Problem/Motivation

It fixes these vulnerabilities that could affect Drupal websites:
https://github.com/Masterminds/html5-php/security/advisories/GHSA-6c7p-5...
https://github.com/Masterminds/html5-php/security/advisories/GHSA-pj59-f...

Currently core-recommended forces 2.10.

Steps to reproduce

composer why-not masterminds/html5 2.12.0

Proposed resolution

Update the dependency.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet

Issue fork drupal-3633064

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

prudloff created an issue. See original summary.

keerthi kumar’s picture

keerthi kumar commented
Assigned: Unassigned » keerthi kumar

I would like to give this a try, Starting to work on this

longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Priority: Normal » Critical

keerthi kumar opened merge request !17583

keerthi kumar’s picture

keerthi kumar commented
Status: Active » Needs review

Opened MR !17583 updating masterminds/html5 to 2.12.0 and drupal/core-recommended constraint to ~2.12.0. Setting status to Needs review.

smustgrave’s picture

smustgrave commented
Status: Needs review » Reviewed & tested by the community

Seems like a good update. Not familiar enough with the library to know what it could impact if it needs a CR but looks like we need to update for security.

smustgrave’s picture

smustgrave commented
Assigned: keerthi kumar » Unassigned
longwave’s picture

longwave
he/him
Primary language English
Location UK
commented
Status: Reviewed & tested by the community » Needs work

We should also bump core's constraint for this to prevent the vulnerable version from being installed.

That will change the lockfile hash, so we will also need MRs for all supported branches: main, 12.0.x, 11.x, 11.5.x, 11.4.x, 11.3.x and 10.6.x.

keerthi kumar’s picture

keerthi kumar commented

Thanks @longwave.

Updated MR !17583 against main to bump core's constraint for masterminds/html5 to ^2.12.0 (in core/composer.json, drupal/core-utility, and composer.lock).
Working on opening the backport MRs for the other supported branches (12.0.x, 11.x, 11.5.x, 11.4.x, 11.3.x, and 10.6.x) next.

keerthi kumar’s picture

keerthi kumar commented
Assigned: Unassigned » keerthi kumar

keerthi kumar opened merge request !17631

keerthi kumar opened merge request !17632

keerthi kumar opened merge request !17634

keerthi kumar opened merge request !17635

keerthi kumar opened merge request !17636

keerthi kumar opened merge request !17637

keerthi kumar’s picture

keerthi kumar commented
Status: Needs work » Needs review

Bumping core's constraint for `masterminds/html5` to `^2.12.0` and updated the lockfile reference hash on `main`. All CI checks on MR !17583 have passed.

Opened backport MRs for all supported branches as requested:
- 12.0.x: MR !17637
- 11.x: MR !17636
- 11.5.x: MR !17635
- 11.4.x: MR !17634
- 11.3.x: MR !17632
- 10.6.x: MR !17631

andypost’s picture

andypost
he/him
Primary language Russian
commented
Component: other » composer
Status: Needs review » Reviewed & tested by the community

straightforward

  • catch committed 0947c3d4 on 11.5.x 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...

  • catch committed 6d5aae36 on 11.x 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...

  • catch committed 950c7017 on 12.0.x 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...

  • catch committed e0b0c06e on main 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...

  • catch committed 6db373a1 on 11.4.x 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...

  • catch committed ce86c28e on 11.3.x 
    task: #3633064 Update masterminds/html5 to 2.12.0

By: prudloff
By:...
catch’s picture

catch
he/him
Primary language English
commented
Version: main » 11.3.x-dev
Status: Reviewed & tested by the community » Fixed

Committed/pushed the respective MRs to main, 12.0.x, 11.x, 11.5.x, 11.4.x and 11.3.x, thanks!

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

quietone’s picture

quietone commented
Assigned: keerthi kumar » Unassigned