Upgrade to copy-webpack-plugin v14

[tdonohue]

References

• Patches a large number of development tool security issues by removing all usages of tar from our devDependencies.
  • Includes patching CVE-2026-23950, CVE-2026-24842, CVE-2026-31802, CVE-2026-23745, CVE-2026-29786 and CVE-2026-26960
  • NOTE: These security issues do NOT impact production. They only impact development.

Description

Upgrades us to the latest version of copy-webpack-plugin (version 14) which does not use tar anymore. The version of copy-webpack-plugin we currently use is five years old. So, upgrading also removes a large number of other older dependencies.

This upgrade was achieved by running:

npm install copy-webpack-plugin@latest -include=dev

This should probably also be backported to DSpace 9.x. However, it cannot be backported to DSpace 8.x because the latest version of copy-webpack-plugin requires Node 20+.

Instructions for Reviewers

• Verify build passes and all tests succeed
• Verify production and development builds still work properly
  • NOTE: I've already verified production build via npm run build:prod && npm run serve:ssr. No change in behavior.

[nwoodward]

Everything is working fine for me with npm run start:dev and npm run serve:ssr. I also tested IIIF using Mirador with npm run start:mirador:prod and didn't notice any new issues with the viewer. I'm +1.

[dspace-bot]

Backport failed for dspace-9_x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin dspace-9_x
git worktree add -d .worktree/backport-5417-to-dspace-9_x origin/dspace-9_x
cd .worktree/backport-5417-to-dspace-9_x
git switch --create backport-5417-to-dspace-9_x
git cherry-pick -x 8f0d3caf4c9b77fdc985739b0f5e10ab4ec9669d

[tdonohue]

Manually ported to 9.x in #5427