[#48448] - [5.4] Composer updates 2026-09-12
- Fixed in Code Base
- 13 Sep 2026
- Medium
- Build: 5.4-dev
- # 48448
- Diff
- richard67:5.4-dev-composer-update-2026-09-11
User tests: Successful: Unsuccessful:
Pull Request resolves # .
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
This pull request (PR) updates 2 direct composer dependencies (one development and one non development) in order to fix 3 severity vulnerabilities (one high, one medium and one uncategorized) reported by composer audit.
In detail following dependencies are updated:
-
Non development dependency "paragonie/sodium_compat" from 1.24.0 to 1.24.2
https://github.com/paragonie/sodium_compat/releases/tag/v1.24.1
https://github.com/paragonie/sodium_compat/releases/tag/v1.24.2
paragonie/sodium_compat@v1.24.0...v1.24.2 -
Development dependency "squizlabs/php_codesniffer" from 3.13.4 to 3.13.6
https://github.com/PHPCSStandards/PHP_CodeSniffer/blob/4.x/CHANGELOG-3.x.md
See also the separate commits of this PR.
Equivalent for 6.1-dev is PR #48449 , but here we update "squizlabs/php_codesniffer" from 3.13.4 and not from 3.13.5 like in that PR.
Testing Instructions
- Run
composer installand thencomposer audit. - Verify that there are no breaking changes done with this update by checking the release information listed above in the summary of changes.
- Check that all CI actions are successful.
Actual result BEFORE applying this Pull Request
- Composer audit
Found 3 security vulnerability advisories affecting 3 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package | paragonie/sodium_compat |
| Severity | |
| Advisory ID | PKSA-32g2-byr9-drtw |
| CVE | NO CVE |
| Title | Incorrect Ed25519 public key validation |
| URL | https://github.com/paragonie/sodium_compat/pull/206 |
| Affected versions | >=2,<2.5.1|<1.24.1 |
| Reported at | 2026-08-18T00:00:00+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | squizlabs/php_codesniffer |
| Severity | high |
| Advisory ID | PKSA-rdkp-vv9z-mjkg |
| CVE | CVE-2026-67434 |
| Title | OS Command injection |
| URL | https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg- |
| | cxww-wqhq |
| Affected versions | <3.13.6|>=4.0.0,<4.0.2 |
| Reported at | 2026-08-05T23:53:11+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | web-auth/webauthn-lib |
| Severity | medium |
| Advisory ID | PKSA-3mms-4n3p-ym65 |
| CVE | CVE-2024-39912 |
| Title | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames |
| URL | https://github.com/advisories/GHSA-875x-g8p7-5w27 |
| Affected versions | >=4.5.0,<4.9.0 |
| Reported at | 2024-07-15T16:37:49+00:00 |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package | Suggested Replacement |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib |
+---------------------------+----------------------------------------------------------------------------------+
- Not applicable.
- All CI actions are successful.
Expected result AFTER applying this Pull Request
- Composer audit
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package | web-auth/webauthn-lib |
| Severity | medium |
| Advisory ID | PKSA-3mms-4n3p-ym65 |
| CVE | CVE-2024-39912 |
| Title | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames |
| URL | https://github.com/advisories/GHSA-875x-g8p7-5w27 |
| Affected versions | >=4.5.0,<4.9.0 |
| Reported at | 2024-07-15T16:37:49+00:00 |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package | Suggested Replacement |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib |
+---------------------------+----------------------------------------------------------------------------------+
- No breaking changes.
- All CI actions are successful.
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | External Library Composer Change |
| Labels |
Added:
RTC
Composer Dependency Changed
PR-5.4-dev
|
||
I have tested this item ✅ successfully on 3367173
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48448.
| Status | Pending | ⇒ | Ready to Commit |
RTC as one maintainer review and one successful test
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48448.
RTC as one maintainer review and one successful test
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48448.
| Status | Ready to Commit | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-09-13 05:37:26 |
| Closed_By | ⇒ | muhme |
Thank you very much @richard67 for your contribution.
Thank you @tecpromotion for review. Thank you @brianteeman for testing.
I have tested this item ✅ successfully on 3367173
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48448.