User tests: Successful: Unsuccessful:
Pull Request resolves # .
This pull request (PR) fixes 1 high severity security vulnerabilities in indirect NPM dependencies reported by npm audit by using npm audit fix.
It needs a development environment with a git clone, composer and npm.
If not done before, run composer install and npm ci.
Run npm audit.
Check the result.
PS D:\repos\j51> npm audit
# npm audit report
systeminformation 4.17.0 - 5.31.5
Severity: high
Systeminformation vulnerable to Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name - https://github.com/advisories/GHSA-hvx9-hwr7-wjj9
fix available via `npm audit fix`
node_modules/systeminformation
tinymce <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.5.0, which is a breaking change
node_modules/tinymce
2 vulnerabilities (1 moderate, 1 high)
PS D:\repos\j51> npm audit
# npm audit report
tinymce <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.5.0, which is a breaking change
node_modules/tinymce
1 moderate severity vulnerability
To address all issues (including breaking changes), run:
npm audit fix --force
```### Link to documentations
Please select:
- [ ] Documentation link for guide.joomla.org: <link>
- [ ] No documentation changes for guide.joomla.org needed
- [ ] Pull Request link for manual.joomla.org: <link>
- [ ] No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
| Category | ⇒ | NPM Change |
| Status | Pending | ⇒ | Ready to Commit |
| Labels |
Added:
NPM Resource Changed
PR-5.4-dev
|
||
RTC as it has 2 approvals by maintainers.
RTC as it has 2 approvals by maintainers.
It is only a development dependency not shown when using
So it won't make it into the 5.4.6 we have just prepared.