Skip to content

Commit 5b6e1de

Browse files
sboldyrevasboldyreva
authored
Merge pull request #380 from sboldyreva/php-fr
Add PHP: Nesbot Carbon page and version updates
2 parents 132f526 + 5c1ff33 commit 5b6e1de

File tree

6 files changed

+214
-1
lines changed

6 files changed

+214
-1
lines changed

‎docs/.vuepress/components/ELSTechnology.vue‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -967,6 +967,11 @@ const techData = [
967967
ecosystem: "PHP",
968968
ecosystemIcon: "/images/php-logo.webp",
969969
projects: [
970+
{
971+
name: "Carbon",
972+
versions: "1.26.6",
973+
link: "./carbon/",
974+
},
970975
{
971976
name: "DomPDF",
972977
versions: "0.8.x | 1.2.x",

‎docs/.vuepress/config-client/sidebar.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,10 @@ export default {
226226
type: 'section-header',
227227
icon: '/images/php-logo.webp',
228228
},
229+
{
230+
path: '/els-for-libraries/carbon/',
231+
icon: '/images/nesbot-carbon.webp',
232+
},
229233
{
230234
path: '/els-for-libraries/dompdf/',
231235
icon: '/images/dompdf-logo.webp',

‎docs/.vuepress/public/images/nesbot-carbon.webp‎

314 Bytes
Loading

‎docs/els-for-libraries/carbon/README.md‎

Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
# Carbon
2+
3+
Endless Lifecycle Support (ELS) for Carbon from TuxCare provides security fixes for Carbon library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended.
4+
5+
## Supported Versions
6+
7+
* **Carbon** 1.26.6
8+
9+
Other versions upon request.
10+
11+
## Connection to ELS for Carbon Repository
12+
13+
This guide outlines the steps needed to integrate the TuxCare ELS for Carbon repository into your application. The repository provides trusted Carbon library versions that can be easily integrated into your **Composer** projects.
14+
15+
### Step 1: Get user credentials
16+
17+
You need a username and password in order to use TuxCare ELS for Carbon repository. Anonymous access is disabled. To receive the credentials, please contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
18+
19+
### Step 2: Configure Composer authentication
20+
21+
1. Create or edit the `auth.json` file for the user running Composer:
22+
23+
* **Linux/macOS**:
24+
25+
<CodeWithCopy>
26+
27+
```text
28+
~/.composer/auth.json
29+
```
30+
31+
</CodeWithCopy>
32+
33+
* **Windows**:
34+
35+
<CodeWithCopy>
36+
37+
```text
38+
%APPDATA%\Composer\auth.json
39+
```
40+
41+
</CodeWithCopy>
42+
43+
2. Use either the Composer CLI or edit `auth.json` directly to add your credentials for `nexus.repo.tuxcare.com`.
44+
45+
<CodeTabs :tabs="[
46+
{ title: 'Composer CLI', content: `composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD` },
47+
{ title: 'auth.json', content: authjson }
48+
]" />
49+
50+
Replace `USERNAME` and `PASSWORD` with the credentials you received in [Step 1](#step-1-get-user-credentials).
51+
52+
### Step 3: Register the TuxCare repository
53+
54+
Add the `els_php_custom1` Composer repository either via CLI or by editing `composer.json`:
55+
56+
<CodeTabs :tabs="[
57+
{ title: 'Composer CLI', content: cli },
58+
{ title: 'composer.json', content: composerjson }
59+
]" />
60+
61+
### Step 4: Install Carbon
62+
63+
Install the TuxCare-maintained Carbon release that matches your project:
64+
65+
<CodeTabs :tabs="[
66+
{ title: 'Composer CLI', content: `composer require nesbot/carbon:1.26.6-p1+tuxcare` },
67+
{ title: 'composer.json', content: carbonjson }
68+
]" />
69+
70+
**Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.**
71+
72+
If you edited `composer.json` manually, run `composer update` to install the package:
73+
74+
<CodeWithCopy>
75+
76+
```text
77+
composer update
78+
```
79+
80+
</CodeWithCopy>
81+
82+
Composer will resolve dependencies against the TuxCare repository and install the patched releases.
83+
84+
### Composer Repository Configuration
85+
86+
If you encounter dependency resolution errors like:
87+
88+
`packages from higher priority repository do not match your constraint`
89+
90+
it usually means your project requires a package version that is not yet available in the TuxCare repository.
91+
92+
**Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical:
93+
94+
<CodeWithCopy>
95+
96+
```
97+
{
98+
"repositories": [
99+
{
100+
"type": "composer",
101+
"url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/",
102+
"canonical": false
103+
}
104+
]
105+
}
106+
```
107+
108+
</CodeWithCopy>
109+
110+
This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available.
111+
112+
## Vulnerability Exploitability eXchange (VEX)
113+
114+
VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks.
115+
116+
TuxCare provides VEX for Carbon ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_php/nesbot-carbon/](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/nesbot-carbon/).
117+
118+
## How to Upgrade to a Newer Version
119+
120+
If you have already installed a TuxCare Carbon package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version:
121+
122+
<CodeWithCopy>
123+
124+
```text
125+
composer require nesbot/carbon:VERSION-pN+tuxcare
126+
```
127+
128+
</CodeWithCopy>
129+
130+
Then run `composer update` to apply the changes:
131+
132+
<CodeWithCopy>
133+
134+
```text
135+
composer update
136+
```
137+
138+
</CodeWithCopy>
139+
140+
## Resolved CVEs in Carbon
141+
142+
Fixes for the following vulnerabilities are available in ELS for Carbon from TuxCare:
143+
144+
<TableTabs label="Choose Carbon version: " >
145+
146+
<template #Carbon_1.26.6 >
147+
148+
| CVE ID | Severity | Vulnerable versions | Fixed in version |
149+
|----------------|----------|---------------------|---------------------|
150+
| CVE-2025-22145 | Medium | 1.26.6 | 1.26.6-p1+tuxcare |
151+
152+
</template>
153+
154+
</TableTabs>
155+
156+
If you are interested in the TuxCare Endless Lifecycle Support, contact [sales@tuxcare.com](mailto:sales@tuxcare.com).
157+
158+
<script setup>
159+
160+
const authjson =
161+
`{
162+
"http-basic": {
163+
"nexus.repo.tuxcare.com": {
164+
"username": "USERNAME",
165+
"password": "PASSWORD"
166+
}
167+
}
168+
}`
169+
170+
const composerjson =
171+
`{
172+
"repositories": [
173+
{
174+
"type": "composer",
175+
"url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/",
176+
"options": {
177+
"http": {
178+
"verify": true
179+
}
180+
}
181+
}
182+
]
183+
}`
184+
185+
const cli =
186+
`composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php_custom1/","options":{"http":{"verify":true}}}' --json`
187+
188+
const carbonjson =
189+
`{
190+
"require": {
191+
"nesbot/carbon": "1.26.6-p1+tuxcare"
192+
}
193+
}`
194+
195+
</script>

‎docs/els-for-libraries/laravel/README.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Endless Lifecycle Support (ELS) for Laravel from TuxCare provides security fixes
44

55
## Supported Versions
66

7-
* **Laravel** 5.8.38, 8, 10, 11
7+
* **Laravel** 5.4.36, 5.8.38, 8, 10, 11
88

99
Other versions upon request.
1010

@@ -143,6 +143,14 @@ Fixes for the following vulnerabilities are available in ELS for Laravel from Tu
143143

144144
<TableTabs label="Choose Laravel version: " >
145145

146+
<template #Laravel_5.4>
147+
148+
| CVE ID | Severity | Vulnerable versions | Fixed in version |
149+
|----------------|----------|-------------------------------|---------------------|
150+
| CVE-2021-43808 | Medium | < 6.18.35, < 7.24.0 | 5.4.36-p1+tuxcare |
151+
152+
</template>
153+
146154
<template #Laravel_5.8>
147155

148156
| CVE ID | Severity | Vulnerable versions | Fixed in version |

‎docs/els-for-libraries/symfony/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ composer update
164164
|----------------|----------|----------------------|-------------------|
165165
| CVE-2025-64500 | Critical |< 5.4.50 >=6, <6.4.29, >=7,<7.3.7| 3.4.47-p1+tuxcare |
166166
| CVE-2025-64500 | Critical |< 5.4.50, >=6,<6.4.29, >=7,<7.3.7| 4.4.49-p1+tuxcare |
167+
| CVE-2024-50345 | Medium |< 5.4.46, >=6,<6.4.14, >=7,<7.1.7| 3.4.47-p2+tuxcare |
167168

168169
</template>
169170

0 commit comments

Comments
 (0)