Repository navigation
🔒️ Update symfony/config, symfony/filesystem and symfony/yaml to 7.4.23 - #37
Merged
Merged
Conversation
The scheduled CI run fails in grumphp's securitychecker_composeraudit task since three Symfony advisories were published on 2026-11-04, all fixed in 7.4.23: - symfony/config: XXE (local file read) in XmlUtils::parse() (GHSA-5jff-8h8q-r5qx) - symfony/filesystem: Path treats any prefix before "://" as a root (GHSA-6prc-h956-hxjq) - symfony/yaml: exponential and quadratic parse times (GHSA-hwfg-qwvh-2wfx) symfony/filesystem is only a transitive dependency and is kept on 7.4: a plain `composer update` would move it to 8.0.15, but the whole 8.0 branch is listed as affected, and 8.1 needs PHP >=8.4.1 while the platform is pinned to 8.4.0. `composer bump` raised the constraints of symfony/config and symfony/yaml to ^7.4.23.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The scheduled CI run #149 fails in grumphp's
securitychecker_composeraudittask. Three Symfony advisories were published on 2026-11-04, all fixed in 7.4.23:symfony/configXmlUtils::parse()– GHSA-5jff-8h8q-r5qxsymfony/filesystemPathtreats any prefix before://as a root – GHSA-6prc-h956-hxjqsymfony/yamlChanges
composer.lock: the three packages go from their old versions to 7.4.23. Nothing else changes.composer.json:composer bump(post-update-cmd) raisedsymfony/configandsymfony/yamlto^7.4.23.Why
symfony/filesystemstays on 7.4symfony/filesystemis only a transitive dependency (throughsymfony/config, grumphp and fractor). A plaincomposer update 'symfony/*' -Wwould move it to 8.0.15, but the advisory lists the whole 8.0 branch as affected. 8.1 requires PHP>=8.4.1, andconfig.platform.phpis pinned to8.4.0. So the update used--with 'symfony/filesystem:^7.4.23'.A later unconstrained
composer updatecould pullsymfony/filesystem8.0.x again. Raisingconfig.platform.phpto a current 8.4 patch release would let it resolve to 8.1.11+ instead.Verification
composer audit --locked: no advisories. The only output is thesymplify/rule-doc-generator-contractsabandoned notice, which was also there in the green runs before.composer validate: valid. The lock file matchescomposer.json.Generated by Claude Code