bump dependencies

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 6.2.3 (2026-07-23)
+
+### Fixes
+
+* `pos-cli deploy` now also includes each module's own `modules/<name>/pos-module.json` manifest in the deploy archive (still excluding the rest of a module's authoring content — generators/, package.json, template-values.json, README, etc.). This lets the instance tell "module has no files in this deploy" apart from "module's files are present but stale versus the lock file" and warn accordingly, instead of silently deploying outdated module content when `pos-cli modules install` wasn't rerun after pulling a bumped lock file.
+
+### Security
+
+* Bumped `yeoman-environment` from `^5.1.3` to `^6.1.0`, fixing a high-severity arbitrary package installation vulnerability ([GHSA-vv9j-gjw2-j8wp](https://github.com/advisories/GHSA-vv9j-gjw2-j8wp)).
+* Replaced the unmaintained `node-notifier` (last published 2022, still on vulnerable `uuid@^8.3.2`) with `toasted-notifier`, an actively maintained fork with the same `.notify()` API, fixing a moderate-severity buffer bounds check issue in `uuid` ([GHSA-w5hq-g745-h8pq](https://github.com/advisories/GHSA-w5hq-g745-h8pq)).
+
 ## 6.2.2 (2026-07-22)
 
 ### New Features

bin/pos-cli-generate-run.js

@@ -156,7 +156,7 @@ const installDependencies = (packageRoot) => {
   logger.Info('Installing generator dependencies...', { hideTimestamp: false });
 
   try {
-    spawnCommand('npm', ['install'], { cwd: packageRoot });
+    spawnCommand('npm', ['install', '--prefer-offline', '--no-audit', '--no-fund'], { cwd: packageRoot });
     logger.Success('Dependencies installed successfully', { hideTimestamp: false });
   } catch (e) {
     throw new Error(`Failed to install dependencies: ${e.message}`);

bin/pos-cli-logs.js

@@ -8,7 +8,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 import { program } from '../lib/program.js';
-import notifier from 'node-notifier';
+import notifier from 'toasted-notifier';
 
 import { fetchSettings } from '../lib/settings.js';
 import logger from '../lib/logger.js';

lib/archive.js

@@ -7,7 +7,7 @@ import { loadSettingsFileForModule } from './settings.js';
 import logger from './logger.js';
 import dir from './directories.js';
 import prepareArchive from './prepareArchive.js';
-import { POS_MODULE_LOCK_FILE } from './modules/paths.js';
+import { POS_MODULE_LOCK_FILE, POS_MODULE_FILE } from './modules/paths.js';
 import { resolveDeployLock } from './deploy/resolveDeployLock.js';
 
 const isEmpty = d => shell.ls(d).length === 0;
@@ -36,6 +36,24 @@ const addModuleToArchive = async (module, archive, withoutAssets, pattern = '{pu
     const realPath = path.join(dir.MODULES, module, f);
     archive.appendTemplated(realPath, realPath.split(path.sep).join('/'), moduleTemplateData);
   }
+
+  addModuleManifestToArchive(module, archive);
+};
+
+// The instance-side auto-installer that downloads a dependency missing from a deploy (see
+// AppBuilder::InstanceModules::DownloadMissingModules on the backend) needs to tell "this module
+// has no files at all in this deploy" apart from "this module's files are here, but stale versus
+// what pos-module.lock.json declares" (e.g. a developer forgot to rerun `modules install` after
+// pulling a bumped lock file) so it can warn appropriately instead of silently deploying stale
+// content. That requires shipping *some* per-module version marker — this ships just the
+// existing pos-module.json manifest, not the rest of the module's authoring content (generators/,
+// package.json, package-lock.json, template-values.json, README, ...), which the instance has no
+// use for and would otherwise show up as unmatched files in the deploy report.
+const addModuleManifestToArchive = (module, archive) => {
+  const manifestPath = path.join(dir.MODULES, module, POS_MODULE_FILE);
+  if (!fs.existsSync(manifestPath)) return;
+
+  archive.addFile(manifestPath, path.join('modules', module, POS_MODULE_FILE).split(path.sep).join('/'));
 };
 
 const findAppDirectory = async () => {

lib/logger.js

@@ -1,5 +1,5 @@
 import path from 'path';
-import notifier from 'node-notifier';
+import notifier from 'toasted-notifier';
 import { fileURLToPath } from 'url';
 import { dirname } from 'path';