Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency laravel/framework to v10 [security] #48

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

fix(deps): update dependency laravel/framework to v10 [security] #48

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
laravel/framework (source) ^7.0 -> ^10.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-43808

A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine.

Given the following two Blade templates:

resources/views/parent.blade.php:

@​section('content')
<input value="">
@&#8203;show

resources/views/child.blade.php:

@&#8203;extends('parent')

@&#8203;section('content')
<input value="">
@&#8203;endsection

And a route like the following:

Route::get('/example', function() {
    $value = '//localhost/###parent-placeholder-040f06fd774092478d450774f5ba30c5da78acc8## onclick=location.assign(this.value);//';

    return view('child', ['value' => $value]);
});

The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed.

This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.

CVE-2024-52301

Description

When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request.

Resolution

The framework now ignores argv values for environment detection on non-cli SAPIs.

CVE-2025-27515

When using wildcard validation to validate a given file or image field array (files.*), a user-crafted malicious request could potentially bypass the validation rules.

Release Notes

laravel/framework (laravel/framework)

v10.48.29

Compare Source

v10.48.28

Compare Source

v10.48.27

Compare Source

v10.48.26

Compare Source

v10.48.25

Compare Source

v10.48.24

Compare Source

v10.48.23

Compare Source

v10.48.22

Compare Source

v10.48.21

Compare Source

v10.48.20

Compare Source

v10.48.19

Compare Source

v10.48.18

Compare Source

v10.48.17

Compare Source

v10.48.16

Compare Source

v10.48.15

Compare Source

v10.48.14

Compare Source

v10.48.13

Compare Source

v10.48.12

Compare Source

v10.48.11

Compare Source

v10.48.10

Compare Source

v10.48.9

Compare Source

v10.48.8

Compare Source

v10.48.7

Compare Source

v10.48.6

Compare Source

v10.48.5

Compare Source

v10.48.4

Compare Source

v10.48.3

Compare Source

  • Re-tag version

v10.48.2

Compare Source

v10.48.1

Compare Source

v10.48.0

Compare Source

v10.47.0

Compare Source

v10.46.0

Compare Source

v10.45.1

Compare Source

v10.45.0

Compare Source

v10.44.0

Compare Source

v10.43.0

Compare Source

v10.42.0

Compare Source

v10.41.0

Compare Source

v10.40.0

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/packagist-laravel-framework-vulnerability branch from cc11e96 to e96cdc8 Compare November 12, 2024 23:53
@renovate renovate bot changed the title fix(deps): update dependency laravel/framework to v7.30.6 [security] fix(deps): update dependency laravel/framework to v7.30.7 [security] Nov 12, 2024
@renovate renovate bot force-pushed the renovate/packagist-laravel-framework-vulnerability branch from e96cdc8 to 166b689 Compare March 6, 2025 19:59
@renovate renovate bot changed the title fix(deps): update dependency laravel/framework to v7.30.7 [security] fix(deps): update dependency laravel/framework to v11 [security] Mar 6, 2025
@renovate Renovate
Copy link
Author

renovate bot commented Mar 6, 2025 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update laravel/framework:10.48.29 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires laravel/framework ^10.0 -> satisfiable by laravel/framework[v10.48.29].
    - laravel/framework v10.48.29 requires php ^8.1 -> your php version (7.4.33) does not satisfy that requirement.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@renovate renovate bot changed the title fix(deps): update dependency laravel/framework to v11 [security] fix(deps): update dependency laravel/framework to v7.30.7 [security] Mar 12, 2025
@renovate renovate bot force-pushed the renovate/packagist-laravel-framework-vulnerability branch from 166b689 to 47b0deb Compare March 14, 2025 03:15
@renovate renovate bot changed the title fix(deps): update dependency laravel/framework to v7.30.7 [security] fix(deps): update dependency laravel/framework to v10 [security] Mar 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants