Problem/Motivation

From #3044175-12: [DO NOT COMMIT] Vendor minimum testing issue:

pear/archive_tar needs to be at least at 1.4.5 to be compliant with SA-CORE-2019-001 (and not calling deprecated code)

Proposed resolution

require pear/archive_tar ^1.4.5

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

CommentFileSizeAuthor
#7 3086796-7.patch416 bytesmondrake
#2 3086796-2.patch1.7 KBmondrake

Comments

mondrake’s picture

mondrake
Location 🇮🇹
commented

mondrake created an issue. See original summary.

mondrake’s picture

mondrake
Location 🇮🇹
commented
Status: Active » Needs review
StatusFileSize
new 3086796-2.patch1.7 KB
mile23’s picture

mile23
Primary language English
Location Seattle, WA
commented
Status: Needs review » Reviewed & tested by the community

If we wrote an SA about it, it stands to reason we'd enforce it in our composer.json file rather than just our lock file. https://www.drupal.org/sa-core-2019-001

Version: 8.8.x-dev » 8.9.x-dev

Drupal 8.8.0-alpha1 will be released the week of October 14th, 2019, which means new developments and disruptive changes should now be targeted against the 8.9.x-dev branch. (Any changes to 8.9.x will also be committed to 9.0.x in preparation for Drupal 9’s release, but some changes like significant feature additions will be deferred to 9.1.x.). For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

mile23’s picture

mile23
Primary language English
Location Seattle, WA
commented
Issue tags: +Needs reroll

Needs a reroll, and we might also target it for 8.8.x tho I'm not sure it's time-sensitive before release.

alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Reviewed & tested by the community » Needs work
mondrake’s picture

mondrake
Location 🇮🇹
commented
Status: Needs work » Reviewed & tested by the community
StatusFileSize
new 3086796-7.patch416 bytes

Rerolled.

  • alexpott committed ac9bfb1 on 9.0.x 
    Issue #3086796 by mondrake, Mile23: Explicitly require pear/archive_tar...

  • alexpott committed 3a9d5fa on 8.9.x 
    Issue #3086796 by mondrake, Mile23: Explicitly require pear/archive_tar...

  • alexpott committed de565ca on 8.8.x 
    Issue #3086796 by mondrake, Mile23: Explicitly require pear/archive_tar...
alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed ac9bfb1e1c to 9.0.x and 3a9d5fadb4 to 8.9.x and de565ca095 to 8.8.x. Thanks!

diff --git a/composer.lock b/composer.lock
index 0c182e35b9..1ae9956e4b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -689,7 +689,7 @@
             "dist": {
                 "type": "path",
                 "url": "core",
-                "reference": "57abe59512b004ec4634f670d65f2b79d505d5a5"
+                "reference": "31a1704b02a57fad76cd5bdf898d5677154ed351"
             },
             "require": {
                 "asm89/stack-cors": "^1.1",
@@ -713,7 +713,7 @@
                 "ext-xml": "*",
                 "guzzlehttp/guzzle": "^6.3",
                 "masterminds/html5": "^2.1",
-                "pear/archive_tar": "^1.4",
+                "pear/archive_tar": "^1.4.5",
                 "php": ">=7.0.8",
                 "stack/builder": "^1.0",
                 "symfony-cmf/routing": "^1.4",
@@ -733,7 +733,7 @@
                 "symfony/yaml": "~3.4.5",
                 "twig/twig": "^1.38.2",
                 "typo3/phar-stream-wrapper": "^2.1.1",
-                "zendframework/zend-diactoros": "^1.1",
+                "zendframework/zend-diactoros": ">=1.7 <1.8",
                 "zendframework/zend-feed": "^2.12"
             },
             "conflict": {

We need to update the lock file too - so it reflects these changes. Done on commit.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.