User tests: Successful: Unsuccessful:
Pull Request for Issue # .
This pull request (PR) fixes one low severity and 3 moderate severity security vulnerabilities in indirect NPM development dependencies reported by npm audit by using npm audit fix.
Same as PR #46429 for 5.4-dev, but here for 6.0-dev to avoid ugly merge conflicts for the upmerge after that.
It needs a development environment with a git clone, composer and npm.
composer install and npm ci.npm audit.# npm audit report
min-document <=2.19.0
min-document vulnerable to prototype pollution - https://github.com/advisories/GHSA-rx8g-88g5-qh64
fix available via `npm audit fix`
node_modules/min-document
nodemailer <7.0.7
Severity: moderate
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict - https://github.com/advisories/GHSA-mm7p-fcc7-pg87
fix available via `npm audit fix`
node_modules/nodemailer
node_modules/smtp-server/node_modules/nodemailer
mailparser 2.3.1 - 3.7.4
Depends on vulnerable versions of nodemailer
node_modules/mailparser
smtp-server 2.0.0 - 3.14.0
Depends on vulnerable versions of nodemailer
node_modules/smtp-server
4 vulnerabilities (1 low, 3 moderate)
To address all issues, run:
npm audit fix
found 0 vulnerabilities
Please select:
Documentation link for docs.joomla.org:
No documentation changes for docs.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | NPM Change |
I have tested this item ✅ successfully on d8d6e46
I have tested this item ✅ successfully on d8d6e46
Tested with JBT
gh pr checkout 46430 and running npm audit report found 0 vulnerabilitiesgit switch -, updated NPM 11.6.2 with npm install -g npm@latest and did npm audit fix by own and got exactly the same package-lock.json filenpm ci is still working and reports found 0 vulnerabilities| Status | Pending | ⇒ | Ready to Commit |
RTC
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-11-10 17:19:24 |
| Closed_By | ⇒ | Bodge-IT | |
| Labels |
Added:
RTC
NPM Resource Changed
PR-6.0-dev
|
||
Thanks @richard67 for the PR and thanks testers for ...tests!
@brianteeman Could you also test this one here? Thanks in advance.