Closed (fixed)
Project:
Drupal core
Version:
11.x-dev
Component:
composer
Priority:
Normal
Category:
Task
Assigned:
Unassigned
Reporter:
Created:
12 Nov 2025 at 13:11 UTC
Updated:
27 Nov 2025 at 20:59 UTC
Jump to comment: Most recent
https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-c...
We are not vulnerable but let's bump minimum versions anyway.
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #8
longwaveValidateHostnameTest fails on an IPv6 test due to https://github.com/symfony/symfony/pull/62324
Comment #9
alexpottHere's the fix for that:
Comment #10
xjmThese
twothree issues probably need to be included in the MRs to get 11.1.x and 10.4.x to pass:Comment #11
xjmEdit: Bad references. Getting the good ones and pushing them up now.
Comment #12
xjmAdditionally #3484845: [random test failure] ImageUrlProviderTest::testResize for 10.4.x.
Comment #13
xjmWe agreed not to update 11.1.x to Symfony 7.3, so I am going to hide that MR.
Comment #15
xjmComment #16
xjmExcellent. Postponing.
Comment #17
anmol singh commentedCan someone tell me how this is fixing this? https://www.drupal.org/project/drupal/issues/3043779#comment-16343306
Comment #26
xjmThe 11.2.x, 10.5.x, and 10.4.x MRs were committed as part of today's security releases, and I've committed 10.6.x just now.
We still need an update for 11.x and 11.3.x once Symfony provides an updated beta for Symfony 7.4, but that will come naturally in a followup issue when we update the dependency as part of our normal release process.
@catch, @longwave, and I agreed not to update 11.1.x to 7.3 (as per the 11.1.9 release notes).
Thanks everyone!
Comment #28
catchThis went out with https://www.drupal.org/project/drupal/releases/11.2.8
edit: apparently had this tab open a long time and crossposted.