Bump version to 2.0.4 and update changelog

[hueitan]

Phabricator: https://phabricator.wikimedia.org/T435320

Draft release, tag 1.1.14 https://github.com/wikimedia/language-data/releases/tag/untagged-5985ead8200d3bf86941

npm audit report

debug  4.0.0 - 4.3.0
Regular Expression Denial of Service in debug - https://github.com/advisories/GHSA-gxpj-cx7g-858c
fix available via `npm audit fix --force`
Will install mocha@11.8.0, which is a breaking change
node_modules/mocha/node_modules/debug
  mocha  5.1.0 - 12.0.0-beta-2
  Depends on vulnerable versions of debug
  Depends on vulnerable versions of diff
  Depends on vulnerable versions of js-yaml
  Depends on vulnerable versions of minimatch
  Depends on vulnerable versions of serialize-javascript
  node_modules/mocha

diff  4.0.0 - 4.0.3
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix --force`
Will install mocha@11.8.0, which is a breaking change
node_modules/diff

js-yaml  <=3.15.0
Severity: high
js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases - https://github.com/advisories/GHSA-h67p-54hq-rp68
js-yaml: YAML merge-key chains can force quadratic CPU consumption - https://github.com/advisories/GHSA-52cp-r559-cp3m
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported - https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
fix available via `npm audit fix --force`
Will install mocha@11.8.0, which is a breaking change
node_modules/mocha/node_modules/js-yaml

minimatch  <=3.1.3
Severity: high
minimatch ReDoS vulnerability - https://github.com/advisories/GHSA-f8q6-p94x-37v3
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix --force`
Will install mocha@11.8.0, which is a breaking change
node_modules/mocha/node_modules/minimatch

serialize-javascript  <=7.0.2
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
fix available via `npm audit fix --force`
Will install mocha@11.8.0, which is a breaking change
node_modules/serialize-javascript

6 vulnerabilities (2 low, 4 high)

add the overrides config change, because of the npm audit report

it can be fixed once mocha update them

diff  6.0.0 - 8.0.2
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix --force`
Will install mocha@11.3.0, which is a breaking change
node_modules/mocha/node_modules/diff
  mocha  8.2.0 - 12.0.0-beta-3
  Depends on vulnerable versions of diff
  Depends on vulnerable versions of serialize-javascript
  node_modules/mocha

serialize-javascript  <=7.0.4
Severity: high
Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq
Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - https://github.com/advisories/GHSA-qj8w-gfj5-8c6v
fix available via `npm audit fix --force`
Will install mocha@11.3.0, which is a breaking change
node_modules/mocha/node_modules/serialize-javascript

3 vulnerabilities (1 low, 1 moderate, 1 high)

[Copilot]

Pull request overview

This PR prepares a new Node.js package release by bumping @wikimedia/language-data to 2.0.4, updating the changelog for the 2026-08-24 release, and updating Node.js dev dependencies in response to npm audit findings.

Changes:

• Bump Node.js package version to 2.0.4.
• Upgrade mocha to 11.8.0 and add overrides to address vulnerable transitive deps.
• Add changelog entries for PHP 1.1.14 and Node.js 2.0.4 referencing the 2026-08-24 language updates.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Bumps version, upgrades mocha, adds dependency overrides for audit-related CVEs.
package-lock.json	Updates lockfile to reflect mocha upgrade and overridden transitive dependency versions.
CHANGELOG.md	Adds 2026-08-24 language updates and release headings for PHP 1.1.14 / Node.js 2.0.4.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.