Skip to content

Commit 6565a07

Browse files
sboldyrevasboldyreva
authored
Merge pull request #319 from sboldyreva/php-library
Add PHP libraries
2 parents 9c4c6c7 + 63c19ab commit 6565a07

File tree

4 files changed

+279
-0
lines changed

4 files changed

+279
-0
lines changed

‎docs/.vuepress/components/ELSTechnology.vue‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -758,6 +758,27 @@ const techData = [
758758
},
759759
],
760760
},
761+
{
762+
ecosystem: "PHP",
763+
ecosystemIcon: "/images/php-logo.webp",
764+
projects: [
765+
{
766+
name: "Laravel",
767+
versions: "8 | 10 | 11",
768+
link: "./php-libraries/",
769+
},
770+
{
771+
name: "Livewire",
772+
versions: "3.x",
773+
link: "./php-libraries/",
774+
},
775+
{
776+
name: "Symfony Process",
777+
versions: "5.x | 6.x",
778+
link: "./php-libraries/",
779+
},
780+
],
781+
},
761782
];
762783
763784
const filteredData = computed(() => {

‎docs/.vuepress/config-client/sidebar.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,15 @@ export default {
197197
path: '/els-for-libraries/python-libraries/',
198198
icon: '/images/python.webp',
199199
},
200+
{
201+
title: 'PHP',
202+
type: 'section-header',
203+
icon: '/images/php-logo.webp',
204+
},
205+
{
206+
path: '/els-for-libraries/php-libraries/',
207+
icon: '/images/php-logo.webp',
208+
},
200209
{
201210
title: 'JavaScript',
202211
type: 'section-header',

‎docs/els-for-libraries/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,4 @@ Language-specific:
7373
- [Python](https://security.tuxcare.com/vex/cyclonedx/els_lang_python/)
7474
- [Java](https://security.tuxcare.com/vex/cyclonedx/els_lang_java/)
7575
- [JavaScript](https://security.tuxcare.com/vex/cyclonedx/els_lang_javascript/)
76+
- [PHP](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/)

‎docs/els-for-libraries/php-libraries/README.md‎

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
# PHP Libraries
2+
3+
Endless Lifecycle Support (ELS) for Libraries from TuxCare provides security fixes for various PHP packages that have reached their end-of-life. This allows you to continue running your PHP applications without vulnerability concerns, even after official support has ended.
4+
5+
## Supported PHP Libraries
6+
7+
* **Laravel** 8, 10, 11
8+
* **Livewire** 3.x
9+
* **Symfony Process** 5.x, 6.x
10+
11+
Other libraries upon request.
12+
13+
## Connection to ELS for PHP Libraries Repository
14+
15+
This guide outlines the steps needed to integrate the TuxCare ELS for PHP Libraries repository into your PHP application. The repository provides trusted PHP libraries that can be easily integrated into your **Composer** projects.
16+
17+
### Step 1: Get user credentials
18+
19+
You need a username and password in order to use TuxCare ELS for PHP Libraries repository. Anonymous access is disabled. To receive the credentials, please contact [[email protected]](mailto:[email protected]).
20+
21+
### Step 2: Configure Composer authentication
22+
23+
1. Create or edit the `auth.json` file for the user running Composer:
24+
25+
* **Linux/macOS**:
26+
27+
<CodeWithCopy>
28+
29+
```text
30+
~/.composer/auth.json
31+
```
32+
33+
</CodeWithCopy>
34+
35+
* **Windows**:
36+
37+
<CodeWithCopy>
38+
39+
```text
40+
%APPDATA%\Composer\auth.json
41+
```
42+
43+
</CodeWithCopy>
44+
45+
2. Use either the Composer CLI or edit `auth.json` directly add your credentials for `nexus.repo.tuxcare.com`.
46+
47+
<CodeTabs :tabs="[
48+
{ title: 'Composer CLI', content: `composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD` },
49+
{ title: 'auth.json', content: authjson }
50+
]" />
51+
52+
Replace `USERNAME` and `PASSWORD` with the credentials you received in [Step 1](#step-1-get-user-credentials).
53+
54+
### Step 3: Register the TuxCare repository
55+
56+
Add the `els_php_custom1` Composer repository either via CLI or by editing `composer.json`:
57+
58+
<CodeTabs :tabs="[
59+
{ title: 'Composer CLI', content: cli },
60+
{ title: 'composer.json', content: composerjson }
61+
]" />
62+
63+
### Step 4: Install packages
64+
65+
* Install the TuxCare-maintained release that matches your project using either the CLI or by editing `composer.json` directly:
66+
67+
<CodeTabs :tabs="[
68+
{ title: 'Composer CLI', content: `composer require vendor/package:VERSION-pN+tuxcare` },
69+
{ title: 'composer.json', content: requirejson }
70+
]" />
71+
72+
Replace:
73+
* `vendor/package` with the needed package (`laravel/framework`, `livewire/livewire`, or `symfony/process`);
74+
* `VERSION-pN+tuxcare` with the exact version listed in your TuxCare Nexus account. `pN` stands for TuxCare patch number.
75+
76+
**Please refer to the following examples to install the needed libraries. Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.**
77+
78+
<TableTabs label="Choose a library: " >
79+
80+
<template #Laravel>
81+
82+
<CodeTabs :tabs="[
83+
{ title: 'Composer CLI', content: `composer require laravel/framework:10.48.28-p1+tuxcare` },
84+
{ title: 'composer.json', content: laraveljson }
85+
]" />
86+
87+
</template>
88+
89+
<template #Livewire>
90+
91+
<CodeTabs :tabs="[
92+
{ title: 'Composer CLI', content: `composer require livewire/livewire:3.6.3-p1+tuxcare` },
93+
{ title: 'composer.json', content: livewirejson }
94+
]" />
95+
96+
</template>
97+
98+
<template #Symfony_process>
99+
100+
<CodeTabs :tabs="[
101+
{ title: 'Composer CLI', content: `composer require symfony/process:6.4.13-p1+tuxcare` },
102+
{ title: 'composer.json', content: symfonyjson }
103+
]" />
104+
105+
</template>
106+
107+
</TableTabs>
108+
109+
* If you edited `composer.json` manually, run `composer update` to install the package:
110+
111+
<CodeWithCopy>
112+
113+
```text
114+
composer update
115+
```
116+
117+
</CodeWithCopy>
118+
119+
* Composer will resolve dependencies against the TuxCare repository and install the patched releases.
120+
121+
### Conclusion
122+
123+
You've successfully integrated the TuxCare ELS for PHP Libraries repository into your project. You can now benefit from the secure and vetted PHP libraries it provides.
124+
125+
## Vulnerability Exploitability eXchange (VEX)
126+
127+
VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks.
128+
129+
TuxCare provides VEX for PHP Libraries ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_php/](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/).
130+
131+
## How to Upgrade to a Newer Version of TuxCare Packages
132+
133+
* If you have already installed a TuxCare package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version:
134+
135+
<CodeWithCopy>
136+
137+
```text
138+
composer require vendor/package:VERSION-pN+tuxcare
139+
```
140+
141+
</CodeWithCopy>
142+
143+
* Then run `composer update` to apply the changes:
144+
145+
<CodeWithCopy>
146+
147+
```text
148+
composer update
149+
```
150+
151+
</CodeWithCopy>
152+
153+
## Resolved CVEs in ELS for PHP Libraries
154+
155+
Fixes for the following vulnerabilities are available in ELS for PHP Libraries from TuxCare:
156+
157+
<TableTabs label="Choose a library: " >
158+
159+
<template #Laravel_framework>
160+
161+
| CVE ID | Severity | Vulnerable versions | Fixed in version |
162+
|----------------|----------|----------------------|---------------------|
163+
| CVE-2025-27515 | Medium | >= 11.0.0, < 11.44.1 | 11.44.0-p1+tuxcare |
164+
| CVE-2025-27515 | Medium | < 10.48.29 | 10.48.28-p1+tuxcare |
165+
| CVE-2025-27515 | Medium | <= 8.83.29 | 8.83.29-p1+tuxcare |
166+
167+
</template>
168+
169+
<template #Livewire>
170+
171+
| CVE ID | Severity | Vulnerable versions | Fixed in version |
172+
|----------------|----------|----------------------|------------------|
173+
| CVE-2025-54068 | Critical | < 3.6.4 | 3.6.3-p1+tuxcare |
174+
175+
</template>
176+
177+
<template #Symfony_process>
178+
179+
| CVE ID | Severity | Vulnerable versions | Fixed in version |
180+
|----------------|----------|----------------------|-------------------|
181+
| CVE-2025-27515 | Critical | < 6.4.14 | 6.4.13-p1+tuxcare |
182+
| CVE-2025-27515 | Critical | < 5.4.46 | 5.4.45-p1+tuxcare |
183+
184+
</template>
185+
186+
</TableTabs>
187+
188+
If you are interested in the TuxCare Endless Lifecycle Support, contact [[email protected]](mailto:[email protected]).
189+
190+
<script setup>
191+
192+
const authjson =
193+
`{
194+
"http-basic": {
195+
"nexus.repo.tuxcare.com": {
196+
"username": "USERNAME",
197+
"password": "PASSWORD"
198+
}
199+
}
200+
}`
201+
202+
const composerjson =
203+
`{
204+
"repositories": [
205+
{
206+
"type": "composer",
207+
"url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/",
208+
"options": {
209+
"http": {
210+
"verify": true
211+
}
212+
}
213+
}
214+
]
215+
}`
216+
217+
const cli =
218+
`composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php_custom1/","options":{"http":{"verify":true}}}' --json`
219+
220+
const requirejson =
221+
`{
222+
"require": {
223+
"vendor/package": "VERSION-pN+tuxcare"
224+
}
225+
}`
226+
227+
const laraveljson =
228+
`{
229+
"require": {
230+
"laravel/framework": "10.48.28-p1+tuxcare"
231+
}
232+
}`
233+
234+
const livewirejson =
235+
`{
236+
"require": {
237+
"livewire/livewire": "3.6.3-p1+tuxcare"
238+
}
239+
}`
240+
241+
const symfonyjson =
242+
`{
243+
"require": {
244+
"symfony/process": "6.4.13-p1+tuxcare"
245+
}
246+
}`
247+
248+
</script>

0 commit comments

Comments
 (0)