From 541fe7cb291482851efda6da36ef907fd231902f Mon Sep 17 00:00:00 2001 From: Matthias Vogel Date: Thu, 5 Nov 2026 11:50:51 +0000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20Update=20symfony/config?= =?UTF-8?q?,=20symfony/filesystem=20and=20symfony/yaml=20to=207.4.23?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scheduled CI run fails in grumphp's securitychecker_composeraudit task since three Symfony advisories were published on 2026-11-04, all fixed in 7.4.23: - symfony/config: XXE (local file read) in XmlUtils::parse() (GHSA-5jff-8h8q-r5qx) - symfony/filesystem: Path treats any prefix before "://" as a root (GHSA-6prc-h956-hxjq) - symfony/yaml: exponential and quadratic parse times (GHSA-hwfg-qwvh-2wfx) symfony/filesystem is only a transitive dependency and is kept on 7.4: a plain `composer update` would move it to 8.0.15, but the whole 8.0 branch is listed as affected, and 8.1 needs PHP >=8.4.1 while the platform is pinned to 8.4.0. `composer bump` raised the constraints of symfony/config and symfony/yaml to ^7.4.23. --- composer.json | 4 ++-- composer.lock | 40 ++++++++++++++++++++-------------------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/composer.json b/composer.json index 0e65545..859cd71 100644 --- a/composer.json +++ b/composer.json @@ -6,7 +6,7 @@ "php": "~8.4.0", "ext-curl": "*", "ext-yaml": "*", - "symfony/config": "^7.4.22", + "symfony/config": "^7.4.23", "symfony/console": "^7.4.22", "symfony/dependency-injection": "^7.4.22", "symfony/error-handler": "^7.4.22", @@ -14,7 +14,7 @@ "symfony/lock": "^7.4.22", "symfony/process": "^7.4.22", "symfony/var-dumper": "^7.4.22", - "symfony/yaml": "^7.4.22", + "symfony/yaml": "^7.4.23", "thecodingmachine/safe": "^3.4" }, "require-dev": { diff --git a/composer.lock b/composer.lock index 46a989b..6a3c13b 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "2ee9f454fe9213dbbd830c8e92304c90", + "content-hash": "4d1f4d73abd204fee94bdd0c40c8b66c", "packages": [ { "name": "psr/container", @@ -111,16 +111,16 @@ }, { "name": "symfony/config", - "version": "v7.4.22", + "version": "v7.4.23", "source": { "type": "git", "url": "https://github.com/symfony/config.git", - "reference": "d7f9d7495992429d916aea42d1a4d76a12dfa29f" + "reference": "8ef666abf731e85e59cf478929dda6c7cb2fa9c4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/config/zipball/d7f9d7495992429d916aea42d1a4d76a12dfa29f", - "reference": "d7f9d7495992429d916aea42d1a4d76a12dfa29f", + "url": "https://api.github.com/repos/symfony/config/zipball/8ef666abf731e85e59cf478929dda6c7cb2fa9c4", + "reference": "8ef666abf731e85e59cf478929dda6c7cb2fa9c4", "shasum": "" }, "require": { @@ -166,7 +166,7 @@ "description": "Helps you find, load, combine, autofill and validate configuration values of any kind", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/config/tree/v7.4.22" + "source": "https://github.com/symfony/config/tree/v7.4.23" }, "funding": [ { @@ -186,7 +186,7 @@ "type": "tidelift" } ], - "time": "2026-10-25T14:40:16+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "symfony/console", @@ -525,16 +525,16 @@ }, { "name": "symfony/filesystem", - "version": "v7.4.21", + "version": "v7.4.23", "source": { "type": "git", "url": "https://github.com/symfony/filesystem.git", - "reference": "fd0e3462be6d32a0d130e8423e4940a7688162d8" + "reference": "53d609da66578dad5a39fe290e8f924ec8f05e93" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/filesystem/zipball/fd0e3462be6d32a0d130e8423e4940a7688162d8", - "reference": "fd0e3462be6d32a0d130e8423e4940a7688162d8", + "url": "https://api.github.com/repos/symfony/filesystem/zipball/53d609da66578dad5a39fe290e8f924ec8f05e93", + "reference": "53d609da66578dad5a39fe290e8f924ec8f05e93", "shasum": "" }, "require": { @@ -571,7 +571,7 @@ "description": "Provides basic utilities for the filesystem", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/filesystem/tree/v7.4.21" + "source": "https://github.com/symfony/filesystem/tree/v7.4.23" }, "funding": [ { @@ -591,7 +591,7 @@ "type": "tidelift" } ], - "time": "2026-10-06T20:05:19+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "symfony/finder", @@ -1572,16 +1572,16 @@ }, { "name": "symfony/yaml", - "version": "v7.4.22", + "version": "v7.4.23", "source": { "type": "git", "url": "https://github.com/symfony/yaml.git", - "reference": "1ed6afa13d48c579c51cbf32e38f50686313497b" + "reference": "1e601207ffe627a2e621faa9d661f1d32dcf1cec" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/yaml/zipball/1ed6afa13d48c579c51cbf32e38f50686313497b", - "reference": "1ed6afa13d48c579c51cbf32e38f50686313497b", + "url": "https://api.github.com/repos/symfony/yaml/zipball/1e601207ffe627a2e621faa9d661f1d32dcf1cec", + "reference": "1e601207ffe627a2e621faa9d661f1d32dcf1cec", "shasum": "" }, "require": { @@ -1624,7 +1624,7 @@ "description": "Loads and dumps YAML files", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/yaml/tree/v7.4.22" + "source": "https://github.com/symfony/yaml/tree/v7.4.23" }, "funding": [ { @@ -1644,7 +1644,7 @@ "type": "tidelift" } ], - "time": "2026-10-18T14:39:27+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "thecodingmachine/safe", @@ -8865,5 +8865,5 @@ "platform-overrides": { "php": "8.4.0" }, - "plugin-api-version": "2.9.0" + "plugin-api-version": "2.6.0" }