User tests: Successful: Unsuccessful:
Pull Request for Issue # .
This pull request (PR) fixes three low severity security vulnerability in indirect NPM development dependencies reported by npm audit by using npm audit fix.
Same as PR #46571 for 5.4-dev, but here for 6.0-dev to avoid ugly merge conflicts for the upmerge after that.
In the 6.1-dev these vulnerabilities have already been fixed with PR #46546 .
It needs a development environment with a git clone, composer and npm.
composer install and npm ci.npm audit.# npm audit report
nodemailer <=7.0.10
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls - https://github.com/advisories/GHSA-rcmh-qjqh-p98v
fix available via `npm audit fix`
node_modules/nodemailer
mailparser 2.3.1 - 3.9.0
Depends on vulnerable versions of nodemailer
node_modules/mailparser
smtp-server 2.0.0 - 3.16.1
Depends on vulnerable versions of nodemailer
node_modules/smtp-server
3 low severity vulnerabilities
To address all issues, run:
npm audit fix
found 0 vulnerabilities
Please select:
Documentation link for docs.joomla.org:
No documentation changes for docs.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | NPM Change |
I have tested this item ✅ successfully on a7a54c7
* Seen the 3 low severity vulnerabilities before
gh pr checkout 46572 and running npm audit report found 0 vulnerabilitiespackage-lock.json file for comparisation, gone back with git switch -, did npm audit fix by own and got exactly the same package-lock.json file| Status | Pending | ⇒ | Ready to Commit |
RTC
@Bodge-IT @softforge This PR here should go into 6.0.2 (and the upcoming 6.0.2-rc1). Best is to merge it before your next upmerge, and then in the upmerge ignore the package-lock.json completely, keeping the version from 6.0-dev.
| Labels |
Added:
RTC
NPM Resource Changed
bug
PR-6.0-dev
|
||
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-12-14 21:47:38 |
| Closed_By | ⇒ | Bodge-IT |
Thanks @richard67, suggestion noted. Thanks @brianteeman & @muhme for tests
I have tested this item ✅ successfully on a7a54c7
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46572.