NPM Resource Changed bug PR-6.1-dev Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
19 Dec 2025

Pull Request for Issue # .

Summary of Changes

This pull request (PR) fixes two high and one moderate severity security vulnerability in NPM development dependencies reported by npm audit by using npm audit fix.

Besides the fix of the moderate issue for the 6.1-specific "altcha" (non-dev) dependency, this PR also includes the changes from PR #46591 for 6.0-dev with the fix for the 2 high-severity issues for developer dependencies to avoid ugly merge conflicts for the upmerge after that.

Finally other NPM dependencies are updated as far as possible.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit.
  3. Check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

altcha  0.8.0 - 2.2.4
Severity: moderate
Altcha Proof-of-Work obfuscation mode cryptanalytic break - https://github.com/advisories/GHSA-mpmc-qchh-r9q8
fix available via `npm audit fix`
node_modules/altcha

systeminformation  <5.27.14
Severity: high
systeminformation has a Command Injection vulnerability in fsSize() function on Windows - https://github.com/advisories/GHSA-wphj-fx3q-84ch
fix available via `npm audit fix`
node_modules/systeminformation
  cypress  15.1.0 - 15.8.0
  Depends on vulnerable versions of systeminformation
  node_modules/cypress

3 vulnerabilities (1 moderate, 2 high)

To address all issues, run:
  npm audit fix

Expected result AFTER applying this Pull Request

found 0 vulnerabilities

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 19 Dec 2025
avatar richard67 richard67 - change - 19 Dec 2025
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 19 Dec 2025
Category NPM Change
avatar tecpromotion tecpromotion - change - 19 Dec 2025
Labels Added: NPM Resource Changed bug PR-6.1-dev
avatar richard67 richard67 - change - 19 Dec 2025
Title
[6.1] NPM audit fix security vulnerabilities 2025-12-19
[6.1] NPM audit fix security vulnerabilities and update other dependencies 2025-12-19
avatar richard67 richard67 - edited - 19 Dec 2025
avatar richard67 richard67 - change - 19 Dec 2025
The description was changed
avatar richard67 richard67 - edited - 19 Dec 2025
avatar HLeithner HLeithner - close - 20 Dec 2025
avatar HLeithner HLeithner - merge - 20 Dec 2025
avatar HLeithner HLeithner - change - 20 Dec 2025
Status Pending Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 2025-12-20 14:00:57
Closed_By HLeithner
avatar HLeithner
HLeithner - comment - 20 Dec 2025

thx

avatar tecpromotion
tecpromotion - comment - 20 Dec 2025

Thanks @richard67

Add a Comment

Login with GitHub to post a comment