Remove unused railroad-diagrams 1.0.0 due to 3rd-party vulnerability CVE-2024-26467

Current Situation

JS7 JOC Cockpit is flagged with a 3rd-party vulnerability in railroad-diagrams (1.0.0).

This dependency is introduced through the following transitive chain:
 
@cyclonedx/cyclonedx-npm@4.2.1
└─ ajv-formats-draft2019@1.6.1
└─ smtp-address-parser@1.1.0
└─ nearley@2.20.1
└─ railroad-diagrams@1.0.0
The package is included as part of the CycloneDX npm plugin, which is used to generate the SBOM (sbom.json) during build time.

Impact

• The railroad-diagrams package is not used in the application code.
• It is not included in any JavaScript bundle delivered to end users.
• It is only a transitive, build-time dependency and not part of runtime/production.
• The vulnerable component (generator.html) is not used or exposed in our context.

Therefore, the practical impact on JS7 JOC Cockpit is Low.

Desired Behavior

• The build-time dependency to railroad-diagrams should ideally be removed.
• JS7 JOC Cockpit should not be flagged for vulnerabilities related to this unused build-time component.

Maintainer Notes / Conclusion

• The railroad-diagrams (1.0.0) package is introduced indirectly via @cyclonedx/cyclonedx-npm for SBOM generation.
• There is no newer or patched version available (latest = 1.0.0).
• The dependency cannot be excluded from SBOM generation, as CycloneDX requires a complete dependency tree representation.
• The reported vulnerability (CVE-2024-26467) relates to a DOM-based XSS in a generator component that is not used in our setup.

Conclusion:
This vulnerability is not fixable at this time and is considered low risk, as it only affects development tooling and has no runtime impact.