[kumilingus]

Summary

Several dev dependencies of the joint workspaces pull in old, vulnerable transitive packages (browserify 16 → elliptic, chokidar 2 → braces 2 / micromatch 3 / decode-uri-component, xml2js, pinned lodash / minimatch / js-yaml / serialize-javascript). This removes the grunt plugins that do little or nothing, and upgrades the parents that pin vulnerable versions instead of overriding them with resolutions.

@joint/core grunt setup

Removed	Replacement
load-grunt-config, jit-grunt	~25-line loader in Gruntfile.js: grunt/config/<name>.js → task config, aliases.js → registerTask, every grunt-* devDependency loaded with loadNpmTasks; pkg stays in the config
grunt-ts	shell:ts-test / shell:ts-test-exports → tsc --noEmit -p test/ts{,-exports}/tsconfig.json
grunt-mocha-test	shell:mocha-server → mocha --reporter spec "test/*-nodejs/*" (grunt-mocha-test does not support mocha 12)
grunt-browserify, grunt-webpack, webpack	none: test/jointjs/browserify.html and the webpack bundle are removed (no test loaded the webpack bundle). test:bundles keeps the requirejs pages for joint, geometry and vectorizer
grunt-contrib-watch	none: only the default alias used it
es-module-shims, should, webpack-dev-server	none: not referenced

The root build-bundles script (only @joint/core defined it) is removed, together with its CLAUDE.md mention.

Upgrades

Package	From	To	Fixes
grunt (@joint/core)	1.6.1	1.6.3	minimatch ^3.1.5, js-yaml ^3.15.0
mocha (@joint/core, @joint/layout-directed-graph)	11.1.0	12.0.3	serialize-javascript ^7
lodash (@joint/core)	~4.17.21	^4.18.1	lodash
@rollup/plugin-terser (layout-directed-graph, layout-elk, layout-msagl, router-avoid)	^0.4.4	^1.0.2	serialize-javascript ^7
copy-webpack-plugin (examples avoid-router-ts, layout-directed-graph, libavoid)	5.1.1	14.0.0	serialize-javascript ^7; the config now takes { patterns: [...] }
@angular-devkit/build-angular → @angular/build (example angular-element-view-ts)	^19.2.0	^19.2.0	serialize-javascript 6 (via copy-webpack-plugin 12); the example already used the esbuild application builder, now taken from @angular/build
@vue/test-utils (@joint/vitest-plugin-mock-svg, ^2.4.6)	2.4.6	2.5.1 (refreshed in range)	minimatch 9.0.1: 2.5 moves to js-beautify 2 → editorconfig 3
grunt-legacy-log / -util, terser-webpack-plugin		refreshed in range	lodash ^4.18, serialize-javascript

Not included

• eslint-plugin-sonarjs 4 (would fix minimatch 9.0.5): 4.2.2, the latest, crashes on packages/joint-react/src/__tests__/internal.test.ts (sonarjs/assertions-in-tests: Cannot read properties of undefined (reading 'declarations')). Left for a follow-up.

Note: while trying sonarjs 4, re-resolving the lockfile moved sonarjs 3's typescript: ">=5" dependency to TypeScript 7.0.2, which lacks the JS API sonarjs uses (SyntaxKind), and yarn lint crashed. The lockfile here is regenerated from master so that range stays on 5.9.3 - worth knowing for any future yarn up that touches it.

Testing

• yarn install --immutable: clean.
• Build output compared with master (diff -r of dist/): byte-identical for @joint/core (yarn dist, 10 files) and for layout-directed-graph, layout-elk, layout-msagl and router-avoid (113 files, including the terser .min.js).
• @joint/core yarn test: mocha 4 passing (as on master), karma geometry 350 / vectorizer 453 / joint 2179, QUnit requirejs pages 3 + 2 + 2, both tsc checks pass. shell:ts-test-exports fails on an injected type error.
• @joint/layout-directed-graph yarn test (mocha 12): 8 passing, karma 22.
• yarn lint: passes.
• Examples avoid-router-ts, layout-directed-graph and libavoid build with copy-webpack-plugin 14; index.html and libavoid.wasm are copied into dist/.
• @joint/vitest-plugin-mock-svg yarn test (after building @joint/mock-svg and the plugin): React and Vue typechecks pass, 2 / 2 tests.
• Example angular-element-view-ts builds with @angular/build (same output size as on master; the existing initial-bundle budget warning is unchanged).