Update dependency symfony/runtime to v7.1.7 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/runtime (source)	7.1.1 -> 7.1.7

GitHub Vulnerability Alerts

CVE-2024-50340

Description

When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.

Resolution

The SymfonyRuntime now ignores the argv values for non-cli SAPIs PHP runtimes

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.

---

Release Notes

symfony/runtime (symfony/runtime)

v7.1.7

Compare Source

Changelog (symfony/runtime@v7.1.6...v7.1.7)

• security symfony/symfony#cve-2024-50340 [Runtime] Do not read from argv on non-CLI SAPIs (@​wouterj)

v7.1.6

Compare Source

Changelog (symfony/runtime@v7.1.5...v7.1.6)

• bug symfony/symfony#58372 Tweak error/exception handler registration (@​nicolas-grekas)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pr-reviewbot]

👋 Hi there!

Thanks for opening a new PR. Please, consider following this guide to make your PR easier to review.

Also, check this new feature to use markdown helpers in your PR.