Problem/Motivation

Composer blocks updates currently as ~0.22 has security vulnerabilities:

drupal/svg_image_field[2.3.5, ..., 2.3.x-dev] require enshrined/svg-sanitize ~0.22 -> found enshrined/svg-sanitize[0.22.0] but these were not loaded, because they are affected by security advisories ("PKSA-8j6w-3kr7-s9xk", "PKSA-6j95-1jtb-x6wc", "PKSA-cbx2-m9db-bmzd"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.

These are fixed in 1.0.0

Steps to reproduce

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Issue fork svg_image_field-3629549

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

acbramley created an issue. See original summary.

acbramley opened merge request !56

acbramley’s picture

acbramley commented
Status: Active » Needs review
jurgenhaas’s picture

jurgenhaas
he/him
Primary language German
Location Gottmadingen
commented
Priority: Normal » Critical
Status: Needs review » Reviewed & tested by the community

Changing this to critical, I would really appreciate a quick patch release to resolve the multiple CVEs.

mably’s picture

mably commented

And it currently blocks upgrading to the new 3.2.5 release of the svg_image module which now requires ^1.0 for enshrined/svg-sanitize.

timohuisman’s picture

timohuisman
Primary language Dutch
Location Leiden, Netherlands
commented

+1 on RTBC. Without a release we have to work around the ~0.22 constraint with a root-level inline alias or a repository override in every project.

aleix’s picture

aleix
Primary language Catalan
Location Terrassa
commented

While waiting, workaround it with: composer require enshrined/svg-sanitize:'1.0 as 0.99'

tonytheferg’s picture

tonytheferg commented

Hit this too...

mandclu’s picture

mandclu commented
Status: Reviewed & tested by the community » Fixed

Thanks for raising this. I have merged in the change, and will work to get a new release out with the change quickly.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

frondeau’s picture

frondeau commented

Hello,
I'm facing the problem on trying to get the version 2.3.8:

composer require 'drupal/svg_image_field:2.3.8'

It returns the message:

./composer.json has been updated
Running composer update drupal/svg_image_field
Gathering patches for root package.
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires drupal/svg_image_field 2.3.8 -> satisfiable by drupal/svg_image_field[2.3.8].
    - drupal/svg_image_field 2.3.8 requires enshrined/svg-sanitize ^1.0 -> found enshrined/svg-sanitize[1.0.0, 1.1.0, 1.1.1] but the package is fixed to 0.22.0 (lock file version) by a partial update and that version does not match. Make sure you list it as an argument for the update command.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

Installation failed, reverting ./composer.json and ./composer.lock to their original content.
Composer [require drupal/svg_image_field:2.3.8] failed, composer command failed: exit status 2. stderr=

Are you available to check where is the problem coming from ?
Thank you by advance.

frondeau’s picture

frondeau commented

It's OK with -W

omposer require 'drupal/svg_image_field:2.3.8' -W
is installing the the version 2.3.8.

Regards.

jwilson3’s picture

jwilson3
Primary language English
Location Ecuador
commented

The -W option, (a.k.a --with-all-dependencies) is generally a best practice when upgrading any contrib module, or even core.

This was documented in the 2.3.8 release notes, but I've just clarified it further so it stands out and provided a second example (diff).

ProTip: I typically update contrib modules using the second example composer require ... so that my composer.json file also gets the latest version explicitly stated and thereby stays in sync with what is actually installed in composer.lock. Using composer update ... typically does not touch composer.json, and only updates composer.lock.

jwilson3’s picture

jwilson3
Primary language English
Location Ecuador
commented

By the way, svg-sanitize version 1.1.1 was recently released, with even more security fixes. I recommend updating, and more generally, staying on top of Drupal modules and their transient dependencies using composer audit frequently.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.