User tests: Successful: Unsuccessful:
Pull Request for Issue # .
This pull request (PR) fixes two high and one moderate severity security vulnerability in NPM development dependencies reported by npm audit by using npm audit fix.
Besides the fix of the moderate issue for the 6.1-specific "altcha" (non-dev) dependency, this PR also includes the changes from PR #46591 for 6.0-dev with the fix for the 2 high-severity issues for developer dependencies to avoid ugly merge conflicts for the upmerge after that.
Finally other NPM dependencies are updated as far as possible.
It needs a development environment with a git clone, composer and npm.
composer install and npm ci.npm audit.# npm audit report
altcha 0.8.0 - 2.2.4
Severity: moderate
Altcha Proof-of-Work obfuscation mode cryptanalytic break - https://github.com/advisories/GHSA-mpmc-qchh-r9q8
fix available via `npm audit fix`
node_modules/altcha
systeminformation <5.27.14
Severity: high
systeminformation has a Command Injection vulnerability in fsSize() function on Windows - https://github.com/advisories/GHSA-wphj-fx3q-84ch
fix available via `npm audit fix`
node_modules/systeminformation
cypress 15.1.0 - 15.8.0
Depends on vulnerable versions of systeminformation
node_modules/cypress
3 vulnerabilities (1 moderate, 2 high)
To address all issues, run:
npm audit fix
found 0 vulnerabilities
Please select:
Documentation link for docs.joomla.org:
No documentation changes for docs.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | NPM Change |
| Labels |
Added:
NPM Resource Changed
bug
PR-6.1-dev
|
||
| Title |
|
||||||
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2025-12-20 14:00:57 |
| Closed_By | ⇒ | HLeithner |
Thanks @richard67
thx