Resolve Dependabot security alerts (534)

[danieldudzic]

Description

Resolves all Dependabot security alerts by updating vulnerable dependencies across npm and Composer lock files.

Root (package-lock.json):

• Updated minimatch to fix ReDoS vulnerabilities

Modules (paypal-pos-assets, paypal-pos-product-debug, paypal-pos-product-settings):

• Upgraded @symfony/webpack-encore from v4 to v6
• Bumped webpack-cli to ^6, postcss-loader to ^8, sass-loader to ^16
• Updated cleanupOutputBeforeBuild() calls in webpack configs (v6 breaking change)
• Resolves: serialize-javascript, webpack-dev-server, minimatch, immutable, node-forge, svgo, lodash, qs, js-yaml, ajv, tough-cookie, form-data vulnerabilities

Composer (composer.lock):

• Updated phpunit/phpunit from 9.6.29 to 9.6.34 (fixes CVE-2026-24765 unsafe deserialization)

Supersedes #7.

Steps to Test

1. Run npm audit in root, modules.local/paypal-pos-assets, modules.local/paypal-pos-product-debug, and modules.local/paypal-pos-product-settings — all should report 0 vulnerabilities
2. Run ddev composer audit — should report no security advisories
3. Run npx encore production in each of the 3 module directories — all builds should succeed

[private-packagist]

composer.lock

Dev Package changes

Package	Operation	From	To	About
doctrine/deprecations	upgrade	1.1.5	1.1.6	diff - changelog
nikic/php-parser	upgrade	v4.19.4	v4.19.5	diff - changelog
phpdocumentor/reflection-docblock	upgrade	5.6.3	5.6.7	diff - changelog
phpdocumentor/type-resolver	upgrade	1.10.0	1.12.0	diff - changelog
phpstan/phpdoc-parser	upgrade	2.3.0	2.3.2	diff - changelog
phpunit/phpunit	upgrade	9.6.29 ⚠️	9.6.34 ✅	diff - changelog
sebastian/comparator	upgrade	4.0.9	4.0.10	diff - changelog
theseer/tokenizer	upgrade	1.2.3	1.3.1	diff - changelog

---

Settings · Docs · Powered by Private Packagist