[oleksandr-nc]

npm audit reports 100 advisories against main, 4 of them critical; 6 remain, none critical. This updates every flagged package whose patched release leaves the built files as they are, plus dompurify, moment and webdav, which ship, and vitest. What remains is build tooling that only releases changing the minified output fix (terser-webpack-plugin, @nextcloud/webpack-vue-config 7.1) or that has no patched release (braces), and vue's server-side renderer, which the app does not use.

What ships changes

• dompurify 3.3.1 → 3.4.17 (through @nextcloud/l10n and @nextcloud/vue): sanitiser fixes for IN_PLACE mode, hooks and the tag and attribute allow-list options, plus two mutation-XSS fixes in the default configuration that @nextcloud/l10n and NcIconSvgWrapper use. The app's translations and the icons NcIconSvgWrapper renders come out the same on both releases.
• moment 2.30.1 → 2.31.0 (through @nextcloud/moment): formats the dates on the board details. Of the locale fixes in this release, only Catalan changes those dates, which now write a typographic apostrophe (d’abril, d’agost, d’octubre).
• webdav 5.8.0 → 5.11.0 (through @nextcloud/dialogs and @nextcloud/files): only the @nextcloud/dialogs vendor chunk that holds @nextcloud/files and webdav changes (+52 KB), and the app never loads it. webdav's prebuilt browser bundle in it now carries fast-xml-parser 5 instead of 4; the lock's own fast-xml-parser (4.5.3 → 5.11.2) is not part of the built files.

Not in the built files

• vitest and @vitest/coverage-v8 4.1.11 → 4.1.12 (package.json ^4.1.12): the two pin each other exactly, so they move together.
• babel 7.29, browserslist 4.29.4 with caniuse-lite, express 4.22.3 with body-parser and path-to-regexp, webpack-dev-server 5.2.7 with ws, http-proxy-middleware and selfsigned 5 (which drops node-forge for @peculiar/x509 and pkijs), shell-quote 1.12.0, minimatch 9.0.9, follow-redirects 1.16.1 (axios's Node adapter), qs 6.16.1, fast-uri 3.1.9, pbkdf2 3.1.7, js-yaml 4.3.2, and the smaller packages they pull along.

npm 11.19 also recomputes the peer flag of about 550 entries whose version stays the same; it rewrites main's lock the same way.

🤖 AI (if applicable)

• The content of this PR was partly or fully generated using AI