14-Jul-2026 — resolve open Dependabot vulnerability alerts ref #316

build 776 — commit c6f16c2

Clears all 14 open Dependabot alerts (3 high, 7 medium, 4 low) with four dependency changes, plus a fifth pre-emptive fix.

The direct nodemailer pin (9.0.3) was never vulnerable: all eight nodemailer alerts were against the stale 6.9.16 copy nested under mailparser 3.7.2. Bumping mailparser drops that copy along with the vulnerable linkify-it, so a single bump clears ten alerts.

• mailparser 3.7.2 -> 3.9.14 (clears the 8 nodemailer alerts, the mailparser XSS, and the linkify-it quadratic scan; nodemailer and linkify-it now resolve to single patched copies at 9.0.3 and 5.0.2)
• morgan 1.10.1 -> 1.11.0 (log forging via control characters in :remote-user)
• serialize-javascript override to 7.0.7 in server (high-severity RCE via RegExp.flags, plus CPU exhaustion DoS). An override is the only route: even mocha 11.7.6 still declares serialize-javascript@^6.0.2
• @babel/core override to 7.29.7 at root, collapsing the 7.29.0 copy nested under @angular/compiler-cli (dev only, arbitrary file read via sourceMappingURL)
• uuid override to 11.1.1 in server. Not yet reported by Dependabot because it arrives with exceljs (ref #315), which is not yet on origin/main. exceljs 4.4.0 pins uuid ^8.3.0, which has a missing buffer bounds check in v3/v5/v6. Not reachable in practice (exceljs only calls v4, without a buffer), but it would be raised as an alert as soon as #315 is pushed.

npm audit reports 0 vulnerabilities in both projects. Server typecheck clean, 879 server unit tests passing, production Angular build succeeds, and exceljs xlsx write/read round-trips correctly against uuid 11.