fix(security): upgrade vendored JS libs to patched versions

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased] 
 
+### Security
+- Upgrade vendored JS libraries to patched versions, resolving Trivy findings:
+  - `underscore` 1.7.0 → 1.13.8 (CVE-2021-23358 critical, CVE-2026-27601 high)
+  - `angular` 1.4.14 → 1.8.3 (CVE-2019-10768 high)
+  - `prism` 1.0.1 → 1.30.0 (CVE-2021-23341, CVE-2021-32723 high)
+
 
 ## [2.1.2] - 2026-07-22
 

js/bower.json

@@ -2,13 +2,13 @@
   "name": "owncloud-notes",
   "version": "0.0.1",
   "dependencies": {
-    "angular": "1.4.*",
+    "angular": "1.8.3",
     "restangular": "1.3.*",
     "jquery": "2.1.*",
-    "underscore": "1.7.*",
-    "angular-mocks": "1.4.*",
-    "angular-route": "1.4.*",
-    "prism": "~1.0.1",
+    "underscore": "1.13.*",
+    "angular-mocks": "1.8.3",
+    "angular-route": "1.8.3",
+    "prism": "1.30.*",
     "mdEdit": "https://github.com/jbt/mdEdit.git#master"
   }
 }

js/vendor/angular-mocks/.bower.json

@@ -1,20 +1,20 @@
 {
   "name": "angular-mocks",
-  "version": "1.4.14",
+  "version": "1.8.3",
   "license": "MIT",
   "main": "./angular-mocks.js",
   "ignore": [],
   "dependencies": {
-    "angular": "1.4.14"
+    "angular": "1.8.3"
   },
   "homepage": "https://github.com/angular/bower-angular-mocks",
-  "_release": "1.4.14",
+  "_release": "1.8.3",
   "_resolution": {
     "type": "version",
-    "tag": "v1.4.14",
-    "commit": "d6d76294fbc8ee9e5d5b581968b775910b4e67d0"
+    "tag": "v1.8.3",
+    "commit": "3e622cd9a90cb953c5d877e2efe3504ac98b6c74"
   },
   "_source": "https://github.com/angular/bower-angular-mocks.git",
-  "_target": "1.4.*",
+  "_target": "1.8.3",
   "_originalSource": "angular-mocks"
 }

js/vendor/angular-mocks/README.md

@@ -1,8 +1,11 @@
 # packaged angular-mocks
 
-This repo is for distribution on `npm` and `bower`. The source for this module is in the
-[main AngularJS repo](https://github.com/angular/angular.js/tree/master/src/ngMock).
-Please file issues and pull requests against that repo.
+**This package contains the legacy AngularJS (version 1.x). AngularJS support has officially ended
+as of January 2022.
+[See what ending support means](https://docs.angularjs.org/misc/version-support-status) and
+[read the end of life announcement](https://goo.gle/angularjs-end-of-life).**
+
+**[See `@angular/core` for the actively supported Angular](https://npmjs.com/@angular/core).**
 
 ## Install
 
@@ -42,7 +45,7 @@ Documentation is available on the
 
 The MIT License
 
-Copyright (c) 2010-2015 Google, Inc. http://angularjs.org
+Copyright (c) 2022 Google LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal