NPM Resource Changed bug PR-5.4-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
19 Dec 2025

Pull Request for Issue # .

Summary of Changes

This pull request (PR) fixes two high severity security vulnerability in NPM development dependencies reported by npm audit by using npm audit fix.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit.
  3. Check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

systeminformation  <5.27.14
Severity: high
systeminformation has a Command Injection vulnerability in fsSize() function on Windows - https://github.com/advisories/GHSA-wphj-fx3q-84ch
fix available via `npm audit fix`
node_modules/systeminformation
  cypress  15.1.0 - 15.8.0
  Depends on vulnerable versions of systeminformation
  node_modules/cypress

tinymce  <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.1, which is a breaking change
node_modules/tinymce

3 vulnerabilities (1 moderate, 2 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

# npm audit report

tinymce  <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.1, which is a breaking change
node_modules/tinymce

1 moderate severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 19 Dec 2025
avatar richard67 richard67 - change - 19 Dec 2025
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 19 Dec 2025
Category NPM Change
avatar brianteeman brianteeman - test_item - 19 Dec 2025 - Tested successfully
avatar brianteeman
brianteeman - comment - 19 Dec 2025

I have tested this item ✅ successfully on aef84ac


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46590.

avatar Bodge-IT Bodge-IT - test_item - 19 Dec 2025 - Tested successfully
avatar Bodge-IT
Bodge-IT - comment - 19 Dec 2025

I have tested this item ✅ successfully on aef84ac

2 high vulnerabilities cleared
1 moderate remaining


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46590.

avatar richard67 richard67 - change - 19 Dec 2025
Status Pending Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2025-12-19 13:37:04
Closed_By richard67
Labels Added: NPM Resource Changed bug PR-5.4-dev
avatar richard67 richard67 - close - 19 Dec 2025
avatar richard67 richard67 - merge - 19 Dec 2025

Add a Comment

Login with GitHub to post a comment