Upgrade 3rd Party Javascript dependencies of JOC Cockpit due to multiple Vulnerabilities

Current Situation

JOC Cockpit 2.7.8 is affected by multiple 3rd party vulnerabilities.

• underscore 1.13.7
  • CVE-2026-27601
  • impact to our software:
    • Exploitation requires untrusted input to create deeply nested recursive data structures.
    • our rating: Low
• xmldom 0.8.11
  • CVE-2026-34601
  • impact to our software:
    • The vulnerability can result in unsafe XML serialization when handling CDATA sections.
    • our rating: Medium
• js-yaml 4.1.0
  • CVE-2025-64718
  • impact to our software:
    • The vulnerability allows prototype pollution through specially crafted YAML merge operations.
    • our rating: Low
• bn.js 4.12.2
  • CVE-2026-2739
  • impact to our software:
    • The vulnerability can cause the affected process to hang indefinitely when the vulnerable maskn(0) function is invoked, resulting in a Denial of Service (DoS) condition.
    • our rating: Low
• lodash / lodash-es 4.17.21
  • CVE-2025-13465, CVE-2026-2950, CVE-2026-4800 
  • impact to our software:
    • The reported vulnerabilities include prototype pollution and a critical code injection issue in _.template.
    • our rating: Low
• brace-expansion 1.1.12 / 2.0.2
  • CVE-2026-33750 
  • impact to our software:
    • The vulnerability can cause an infinite loop resulting in a Denial of Service (DoS) condition when processing specially crafted brace patterns. The affected package is used only by build/development tooling and is not exposed in the production runtime.
    • our rating: Low

Desired Behavior

JOC Cockpit should upgrade the 3rd party dependencies to use current versions where the vulnerabilites are already resolved.