Packages which can't be updated easily

This issue is for tracking those packages where a simple update is not possible, and the reason why.

The intent is simply to avoid wasting effort on retrying the non-trivial updates when doing a general dependencies cleanup.

PRs to address the "requires code change" cases are most welcome.

Please also add a comment if further cases are found.

| Package | Version Limit | Reason |
|---------|---------------|--------|
| @xmldom/xmldom | < 0.9.0 | requires code change |
| ~~bcryptjs~~ | ~~< 3.0.0~~ | ~~requires code change~~ |
| bootstrap | < 5.0.0 | requires code change |
| ~~bson~~ | ~~< 5.0.0~~ | ~~requires code change and tests fail with the most obvious/trivial changes~~ |
| ~~cbor~~ | ~~< 10.0.0~~ | ~~requires newer node version~~ |
| ~~compression-webpack-plugin~~ | ~~<12.0.0~~ | ~~requires node >= 20.9.0~~ |
| ~~copy-webpack-plugin~~ | ~~<14.0.0~~ | ~~requires node: >= 20.9.0~~ |
| ~~cspell~~ | ~~< 9.0.0~~ | ~~requires newer node version~~ |
| ~~eslint~~ | ~~< 10.0.0~~ | ~~requires newer node version~~ |
| ~~eslint-plugin-jsdoc~~ | ~~< 51.0.0~~ | ~~requires newer node version~~ |
| fernet | < 0.4.0 | 0.3.3 is actually a later release than 0.4.0 |
| geodesy | < 2.0.0 | can't load js modules into an mjs file |
| jimp | < 1.6.1 | 1.6.1 is a faulty release (see https://github.com/jimp-dev/jimp/issues/1402) and breaks everything! (hopefully any subsequent release will fix this) |
| jq-web | < 0.6.0 | fails when fetching wasm file (#2209)|
| jquery | <4.0.0 | clash with bootstrap peer dependency |
| ~~otpauth~~ | ~~< 9.4.0~~ | ~~requires newer node version~~ |
| ~~sitemap~~ | ~~< 9.0.0~~ | ~~no longer provides default export - requires code change~~ |
| ~~uuid~~ | ~~< 14.0.0~~ | ~~requires node >= 19 (expects crypto to be built in)~~ |
| ~~webpack~~ | ~~< 5.110.0~~ | ~~requires a code an/or config change (version 5.110.0+ throws errors on build) (#2778)~~ |
| ~~webpack-dev-server~~ | ~~< 5.1.0~~ | ~~requires newer node version~~ |

Start by reviewing the package/version table and the referenced issues #2209 and #2778; no source files, tests, or entry points are named in this issue. Done means addressing a listed package's stated incompatibility and updating the dependency cleanup tracking with the resulting status.

Written by the indexing model from the issue text.