Body: <p>According to <a href="https://civicrm.org/advisory/civi-sa-2021-09-ckeditor-multiple-advisories" rel="nofollow noreferrer">https://civicrm.org/advisory/civi-sa-2021-09-ckeditor-multiple-advisories</a> a recommended mitigation is to replace /civicrm/bower_components/ckeditor/ with version 4.16.2 (it's currently 4.16.1 in older civi versions).</p>
  <p>In a D8/9 install, that folder appears to get populated according to the composer.json in civicrm core, and this code <a href="https://github.com/civicrm/civicrm-core/pull/21108" rel="nofollow noreferrer">https://github.com/civicrm/civicrm-core/pull/21108</a> shows how it was updated for the security release.</p>
  <p>But, that change in the composer.json file is in a special section called &quot;extra &gt; downloads&quot;, and just updating the composer.json file and running composer update doesn't do anything (or at least, it doesn't download the new version of ckeditor).</p>
  <p>I thought perhaps running composer civicrm:publish might invoke the magic, but that doesn't do anything either.</p>
  <p>Anyone else managed to use composer to just update civicrm's ckeditor version?</p>
  <p>p.s. okay, I tried reading the docs, here: <a href="https://github.com/civicrm/composer-downloads-plugin" rel="nofollow noreferrer">https://github.com/civicrm/composer-downloads-plugin</a></p>
  <p>It appears to say that it should update it if I've updated the composer.json and run composer install. I noticed that the composer.lock in the root hadn't changed it's version of ckeditor, so I updated that manually as well, but it had no effect.</p>
  
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-24T17:26:58.023Z
Comments.Text: According to @Demerit, composer won't do anything if you don't change the composer.json in the root of the project, so perhaps there a composer command to tell it to pay attention to the one I changed?
Comments.UserDisplayName: Alan Dixon
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-24T18:08:54.140Z
Comments.Text: Yes, I could just update civicrm or yes, I could just manually replace the files as per the advisory. Where's the fun in that? But more importantly, I was hoping to automate it in an elegant way.
Comments.UserDisplayName: Alan Dixon
Comments.ContentLicense: CC BY-SA 4.0
Comments.CreationDate: 2021-08-24T18:42:51.360Z
Comments.Text: Regarding the docs for composer-downloads-plugin, it's true but again only if it's the root. If you want inelegant, what might work is to make your own copy of the civicrm-core repo somewhere where you change that composer.json, then in the root composer.json of the site you want to update you add a [vcs repo](https://getcomposer.org/doc/05-repositories.md#vcs) definition for civicrm-core with a higher priority that points to your copy. Then composer will look there. I think I did that once to test something with a different repo, but don't remember how it worked out.
Comments.UserDisplayName: Demerit
Tags: <ckeditor><composer><security-advisory>
Title: Update CiviCRM's copy of CKEditor using composer?
ThreadText: # Update CiviCRM's copy of CKEditor using composer?
  
  (Asked by: username_0 on 2021-08-24)
  
  According to <https://civicrm.org/advisory/civi-sa-2021-09-ckeditor-multiple-advisories> a recommended mitigation is to replace /civicrm/bower\_components/ckeditor/ with version 4.16.2 (it's currently 4.16.1 in older civi versions).
  
  In a D8/9 install, that folder appears to get populated according to the composer.json in civicrm core, and this code <https://github.com/civicrm/civicrm-core/pull/21108> shows how it was updated for the security release.
  
  But, that change in the composer.json file is in a special section called "extra > downloads", and just updating the composer.json file and running composer update doesn't do anything (or at least, it doesn't download the new version of ckeditor).
  
  I thought perhaps running composer civicrm:publish might invoke the magic, but that doesn't do anything either.
  
  Anyone else managed to use composer to just update civicrm's ckeditor version?
  
  p.s. okay, I tried reading the docs, here: <https://github.com/civicrm/composer-downloads-plugin>
  
  It appears to say that it should update it if I've updated the composer.json and run composer install. I noticed that the composer.lock in the root hadn't changed it's version of ckeditor, so I updated that manually as well, but it had no effect.
  
  **Tags:** ckeditor, composer, security-advisory
  
  > **Comments:**
  > **username_0**: According to @username_1, composer won't do anything if you don't change the composer.json in the root of the project, so perhaps there a composer command to tell it to pay attention to the one I changed?  
  > **username_0**: Yes, I could just update civicrm or yes, I could just manually replace the files as per the advisory. Where's the fun in that? But more importantly, I was hoping to automate it in an elegant way.  
  > **username_1**: Regarding the docs for composer-downloads-plugin, it's true but again only if it's the root. If you want inelegant, what might work is to make your own copy of the civicrm-core repo somewhere where you change that composer.json, then in the root composer.json of the site you want to update you add a [vcs repo](https://getcomposer.org/doc/05-repositories.md#vcs) definition for civicrm-core with a higher priority that points to your copy. Then composer will look there. I think I did that once to test something with a different repo, but don't remember how it worked out.  
  
  ---
  
  ## 0 answers
  
  