NodeBB (update)
-
# npm audit fix --force npm warn using --force Recommended protections disabled. npm warn audit Updating postcss to 8.5.25, which is outside your stated dependency range. npm warn audit Updating @nodebb/nodebb-plugin-user-level to 1.0.2, which is a SemVer major change. npm warn audit Updating grunt to 1.6.3, which is outside your stated dependency range. npm warn audit Updating mocha to 11.3.0, which is a SemVer major change. npm warn audit Updating nodebb-plugin-dbsearch to 3.0.8, which is a SemVer major change. npm warn audit No fix available for coveralls@* npm warn audit Updating grunt-contrib-watch to 0.4.4, which is a SemVer major change. npm warn deprecated osenv@0.1.5: This package is no longer supported. npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful. npm warn deprecated har-validator@5.1.5: this library is no longer supported npm warn deprecated glob@7.1.7: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me npm warn deprecated minimatch@0.4.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue npm warn deprecated minimatch@0.2.14: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue npm warn deprecated minimatch@0.3.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue npm warn deprecated uuid@3.4.0: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). npm warn deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142 npm warn deprecated glob@3.2.11: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me added 405 packages, removed 17 packages, changed 11 packages, and audited 1243 packages in 26s 202 packages are looking for funding run `npm fund` for details # npm audit report async 2.0.0 - 2.6.3 Severity: high Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25 fix available via `npm audit fix --force` Will install nodebb-plugin-dbsearch@7.0.0, which is a breaking change node_modules/nodebb-plugin-dbsearch/node_modules/async nodebb-plugin-dbsearch 2.0.0 - 4.0.7 Depends on vulnerable versions of async node_modules/nodebb-plugin-dbsearch brace-expansion <=5.0.7 Severity: high brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg fix available via `npm audit fix --force` Will install mocha@8.1.3, which is a breaking change node_modules/brace-expansion node_modules/mocha/node_modules/brace-expansion minimatch <=10.0.2 Depends on vulnerable versions of brace-expansion node_modules/fileset/node_modules/glob/node_modules/minimatch node_modules/fileset/node_modules/minimatch node_modules/gaze/node_modules/minimatch node_modules/minimatch node_modules/mocha/node_modules/glob/node_modules/minimatch node_modules/mocha/node_modules/minimatch fileset 0.1.0 - 0.2.1 Depends on vulnerable versions of glob Depends on vulnerable versions of minimatch node_modules/fileset gaze <=0.3.4 Depends on vulnerable versions of fileset Depends on vulnerable versions of minimatch node_modules/gaze grunt-contrib-watch <=0.5.3 || 1.0.0 - 1.0.1 Depends on vulnerable versions of gaze Depends on vulnerable versions of tiny-lr node_modules/grunt-contrib-watch glob 3.0.0 - 10.5.0 Depends on vulnerable versions of minimatch Depends on vulnerable versions of minimatch node_modules/fileset/node_modules/glob node_modules/glob node_modules/mocha/node_modules/glob grunt >=1.0.0-rc1 Depends on vulnerable versions of glob Depends on vulnerable versions of minimatch node_modules/grunt mocha 3.0.0-0 - 12.0.0-beta-9 Depends on vulnerable versions of glob Depends on vulnerable versions of minimatch Depends on vulnerable versions of serialize-javascript node_modules/mocha debug <=2.6.8 Severity: high debug Inefficient Regular Expression Complexity vulnerability - https://github.com/advisories/GHSA-9vvw-cc9w-f27h Regular Expression Denial of Service in debug - https://github.com/advisories/GHSA-gxpj-cx7g-858c fix available via `npm audit fix --force` Will install grunt-contrib-watch@1.1.0, which is a breaking change node_modules/tiny-lr/node_modules/debug tiny-lr <=1.0.4 Depends on vulnerable versions of debug Depends on vulnerable versions of qs node_modules/tiny-lr form-data <=2.5.5 Severity: critical form-data uses unsafe random function in form-data for choosing boundary - https://github.com/advisories/GHSA-fjxv-7rqg-78g4 form-data: CRLF injection in form-data via unescaped multipart field names and filenames - https://github.com/advisories/GHSA-hmw2-7cc7-3qxx No fix available node_modules/form-data request * Depends on vulnerable versions of form-data Depends on vulnerable versions of qs Depends on vulnerable versions of tough-cookie Depends on vulnerable versions of uuid node_modules/request coveralls * Depends on vulnerable versions of request node_modules/coveralls qs <=6.14.0 Severity: high Prototype Pollution Protection Bypass in qs - https://github.com/advisories/GHSA-gqgv-6jq5-jjj9 Denial-of-Service Extended Event Loop Blocking in qs - https://github.com/advisories/GHSA-f9cm-p3w6-xvr3 Denial-of-Service Memory Exhaustion in qs - https://github.com/advisories/GHSA-jjv7-qpx3-h62q qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p fix available via `npm audit fix --force` Will install grunt-contrib-watch@1.1.0, which is a breaking change node_modules/request/node_modules/qs node_modules/tiny-lr/node_modules/qs serialize-javascript <=7.0.4 Severity: high Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() - https://github.com/advisories/GHSA-5c6j-r48x-rmvq Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - https://github.com/advisories/GHSA-qj8w-gfj5-8c6v fix available via `npm audit fix --force` Will install mocha@8.1.3, which is a breaking change node_modules/serialize-javascript tough-cookie <4.1.3 Severity: moderate tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3 No fix available node_modules/request/node_modules/tough-cookie uuid <11.1.1 Severity: moderate uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided - https://github.com/advisories/GHSA-w5hq-g745-h8pq No fix available node_modules/uuid 19 vulnerabilities (3 moderate, 14 high, 2 critical) To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. -
Toujours pareil …
# npx npm-check-updates -u npm notice run nodebb@4.14.4 npx npm notice run 'ncu' -u Upgrading /home/farias/nodebb/package.json [====================] 164/164 100% Patch Backwards-compatible bug fixes @fortawesome/fontawesome-free 7.3.0 → 7.3.1 @json2csv/node 7.0.6 → 7.0.7 autoprefixer 10.5.2 → 10.5.4 nodebb-plugin-2factor 8.0.1 → 8.0.5 nodebb-plugin-emoji 6.0.14 → 6.0.16 nodebb-plugin-markdown 13.2.6 → 13.2.7 nodebb-plugin-spam-be-gone 2.3.4 → 2.3.5 nodebb-widget-essentials 8.0.4 → 8.0.5 postcss-clean 1.2.0 → 1.2.2 sanitize-html 2.17.5 → 2.17.6 Minor Backwards-compatible features @fontsource/inter 5.2.8 → 5.3.0 @fontsource/poppins 5.2.7 → 5.3.0 fs-extra 11.3.6 → 11.4.0 globals 17.7.0 → 17.8.0 helmet 8.2.0 → 8.3.0 lint-staged 17.0.8 → 17.2.0 nodebb-theme-lavender 8.0.6 → 8.1.0 nodebb-theme-peace 3.0.6 → 3.1.1 sass 1.101.0 → 1.102.0 spdx-license-list 6.11.0 → 6.12.0 undici 8.7.0 → 8.9.0 webpack 5.108.4 → 5.109.2 yargs 18.0.0 → 18.1.0 Major Potentially breaking API changes @apidevtools/swagger-parser 10.1.0 → 12.1.0 @nodebb/nodebb-plugin-user-level ^1.0.2 → ^3.0.0 chalk 5.6.2 → 6.0.0 connect-redis 9.0.0 → 10.0.0 cropperjs 1.6.2 → 2.1.1 express 4.22.2 → 5.2.1 grunt-contrib-watch ^0.4.4 → ^1.1.0 husky 8.0.3 → 9.1.7 jquery 3.7.1 → 4.0.0 jsdom 29.1.1 → 30.0.1 mocha ^8.1.3 → ^11.7.6 nodebb-plugin-dbsearch ^3.0.8 → ^7.0.0 redis 5.12.1 → 6.1.0 Major version zero Anything may change @fontsource-utils/scss 0.2.2 → 0.2.4 nodebb-plugin-web-push 0.8.1 → 0.9.2 satori 0.26.0 → 0.29.0 Run npm install to install new versions. # npm install npm warn deprecated raw-body@1.1.7: No longer maintained. Please upgrade to a stable version. npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me npm notice run nodebb@4.14.4 postinstall npm notice run if [ "$NODE_ENV" != "production" ]; then npx husky install; fi npm notice run nodebb@4.14.4 npx npm notice run 'husky' install husky - install command is DEPRECATED added 89 packages, removed 70 packages, changed 78 packages, and audited 1255 packages in 36s 204 packages are looking for funding run `npm fund` for details 22 vulnerabilities (1 low, 6 moderate, 13 high, 2 critical) To address all issues possible (including breaking changes), run: npm audit fix --force Some issues need review, and may require choosing a different dependency. Run `npm audit` for details. # npx npm-check-updates npm notice run nodebb@4.14.4 npx npm notice run 'ncu' Checking /home/farias/nodebb/package.json [====================] 164/164 100% All dependencies match the latest package versions :) # ./nodebb stop Dependencies outdated or not yet installed. Error Code: DEP_WRONG_VERSION TypeError: Incorrect dependency version: chalk at checkVersion (/home/farias/nodebb/src/cli/index.js:41:14) at Object.<anonymous> (/home/farias/nodebb/src/cli/index.js:50:2) at Module._compile (node:internal/modules/cjs/loader:1871:14) at Object..js (node:internal/modules/cjs/loader:2002:10) at Module.load (node:internal/modules/cjs/loader:1594:32) at Module._load (node:internal/modules/cjs/loader:1396:12) at wrapModuleLoad (node:internal/modules/cjs/loader:255:19) at Module.require (node:internal/modules/cjs/loader:1617:12) at require (node:internal/modules/helpers:153:16) at Object.<anonymous> (/home/farias/nodebb/nodebb:5:1) Installing them now... npm notice run nodebb@4.14.4 postinstall npm notice run if [ "$NODE_ENV" != "production" ]; then npx husky install; fi added 14 packages, removed 436 packages, changed 47 packages, and audited 833 packages in 18s 129 packages are looking for funding run `npm fund` for details 5 vulnerabilities (1 moderate, 4 high) To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. OK Stopping NodeBB. Goodbye! # ./nodebb upgrade upgrade Updating NodeBB... 1. Updating package.json file with defaults... OK 2. Bringing base dependencies up to date... started npm notice run nodebb@4.14.4 postinstall npm notice run if [ "$NODE_ENV" != "production" ]; then npx husky install; fi up to date, audited 833 packages in 6s 129 packages are looking for funding run `npm fund` for details 5 vulnerabilities (1 moderate, 4 high) To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. 3. Checking installed plugins for updates...Checking installed plugins and themes for updates... OK All packages up-to-date! 4. Updating NodeBB data store schema... Parsing upgrade scripts... OK | 0 script(s) found, 182 skipped Schema update complete! 5. Rebuilding assets... started 2026-07-30T06:10:32.067Z [4567/25380] - info: [build] Building in parallel mode 2026-07-30T06:10:32.072Z [4567/25380] - info: [build] plugin static dirs build started 2026-07-30T06:10:32.073Z [4567/25380] - info: [build] requirejs modules build started 2026-07-30T06:10:32.075Z [4567/25380] - info: [build] client js bundle build started 2026-07-30T06:10:32.077Z [4567/25380] - info: [build] admin js bundle build started 2026-07-30T06:10:32.077Z [4567/25380] - info: [build] client side styles build started 2026-07-30T06:10:32.079Z [4567/25380] - info: [build] admin control panel styles build started 2026-07-30T06:10:32.083Z [4567/25380] - info: [build] templates build started 2026-07-30T06:10:32.084Z [4567/25380] - info: [build] languages build started 2026-07-30T06:10:32.976Z [4567/25380] - info: [build] plugin static dirs build completed in 0.904sec 2026-07-30T06:10:34.210Z [4567/25380] - info: [build] admin js bundle build completed in 2.133sec 2026-07-30T06:10:34.210Z [4567/25380] - info: [build] client js bundle build completed in 2.135sec 2026-07-30T06:10:37.757Z [4567/25380] - info: [build] requirejs modules build completed in 5.684sec 2026-07-30T06:10:37.758Z [4567/25380] - info: [build] Bundling with Webpack. [10%] building (0/0 modules) 2026-07-30T06:10:39.384Z [4567/25380] - info: [build] client side styles build completed in 7.307sec [10%] building (17/233 modules) [10%] building (385/465 modules) 338 assets 541 modules ERROR in ./build/public/scripts-client.js 3435:5 Module parse failed: Unexpected token (3435:5) You may need an appropriate loader to handle this file type, currently no loaders are configured to process this file. See https://webpack.js.org/concepts#loaders | }); | > ;CC0 1.0 Universal | | Statement of Purpose webpack 5.108.4 compiled with 1 error in 8050 ms 2026-07-30T06:10:47.164Z [4567/25380] - info: [build] Asset compilation successful. Completed in 15.09sec. NodeBB Upgrade Complete! # ./nodebb start Starting NodeBB "./nodebb stop" to stop the NodeBB server "./nodebb log" to view server output "./nodebb help" for more commands -
Toujours la même erreur :
# ./nodebb upgrade Updating NodeBB... 1. Updating package.json file with defaults... OK 2. Bringing base dependencies up to date... started npm notice run nodebb@4.14.6 postinstall npm notice run if [ "$NODE_ENV" != "production" ]; then npx husky install; fi changed 4 packages, and audited 833 packages in 10s 129 packages are looking for funding run `npm fund` for details 8 vulnerabilities (1 moderate, 7 high) To address issues that do not require attention, run: npm audit fix To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. 3. Checking installed plugins for updates...Checking installed plugins and themes for updates... OK A total of 2 package(s) can be upgraded: * @nodebb/nodebb-plugin-reactions (3.0.3 -> 3.0.4) * nodebb-plugin-feed (4.0.1 -> 4.0.3) Proceed with upgrade (y|n)? y Upgrading packages... 4. Updating NodeBB data store schema... Parsing upgrade scripts... OK | 0 script(s) found, 182 skipped Schema update complete! 5. Rebuilding assets... started 2026-08-04T06:20:09.785Z [4567/57604] - info: [build] Building in parallel mode 2026-08-04T06:20:09.787Z [4567/57604] - info: [build] plugin static dirs build started 2026-08-04T06:20:09.787Z [4567/57604] - info: [build] requirejs modules build started 2026-08-04T06:20:09.788Z [4567/57604] - info: [build] client js bundle build started 2026-08-04T06:20:09.788Z [4567/57604] - info: [build] admin js bundle build started 2026-08-04T06:20:09.789Z [4567/57604] - info: [build] client side styles build started 2026-08-04T06:20:09.789Z [4567/57604] - info: [build] admin control panel styles build started 2026-08-04T06:20:09.791Z [4567/57604] - info: [build] templates build started 2026-08-04T06:20:09.791Z [4567/57604] - info: [build] languages build started 2026-08-04T06:20:10.316Z [4567/57604] - info: [build] plugin static dirs build completed in 0.528sec 2026-08-04T06:20:11.821Z [4567/57604] - info: [build] client js bundle build completed in 2.033sec 2026-08-04T06:20:11.821Z [4567/57604] - info: [build] admin js bundle build completed in 2.033sec 2026-08-04T06:20:15.137Z [4567/57604] - info: [build] requirejs modules build completed in 5.35sec 2026-08-04T06:20:15.138Z [4567/57604] - info: [build] Bundling with Webpack. [10%] building (0/0 modules) 2026-08-04T06:20:16.987Z [4567/57604] - info: [build] client side styles build completed in 7.197sec [10%] building (23/245 modules) [10%] building (411/496 modules) 338 assets 541 modules ERROR in ./build/public/scripts-client.js 3435:5 Module parse failed: Unexpected token (3435:5) You may need an appropriate loader to handle this file type, currently no loaders are configured to process this file. See https://webpack.js.org/concepts#loaders | }); | > ;CC0 1.0 Universal | | Statement of Purpose webpack 5.108.4 compiled with 1 error in 10848 ms 2026-08-04T06:20:27.656Z [4567/57604] - info: [build] Asset compilation successful. Completed in 17.861sec. NodeBB Upgrade Complete! -
J’ai ouvert un bug sur le problème : https://github.com/NodeBB/NodeBB/issues/14604
-
J’ai donc fait :
# ./nodebb plugins Active plugins: * @nodebb/nodebb-plugin-reactions@3.0.4 (installed, enabled) * @nodebb/nodebb-plugin-user-level@3.0.0 (installed, enabled) * @nodebb/nodebb-plugin-youtube-embed@1.0.0 (installed, enabled) * nodebb-plugin-2factor@8.0.5 (installed, disabled) * nodebb-plugin-composer-default@11.0.10 (installed, enabled) * nodebb-plugin-dbsearch@7.0.0 (installed, enabled) * nodebb-plugin-emoji@6.0.14 (installed, enabled) * nodebb-plugin-emoji-android@4.1.1 (installed, disabled) * nodebb-plugin-extended-markdown@2.1.1 (installed, enabled) * nodebb-plugin-feed@4.0.3 (installed, enabled) * nodebb-plugin-html5videoplayer@0.2.5 (installed, enabled) * nodebb-plugin-imagemagick@3.0.0 (installed, disabled) * nodebb-plugin-imgbed@3.0.0 (installed, enabled) * nodebb-plugin-link-preview@2.2.8 (installed, enabled) * nodebb-plugin-markdown@13.2.6 (installed, enabled) * nodebb-plugin-mentions@5.0.2 (installed, enabled) * nodebb-plugin-poll@4.0.15 (installed, enabled) * nodebb-plugin-spam-be-gone@2.3.4 (installed, enabled) * nodebb-plugin-web-push@0.8.1 (installed, enabled) * nodebb-rewards-essentials@1.0.3 (installed, enabled) * nodebb-theme-harmony@3.1.15 (installed, enabled) * nodebb-theme-lavender@8.0.6 (installed, disabled) * nodebb-theme-peace@3.0.6 (installed, disabled) * nodebb-theme-persona@15.1.9 (installed, disabled) * nodebb-widget-essentials@8.0.9 (installed, enabled) -
Mise à jours …
# npm install-scripts ls 1 package has install scripts blocked because they are not covered by allowScripts: esbuild@0.28.2 (postinstall: node install.js) Run `npm install-scripts approve <pkg>` to allow, or `npm install-scripts deny <pkg>` to deny. # npm install-scripts approve esbuild@0.28.2 Approved esbuild: removed-stale esbuild@0.28.1 added esbuild@0.28.2 # ./nodebb upgrade Updating NodeBB... 1. Updating package.json file with defaults... OK 2. Bringing base dependencies up to date... started npm notice run nodebb@4.15.0 postinstall npm notice run if [ "$NODE_ENV" != "production" ]; then npx husky install; fi up to date, audited 844 packages in 6s 138 packages are looking for funding run `npm fund` for details 4 vulnerabilities (1 moderate, 3 high) To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. 3. Checking installed plugins for updates...Checking installed plugins and themes for updates... OK All packages up-to-date! 4. Updating NodeBB data store schema... Parsing upgrade scripts... OK | 0 script(s) found, 183 skipped Schema update complete! 5. Rebuilding assets... started 2026-08-13T06:11:58.405Z [4567/127411] - warn: [plugins] "nodebb-plugin-html5videoplayer" is active but not installed. 2026-08-13T06:11:58.548Z [4567/127411] - info: [build] Building in parallel mode 2026-08-13T06:11:58.552Z [4567/127411] - info: [build] plugin static dirs build started 2026-08-13T06:11:58.554Z [4567/127411] - info: [build] requirejs modules build started 2026-08-13T06:11:58.555Z [4567/127411] - info: [build] client js bundle build started 2026-08-13T06:11:58.557Z [4567/127411] - info: [build] admin js bundle build started 2026-08-13T06:11:58.558Z [4567/127411] - info: [build] client side styles build started 2026-08-13T06:11:58.559Z [4567/127411] - info: [build] admin control panel styles build started 2026-08-13T06:11:58.563Z [4567/127411] - info: [build] templates build started 2026-08-13T06:11:58.565Z [4567/127411] - info: [build] languages build started 2026-08-13T06:11:59.388Z [4567/127411] - info: [build] plugin static dirs build completed in 0.836sec 2026-08-13T06:12:00.022Z [4567/127411] - info: [build] admin js bundle build completed in 1.464sec 2026-08-13T06:12:00.686Z [4567/127411] - info: [build] client js bundle build completed in 2.13sec 2026-08-13T06:12:04.767Z [4567/127411] - info: [build] requirejs modules build completed in 6.212sec 2026-08-13T06:12:04.768Z [4567/127411] - info: [build] Bundling with Webpack. 2026-08-13T06:12:04.890Z [4567/127411] - warn: [plugins] "nodebb-plugin-html5videoplayer" is active but not installed. [10%] building (0/0 modules) 2026-08-13T06:12:05.825Z [4567/127411] - info: [build] admin control panel styles build completed in 7.266sec [10%] building (402/623 modules) [10%] building (600/794 modules) 2026-08-13T06:12:18.161Z [4567/127411] - info: [build] Bundling took 9917 ms 2026-08-13T06:12:18.165Z [4567/127411] - info: [build] Asset compilation successful. Completed in 19.612sec. NodeBB Upgrade Complete!
Bonjour ! Vous semblez intéressé par cette conversation, mais vous n’avez pas encore de compte.
Marre de refaire défiler les mêmes messages ? Créez un compte pour retrouver votre position, recevoir des notifications des nouvelles réponses, sauvegarder vos favoris et voter pour les messages que vous appréciez.
Grâce à votre participation, ce message peut devenir encore meilleur 💗
S'inscrire Se connecter