Pending

User tests: Successful: Unsuccessful:

avatar richard67
richard67
7 Mar 2026

Pull Request resolves # .

  • I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

This pull request (PR) fixes one high severity security vulnerability in the indirect NPM development dependency "immutable" reported by npm audit by using npm audit fix.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit.
  3. Check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

immutable  5.0.0 - 5.1.4
Severity: high
Immutable is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-wf6x-7x77-mvgw
fix available via `npm audit fix`
node_modules/immutable

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Expected result AFTER applying this Pull Request

found 0 vulnerabilities

Link to documentations

Please select:

  • Documentation link for guide.joomla.org:

  • No documentation changes for guide.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

avatar richard67 richard67 - open - 7 Mar 2026
avatar richard67 richard67 - change - 7 Mar 2026
Status New Pending
avatar joomla-cms-bot joomla-cms-bot - change - 7 Mar 2026
Category NPM Change
avatar richard67 richard67 - change - 7 Mar 2026
Title
[6.0] NPM update indirect development dependency "immutable" to fix a high severity security vulnerability
[6.1] NPM update indirect development dependency "immutable" to fix a high severity security vulnerability
avatar richard67 richard67 - edited - 7 Mar 2026
avatar krishnagandhicode krishnagandhicode - test_item - 7 Mar 2026 - Tested successfully
avatar krishnagandhicode
krishnagandhicode - comment - 7 Mar 2026

I have tested this item ✅ successfully on 16bb090

Before PR:
Screenshot 2026-03-08 011544

after PR:
Screenshot 2026-03-08 012314


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/47323.

Add a Comment

Login with GitHub to post a comment