[Geliogabalus]

Description

Clears most of the open Dependabot alerts and removes comments that no longer suppress anything. Only development dependencies change; no published package changes its runtime dependencies, so the changeset is empty.

• Dependencies (chore(deps) commits):
  • webpack 5.112.0 and webpack-dev-server 5.2.7 in joint-core and the webpack-based examples
  • The examples still on webpack-dev-server 4 (anchors-ts, bezier-js, connection-points-ts, layout-msagl, offscreen-rendering) move to webpack-cli 6 and webpack-dev-server 5, because v4 has no patched release. Their configs only use devServer.static, which v5 keeps.
  • rollup 4.64.12 (GHSA-mw96-cpmx-2vgc), @babel/core 7.29.6, requirejs 2.3.8, async 2.6.4, shelljs 0.8.5
  • Vulnerable transitive packages are re-resolved within their existing ranges (yarn up -R); express and qs once more after the first pass picked a qs with another advisory
• Code scanning: removes the // lgtm [js/xss-through-dom] comments in V/index.mjs and util.mjs. LGTM.com is shut down and GitHub code scanning ignores them, so they suppress nothing and the three alerts on those lines stay open.

Note

The CodeQL check reports 3 new alerts (#98, #99, #100). They are #75, #76 and #77 under new numbers, not new findings. Code scanning matches an alert to earlier ones by a hash of the flagged line's text, and removing the comment changes that text. After merging, #75–#77 close as fixed and #98–#100 stay open, so the count does not change. The alert is a false positive: the flagged sinks are appendChild(node) calls, which never parse text as HTML, and CodeQL treats the element returned by the attr() setter as if it were the attribute object the getter returns. Please dismiss #98–#100 as false positive.

Motivation and Context

GitHub's dependency review of this branch against master reports 297 vulnerabilities fixed (7 critical, 81 high, 169 moderate, 40 low) and none introduced.

Not covered, because each needs a major upgrade:

• examples/angular-element-view-ts (Angular 19 has no patched 19.x release)
• Packages held back by old parents: [email protected] through brilliant-errors, happy-dom@8, chokidar@2, copy-webpack-plugin@5, @angular-devkit 19
• The standalone packages/joint-core/demo/*/yarn.lock files

Merge before the matching JointJS+ PR. Its lockfile already resolves these versions, so its CI install fails until this PR is on master.

Testing

• @joint/core: yarn build and grunt test. All suites pass apart from two karma tests that also fail on master on Windows (util.breakText ellipsis, port labels label attributes).
• Examples: anchors-ts (webpack-dev-server 4 to 5), layout-msagl, dwdm and layout-directed-graph build with webpack 5.112.0, and the anchors-ts dev server starts and serves the page.

🤖 Generated with Claude Code