Problem/Motivation

Guzzle
https://github.com/advisories/GHSA-h95v-h523-3mw8
https://github.com/advisories/GHSA-wm3w-8rrp-j577
https://github.com/advisories/GHSA-f283-ghqc-fg79

Composer
https://github.com/advisories/GHSA-gjfg-22fp-rrxx
https://github.com/advisories/GHSA-g6xq-892h-64w3
https://github.com/advisories/GHSA-499r-g7pc-vmp9
composer/composer is not in core-recommended, so updating is not in scope here.

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Workaround

You can temporarily fetch aliases of the affected guzzlehttp libraries with this command:

composer require "guzzlehttp/guzzle:7.15.1 as 7.12.1" "guzzlehttp/promises:2.5.1 as 2.5.0" "guzzlehttp/psr7:2.13.0 as 2.12.1"

When a new Drupal core is released, revert this temporary fix by deleting these lines in composer.json, and then update Drupal core:

"guzzlehttp/guzzle": "7.15.1 as 7.12.1",
"guzzlehttp/promises": "2.5.1 as 2.5.0",
"guzzlehttp/psr7": "2.13.0 as 2.12.1",

For details, see https://getcomposer.org/doc/articles/aliases.md.

Issue fork drupal-3612247

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

catch created an issue. See original summary.

catch’s picture

catch
he/him
Primary language English
commented
Priority: Normal » Critical

godotislate made their first commit to this issue’s fork.

godotislate opened merge request !16380

godotislate’s picture

godotislate
he/him
commented
Title: Update guzzle » Update guzzle and composer
Issue summary: View changes

godotislate opened merge request !16381

godotislate opened merge request !16382

godotislate closed merge request !16380

godotislate’s picture

godotislate
he/him
commented
Title: Update guzzle and composer » Update guzzle to 7.15.1
Issue summary: View changes
godotislate’s picture

godotislate
he/him
commented
Version: main » 10.6.x-dev
Status: Active » Needs review

11.3.x: https://git.drupalcode.org/project/drupal/-/merge_requests/16381
10.6.x: https://git.drupalcode.org/project/drupal/-/merge_requests/16382

godotislate’s picture

godotislate
he/him
commented
Issue summary: View changes
hummeldon’s picture

hummeldon commented
Version: 10.6.x-dev » main
Issue summary: View changes
Status: Needs review » Active

Just popping in to say thanks for getting things rolling on this. Looking forward to when my team can move over to 11.4.

hummeldon’s picture

hummeldon commented
Status: Active » Needs review
godotislate’s picture

godotislate
he/him
commented
Title: Update guzzle to 7.15.1 » Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.12.3
catch’s picture

catch
he/him
Primary language English
commented
Status: Needs review » Reviewed & tested by the community

Looks good.

mstrelan’s picture

mstrelan commented

I tried to follow Managing composer updates for Drupal core to verify that I got the same output, but it just kept trying to downgrade to an older guzzle version. Perhaps there are different steps for core-recommended.

Instead I reviewed the commit from #3603733: Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1 and can see this follows the same pattern. Tests are green, RTBC+1.

sense-design’s picture

sense-design
sense
Primary language German
Location Münster
commented

RTBC+1 for me too, need this fix for Drupal 11.3 very soon if possible. Currently our automatic scanner will not let us through.

sense-design’s picture

sense-design
sense
Primary language German
Location Münster
commented

Currently using this workaround in Drupal 11.3 to pass my tests

composer require "guzzlehttp/guzzle:7.15.1 as 7.12.1" "guzzlehttp/promises:2.5.1 as 2.5.0" "guzzlehttp/psr7:2.13.0 as 2.12.1"

or if using DDEV

ddev composer require "guzzlehttp/guzzle:7.15.1 as 7.12.1" "guzzlehttp/promises:2.5.1 as 2.5.0" "guzzlehttp/psr7:2.13.0 as 2.12.1"

catch closed merge request !16381

  • catch committed dff624a5 on 10.6.x 
    task: #3612247 Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to...

  • catch committed 0ca40af5 on 11.3.x 
    task: #3612247 Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to...
catch’s picture

catch
he/him
Primary language English
commented
Status: Reviewed & tested by the community » Fixed

Since @mstrelan +1d this going ahead with a commit here. Committed/pushed the respective MRs to 10.6.x and 11.3.x, thanks!

Opened #3612448: Widen constraints in core-recommended for 11.3.x and 10.6.x so we don't have to keep doing this constantly.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

catch closed merge request !16382

ressa’s picture

ressa
he/him
commented
Issue summary: View changes
Related issues: +#3603733: Update guzzlehttp/psr7 to 2.12.1 and guzzlehttp/guzzle to 7.12.1

Thanks everyone for a fast reaction to this, I am adding the Composer / Guzzle workaround tip in the Issue Summary. Widening the constraints in 10.6 and 11.3 would be a welcome update.