Skip to content

[5.4] NPM audit fix one low and one moderate severity security vulnerability#46758

Merged
muhme merged 2 commits intojoomla:5.4-devfrom
richard67:5.4-dev-npm-audit-fix-2026-01-25
Jan 26, 2026
Merged

[5.4] NPM audit fix one low and one moderate severity security vulnerability#46758
muhme merged 2 commits intojoomla:5.4-devfrom
richard67:5.4-dev-npm-audit-fix-2026-01-25

Conversation

@richard67
Copy link
Copy Markdown
Member

@richard67 richard67 commented Jan 25, 2026 •
edited
Loading

Pull Request for Issue # .

Summary of Changes

This pull request (PR) fixes one low and one moderate severity security vulnerability in NPM dependencies reported by npm audit by using npm audit fix.

This updates the direct non-developer dependency "diff" from 5.3.0 to 5.2.2 and the indirect development dependency "loadsh" from 4.7.21 to 4.7.23.

@Bodge-IT @softforge @muhme In 6.0-dev the "diff" dependency has already been updated with PR #46713 from 8.0.2 to 8.0.3 to fix the same vulnerability. At that time there was no fix for their version 5. Now we have it in this PR here.

For the "lodash" dependency I've made PR #46759 for 6.0-dev to avoid ugly merge conflicts in the upmerge. @HLeithner @tecpromotion That update will also be needed in 6.1-dev. I can make a separate PR for that to avoid merge conflicts for your upmerge, but if you plan do do another, general NPM update anway, it would not need my separate 6.1-dev PR.

Testing Instructions

It needs a development environment with a git clone, composer and npm.

  1. If not done before, run composer install and npm ci.
  2. Run npm audit.
  3. Check the result.

Actual result BEFORE applying this Pull Request

# npm audit report

diff  5.0.0 - 5.2.1
jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch - https://github.com/advisories/GHSA-73rr-hh4g-fpgx
fix available via `npm audit fix`
node_modules/diff

lodash  4.0.0 - 4.17.21
Severity: moderate
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
fix available via `npm audit fix`
node_modules/lodash

tinymce  <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.2, which is a breaking change
node_modules/tinymce

3 vulnerabilities (1 low, 2 moderate)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Expected result AFTER applying this Pull Request

# npm audit report

tinymce  <7.0.0
Severity: moderate
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements - https://github.com/advisories/GHSA-5359-pvf2-pw78
fix available via `npm audit fix --force`
Will install tinymce@8.3.2, which is a breaking change
node_modules/tinymce

1 moderate severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

Link to documentations

Please select:

  • Documentation link for docs.joomla.org:

  • No documentation changes for docs.joomla.org needed

  • Pull Request link for manual.joomla.org:

  • No documentation changes for manual.joomla.org needed

@joomla-cms-bot joomla-cms-bot added NPM Resource Changed This Pull Request can't be tested by Patchtester PR-5.4-dev labels Jan 25, 2026
@richard67 richard67 added the bug label Jan 25, 2026
@richard67 richard67 mentioned this pull request Jan 25, 2026
Merged
4 tasks
@richard67 richard67 added this to the Joomla! 5.4.3 milestone Jan 25, 2026
muhme
muhme approved these changes Jan 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@muhme muhme left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Final code review and test before merge with local git clone

  • Checked file changes
  • Seen the 3 vulnerabilities (1 low, 2 moderate) before PR
  • Manual edited "diff": "^5.2.2" and running npm audit fix by own, saved package-lock.json
  • Applied PR with gh pr checkout 46758
  • npm audit shows only the one breaking-change tinymce moderate-severity-vulnerability as expected
  • package-lock.json file is identical to own created

@muhme muhme merged commit cb61b31 into joomla:5.4-dev Jan 26, 2026
69 checks passed
@muhme
Copy link
Copy Markdown
Contributor

muhme commented Jan 26, 2026

Thank you @richard67.

@richard67 richard67 deleted the 5.4-dev-npm-audit-fix-2026-01-25 branch January 26, 2026 14:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@muhme muhme muhme approved these changes

Assignees

@muhme muhme

Labels

bug NPM Resource Changed This Pull Request can't be tested by Patchtester PR-5.4-dev

Projects

None yet

Milestone

Joomla! 5.4.3

Development

Successfully merging this pull request may close these issues.

3 participants

@richard67 @muhme @joomla-cms-bot