^12.0.5 to ^15.3.0 bump: three major versions of the library that renders the tour itself. It is genuinely audit-driven, since shepherd.js is flagged on the base branch, and the static signals are reassuring: types compile, and shepherd.js/dist/css/shepherd.css still resolves into the bundle. But three majors of a UI library can move markup, CSS class names and step positioning, and none of that shows up in a build.

Could someone run the tour once against a server before this merges? Happy to do that here if it helps. I just did not want an approval to imply the visual side was covered, when what I verified was the build.

Two smaller notes:

1. The title here is "Npm audit" while the sibling PRs in the other plugin repos use "build: resolve npm audit advisories". Worth aligning, since these titles end up in the changelog.
2. watch ^1.0.2 to ^0.13.0 reads as a downgrade, and it is one, but it is the right call: it drops the vulnerable exec-sh chain, and 0.13.0 is what picture-in-picture already carries.