From 36a9bc0e1cc01697132d2ab6bd69f6c38cbeda12 Mon Sep 17 00:00:00 2001 From: AdilAzhariOmsan Date: Tue, 3 Nov 2026 21:49:47 +0800 Subject: [PATCH] chore(deps): update dependencies for security advisories Resolve the five advisories reported by `composer audit`, which fail CI on main before lint, static analysis and tests run. - CVE-2026-108082 (GHSA-r925-mgvr-h9cc), high: symfony/http-foundation ReDoS in HeaderUtils::split() via Cache-Control. v8.1.6 -> v8.1.10 - GHSA-3q6v-r5mr-hxv8, high: league/commonmark quadratic-time DoS in the GFM Table extension. 2.10.0 -> 2.10.7 - GHSA-97jj-33gv-5xf9, medium: league/commonmark DisallowedRawHtml bypass. 2.10.0 -> 2.10.7 - CVE-2026-45070 (GHSA-vqc8-7275-q272), medium: symfony/mime email header injection via parameter names. v8.1.6 -> v8.1.10 - CVE-2026-102279 (GHSA-jh5r-qr3c-85q8), low: laravel/framework XSS on the debug exception page. v13.29.0 -> v13.39.0 laravel/prompts v0.3.24 -> v0.3.26 is pulled in by laravel/framework. Lock-only change via `composer update --with-dependencies --minimal-changes`; composer.json is unchanged and every version stays within its existing constraint. --- composer.lock | 81 ++++++++++++++++++++++++++------------------------- 1 file changed, 42 insertions(+), 39 deletions(-) diff --git a/composer.lock b/composer.lock index c883680..799ae1d 100644 --- a/composer.lock +++ b/composer.lock @@ -1056,20 +1056,20 @@ }, { "name": "laravel/framework", - "version": "v13.29.0", + "version": "v13.39.0", "source": { "type": "git", "url": "https://github.com/laravel/framework.git", - "reference": "6e2c363716964d8238cee7097b258119a984f0cf" + "reference": "d52c3b3129e4c8e213c97cdc68f94b0b7d27f181" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/framework/zipball/6e2c363716964d8238cee7097b258119a984f0cf", - "reference": "6e2c363716964d8238cee7097b258119a984f0cf", + "url": "https://api.github.com/repos/laravel/framework/zipball/d52c3b3129e4c8e213c97cdc68f94b0b7d27f181", + "reference": "d52c3b3129e4c8e213c97cdc68f94b0b7d27f181", "shasum": "" }, "require": { - "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19", + "brick/math": "^0.14.2 || ^0.15 || ^0.16 || ^0.17 || ^0.18 || ^0.19 || ^0.20 || ^1.0", "composer-runtime-api": "^2.2", "doctrine/inflector": "^2.0.5", "dragonmantank/cron-expression": "^3.4", @@ -1086,7 +1086,7 @@ "guzzlehttp/promises": "^2.0.3 || ^3.0", "guzzlehttp/psr7": "^2.9 || ^3.0", "guzzlehttp/uri-template": "^1.0 || ^2.0", - "laravel/prompts": "^0.3.11", + "laravel/prompts": "^0.3.25", "laravel/serializable-closure": "^2.0.10", "league/commonmark": "^2.8.1", "league/flysystem": "^3.25.1", @@ -1172,7 +1172,7 @@ "aws/aws-sdk-php": "^3.322.9", "ext-gmp": "*", "fakerphp/faker": "^1.24", - "intervention/image": "^4.0", + "intervention/image": "^4.2", "laravel/pint": "^1.18", "league/flysystem-aws-s3-v3": "^3.25.1", "league/flysystem-ftp": "^3.25.1", @@ -1181,18 +1181,20 @@ "league/flysystem-sftp-v3": "^3.25.1", "mockery/mockery": "^1.6.10", "opis/json-schema": "^2.4.1", - "orchestra/testbench-core": "^11.0.0", + "orchestra/testbench-core": "^11.6.0", "pda/pheanstalk": "^7.0.0 || ^8.0.0", "php-http/discovery": "^1.15", - "phpstan/phpstan": "^2.0", + "phpstan/phpstan": "2.3.1", "phpunit/phpunit": "^11.5.50 || ^12.5.8 || ^13.0.3", "predis/predis": "^2.3 || ^3.0", "rector/rector": "2.6.3", "resend/resend-php": "^1.0", "symfony/cache": "^7.4.0 || ^8.0.0", "symfony/http-client": "^7.4.0 || ^8.0.0", + "symfony/mercure": "^0.8.0", "symfony/psr-http-message-bridge": "^7.4.0 || ^8.0.0", - "symfony/translation": "^7.4.0 || ^8.0.0" + "symfony/translation": "^7.4.0 || ^8.0.0", + "web-token/jwt-library": "^4.1" }, "suggest": { "ably/ably-php": "Required to use the Ably broadcast driver (^1.0).", @@ -1209,7 +1211,7 @@ "ext-redis": "Required to use the Redis cache and queue drivers (^4.0 || ^5.0 || ^6.0).", "fakerphp/faker": "Required to generate fake data using the fake() helper (^1.23).", "filp/whoops": "Required for friendly error pages in development (^2.14.3).", - "intervention/image": "Required to use the image processing features (^4.0).", + "intervention/image": "Required to use the image processing features (^4.2).", "laravel/tinker": "Required to use the tinker console command (^2.0).", "league/flysystem-aws-s3-v3": "Required to use the Flysystem S3 driver (^3.25.1).", "league/flysystem-ftp": "Required to use the Flysystem FTP driver (^3.25.1).", @@ -1228,8 +1230,10 @@ "symfony/filesystem": "Required to enable support for relative symbolic links (^7.4 || ^8.0).", "symfony/http-client": "Required to enable support for the Symfony API mail transports (^7.4 || ^8.0).", "symfony/mailgun-mailer": "Required to enable support for the Mailgun mail transport (^7.4 || ^8.0).", + "symfony/mercure": "Required to use the Mercure broadcast driver (^0.8).", "symfony/postmark-mailer": "Required to enable support for the Postmark mail transport (^7.4 || ^8.0).", - "symfony/psr-http-message-bridge": "Required to use PSR-7 bridging features (^7.4 || ^8.0)." + "symfony/psr-http-message-bridge": "Required to use PSR-7 bridging features (^7.4 || ^8.0).", + "web-token/jwt-library": "Required to sign Mercure JWTs and use end-to-end encrypted channels (^4.1)." }, "type": "library", "extra": { @@ -1279,20 +1283,20 @@ "issues": "https://github.com/laravel/framework/issues", "source": "https://github.com/laravel/framework" }, - "time": "2026-08-25T20:57:16+00:00" + "time": "2026-10-27T14:04:39+00:00" }, { "name": "laravel/prompts", - "version": "v0.3.24", + "version": "v0.3.26", "source": { "type": "git", "url": "https://github.com/laravel/prompts.git", - "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b" + "reference": "2d1e9bf6bab8d3f383c254db7f2b4ea8816d55e0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/prompts/zipball/5d3cdef29e93ca3b62b1871359db3078cd99908b", - "reference": "5d3cdef29e93ca3b62b1871359db3078cd99908b", + "url": "https://api.github.com/repos/laravel/prompts/zipball/2d1e9bf6bab8d3f383c254db7f2b4ea8816d55e0", + "reference": "2d1e9bf6bab8d3f383c254db7f2b4ea8816d55e0", "shasum": "" }, "require": { @@ -1335,10 +1339,9 @@ ], "description": "Add beautiful and user-friendly forms to your command-line applications.", "support": { - "issues": "https://github.com/laravel/prompts/issues", - "source": "https://github.com/laravel/prompts/tree/v0.3.24" + "source": "https://github.com/laravel/prompts/tree/v0.3.26" }, - "time": "2026-08-20T12:55:36+00:00" + "time": "2026-10-09T14:45:13+00:00" }, { "name": "laravel/serializable-closure", @@ -1472,16 +1475,16 @@ }, { "name": "league/commonmark", - "version": "2.10.0", + "version": "2.10.7", "source": { "type": "git", "url": "https://github.com/thephpleague/commonmark.git", - "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4" + "reference": "8eb53e906fd60c67038d22f1f1cab420ed58b8be" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/d2d1aa8b35e072966c89bc0c66cf926e56767dc4", - "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4", + "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/8eb53e906fd60c67038d22f1f1cab420ed58b8be", + "reference": "8eb53e906fd60c67038d22f1f1cab420ed58b8be", "shasum": "" }, "require": { @@ -1575,7 +1578,7 @@ "type": "tidelift" } ], - "time": "2026-08-11T16:06:25+00:00" + "time": "2026-10-31T13:35:37+00:00" }, { "name": "league/config", @@ -3893,16 +3896,16 @@ }, { "name": "symfony/http-foundation", - "version": "v8.1.6", + "version": "v8.1.10", "source": { "type": "git", "url": "https://github.com/symfony/http-foundation.git", - "reference": "093b78326f649c3a9db922b9f17123b6aeb3b8fb" + "reference": "79325f87c3a2acc7564ddce9f457046e980e7255" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/http-foundation/zipball/093b78326f649c3a9db922b9f17123b6aeb3b8fb", - "reference": "093b78326f649c3a9db922b9f17123b6aeb3b8fb", + "url": "https://api.github.com/repos/symfony/http-foundation/zipball/79325f87c3a2acc7564ddce9f457046e980e7255", + "reference": "79325f87c3a2acc7564ddce9f457046e980e7255", "shasum": "" }, "require": { @@ -3950,7 +3953,7 @@ "description": "Defines an object-oriented layer for the HTTP specification", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/http-foundation/tree/v8.1.6" + "source": "https://github.com/symfony/http-foundation/tree/v8.1.10" }, "funding": [ { @@ -3970,7 +3973,7 @@ "type": "tidelift" } ], - "time": "2026-08-30T20:10:55+00:00" + "time": "2026-10-27T12:24:10+00:00" }, { "name": "symfony/http-kernel", @@ -4164,16 +4167,16 @@ }, { "name": "symfony/mime", - "version": "v8.1.6", + "version": "v8.1.10", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "1b36ccfd7ccb9ad1d6eafb9024b3dd3d9606b15f" + "reference": "8d1232052c9cdef170ed9608b3147bca4f61ff69" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/1b36ccfd7ccb9ad1d6eafb9024b3dd3d9606b15f", - "reference": "1b36ccfd7ccb9ad1d6eafb9024b3dd3d9606b15f", + "url": "https://api.github.com/repos/symfony/mime/zipball/8d1232052c9cdef170ed9608b3147bca4f61ff69", + "reference": "8d1232052c9cdef170ed9608b3147bca4f61ff69", "shasum": "" }, "require": { @@ -4226,7 +4229,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v8.1.6" + "source": "https://github.com/symfony/mime/tree/v8.1.10" }, "funding": [ { @@ -4246,7 +4249,7 @@ "type": "tidelift" } ], - "time": "2026-08-22T09:06:25+00:00" + "time": "2026-10-28T17:58:38+00:00" }, { "name": "symfony/polyfill-ctype", @@ -5879,12 +5882,12 @@ "version": "v5.7.0", "source": { "type": "git", - "url": "https://github.com/vlucas/phpdotenv.git", + "url": "https://github.com/phpdotenv/phpdotenv.git", "reference": "301c07936b16d88628b126b01d082ba153cf4c40" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", + "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/301c07936b16d88628b126b01d082ba153cf4c40", "reference": "301c07936b16d88628b126b01d082ba153cf4c40", "shasum": "" },