fix(deps): patch 12 security advisories and unblock Dependabot - #343
Merged
Conversation
Dependabot's security-update jobs have been failing on this repo since they could not resolve dependencies at all, so no fix PRs were ever opened and the advisories piled up. The cause is a platform mismatch. require.php was "^8.4", from which Dependabot derives config.platform.php = 8.4.0, but phpunit/phpunit requires php >=8.4.1 across the whole 13.x line. Every job died during resolution. Raising the declared floor to ^8.4.1 states the real minimum and lets Dependabot resolve again. Setting config.platform would also have worked, but it applies to every composer update including CI, which would collapse the 8.4/8.5 x prefer-lowest/prefer-stable matrix into four identical dependency sets. Regenerating the lock clears all 12 advisories. Runtime: guzzle 7.10.0 -> 7.15.3, psr7 2.9.0 -> 2.13.0. Development, via orchestra/testbench: laravel/framework, league/commonmark, php_codesniffer, symfony http-kernel, http-foundation, routing, mime, mailer, yaml and polyfill-intl-idn. Adds a Composer audit job that checks the committed lock, which is what Dependabot scans. It sits outside the test matrix because --prefer-lowest resolves to the oldest permitted versions and will always carry advisories. Mergify now requires that check before auto-merging Dependabot PRs, so a future advisory blocks the merge instead of riding along with it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot has been reporting advisories on this repo while its own security-update jobs were failing, so no fix PRs were ever opened and the alerts accumulated.
The cause is a platform mismatch, not the dependencies themselves.
require.phpwas^8.4, from which Dependabot derivesconfig.platform.php = 8.4.0, butphpunit/phpunitrequiresphp >=8.4.1across the whole 13.x line. Every job died during resolution:Reproduced and confirmed locally:
config.platform.php8.4.0(what Dependabot derives)Your requirements could not be resolved8.4.1What changed
composer.json—require.php^8.4→^8.4.1, stating the real minimum.config.platformwould also have unblocked Dependabot, but it applies to everycomposer updateincluding CI, collapsing the8.4/8.5×prefer-lowest/prefer-stablematrix into four identical dependency sets. Declaring the floor inrequirekeeps the matrix meaningful.composer.lock— regenerated, clearing all 12 advisories:guzzlehttp/guzzleguzzlehttp/psr7laravel/frameworkleague/commonmarksquizlabs/php_codesniffersymfony/http-kernelsymfony/http-foundationsymfony/routingsymfony/mimesymfony/mailersymfony/yamlsymfony/polyfill-intl-idn84 packages move in total; only those carrying advisories are listed. The dev ones all arrive through
orchestra/testbench..github/workflows/main.yml— newComposer auditjob against the committed lock, which is what Dependabot scans. Deliberately outside the test matrix:--prefer-lowestresolves to the oldest versions the constraints allow and will always carry advisories..mergify.yml— the auto-merge rule now also requires the audit check, so a future advisory blocks a Dependabot merge rather than riding along with it. Worth a second look, since it changes when auto-merge fires..gitignore—infection.log, a build artifact the suite writes.Verification
No new findings from the phpstan 2.1.46 → 2.2.8 or phpcs 4.0.1 → 4.0.4 bumps.
Dependabot resolution re-simulated against the new manifest at platform
8.4.1:Nothing to modify in lock file.