Update dependency symfony/validator to v6.4.11 [SECURITY] #1367

renovate · 2024-11-06T16:20:41Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
symfony/validator (source)	`6.4.2` -> `6.4.11`

GitHub Vulnerability Alerts

CVE-2024-50343

Description

It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.

Resolution

Symfony now uses the D regex modifier to match the entire input.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.

Release Notes

symfony/validator (symfony/validator)

`v6.4.11`

Compare Source

Changelog (symfony/validator@v6.4.10...v6.4.11)

bug symfony/symfony#58127 [Validator] synchronize IBAN formats (@xabbuh)
bug symfony/symfony#57984 [Validator] Add D regex modifier in relevant validators (@alexandre-daubois)
bug symfony/symfony#57925 [Validator] reset the validation context after validating nested constraints (@xabbuh)
bug symfony/symfony#57905 [Validator] allow more unicode characters in URL paths (@xabbuh)

`v6.4.10`

Compare Source

Changelog (symfony/validator@v6.4.9...v6.4.10)

bug symfony/symfony#57812 [Validator] treat uninitialized properties referenced by property paths as null (@xabbuh)

`v6.4.9`

Compare Source

Changelog (symfony/validator@v6.4.8...v6.4.9)

bug symfony/symfony#57213 [Validator] [UniqueValidator] Use correct variable as parameter in (custom) error message (@seho-nl, Sebastien Hoek)

`v6.4.8`

Compare Source

Changelog (symfony/validator@v6.4.7...v6.4.8)

bug symfony/symfony#57275 Fix autoload configs to avoid warnings when building optimized autoloaders (@Seldaek)
bug symfony/symfony#54924 [Validator] IBAN Check digits should always between 2 and 98 (@karstennilsen)
bug symfony/symfony#54834 [Validator] Check Locale class existence before using it (@alexandre-daubois)
bug symfony/symfony#54758 [Validator] handle edge cases when constructing constraints with named arguments (@xabbuh)
bug symfony/symfony#54760 [Validator] handle union and intersection types for cascaded validations (@xabbuh)

`v6.4.7`

Compare Source

Changelog (symfony/validator@v6.4.6...v6.4.7)

bug symfony/symfony#54750 [Validator] detect wrong usages of minMessage/maxMessage in options (@xabbuh)
bug symfony/symfony#54751 [Validator] detect wrong e-mail validation modes (@xabbuh)
bug symfony/symfony#54487 [Validator] Accept Stringable in ExecutionContext::build/addViolation() (@alexandre-daubois)

`v6.4.6`

Compare Source

Changelog (symfony/validator@v6.4.5...v6.4.6)

bug symfony/symfony#54191 [Validator] add missing invalid extension error entry (@xabbuh)
bug symfony/symfony#54219 [Validator] Allow BICs’ first four characters to be digits (@MatTheCat)
bug symfony/symfony#54137 [Validator] UniqueValidator - normalize before reducing keys (@Brajk19)

`v6.4.4`

Compare Source

Changelog (symfony/validator@v6.4.3...v6.4.4)

bug symfony/symfony#53755 [Validator] Fix fields without constraints in Collection (@xabbuh, @HypeMC)

`v6.4.3`

Compare Source

Changelog (symfony/validator@v6.4.2...v6.4.3)

bug symfony/symfony#53620 [Validator] Fix option filenameMaxLength to the File constraint (Image) (@mindaugasvcs)
bug symfony/symfony#53383 [Validator] re-allow an empty list of fields (@xabbuh)
bug symfony/symfony#53350 [Validator] fix the exception being thrown (@xabbuh)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-11-06T16:20:43Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/composer.lock

Command failed: composer install --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Your lock file does not contain a compatible set of packages. Please run composer update.

  Problem 1
    - lcobucci/clock is locked to version 3.0.0 and an update of this package was not requested.
    - lcobucci/clock 3.0.0 requires php ~8.1.0 || ~8.2.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 2
    - lcobucci/jwt is locked to version 5.2.0 and an update of this package was not requested.
    - lcobucci/jwt 5.2.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 3
    - ergebnis/composer-normalize is locked to version 2.41.1 and an update of this package was not requested.
    - ergebnis/composer-normalize 2.41.1 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 4
    - ergebnis/json is locked to version 1.1.0 and an update of this package was not requested.
    - ergebnis/json 1.1.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 5
    - ergebnis/json-normalizer is locked to version 4.4.1 and an update of this package was not requested.
    - ergebnis/json-normalizer 4.4.1 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 6
    - ergebnis/json-pointer is locked to version 3.3.0 and an update of this package was not requested.
    - ergebnis/json-pointer 3.3.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 7
    - ergebnis/json-printer is locked to version 3.4.0 and an update of this package was not requested.
    - ergebnis/json-printer 3.4.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 8
    - ergebnis/json-schema-validator is locked to version 4.1.0 and an update of this package was not requested.
    - ergebnis/json-schema-validator 4.1.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 9
    - vimeo/psalm is locked to version 5.20.0 and an update of this package was not requested.
    - vimeo/psalm 5.20.0 requires php ^7.4 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.2) does not satisfy that requirement.
  Problem 10
    - lexik/jwt-authentication-bundle is locked to version v2.20.3 and an update of this package was not requested.
    - lcobucci/clock 3.0.0 requires php ~8.1.0 || ~8.2.0 -> your php version (8.4.2) does not satisfy that requirement.
    - lexik/jwt-authentication-bundle v2.20.3 requires lcobucci/clock ^1.2|^2.0|^3.0 -> satisfiable by lcobucci/clock[3.0.0].

renovate bot added the dependencies Add or update dependencies label Nov 6, 2024

renovate-approve bot approved these changes Nov 6, 2024

View reviewed changes

Update dependency symfony/validator to v6.4.11 [SECURITY]

f0bf374

renovate bot force-pushed the deps-packagist-symfony-validator-vulnerability branch from 353cc4f to f0bf374 Compare January 7, 2025 11:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency symfony/validator to v6.4.11 [SECURITY] #1367

Update dependency symfony/validator to v6.4.11 [SECURITY] #1367

Update dependency symfony/validator to v6.4.11 [SECURITY] #1367

Are you sure you want to change the base?

Update dependency symfony/validator to v6.4.11 [SECURITY] #1367

Conversation

GitHub Vulnerability Alerts

Description

Resolution

Credits

Release Notes

Configuration

⚠️ Artifact update problem

File name: backend/composer.lock