Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#46100] - [6.0] Update Composer and NPM dependencies for 6.0.0-rc1

Composer Dependency Changed Documentation Required NPM Resource Changed PR-6.0-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
14 Sep 2025

Pull Request for Issue # .

Summary of Changes

This pull request (PR) updates Composer and NPM dependencies for the upcoming 5.4.0-rc1 release.

It contains also the dependency updates from PR #46099 for 5.4-dev if relevant for 6.0-dev, too, so when both PRs, that one and this one here, have been merged, then at the next upmerge from 5.4-dev to 6.0-dev the conflicts in the files modified by these PRs can be solved by keeping the complete file from the 6.0-dev branch.

Major Updates

There are no major updates made for direct non-development composer dependencies.

For development dependencies (composer and NPM) some major updates are made. They work for the CMS core and produce b/c results, and we do not ship them with our packages.

For the following direct non-development NPM dependencies major updates are made:

Other Notable Updates

One notable change is the NPM dependency update of bootstrap from 5.3.7 to 5.3.8.

It adds the following to our template.css files:

[type="search"]::-webkit-search-cancel-button {
  cursor: pointer;
  filter: grayscale();
}

In addition it adds a flex-shrink: 0; property to the .spinner-grow, .spinner-border { sections.

See twbs/bootstrap#41639 and twbs/bootstrap#41654 for details.

Another notable changes comes with the update of the composer dependency "doctrine/inflector" from 2.0.10 to 2.1.0.

They have moved their sources from subfolder inflector/lib/Doctrine/Inflector to subfolder src with version 2.1.0.

Therefore this PR here adds the files and folders from the old location to the lists of files and folders to be deleted on update in the script.php file.

Updated dependencies

Composer Dependencies (non-dev)

NPM Dependencies (non-dev)

Composer Dependencies (dev)

NPM Dependencies (dev)

Testing Instructions

Test 1: Check package build - Variant 1

This test shall verify that building the packages (which includes composer install and npm ci) still works and the installation package shows only the expected differences compared to a package created without this PR.

It requires to have a development environment (git clone, composer, npm) with runs either on a unixoid OS (Linux, Mac), or if on Windows it needs WSL2 and a Linux filesystem for the git clone.

If you don't have all that or are not familiar with development and package building, skip this test variant 1 and go to the next section for variant 2.

The description below assumes that you have a git clone of your fork with origin being the remote for your fork, and upstream being the remote to this repository here, as it is with a standard installation of GitHub desktop or most other Git clients.

  1. Checkout your 6.0-dev branch and make sure that your branch is clean and up to date with the upstream 6.0-dev branch:
git clean -d -x -f
git checkout .
git checkout 6.0-dev
git remote update
git reset --hard upstream/6.0-dev
  1. Build packages from the current branch (i.e. remote=HEAD) and redirect the output into a log file:
php ./build/build.php --remote=HEAD 2>&1 | tee ./tmp/build.log
  1. Check that the created packages in the build/tmp/packages folder are complete and have plausible sizes:
ls -al ./build/tmp/packages/
  1. Save the full installation zip package build/tmp/packages/Joomla_6.0.0-beta4-dev-Development-Full_Package.zip somewhere outside your git clone, e.g. in a folder test-pr-46100-before your home directory:
md ~/test-pr-46100-before
cp ./build/tmp/packages/Joomla_6.0.0-beta4-dev-Development-Full_Package.zip ~/test-pr-46100-before/
  1. Copy the log file from step 2 to the same place:
cp ./tmp/build.log ~/test-pr-46100-before/
  1. Clean up the branch
git clean -d -x -f
git checkout .
  1. Fetch this pull request into a new local branch and check out that branch:
git fetch upstream pull/46100/head:test-pr-46100
git checkout test-pr-46100
  1. Same as steps 2 to 5, but with a different folder outside of the git clone to save the results:
php ./build/build.php --remote=HEAD 2>&1 | tee ./tmp/build.log
ls -al ./build/tmp/packages/
md ~/test-pr-46100-after
cp ./build/tmp/packages/Joomla_6.0.0-beta4-dev-Development-Full_Package.zip ~/test-pr-46100-after/
cp ./tmp/build.log ~/test-pr-46100-after/
  1. Unpack the full installation zip packages (one without this PR and one with this PR) into 2 separate folders.
  2. Compare the content of the packages with a good comparison tool, e.g. Beyond Compare, TotalCommander, Meld, ...
    Result: See section "Expected result AFTER applying this Pull Request" below.
  3. Compare the 2 logs (one without and one with this PR) from the previous steps.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Test 1: Check package build - Variant 2

If you have executed the test in the previous section "Test 1: Check package build - Variant 1", you can skip the test here and directly continue with the next section "Test 2: Check if Joomla still works".

  1. Download the latest 6.0 nightly build full installation zip package from here:
    https://developer.joomla.org/nightlies/Joomla_6.0.0-beta4-dev-Development-Full_Package.zip
  2. Download the full installation zip package created by Drone for this PR from here:
    https://artifacts.joomla.org/drone/joomla/joomla-cms/6.0-dev/46100/downloads/88106/Joomla_6.0.0-beta4-dev+pr.46100-Development-Full_Package.zip
  3. Unpack the packages downloaded in the previous 2 steps into 2 separate folders.
  4. Compare the content of the packages with a good comparison tool, e.g. Beyond Compare, TotalCommander, Meld, ...
    Result: See section "Expected result AFTER applying this Pull Request" below.
  5. Download the log of the "Packages" step of Drone CI for the last commit in the 6.0-dev branch of the CMS repo.
    You can find it here: https://ci.joomla.org/joomla/joomla-cms/88080/1/2
    Select the "Packager" step at the left side, then use the download button at the top right corner of the console lo area.
  6. Do the same for the log of the "Packages" step of Drone CI for this PR.
    You can find it here: https://ci.joomla.org/joomla/joomla-cms/88106/1/2
    Select the "Packager" step at the left side, then use the download button at the top right corner of the console lo area.
  7. Compare the 2 logs downloaded in the 2 previous steps.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Test 2: Check if Joomla still works

  1. Make a new installation with the full installation zip package for this PR, using the package from the previous test 1.
  2. Check that everything looks and works as usual.
  3. Check that qrcodes are still working for MFA with OTP, i.e. add an authenticator and scan the qrcode with a modible device to add it to your authenticator app.
    Result: See section "Expected result AFTER applying this Pull Request" below.

Actual result BEFORE applying this Pull Request

Not applicable.

Expected result AFTER applying this Pull Request

When comparing the 2 installation zip packages, only the following differences can be found:

  • Updated dependencies in the libraries/vendor folder or subfolders
  • Notable differences mentioned in section "Summary of Changes" for the "bootstrap" update
  • Notable differences mentioned in section "Summary of Changes" for the "doctrine/inflector" update

Besides that, only the usual changes between 2 consecutive builds can be found, i.e. different ordering of assets in joomla.assets.json files and versions in css or js files.

When comparing the log files you can see the different versions in the composer install step.

The npm ci step may differ much due to the random order of processing dependencies and compiling assets due to the asynchronous execution of the dependency installation and the compilation steps.

But there are no new warnings shown at the beginning of that step, and at the end the summary is the same, too.

The installation made with the installation package for this PR looks and works as well as before.

Qrcodes in MFA with OTP are still working.

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org: To be done.

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 14 Sep 2025
Category ⇒ External Library Composer Change NPM Change Front End Plugins
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
Labels Added: Composer Dependency Changed NPM Resource Changed PR-6.0-dev
avatar joomla-cms-bot joomla-cms-bot - change - 14 Sep 2025
Category External Library Composer Change NPM Change Front End Plugins ⇒ Administration com_admin External Library Composer Change NPM Change Front End Plugins
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 14 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 14 Sep 2025
avatar richard67 richard67 - change - 16 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 16 Sep 2025
avatar richard67 richard67 - change - 16 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 16 Sep 2025
avatar joomla-cms-bot joomla-cms-bot - change - 16 Sep 2025
Category External Library Composer Change NPM Change Front End Plugins Administration com_admin ⇒ Administration com_admin External Library Composer Change NPM Change Front End Plugins JavaScript Unit Tests
avatar richard67 richard67 - change - 16 Sep 2025
Labels Added: Unit/System Tests
avatar joomla-cms-bot joomla-cms-bot - change - 16 Sep 2025
Category External Library Composer Change NPM Change Front End Plugins Administration com_admin JavaScript Unit Tests ⇒ Administration com_admin External Library Composer Change NPM Change Front End Plugins
avatar richard67
richard67 - comment - 16 Sep 2025

@dgrammatiko Could you help me here with some major updates?

The first one it totp-generator (NPM dev dependency).

I have tried to update it from 1.0.0 to 1.1.0 in my other PR for 5.4-dev, but that caused the system tests for MFA to fail due to an issue with a missing indirect dependency, see bellstrand/totp-generator#229 . They say they have fixed it with 2.0.0. Obviously they don't care that it's broken in their 1.1.0 version.

But 2.0.0 claims to have breaking changes, see https://github.com/bellstrand/totp-generator/releases/tag/v2.0.0 .

So I've reverted and pinned to 1.0.0 in my 5.4-dev PR.

For this 6.0-dev PR here I have tried to update to 2.0.0 and fix the places where we use it (system tests), see commit a29f698 .

The first try failed because using await outside an asynchronous function, so I've tried to fix it like this: e52d90d

But that failed again with missing dependency.

Do you have an idea how to make it work with 2.0.0?

And if you have a fix: Do you think we can also update to 2.0.0 for CMS 5.4? As far as I can see we use it only in system tests and don't ship it with our packages, so it would not be a b/c break.

avatar richard67
richard67 - comment - 16 Sep 2025

@Hackwar @laoneo Do you think we can update cypress from 14.5.4 to 15.2.0 in J 6.0? Or even in 5.4? As far as I see it is only a dev dependency so we don't ship it. Or are there some breaking changes which would require some work on the CMS so we should only do it in 6.0, or not do it at all?

avatar laoneo
laoneo - comment - 16 Sep 2025

We often did major updates of cypress in minors. When the tests are running through you can even do it in 5.4.

avatar richard67 richard67 - change - 17 Sep 2025
Labels Removed: Unit/System Tests
avatar richard67
richard67 - comment - 17 Sep 2025

We often did major updates of cypress in minors. When the tests are running through you can even do it in 5.4.

@laoneo Hmm, reading the "Breaking changes:" section in their changelog and their migration guide I am not sure. Could you check that?

avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67
richard67 - comment - 17 Sep 2025

@laoneo Meanwhile I've updated cypress to 15.2.0 here in this PR. System tests are working.

avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar laoneo
laoneo - comment - 17 Sep 2025

Don't think so we need any of the features which have changed in 15. Good job by the way.

avatar richard67 richard67 - change - 17 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 17 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar joomla-cms-bot joomla-cms-bot - change - 18 Sep 2025
Category External Library Composer Change NPM Change Front End Plugins Administration com_admin ⇒ Administration com_admin Repository External Library Composer Change NPM Change Front End Plugins
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67
richard67 - comment - 18 Sep 2025

@Fedik As you have once added it with your PR #40714 , and @dgrammatiko as you were involved: Do you think we can safely update the NPM dependency "es-module-shims" from 1.10.1 to 2.6.2?

Checking their releases on https://github.com/guybedford/es-module-shims/releases I do not see any breaking changes, but maybe I miss something?

And are there changes which we should document somewhere for developers?

Unfortunately they don't have a migration documentation on https://github.com/guybedford/es-module-shims .

avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar dgrammatiko
dgrammatiko - comment - 18 Sep 2025

It’s ok to update the polyfill

avatar brianteeman
brianteeman - comment - 18 Sep 2025

did a quick check and all seems good so far. There is a relevant deprecation in tinyMCE but we dont need to worry about it until tinymce9

avatar richard67
richard67 - comment - 18 Sep 2025

@brianteeman Thanks for checking so far. The only outstanding major NPM update is the es-module-shims. After that I will have do add testing instructions and make a PR for the developer documentation. I hope to have it ready in the next few days.

avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar Fedik
Fedik - comment - 18 Sep 2025

Do you think we can safely update the NPM dependency "es-module-shims" from 1.10.1 to 2.6.2?

yes, it should be good

avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67
richard67 - comment - 18 Sep 2025

The direct non-dev NPM dependencies "accessibility", "diff", "choices.js" and "cropperjs" will be done with separate PRs.

"shepherd.js" and "totp-generator" (the latter is dev and only used by our MFA system tests) cannot be updated, the former for license reasons and the latter because it does not work.

avatar brianteeman
brianteeman - comment - 18 Sep 2025

accessibility can not be updated

avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar richard67 richard67 - change - 18 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 18 Sep 2025
avatar brianteeman
brianteeman - comment - 18 Sep 2025

tinymce just had another release

avatar richard67
richard67 - comment - 18 Sep 2025

Thanks. Will check anyway tomorrow.

avatar richard67
richard67 - comment - 18 Sep 2025

tinymce just had another release

@brianteeman Where? Latest is 8.1.2 from 12 hours ago: https://github.com/tinymce/tinymce/tags . My PR is already updated with that.

avatar brianteeman
brianteeman - comment - 18 Sep 2025

Sorry you're correct. Three releases in two days got me confused

avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
Title
…
[6.0] [WiP] Update Composer and NPM dependencies for 6.0.0-rc1
[6.0] Update Composer and NPM dependencies for 6.0.0-rc1
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar richard67 richard67 - change - 19 Sep 2025
The description was changed
avatar richard67 richard67 - edited - 19 Sep 2025
avatar bembelimen bembelimen - change - 20 Sep 2025
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2025-09-20 15:24:26
Closed_By ⇒ bembelimen
Labels Added: Documentation Required
avatar bembelimen bembelimen - close - 20 Sep 2025
avatar bembelimen bembelimen - merge - 20 Sep 2025
avatar bembelimen
bembelimen - comment - 20 Sep 2025

Thx

avatar richard67
richard67 - comment - 20 Sep 2025

@dgrammatiko Could you also review the PR for 5.4-dev, #46099 ?

Add a Comment

Login with GitHub to post a comment