Problem/Motivation

symfony/http-foundation had a security release last week.

Proposed resolution

Update our lockfile version of it.

Remaining tasks

Release notes snippet

symfony/http-foundation has been updated to 8.1.9.

Issue fork drupal-3632086

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

xjm created an issue. See original summary.

xjm opened merge request !17518

xjm’s picture

xjm
she/her
Primary language English
commented
Status: Active » Needs review
xjm’s picture

xjm
she/her
Primary language English
commented
Title: Update lockfile version of symfony/http-foundation » Update lockfile versions of symfony components

xjm opened merge request !17519

xjm opened merge request !17520

xjm opened merge request !17521

xjm’s picture

xjm
she/her
Primary language English
commented
Title: Update lockfile versions of symfony components » Update lockfile versions of Symfony components, Guzzle, Composer

xjm opened merge request !17522

xjm opened merge request !17523

xjm opened merge request !17524

godotislate’s picture

godotislate
he/him
commented

Relevant Symfony CVEs
https://symfony.com/blog/cve-2026-108082-redos-in-headerutils-split-reac...

The issue has been fixed in Symfony HTTP Foundation 5.4.54, 6.4.46, 7.4.19, 8.1.7.

https://symfony.com/blog/cve-2026-109413-unbounded-recursion-in-the-yaml...

The issue has been fixed in Symfony YAML 5.4.54, 6.4.45, 7.4.18, 8.1.6.

Composer SAs
https://github.com/composer/composer/security/advisories/GHSA-rvx4-ffvw-...
https://github.com/composer/composer/security/advisories/GHSA-96h3-5x6v-...

Patched versions
2.10.3
2.2.30

godotislate’s picture

godotislate
he/him
commented

tl;dr main, 12.0.x, 11.x, 11.5.x look good. Questions on the rest.

✓ main, 12.0x: symfony/http-foundation -> 8.1.9. symfony/yaml already at 8.1.6, and no composer version to worry bout since PinnedDevDependencies is gone

✓ 11.x, 11.5.x: symfony/http-foundation -> 7.4.21, symfony/yaml -> 7.4.21. composer/composer already at 2.10.3

? 11.4.x: symfony/http-foundation -> 7.4.21, symfony/yaml -> 7.4.21, composer/composer -> 2.10.3. 1 question about the symfony/deprecation-contracts update.

? 11.3.x: symfony/http-foundation -> 7.4.21, symfony/yaml -> 7.4.21, composer/composer -> 2.10.3. 1 question about the symfony/deprecation-contracts update. Also a question about why symfony/runtime was added as an allowed plugin.

? 10.6.x symfony/http-foundation -> 6.4.48, symfony/yaml -> 6.4.48, composer/composer -> 2.10.3. 1 question about the symfony/deprecation-contracts update

godotislate’s picture

godotislate
he/him
commented
Status: Needs review » Reviewed & tested by the community

Discussed with @xjm, and the symfony/deprecation_contracts updates are probably second-tier dependencies and fine.

Other comments resolved.

lgtm

  • larowlan committed d3cbca3f on main 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed ad342803 on 11.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed a316cc1f on 12.0.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed d1ffb9b8 on 11.5.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed 5060cdf6 on 11.4.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed 6ee6bd64 on 10.6.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...

  • larowlan committed 644d37f7 on 11.3.x 
    task: #3632086 Update lockfile versions of Symfony components, Guzzle,...
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Version: main » 10.6.x-dev
Status: Reviewed & tested by the community » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.