chore(deps): Update Composer dependencies (security-patch)#430
Closed
nielsdrost7 wants to merge 1 commit intodevelopfrom
Closed
chore(deps): Update Composer dependencies (security-patch)#430nielsdrost7 wants to merge 1 commit intodevelopfrom
nielsdrost7 wants to merge 1 commit intodevelopfrom
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR updates the project's security audit report with newly identified vulnerability advisories across six packages, and comprehensively upgrades Composer dependencies to newer versions across both direct and transitive package requirements. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@audit-report.json`:
- Around line 2-109: The audit-report.json still contains obsolete entries under
the "advisories" section (e.g., "filament/tables", "league/commonmark",
"phpunit/phpunit", etc.); regenerate the report from the current composer.lock
so it reflects installed versions (run your project's Composer audit and
export/update audit-report.json), verify the "advisories" block no longer lists
fixed vulnerabilities, and commit the regenerated audit-report.json.
In `@updated-packages.txt`:
- Around line 10-19: This PR upgrades several packages across major versions
(e.g., barryvdh/laravel-debugbar v3→v4, laravel/boost v1→v2, laravel/tinker
v2→v3, php-debugbar v2→v3, webmozart/assert 1→2 and phpunit/phpunit bumped), but
the phpunit and phpstan CI workflows are configured only with workflow_dispatch
so they won't run automatically on PRs; update the CI to run the PHPUnit and
PHPStan workflows on pull_request (add or change the trigger from
workflow_dispatch to include pull_request) or manually trigger them for this PR,
then re-run all three quality gates (phpunit/phpunit tests, phpstan analysis,
and pint formatting) against this branch to validate compatibility with the
upgraded packages (focus checks around barryvdh/laravel-debugbar,
laravel/tinker, laravel/boost, php-debugbar, webmozart/assert).
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 468da512-6f1f-4460-a06e-8926a09051f5
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
audit-report.jsonupdated-packages.txt
Comment on lines
+2
to
+109
| "advisories": { | ||
| "filament/tables": [ | ||
| { | ||
| "advisoryId": "PKSA-5bdf-2x61-v43c", | ||
| "packageName": "filament/tables", | ||
| "affectedVersions": ">=5.0.0,<5.3.5|>=4.0.0,<4.8.5", | ||
| "title": "Filament Unvalidated Range and Values summarizer values can be used for XSS", | ||
| "cve": "CVE-2026-33080", | ||
| "link": "https://github.com/advisories/GHSA-vv3x-j2x5-36jc", | ||
| "reportedAt": "2026-03-18T20:07:24+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-vv3x-j2x5-36jc" | ||
| } | ||
| ], | ||
| "severity": "high" | ||
| } | ||
| ], | ||
| "league/commonmark": [ | ||
| { | ||
| "advisoryId": "PKSA-21fb-n1x5-5nf7", | ||
| "packageName": "league/commonmark", | ||
| "affectedVersions": ">=2.3.0,<=2.8.1", | ||
| "title": "league/commonmark has an embed extension allowed_domains bypass", | ||
| "cve": "CVE-2026-33347", | ||
| "link": "https://github.com/advisories/GHSA-hh8v-hgvp-g3f5", | ||
| "reportedAt": "2026-03-19T19:04:24+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-hh8v-hgvp-g3f5" | ||
| } | ||
| ], | ||
| "severity": "medium" | ||
| }, | ||
| { | ||
| "advisoryId": "PKSA-2cx9-ynrq-qdk3", | ||
| "packageName": "league/commonmark", | ||
| "affectedVersions": ">=2.0.0,<=2.8.0", | ||
| "title": "CommonMark has DisallowedRawHtml extension bypass via whitespace in HTML tag names", | ||
| "cve": "CVE-2026-30838", | ||
| "link": "https://github.com/advisories/GHSA-4v6x-c7xx-hw9f", | ||
| "reportedAt": "2026-03-06T23:27:03+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-4v6x-c7xx-hw9f" | ||
| } | ||
| ], | ||
| "severity": "medium" | ||
| } | ||
| ], | ||
| "phpunit/phpunit": [ | ||
| { | ||
| "advisoryId": "PKSA-z3gr-8qht-p93v", | ||
| "packageName": "phpunit/phpunit", | ||
| "affectedVersions": ">=12.0.0,<12.5.8|>=11.0.0,<11.5.50|>=10.0.0,<10.5.62|>=9.0.0,<9.6.33|<8.5.52", | ||
| "title": "PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling", | ||
| "cve": "CVE-2026-24765", | ||
| "link": "https://github.com/advisories/GHSA-vvj3-c3rp-c85p", | ||
| "reportedAt": "2026-01-27T22:26:22+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-vvj3-c3rp-c85p" | ||
| } | ||
| ], | ||
| "severity": "high" | ||
| } | ||
| ], | ||
| "psy/psysh": [ | ||
| { | ||
| "advisoryId": "PKSA-4s4z-t146-6123", | ||
| "packageName": "psy/psysh", | ||
| "affectedVersions": "<=0.11.22|>=0.12.0,<=0.12.18", | ||
| "title": "PsySH has Local Privilege Escalation via CWD .psysh.php auto-load", | ||
| "cve": "CVE-2026-25129", | ||
| "link": "https://github.com/advisories/GHSA-4486-gxhx-5mg7", | ||
| "reportedAt": "2026-01-30T21:28:44+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-4486-gxhx-5mg7" | ||
| } | ||
| ], | ||
| "severity": "medium" | ||
| } | ||
| ], | ||
| "symfony/process": [ | ||
| { | ||
| "advisoryId": "PKSA-rkkf-636k-qjb3", | ||
| "packageName": "symfony/process", | ||
| "affectedVersions": ">=8.0,<8.0.5|>=7.4,<7.4.5|>=7.3,<7.3.11|>=6.4,<6.4.33|<5.4.51", | ||
| "title": "Symfony's incorrect argument escaping under MSYS2/Git Bash can lead to destructive file operations on Windows", | ||
| "cve": "CVE-2026-24739", | ||
| "link": "https://github.com/advisories/GHSA-r39x-jcww-82v6", | ||
| "reportedAt": "2026-01-28T21:28:10+00:00", | ||
| "sources": [ | ||
| { | ||
| "name": "GitHub", | ||
| "remoteId": "GHSA-r39x-jcww-82v6" | ||
| } | ||
| ], | ||
| "severity": "medium" | ||
| } | ||
| ] | ||
| }, |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify installed versions from composer.lock for packages listed in audit-report.json
python - <<'PY'
import json, pathlib
lock_path = pathlib.Path("composer.lock")
audit_path = pathlib.Path("audit-report.json")
lock = json.loads(lock_path.read_text())
audit = json.loads(audit_path.read_text())
pkgs = {}
for section in ("packages", "packages-dev"):
for p in lock.get(section, []):
pkgs[p["name"]] = p["version"]
targets = list(audit.get("advisories", {}).keys())
print("Package versions in composer.lock:")
for name in targets:
print(f"- {name}: {pkgs.get(name, 'NOT INSTALLED')}")
print("\nAdvisory IDs:")
for name, items in audit.get("advisories", {}).items():
ids = ", ".join(x.get("advisoryId","?") for x in items)
print(f"- {name}: {ids}")
PYRepository: InvoicePlane/InvoicePlane-v2
Length of output: 461
Regenerate audit-report.json from composer.lock before merge
The security report contains advisories that no longer apply. All listed packages have been upgraded to versions that resolve their respective vulnerabilities according to the affected version ranges specified. Commit an updated report that reflects the current security status of the installed dependencies.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@audit-report.json` around lines 2 - 109, The audit-report.json still contains
obsolete entries under the "advisories" section (e.g., "filament/tables",
"league/commonmark", "phpunit/phpunit", etc.); regenerate the report from the
current composer.lock so it reflects installed versions (run your project's
Composer audit and export/update audit-report.json), verify the "advisories"
block no longer lists fixed vulnerabilities, and commit the regenerated
audit-report.json.
Comment on lines
+10
to
+19
| barryvdh/laravel-debugbar: v3.16.3 → v4.1.3 | ||
| driftingly/rector-laravel: 2.1.9 → 2.2.0 | ||
| larastan/larastan: v3.9.0 → v3.9.3 | ||
| laravel/boost: v1.8.10 → v2.3.4 | ||
| laravel/pail: v1.2.4 → v1.2.6 | ||
| laravel/sail: v1.52.0 → v1.54.0 | ||
| laravel/tinker: v2.11.0 → v3.0.0 | ||
| nunomaduro/collision: v8.8.3 → v8.9.1 | ||
| phpunit/phpunit: 11.5.48 → 11.5.55 | ||
| rector/rector: 2.3.1 → 2.3.9 |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Detect major version jumps from updated-packages.txt =="
python - <<'PY'
import re, pathlib
txt = pathlib.Path("updated-packages.txt").read_text().splitlines()
pat = re.compile(r'^([a-z0-9_.-]+/[a-z0-9_.-]+):\s+([vV]?\d+(?:\.\d+){0,2}|[0-9]+(?:\.[0-9]+){0,2})\s+→\s+([vV]?\d+(?:\.\d+){0,2}|[0-9]+(?:\.[0-9]+){0,2})$')
def major(v):
v=v.lower().lstrip('v')
return int(v.split('.')[0])
for line in txt:
m = pat.match(line.strip())
if not m:
continue
name, old, new = m.groups()
if major(old) != major(new):
print(f"{name}: {old} -> {new}")
PY
echo
echo "== Check for commented-out quality gates in GitHub workflows =="
fd -e yml -e yaml .github/workflows | xargs -r rg -n -C2 '^\s*#\s*.*(phpunit|pint|phpstan|test|static|analysis|format)'Repository: InvoicePlane/InvoicePlane-v2
Length of output: 776
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Check lines 74-81 in updated-packages.txt =="
sed -n '74,81p' updated-packages.txt
echo
echo "== Check for commented-out quality gates in GitHub workflows =="
fd --full-path '.github/workflows' -e yml -e yaml | xargs -r rg -n -C2 '^\s*#\s*.*(phpunit|pint|phpstan|test|static|analysis|format)' || echo "No commented-out quality gates found"
echo
echo "== List all workflow files =="
find .github/workflows -type f -name '*.yml' -o -name '*.yaml' 2>/dev/null || echo "No workflow files found"Repository: InvoicePlane/InvoicePlane-v2
Length of output: 820
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Inspect phpunit.yml =="
cat .github/workflows/phpunit.yml
echo
echo "== Inspect phpstan.yml =="
cat .github/workflows/phpstan.yml
echo
echo "== Inspect pint.yml =="
cat .github/workflows/pint.ymlRepository: InvoicePlane/InvoicePlane-v2
Length of output: 8714
Run quality gate workflows on all major version upgrades before merging
The PR includes 5 major version jumps across lines 10–19 and 74–81:
- barryvdh/laravel-debugbar: v3 → v4
- laravel/boost: v1 → v2
- laravel/tinker: v2 → v3
- php-debugbar/php-debugbar: v2 → v3
- webmozart/assert: 1 → 2
The PHPUnit and PHPStan workflows are configured to run manually only (workflow_dispatch), not automatically on PRs. Pint runs on PRs but may need validation with the updated versions. Re-run all three quality gates (phpunit, phpstan, pint) with these new versions before merging to ensure compatibility.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@updated-packages.txt` around lines 10 - 19, This PR upgrades several packages
across major versions (e.g., barryvdh/laravel-debugbar v3→v4, laravel/boost
v1→v2, laravel/tinker v2→v3, php-debugbar v2→v3, webmozart/assert 1→2 and
phpunit/phpunit bumped), but the phpunit and phpstan CI workflows are configured
only with workflow_dispatch so they won't run automatically on PRs; update the
CI to run the PHPUnit and PHPStan workflows on pull_request (add or change the
trigger from workflow_dispatch to include pull_request) or manually trigger them
for this PR, then re-run all three quality gates (phpunit/phpunit tests, phpstan
analysis, and pint formatting) against this branch to validate compatibility
with the upgraded packages (focus checks around barryvdh/laravel-debugbar,
laravel/tinker, laravel/boost, php-debugbar, webmozart/assert).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Composer Dependency Update
This PR updates Composer dependencies.
Update Type:
Triggered by: schedule
Updated Packages
Checks Performed
Unit tests passed(commented out until further notice)Static analysis completed(commented out until further notice)Code formatting checked(commented out until further notice)Security Audit
Security vulnerabilities detected. Please review audit-report.json.
Review Checklist
This PR was automatically created by the Composer Update workflow.
Summary by CodeRabbit