Skip to content

[6.0] NPM audit fix low severity security vulnerability by updating diff from 8.0.2 to 8.0.3#46713

Merged
Bodge-IT merged 2 commits intojoomla:6.0-devfrom
richard67:6.0-dev-npm-audit-fix-2026-01-18
Jan 20, 2026
Merged

[6.0] NPM audit fix low severity security vulnerability by updating diff from 8.0.2 to 8.0.3#46713
Bodge-IT merged 2 commits intojoomla:6.0-devfrom
richard67:6.0-dev-npm-audit-fix-2026-01-18

Conversation

@richard67
Copy link
Copy Markdown
Member

Pull Request for Issue # .

Summary of Changes

This pull request (PR) fixes one low severity security vulnerability in NPM dependencies reported by npm audit by using npm audit fix.

@Bodge-IT @softforge @muhme In opposite to my previous PRs of this kind there is no corresponding PR in the 5.4-dev branch this time because in 5.4-dev it would mean a major update of the "diff dependency".

@HLeithner @tecpromotion In 6.1-dev the changes from this PR here have already been made with the last NPM dependency update, so simply ignore the changes when doing your upmerge after this PR here has been merged into 6.0-dev.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit.
  3. Check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

diff  <8.0.3
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix`
node_modules/diff

1 low severity vulnerability

To address all issues, run:
  npm audit fix

Expected result AFTER applying this Pull Request

found 0 vulnerabilities

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

@joomla-cms-bot joomla-cms-bot added NPM Resource Changed This Pull Request can't be tested by Patchtester PR-6.0-dev labels Jan 18, 2026
@richard67 richard67 added the bug label Jan 18, 2026
@brianteeman
Copy link
Copy Markdown
Contributor

I have tested this item ✅ successfully on 25a59c1


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46713.

@muhme
Copy link
Copy Markdown
Contributor

muhme commented Jan 19, 2026

I have tested this item ✅ successfully on 25a59c1

Tested based on git clone

  • Seen the low severity vulnerability from jsdiff
  • Running npm audit fix by own and saved package-lock.json file
  • Applied PR with gh pr checkout 46713
  • Own created and patched package-lock.json files are identical
  • npm audit found 0 vulnerabilities

This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46713.

@muhme muhme removed NPM Resource Changed This Pull Request can't be tested by Patchtester bug PR-6.0-dev labels Jan 19, 2026
@muhme
Copy link
Copy Markdown
Contributor

muhme commented Jan 19, 2026

RTC


This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46713.

@joomla-cms-bot joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Jan 19, 2026
@muhme muhme added NPM Resource Changed This Pull Request can't be tested by Patchtester bug PR-6.0-dev labels Jan 19, 2026
@Bodge-IT Bodge-IT merged commit 0fe0848 into joomla:6.0-dev Jan 20, 2026
51 checks passed
@joomla-cms-bot joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Jan 20, 2026
@Bodge-IT
Copy link
Copy Markdown
Contributor

Thanks @richard67 for the fix and @brianteeman & @muhme for testing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug NPM Resource Changed This Pull Request can't be tested by Patchtester PR-6.0-dev

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants