fix(deps): update vulnerable client dependencies

[appsmith-smithes]

Summary

Updates vulnerable client dependencies using direct version bumps and Yarn resolutions.

Resolved alerts

• [BUG] Empty query response shows empty table #747–750, Release #756, [FEATURE] Run appsmith on custom port #762–764 — nodemailer → 9.1.1
• [BUG] After picking a date in date picker, it's going out of range #751 — csv-parse → 7.0.2
• [BUG]Did not observe any item or terminal signal within 10000ms in 'onErrorResume' (and no fallback has been configured) #753, [BUG] Widget breaks when input value contains too many characters #755 — joi → 18.2.8
• Fixing merge issue with ShadeColor #757–760 — svgo → 2.8.4 / 3.3.5
• Update table icon #761 — js-yaml → 3.15.2

This is the CE source-of-truth counterpart to appsmith-ee PR #9706. The EE-only colord alert is not present in CE.

No code changes — dependency versions and resolutions only. Local yarn install --no-immutable and production build passed with Node 24.14.1.

/ok-to-test tags="@tag.All"

Tip

🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉
Workflow run: https://github.com/appsmithorg/appsmith/actions/runs/34344959521
Commit: be4f08b
Cypress dashboard.
Tags: @tag.All
Spec:

---

Wed, 09 Sep 2026 12:34:45 UTC