Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#46099] - [5.4] Update Composer and NPM dependencies for 5.4.0-rc1

Composer Dependency Changed NPM Resource Changed PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
14 Sep 2025

Pull Request for Issue # .

Summary of Changes

This pull request (PR) updates Composer and NPM dependencies for the upcoming 5.4.0-rc1 release.

All updates of non-development dependencies are minor or patch version updates only, there are no major updates.

For development dependencies some major updates are made. They work for the CMS core and produce b/c results, and we do not ship them with our packages.

The most notable change is the NPM dependency update of bootstrap from 5.3.7 to 5.3.8.

It adds the following to our template.css files:

[type="search"]::-webkit-search-cancel-button {
  cursor: pointer;
  filter: grayscale();
}

In addition it adds a flex-shrink: 0; property to the .spinner-grow, .spinner-border { sections.

See twbs/bootstrap#41639 and twbs/bootstrap#41654 for details.

Besides this I have not seen any notable changes, only bug fixes and improvements.

There may meanwhile be again updates for some dependencies available, but this PR here is in synch with the merged 6.0-dev PR #46100 for the common update for both branches, so I will not update this PR here but if necessary make new ones later.

Updated dependencies

Composer Dependencies (non-dev)

NPM Dependencies (non-dev)

Composer Dependencies (dev)

NPM Dependencies (dev)

Testing Instructions

Test 1: Check package build - Variant 1

This test shall verify that building the packages (which includes composer install and npm ci) still works and the installation package shows only the expected differences compared to a package created without this PR.

It requires to have a development environment (git clone, composer, npm) with runs either on a unixoid OS (Linux, Mac), or if on Windows it needs WSL2 and a Linux filesystem for the git clone.

If you don't have all that or are not familiar with development and package building, skip this test variant 1 and go to the next section for variant 2.

The description below assumes that you have a git clone of your fork with origin being the remote for your fork, and upstream being the remote to this repository here, as it is with a standard installation of GitHub desktop or most other Git clients.

  1. Checkout your 5.4-dev branch and make sure that your branch is clean and up to date with the upstream 5.4-dev branch:
git clean -d -x -f
git checkout .
git checkout 5.4-dev
git remote update
git reset --hard upstream/5.4-dev
  1. Build packages from the current branch (i.e. remote=HEAD) and redirect the output into a log file:
php ./build/build.php --remote=HEAD 2>&1 | tee ./tmp/build.log
  1. Check that the created packages in the build/tmp/packages folder are complete and have plausible sizes:
ls -al ./build/tmp/packages/
  1. Save the full installation zip package build/tmp/packages/Joomla_5.4.0-beta4-dev-Development-Full_Package.zip somewhere outside your git clone, e.g. in a folder test-pr-46099-before your home directory:
md ~/test-pr-46099-before
cp ./build/tmp/packages/Joomla_5.4.0-beta4-dev-Development-Full_Package.zip ~/test-pr-46099-before/
  1. Copy the log file from step 2 to the same place:
cp ./tmp/build.log ~/test-pr-46099-before/
  1. Clean up the branch
git clean -d -x -f
git checkout .
  1. Fetch this pull request into a new local branch and check out that branch:
git fetch upstream pull/46099/head:test-pr-46099
git checkout test-pr-46099
  1. Same as steps 2 to 5, but with a different folder outside of the git clone to save the results:
php ./build/build.php --remote=HEAD 2>&1 | tee ./tmp/build.log
ls -al ./build/tmp/packages/
md ~/test-pr-46099-after
cp ./build/tmp/packages/Joomla_5.4.0-beta4-dev-Development-Full_Package.zip ~/test-pr-46099-after/
cp ./tmp/build.log ~/test-pr-46099-after/
  1. Unpack the full installation zip packages (one without this PR and one with this PR) into 2 separate folders.
  2. Compare the content of the packages with a good comparison tool, e.g. Beyond Compare, TotalCommander, Meld, ...
    Result: See section "Expected result AFTER applying this Pull Request" below.
  3. Compare the 2 logs (one without and one with this PR) from the previous steps.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Test 1: Check package build - Variant 2

If you have executed the test in the previous section "Test 1: Check package build - Variant 1", you can skip the test here and directly continue with the next section "Test 2: Check if Joomla still works".

  1. Download the latest 5.4 nightly build full installation zip package from here:
    https://developer.joomla.org/nightlies/Joomla_5.4.0-beta4-dev-Development-Full_Package.zip
  2. Download the full installation zip package created by Drone for this PR from here:
    https://artifacts.joomla.org/drone/joomla/joomla-cms/5.4-dev/46099/downloads/88167/Joomla_5.4.0-beta4-dev+pr.46099-Development-Full_Package.zip
  3. Unpack the packages downloaded in the previous 2 steps into 2 separate folders.
  4. Compare the content of the packages with a good comparison tool, e.g. Beyond Compare, TotalCommander, Meld, ...
    Result: See section "Expected result AFTER applying this Pull Request" below.
  5. Download the log of the "Packages" step of Drone CI for the last commit in the 5.4-dev branch of the CMS repo.
    You can find it here: https://ci.joomla.org/joomla/joomla-cms/88010/1/2
    Select the "Packager" step at the left side, then use the download button at the top right corner of the console lo area.
  6. Do the same for the log of the "Packages" step of Drone CI for this PR.
    You can find it here: https://ci.joomla.org/joomla/joomla-cms/88103/1/2
    Select the "Packager" step at the left side, then use the download button at the top right corner of the console lo area.
  7. Compare the 2 logs downloaded in the 2 previous steps.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Test 2: Check if Joomla still works

  1. Make a new installation with the full installation zip package for this PR, using the package from the previous test 1.
  2. Check that everything looks and works as usual.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Actual result BEFORE applying this Pull Request

Not applicable.

Expected result AFTER applying this Pull Request

When comparing the 2 installation zip packages, only the following differences can be found:

  • Updated dependencies in the libraries/vendor folder or subfolders
  • Notable differences mentioned in section "Summary of Changes" for the "bootstrap" update

Besides that, only the usual changes between 2 consecutive builds can be found, i.e. different ordering of assets in joomla.assets.json files and versions in css or js files.

When comparing the log files you can see the different versions in the composer install step.

The npm ci step may differ much due to the random order of processing dependencies and compiling assets due to the asynchronous execution of the dependency installation and the compilation steps.

But there are no new warnings shown at the beginning of that step, and at the end the summary is the same, too.

The installation made with the installation package for this PR looks and works as well as before.

There may meanwhile be again updates for some dependencies available, but this PR here is in synch with the merged 6.0-dev PR #46100 for the common update for both branches, so I will not update this PR here but if necessary make new ones later.

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 14 Sep 2025
Category ⇒ External Library Composer Change NPM Change
avatar richard67 richard67 - change - 14 Sep 2025
Title
…
[5.4] Update [WiP] Composer and NPM dependencies for 5.4.0-rc1
[5.4] [WiP] Update Composer and NPM dependencies for 5.4.0-rc1
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
Labels Added: Composer Dependency Changed NPM Resource Changed PR-5.4-dev
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 16 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 16 Sep 2025
avatar richard67 richard67 - change - 16 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 16 Sep 2025
avatar richard67 richard67 - change - 16 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 16 Sep 2025
avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
Title
…
[5.4] [WiP] Update Composer and NPM dependencies for 5.4.0-rc1
[5.4] Update Composer and NPM dependencies for 5.4.0-rc1
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 20 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 20 Sep 2025
avatar richard67 richard67 - change - 20 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 20 Sep 2025
avatar richard67 richard67 - change - 20 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 20 Sep 2025
avatar richard67 richard67 - change - 20 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 20 Sep 2025
avatar brianteeman
brianteeman - comment - 20 Sep 2025
Package Current Wanted Latest Location
eslint 9.35.0 9.36.0 9.36.0 node_modules/eslint
rollup 4.51.0 4.52.0 4.52.0 node_modules/rollup
sass-embedded 1.92.1 1.93.0 1.93.0 node_modules/sass-embedded
avatar richard67
richard67 - comment - 20 Sep 2025

@brianteeman Please see the updated description (and also the end of the expected result in the testin instructions):

There may meanwhile be again updates for some dependencies available, but this PR here is in synch with the merged 6.0-dev PR #46100 for the common update for both branches, so I will not update this PR here but if necessary make new ones later.

avatar richard67
richard67 - comment - 20 Sep 2025

P.S.: Another things is that these dependencies have updates every few days, some even daily, so we will for sure not be 100% up to date when we build RC 1.

avatar brianteeman
brianteeman - comment - 21 Sep 2025

Sorry I cannot mark this as successful/unsuccessful - maybe its me not understanding or following the instructions but my comparison of a local checkout composer and npm ci and the compared to the download from this repo shows very different css. Specifically the local build css in the media folders have comments and headers that are all removed from the downloaded version

example

image
avatar richard67
richard67 - comment - 21 Sep 2025

@brianteeman That's just the copyright comment in the minified versions. We have already merged the same dependency update for bootstrap into 6.0-dev with PR #46100 .

@dgrammatiko Do you have an idea why that has changed (see Brian's screenshot in his comment above, left hand side = with this PR, right hand side = without it)? Is it due to an update for the stylelint or rollup or something like that, or is it due to the bootstrap update?

avatar brianteeman
brianteeman - comment - 21 Sep 2025

Then it is wrong as we MUST NOT remove the copyright statements ever. It is a breach of the licence

There were other changes in the CSS I observed such as removal of comments (which can be useful) and element ordering but thats just taste

The js files maintained the copyright headers if that helps you find the problem

avatar richard67
richard67 - comment - 21 Sep 2025

Then it is wrong as we MUST NOT remove the copyright statements ever. It is a breach of the licence

There were other changes in the CSS I observed such as removal of comments (which can be useful) and element ordering but thats just taste

The js files maintained the copyright headers if that helps you find the problem

@brianteeman I see its vice versa to what I saw first. Right hand side is with this PR, left hand side without?

avatar brianteeman
brianteeman - comment - 21 Sep 2025

Left hand side was the result of a checkout of this branch followed by composer install and npm i
Right hand side was the downloaded package from this PR

avatar brianteeman
brianteeman - comment - 21 Sep 2025

but as i also said " maybe its me not understanding"

avatar richard67
richard67 - comment - 21 Sep 2025

Left hand side was the result of a checkout of this branch followed by composer install and npm i Right hand side was the downloaded package from this PR

@brianteeman Hmm, the testing instructions say to compare the packages with and without this PR after a build.php run or from a download. The difference between running composer install and npm ci and building a package might be that the package build has the additional step to create the gzipped resources. And possibly also the versioning is different.

What happens if you clean up your branch and then change back to the normasl 5.4-dev branch and compare that with a normal 5.4-dev nightly build? I would assume you see the same differences, and that was not changed with this PR here.

avatar richard67
richard67 - comment - 21 Sep 2025

When I compare packages I do not see these differences.

avatar brianteeman
brianteeman - comment - 21 Sep 2025

I will check again this afternoon

avatar brianteeman
brianteeman - comment - 21 Sep 2025

so i just checked the 5.3.3 release package and in that package I also observe that the copyright header is removed from media\vendor\bootstrap\css\bootstrap.min.css when it is present in a local build. So there is a problem somewhere with the build scripts as we must not remove the copyright headers. This also matches with a report from a user #45674 (comment)

avatar richard67
richard67 - comment - 21 Sep 2025

@brianteeman But it's not related to this PR here, right? It happens with and without this PR, comparing a developer build and a package, right?

avatar richard67
richard67 - comment - 21 Sep 2025

If I'm right and it's not related to this PR here, we should handle it separately with an extra issue.

avatar brianteeman
brianteeman - comment - 21 Sep 2025

yes thats right which is why I just raised an issue for it #46140

avatar richard67
richard67 - comment - 21 Sep 2025

Thanks.

avatar richard67
richard67 - comment - 21 Sep 2025

@brianteeman Something wrong with this PR? Or jost no time to continue testing?

avatar brianteeman
brianteeman - comment - 21 Sep 2025

No time and I won't have any until Thursday. https://share.google/WpQsDbV3vTnRpKLFG

avatar muhme muhme - test_item - 22 Sep 2025 - Tested successfully
avatar muhme
muhme - comment - 22 Sep 2025

I have tested this item ✅ successfully on 0111d84

* ✅ Test 1. variant 1 with JBT 5.4-dev against gh pr checkout 46099

  • Roughly compared build output with diff, after unifying the build number
    • Changed and more deprecations from .scss files
  • A rough comparison of both versions unzipped
    • After removing of librariesand media/vendor folders 37 files differ
    • Some file content exist with different content orders e.g. media/system/joomla.asset.json (as usually between build runs)
    • Something is added as the already named changes with NPM dependency update of bootstrap from 5.3.7 to 5.3.8.
    • With the @vue/shared update there are changes in media/com_media/js/media-manager.js file
  • ✅ Test 2. Updated existing 5.3.3 live sites clones
    • Enabled 'Debug System' and 'Log Almost Everything'
    • Updated with Joomla_5.4.0-beta4-dev+pr.46099-Development-Update_Package.zip
    • 1st site clone (multilingual site with 5 lanaguages and zitat-service.de module)
      • Frontend is still working
      • Created a user and an article
      • Checked joomla and PHP log
    • 2nd site clone (small site with some articles and > 1.000 images)
      • Frontend is still working
      • Created a user and an article
      • Checked joomla and PHP log
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46099.
avatar muhme muhme - close - 22 Sep 2025
avatar muhme muhme - merge - 22 Sep 2025
avatar muhme muhme - change - 22 Sep 2025
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2025-09-22 12:27:39
Closed_By ⇒ muhme
avatar muhme
muhme - comment - 22 Sep 2025

Big thank you @richard67 for all the detailed work with this PR. Thank you @rdeutz for your review. Thank you @dgrammatiko and @brianteeman for supporting this PR.

Add a Comment

Login with GitHub to post a comment