Feeling Lucky
Composer Dependency Changed
PR-5.4-dev
[#48845] - [5.4] Composer updates 2026-11-12
- Fixed in Code Base
- 13 Nov 2026
- Medium
- Build: 5.4-dev
- # 48845
- Diff
- richard67:5.4-dev-composer-update-2026-11-11
User tests: Successful: Unsuccessful:
Pull Request resolves # .
- I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.
Summary of Changes
This pull request (PR) updates 1 direct and 4 indirect composer dependencies in order to fix 6 security vulnerabilities reported by composer audit for the current 5.4-dev branch.
In detail following dependencies are updated:
- Direct non-development dependency "symfony/yaml" from 6.4.48 to 6.4.50
- https://github.com/symfony/yaml/releases/tag/v6.4.49
- https://github.com/symfony/yaml/releases/tag/v6.4.50
- All changes symfony/yaml@v6.4.48...v6.4.50
- Indirect development dependency "symfony/filesystem" from 6.4.24 to 6.4.50
- https://github.com/symfony/filesystem/releases/tag/v6.4.30
- https://github.com/symfony/filesystem/releases/tag/v6.4.34
- https://github.com/symfony/filesystem/releases/tag/v6.4.37
- https://github.com/symfony/filesystem/releases/tag/v6.4.39
- https://github.com/symfony/filesystem/releases/tag/v6.4.43
- https://github.com/symfony/filesystem/releases/tag/v6.4.44
- https://github.com/symfony/filesystem/releases/tag/v6.4.45
- https://github.com/symfony/filesystem/releases/tag/v6.4.48
- https://github.com/symfony/filesystem/releases/tag/v6.4.50
- All changes symfony/filesystem@v6.4.24...v6.4.50
- Indirect non-development dependency "symfony/http-client" from 6.4.25 to 6.4.50
- https://github.com/symfony/http-client/releases/tag/v6.4.26
- https://github.com/symfony/http-client/releases/tag/v6.4.28
- https://github.com/symfony/http-client/releases/tag/v6.4.30
- https://github.com/symfony/http-client/releases/tag/v6.4.31
- https://github.com/symfony/http-client/releases/tag/v6.4.32
- https://github.com/symfony/http-client/releases/tag/v6.4.33
- https://github.com/symfony/http-client/releases/tag/v6.4.34
- https://github.com/symfony/http-client/releases/tag/v6.4.36
- https://github.com/symfony/http-client/releases/tag/v6.4.37
- https://github.com/symfony/http-client/releases/tag/v6.4.41
- https://github.com/symfony/http-client/releases/tag/v6.4.42
- https://github.com/symfony/http-client/releases/tag/v6.4.43
- https://github.com/symfony/http-client/releases/tag/v6.4.44
- https://github.com/symfony/http-client/releases/tag/v6.4.45
- https://github.com/symfony/http-client/releases/tag/v6.4.46
- https://github.com/symfony/http-client/releases/tag/v6.4.47
- https://github.com/symfony/http-client/releases/tag/v6.4.48
- https://github.com/symfony/http-client/releases/tag/v6.4.49
- https://github.com/symfony/http-client/releases/tag/v6.4.50
- All changes symfony/http-client@v6.4.25...v6.4.50
- Indirect non-development dependency "symfony/validator" from 6.4.25 to 6.4.50
- https://github.com/symfony/validator/releases/tag/v6.4.26
- https://github.com/symfony/validator/releases/tag/v6.4.27
- https://github.com/symfony/validator/releases/tag/v6.4.29
- https://github.com/symfony/validator/releases/tag/v6.4.30
- https://github.com/symfony/validator/releases/tag/v6.4.31
- https://github.com/symfony/validator/releases/tag/v6.4.33
- https://github.com/symfony/validator/releases/tag/v6.4.34
- https://github.com/symfony/validator/releases/tag/v6.4.35
- https://github.com/symfony/validator/releases/tag/v6.4.36
- https://github.com/symfony/validator/releases/tag/v6.4.37
- https://github.com/symfony/validator/releases/tag/v6.4.42
- https://github.com/symfony/validator/releases/tag/v6.4.43
- https://github.com/symfony/validator/releases/tag/v6.4.44
- https://github.com/symfony/validator/releases/tag/v6.4.45
- https://github.com/symfony/validator/releases/tag/v6.4.46
- https://github.com/symfony/validator/releases/tag/v6.4.47
- https://github.com/symfony/validator/releases/tag/v6.4.48
- https://github.com/symfony/validator/releases/tag/v6.4.49
- https://github.com/symfony/validator/releases/tag/v6.4.50
- All changes symfony/validator@v6.4.25...v6.4.50
- Indirect non-development dependency "phpseclib/phpseclib" from 3.0.57 to 3.0.58
- https://github.com/phpseclib/phpseclib/releases/tag/3.0.58
- All changes phpseclib/phpseclib@3.0.57...3.0.58
Testing Instructions
- Run
composer installand thencomposer audit. - Verify that there are no breaking changes done with this update by checking the release information listed above in the summary of changes.
- Check that all CI actions are successful.
Actual result BEFORE applying this Pull Request
- Composer audit
Found 7 security vulnerability advisories affecting 6 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package | phpseclib/phpseclib |
| Severity | |
| Advisory ID | PKSA-h7cz-q7zq-mdkt |
| CVE | NO CVE |
| Title | phpseclib unbounded PBKDF iteration count in encrypted key/PFX/CMS parsing |
| | enables CPU-exhaustion DoS |
| URL | https://github.com/phpseclib/phpseclib/security/advisories/GHSA-w3p9-g4p2-h3rr |
| Affected versions | >=4.0.0,<4.0.3|>=3.0.0,<3.0.58|>=2.0.0,<2.0.56|>=1.0.0,<1.0.31 |
| Reported at | 2026-11-02T00:00:00+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | symfony/filesystem |
| Severity | |
| Advisory ID | PKSA-g499-cm4q-v35y |
| CVE | NO CVE |
| Title | Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape |
| | Their Base Directory |
| URL | https://github.com/symfony/symfony/security/advisories/GHSA-6prc-h956-hxjq |
| Affected versions | >=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6. |
| | 4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0, |
| | <7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11 |
| Reported at | 2026-11-04T00:00:00+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | symfony/http-client |
| Severity | |
| Advisory ID | PKSA-yd1s-kk7g-k2j3 |
| CVE | CVE-2026-121971 |
| Title | ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins |
| | Through Network-Path References |
| URL | https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj |
| Affected versions | >=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3 |
| | .0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,< |
| | 6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4. |
| | 0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11 |
| Reported at | 2026-11-04T10:45:07+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | symfony/http-client |
| Severity | |
| Advisory ID | PKSA-gfw6-4rnd-4533 |
| CVE | CVE-2026-123119 |
| Title | NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting |
| | DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342 |
| URL | https://github.com/symfony/symfony/security/advisories/GHSA-c7hm-wqwp-f9v8 |
| Affected versions | >=4.3.0,<4.4.0|>=4.4.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3 |
| | .0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,< |
| | 6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4. |
| | 0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11 |
| Reported at | 2026-11-04T10:45:07+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | symfony/validator |
| Severity | |
| Advisory ID | PKSA-68kf-8d6f-hdsy |
| CVE | CVE-2026-123125 |
| Title | Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 |
| | Addresses: SSRF Filter Bypass |
| URL | https://github.com/symfony/symfony/security/advisories/GHSA-4qpf-57w4-m3wc |
| Affected versions | >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2 |
| | .0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,< |
| | 6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3. |
| | 0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11 |
| Reported at | 2026-11-04T10:45:07+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | symfony/yaml |
| Severity | |
| Advisory ID | PKSA-nktx-f1n1-b4yd |
| CVE | CVE-2026-123792 |
| Title | Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document |
| | Hold a Process |
| URL | https://github.com/symfony/symfony/security/advisories/GHSA-hwfg-qwvh-2wfx |
| Affected versions | >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2 |
| | .0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.56|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,< |
| | 6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.50|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3. |
| | 0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.23|>=8.0.0,<8.1.0|>=8.1.0,<8.1.11 |
| Reported at | 2026-11-04T10:45:07+00:00 |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package | web-auth/webauthn-lib |
| Severity | medium |
| Advisory ID | PKSA-3mms-4n3p-ym65 |
| CVE | CVE-2024-39912 |
| Title | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames |
| URL | https://github.com/advisories/GHSA-875x-g8p7-5w27 |
| Affected versions | >=4.5.0,<4.9.0 |
| Reported at | 2024-07-15T16:37:49+00:00 |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package | Suggested Replacement |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib |
+---------------------------+----------------------------------------------------------------------------------+
- Not applicable.
- All CI actions are successful.
Expected result AFTER applying this Pull Request
- Composer audit
Found 1 security vulnerability advisory affecting 1 package:
+-------------------+----------------------------------------------------------------------------------+
| Package | web-auth/webauthn-lib |
| Severity | medium |
| Advisory ID | PKSA-3mms-4n3p-ym65 |
| CVE | CVE-2024-39912 |
| Title | The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames |
| URL | https://github.com/advisories/GHSA-875x-g8p7-5w27 |
| Affected versions | >=4.5.0,<4.9.0 |
| Reported at | 2024-07-15T16:37:49+00:00 |
+-------------------+----------------------------------------------------------------------------------+
Found 1 abandoned package:
+---------------------------+----------------------------------------------------------------------------------+
| Abandoned Package | Suggested Replacement |
+---------------------------+----------------------------------------------------------------------------------+
| web-auth/metadata-service | web-auth/webauthn-lib |
+---------------------------+----------------------------------------------------------------------------------+
- No breaking changes.
- All CI actions are successful.
Link to documentations
Please select:
-
Documentation link for guide.joomla.org:
-
No documentation changes for guide.joomla.org needed
-
Pull Request link for manual.joomla.org:
-
No documentation changes for manual.joomla.org needed
| Status | New | ⇒ | Pending |
joomla-cms-bot
- | Category | ⇒ | External Library Composer Change |
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2026-11-13 06:40:42 |
| Closed_By | ⇒ | muhme | |
| Labels |
Added:
Composer Dependency Changed
PR-5.4-dev
|
||
Thank you very much @richard67 for your contribution.