[tombrunet]

Security dependency upgrades — 2026-10-15

This PR applies semver-compatible (npm audit fix, no --force) security upgrades across 12 package-lock.json files in the equal-access monorepo. No package.json manifest versions were changed; all fixes are lock-file resolutions within existing declared ranges.

---

Findings addressed

CVE / Advisory	Package	Old version	New version	Severity
GHSA-7fh5-64p2-3v2j, GHSA-qx2v-qp2m-jg93, GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849	postcss	8.5.26 / 8.5.28	8.5.30	High
GHSA-5c6j-r48x-rmvq, GHSA-qj8w-gfj5-8c6v	serialize-javascript	7.1.1	7.1.2	High
GHSA-c475-qrg2-pj4r	basic-ftp	5.3.1	removed (no longer in resolved graph)	High
GHSA-vfj7-8cjw-p6xm	braces	affected range	resolved via transitive update	High

Findings NOT addressed (require semver-major upgrade or upstream action)

Package	Reason
jest / @jest/* family	Fix requires jest@30.5.2 (semver-major). Needs separate deliberate upgrade.
karma	Fix requires karma@4.0.0 (semver-major).
gulp / gulp-cli	Fix requires gulp@3.9.1 (semver-major downgrade from v4).
puppeteer / puppeteer-core	Fix requires puppeteer@20.3.0 (semver-major).
react-scripts / webpack-dev-server	No published fix version available (react-scripts fix placeholder is 0.0.0).
rule-server (tsoa-related)	Require --force; deferred for manual review.

---

Files changed

accessibility-checker-extension/package-lock.json
accessibility-checker-extension/test/package-lock.json
accessibility-checker/src/bin/achecker.js  (mode change only)
common/module/package-lock.json
cypress-accessibility-checker/boilerplates/package-lock.json
cypress-accessibility-checker/package-lock.json
package-lock.json
report-react/package-lock.json
rule-server/package-lock.json
vitest-accessibility-checker/boilerplates/vitest/package-lock.json
vitest-accessibility-checker/package-lock.json
vitest-accessibility-checker/src/package-lock.json

---

Test plan

1. The existing CI test suite (unit, integration, and accessibility rule tests across accessibility-checker-engine, accessibility-checker, karma-accessibility-checker, vitest-accessibility-checker, and cypress-accessibility-checker) validates that no regressions were introduced by these lock-file changes.
2. Only lock-file entries were modified; no runtime source code was changed (the achecker.js change is a file-mode bit only).
3. All updated packages (postcss, serialize-javascript, basic-ftp) are transitive devDependencies or build-time dependencies; they are not part of the published runtime artefacts.
4. Reviewer should confirm CI passes on this branch before merging.

---

Method

• updateDeps.sh run first (bulk npm update across all workspaces).
• npm audit fix (without --force) run in each workspace with high-severity findings.
• No secrets, tokens, or credentials were included at any stage.