[#48685] - [6.2] Composer updates 2026-10-22 - #48684
- Closed
- 27 Oct 2026
- Medium
- Build: 6.2-dev
- # 48685
- Diff
- SniperSister:6.2-composer-deps-oct26
User tests: Successful: Unsuccessful:
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
Updates the composer dependencies, most importantly an update to the cabundle to distrust a compromised CA:
composer/ca-bundle#153
Testing Instructions
- verify update of cabundle package in lock file
- All CI actions are successful.
Actual result BEFORE applying this Pull Request
- Outdated cabundle
Expected result AFTER applying this Pull Request
- Up-to-date cabundle
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | External Library Composer Change |
![avatar github-actions[bot]](/images/avatars/github-actions[bot].png)
| Labels |
Added:
Composer Dependency Changed
PR-6.2-dev
|
||
| Category | External Library Composer Change | ⇒ | Administration com_media External Library Composer Change Libraries Front End Plugins Unit Tests |
WTF
That's the github actions bot - but no idea why my PR was based on the "plain" 6.2 branch?
| Labels |
Added:
Unit/System Tests
|
||
See 5.4 PR: couldn’t care less :)
See 5.4 PR: couldn’t care less :)
@SniperSister I don't care much, either, but you should also update the SVG sanitiser enshrined/svg-sanitize to version 1.1.1. It needs to change the version requirement in composer.json for that. See the description my PR #48660 about why we can do that even if it is a major update.
Or we use my PR, I have just updated it by the "composer/ca-bundle" update.
See 5.4 PR: couldn’t care less :)
@SniperSister I don't care much, either, but you should also update the SVG sanitiser enshrined/svg-sanitize to version 1.1.1. It needs to change the version requirement in composer.json for that. See the description my PR #48660 about why we can do that even if it is a major update.
Or we use my PR, I have just updated it by the "composer/ca-bundle" update.
Hmm, I just see you are updating more dependencies here, not only those reported by composer audit and the ca-bundle.
See 5.4 PR: couldn’t care less :)
@SniperSister I don't care much, either, but you should also update the SVG sanitiser enshrined/svg-sanitize to version 1.1.1. It needs to change the version requirement in composer.json for that. See the description my PR #48660 about why we can do that even if it is a major update.
| Status | Pending | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-10-27 09:23:15 |
| Closed_By | ⇒ | SniperSister |
Let's use your pr.
I have tested this item ✅ successfully on f36c278
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48685.
I have tested this item ✅ successfully on f36c278
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/48685.
I have tested this item ✅ successfully on f36c278
@SniperSister You have marked the test result for your PR, not mine :-)
There seem to be a lot of unrelated changes here