plupload was released as a newer version of the 2.x branch. While the release was triggered by security issues (https://nvd.nist.gov/vuln/detail/CVE-2021-23562), these parts of plupload are not used in phpBB and hence do not affect us. To not get any false positive alerts about using a vulnerable version of plupload, we should however still update it.