[6.0] NPM update indirect development dependencies to fix 19 security vulnerabilities#46826
Merged
Bodge-IT merged 3 commits intojoomla:6.0-devfrom Feb 4, 2026
Merged
Conversation
Contributor
|
Member
Author
@brianteeman Oh, that must be brand new. It wasn't there 1 hour ago. Will fix here and in the 5.4-dev PR in a minute. |
Member
Author
|
Done. |
Contributor
|
I have tested this item ✅ successfully on 612db74 This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46826. |
Contributor
|
I have tested this item ✅ successfully on 612db74 Before applying Patch/fix: After applying patch/fix: This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46826. |
Member
Author
|
RTC This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/46826. |
Contributor
|
Thank you @richard67 and thanks to @krishnagandhicode and @brianteeman for the testing |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request for Issue # .
Summary of Changes
This pull request (PR) fixes 1 critical and 18 high severity security vulnerability in indirect NPM development dependencies reported by
npm auditby usingnpm audit fix.As they are all development dependencies, they are not shipped with installation or update packages.
@Bodge-IT @softforge It is the same as PR #46825 for 5.4-dev, but here for 6.0-dev so you don't have to handle any merge conflict in the lock file. Simply merge this PR here into your 6.0-dev branch, and when the 5.4-dev PR will be merged and you do an upmerge after that, just ignore all changes in
package-lock.jsonand keep the file from 6.0-dev.Testing Instructions
It needs a development environment with a git clone, composer and npm.
composer installandnpm ci.npm audit.Actual result BEFORE applying this Pull Request
Expected result AFTER applying this Pull Request
Link to documentations
Please select:
Documentation link for guide.joomla.org:
No documentation changes for guide.joomla.org needed
Pull Request link for manual.joomla.org:
No documentation changes for manual.joomla.org needed