Upgrade codemirror 5.65.16 to version 6.0.2 due to 3rd-party vulnerability CVE-2025-6493

Current Stuation

Currently JS7 JOC-Cockpit ships with codemirror 5.65.18 which is affected by CVE-2025-6493.

We rate the impact to our software as low as whatever is typed inside the script editor is treated as plain text for editing and highlighting, not as executable HTML/JavaScript. Even if someone pastes malicious HTML/JS code, it will never be executed inside the browser.

Desired Behavior

JS7 should use codemirror version 6.0.2 which solves the issue.

 Maintainer Note

This issue is dismissed as

• codemirror 6.0.2 introduces 3rd-party packages that include new vulnerabilities.
• it will take more effort to drop use of codemirror.
  • codemirror will be removed from releases 2.7.7 and 2.8.2.
  • There will not be a fix for release 2.5.12 or later releases as the change to remove codemirror is too big and is not acceptable for the LTS phase of the branch.