Problem/Motivation

`drupal/core-recommended:10.6.13` currently requires:
"guzzlehttp/guzzle": "~7.12.1"

However, Composer audit now reports multiple security advisories for guzzlehttp/guzzle that are fixed only in guzzlehttp/guzzle >= 7.15.1.
Because drupal/core-recommended:10.6.13 pins Guzzle to the ~7.12.1 range, Composer-managed Drupal projects using drupal/core-recommended cannot resolve these advisories while keeping the recommended dependency set.

Steps to reproduce

Use a Drupal project requiring:
"drupal/core-recommended": "10.6.13"
Then run:
composer audit

Actual result
Composer reports security advisories for guzzlehttp/guzzle, including:
PKSA-fy2t-3c5f-827y
PKSA-qxvb-2bpp-dnk6
PKSA-bbs6-q5q9-f3t4
PKSA-pwsk-hy21-4gby
The affected versions are below 7.15.1.
Expected result
drupal/core-recommended should allow installing a non-vulnerable Guzzle version, at least guzzlehttp/guzzle >= 7.15.1, while keeping Drupal core on the supported 10.6.x release line.

Proposed resolution

Release a Drupal core patch version that updates the drupal/core-recommended dependency set so that guzzlehttp/guzzle can resolve to 7.15.1 or later.

Issue fork drupal-3612292

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

ankondrat4 created an issue. See original summary.

cilefen’s picture

cilefen commented
Status: Active » Closed (duplicate)
Related issues: +#3612247: Update guzzlehttp/guzzle to 7.15.1 and guzzlehttp/psr7 to 2.12.3

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.