MWPW-195616 cumulative dependabot PRs

[npeltier]

https://jira.corp.adobe.com/browse/MWPW-195616
cumulative dependabot PRs :

PR	Title	Files touched
#759	basic-ftp 5.2.1 → 5.2.2	package-lock.json
#783	fast-xml-parser 5.5.7 → 5.7.1 (io/www)	io/www/package-lock.json
#802	fast-xml-parser + @aws-sdk/xml-builder	package-lock.json
#803	uuid 8.3.2 → 14.0.0	io/studio/package.json, package-lock.json
#804	axios 1.13.5 → 1.15.2	package-lock.json
#805	postcss 8.5.6 → 8.5.12	package-lock.json
#814	axios 1.13.5 → 1.15.2 (io/www)	io/www/package-lock.json
#815	uuid 8.3.2 → 14.0.0 (io/www)	io/www/package.json, io/www/package-lock.json
#847	fast-xml-builder 1.1.4 → 1.2.0 (/io/www)	io/www/package.json, io/www/package-lock.json
#848	fast-uri 3.0.3 → 3.1.2 (io/www)	io/www/package-lock.json
#850	fast-uri 3.1.0 → 3.1.2	package-lock.json
#900	qs + express	package-lock.json

[aem-code-sync]

Hello, I'm the AEM Code Sync Bot and I will run some actions to deploy your branch.
In case there are problems, just click the checkbox below to rerun the respective action.

• Re-sync branch

Commits

• 7f795b4 ❌ (latest)
• d43bee9 ❌
• e1d82cb ❌
• 08c295e ❌
• 662f3bd ❌
• 7c2050d ❌
• bce539b ✅
• 274eccc ❌
• 78624ca ❌
• f648cfc ❌
• 23e7a35 ❌
• 3160f5f ❌
• cdbeda3 ❌
• 78853b9 ❌
• c9c480b ❌
• 6b31e72 ❌
• a87c48a ❌
• a270105 ❌
• 0f17fed ❌
• e119491 ❌
• 2be727c ❌
• 649a109 ❌
• e0837da ❌
• d471717 ❌
• 97a034a ❌
• 5cd76f6 ❌
• e466571 ❌
• 9cee413 ❌
• 98f383e ❌
• 6fe36db ❌

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.89%. Comparing base (f15411b) to head (422b0a6).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #902      +/-   ##
==========================================
+ Coverage   88.85%   88.89%   +0.03%     
==========================================
  Files         242      242              
  Lines       71723    71723              
==========================================
+ Hits        63732    63758      +26     
+ Misses       7991     7965      -26     

see 4 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f15411b...422b0a6. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Axelcureno]

Overlaps with #907 (MWPW-193502), which fixes the same CVE class via overrides in io/www. This PR's io/www lockfile misses some:

• axios not bumped in io/www/package-lock.json (only root) — leaves 14 Kodiak axios CVEs open in io/www, incl. 2 Critical
• follow-redirects, diff, fast-uri — not updated in io/www
• uuid nested @azure/cosmos + cloudevents copies still 8.3.2

#907 also bumps CI Node 20→24 (MWPW-195210). Complementary (root vs io/www) but conflict on io/www/package.json — suggest coordinating merge order.

[Axelcureno]

Full list of CVEs can be found here: https://jira.corp.adobe.com/browse/MWPW-193502?filter=-1&jql=resolution%20%3D%20Unresolved%20AND%20description%20~%20Kodiak%20AND%20assignee%20in%20(currentUser())%20order%20by%20updated%20DESC