Dear Maintainer,
The version of phpSysInfo shipped in Debian is very old, and in turn bundles a very
old version of jQuery (1.12.4). Rather than upgrade to a recent jQuery - which would
allow for using libjs-jquery instead - upstream has decided to backport fixes for at
least some of these CVEs, as seen in
<https://github.com/phpsysinfo/phpsysinfo/commit/7fece46f79135d0a850fbda92c277684cd5596d4>
and elsewhere.
Please consider upgrading the package to the most recent upstream version so Debian
users can benefit from these fixes and others. In lieu of that, please upgrade the
bundled jQuery libs, which appear to have been quite heavily patched by upstream
over the years.
I'm also wondering whether the existing dependency on libjs-jquery is actually needed,
as it does not seem to actually be used. Presumably a modern day jQuery version would
not work with phpSysInfo if it needs such ancient versions, at least not without jQuery
Migrate being involved, which is presumably an upstream job and outside the scope
of package maintenance.
Thanks.