Upgrade 3rd Party Javascript dependencies of JOC Cockpit due to multiple Vulnerabilities

Current Situation

JOC Cockpit 2.7.8 is affected by multiple 3rd party vulnerabilities related to the Agular version in use.

• railroad-diagrams 1.0.0
  • CVE-2024-26467
  • impact to our software:
    • Zero runtime risk. It is never bundled into the Angular application and is not exposed to end users.
    • our rating: Low
• minimatch 5.1.9
  • CVE-2026-27904
  • impact to our software:
    • Zero runtime risk. All usages are limited to build-time tooling (replace.build.js and versioning.build.js) and use hardcoded glob patterns. Furthermore, versions >=5.1.8 are already patched for the 5.x release line, making this likely a false positive reported by the vulnerability scanner. 
    • our rating: Low
• Angular 18.2.0
  • CVE-2025-66035, CVE-2026-54266, CVE-2026-50171, CVE-2026-50170, CVE-2026-54268, CVE-2025-66412, CVE-2026-32635, CVE-2026-50557, CVE-2026-52725, CVE-2026-54267
  • impact to our software:
    • The reported vulnerabilities include XSRF information disclosure, XSS-related issues, namespace bypasses, and cache-key/DoS related problems. Fixes are available only in newer Angular releases.

Announcement

Fixing these vulnerabilities requires upgrading Angular and its related ecosystem packages, which is outside the scope of the 2.7.9 release.