Executing the npm audit. It will be enough to show just last three issues - all of them has "fix available via `npm audit fix" message:

All dependencies mentioned above are transitive ones, it means none of them has been directly installed thus none of them listed in package.json.
Executing npm audit fix. As you see the message is completely the same, and the number of vulnerabilities has not changed:

Does npm audit fix do nothing?
Versions;
Node.js: 22.15.0 (current Maintenance LTS)
npm: 10.9.0
npm audit fixdo nothing?" - no.