Skip to content

chore(deps): update dependency drupal/core-recommended to v10 [security] #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

chore(deps): update dependency drupal/core-recommended to v10 [security] #118

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 3, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
drupal/core-recommended 9.4.8 -> 10.2.11 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-45440

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

CVE-2024-55637

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

To help protect against this potential vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a TypeError.

This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2024-55636

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Artbitrary File Deletion. It is not directly exploitable.

This issue is mitigated by the fact that in order to be exploitable, a separate vulnerability must be present that allows an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

To help protect against this vulnerability, types have been added to properties in some of Drupal core's classes. If an application extends those classes, the same types may need to be specified on the subclass to avoid a TypeError.

This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2024-55634

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation. As a result, a user may be able to register with the same email address as another user. This may lead to data integrity issues. This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2024-12393

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized. This issue affects Drupal Core: from 8.8.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8.

CVE-2024-55638

Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead to Remote Code Execution. It is not directly exploitable.

This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize(). There are no such known exploits in Drupal core.

To help protect against this potential vulnerability, some additional checks have been added to Drupal core's database code. If you use a third-party database driver, check the release notes for additional configuration steps that may be required in certain cases.

This issue affects Drupal Core: from 7.0 before 7.102, from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9.

Release Notes

drupal/core-recommended (drupal/core-recommended)

v10.2.11

Compare Source

v10.2.10

Compare Source

v10.2.9

Compare Source

v10.2.8

Compare Source

v10.2.7

Compare Source

v10.2.6

Compare Source

v10.2.5

Compare Source

v10.2.4

Compare Source

v10.2.3

Compare Source

v10.2.2

Compare Source

v10.2.1

Compare Source

v10.2.0

Compare Source

v10.1.8

Compare Source

v10.1.7

Compare Source

v10.1.6

Compare Source

v10.1.5

Compare Source

v10.1.4

Compare Source

v10.1.3

Compare Source

v10.1.2

Compare Source

v10.1.1

Compare Source

v10.1.0

Compare Source

v10.0.11

Compare Source

v10.0.10

Compare Source

v10.0.9

Compare Source

v10.0.8

Compare Source

v10.0.7

Compare Source

v10.0.6

Compare Source

v10.0.5

Compare Source

v10.0.4

Compare Source

v10.0.3

Compare Source

v10.0.2

Compare Source

v10.0.1

Compare Source

v10.0.0

Compare Source

v9.5.11

Compare Source

v9.5.10

Compare Source

v9.5.9

Compare Source

v9.5.8

Compare Source

v9.5.7

Compare Source

v9.5.6

Compare Source

v9.5.5

Compare Source

v9.5.4

Compare Source

v9.5.3

Compare Source

v9.5.2

Compare Source

v9.5.1

Compare Source

v9.5.0

Compare Source

v9.4.15

Compare Source

v9.4.14

Compare Source

v9.4.13

Compare Source

v9.4.12

Compare Source

v9.4.11

Compare Source

v9.4.10

Compare Source

v9.4.9

Compare Source

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Contributor Author

renovate bot commented Oct 3, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: drupal/composer.lock
Command failed: composer update drupal/core-recommended:10.2.11 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires drupal/core-recommended 10.2.11 -> satisfiable by drupal/core-recommended[10.2.11].
    - drupal/core-recommended 10.2.11 requires drupal/core 10.2.11 -> found drupal/core[10.2.11] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("SA-CORE-2025-001", "SA-CORE-2025-002", "SA-CORE-2025-003", "SA-CORE-2025-004", "SA-CORE-2025-007", "SA-CORE-2025-008", "SA-CORE-2025-005", "SA-CORE-2025-006", "PKSA-d8tb-wwz2-ctxk", "PKSA-dh1f-zjm5-qg8y", "PKSA-bn52-vyzy-rmnm", "PKSA-xj83-g6g8-41vf", "PKSA-s1zc-gcfk-ddw5", "PKSA-ctyc-dmct-npkz", "PKSA-42zc-x5ss-z64p", "PKSA-s6zc-mws4-ngh4") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 2
    - drupal/simple_oauth is locked to version 5.2.2 and an update of this package was not requested.
    - drupal/simple_oauth 5.2.2 requires league/oauth2-server ^8.3 -> found league/oauth2-server[8.3.0, ..., 8.5.x-dev] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-pc52-dbxt-c1w6") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 3
    - drupal/core-dev is locked to version 9.4.8 and an update of this package was not requested.
    - drupal/core-dev 9.4.8 requires composer/composer ^2.2.12 -> found composer/composer[dev-main, 2.2.12, ..., 2.9.x-dev (alias of dev-main)] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-b8f7-zn44-r4gz", "PKSA-s25b-vbmp-jvhh", "PKSA-jn72-4kr8-gj3h", "PKSA-m1ph-vmbx-2xd3") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 4
    - drupal/druxt is locked to version 1.1.1 and an update of this package was not requested.
    - drupal/core[8.8.x-dev, ..., 8.9.x-dev] require symfony/console ~3.4.0 -> found symfony/console[v3.4.0-BETA1, ..., 3.4.x-dev] but these were not loaded, likely because it conflicts with another require.
    - drupal/core 9.0.x-dev requires composer/semver ^1.0 -> found composer/semver[1.0.0, ..., 1.x-dev] but these were not loaded, likely because it conflicts with another require.
    - drupal/core[9.1.x-dev, ..., 9.3.x-dev] require laminas/laminas-diactoros ^2.1 -> satisfiable by laminas/laminas-diactoros[2.4.x-dev, ..., 2.26.x-dev], longwave/laminas-diactoros[2.14.x-dev].
    - drupal/core[9.4.x-dev, ..., 9.5.x-dev] require longwave/laminas-diactoros ^2.14 -> satisfiable by longwave/laminas-diactoros[2.14.x-dev].
    - drupal/druxt 1.1.1 requires drupal/core ^8.8 || ^9 -> satisfiable by drupal/core[8.8.x-dev, 8.9.x-dev, 9.0.x-dev, ..., 9.5.x-dev].
    - laminas/laminas-diactoros[2.7.x-dev, ..., 2.14.x-dev] require php ^7.3 || ~8.0.0 || ~8.1.0 -> your php version (8.4.14) does not satisfy that requirement.
    - laminas/laminas-diactoros[2.15.x-dev, ..., 2.17.x-dev] require php ^7.4 || ~8.0.0 || ~8.1.0 -> your php version (8.4.14) does not satisfy that requirement.
    - laminas/laminas-diactoros[2.18.1, ..., 2.25.x-dev] require php ~8.0.0 || ~8.1.0 || ~8.2.0 -> your php version (8.4.14) does not satisfy that requirement.
    - laminas/laminas-diactoros[2.26.0, ..., 2.26.x-dev] require php ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.14) does not satisfy that requirement.
    - laminas/laminas-diactoros 2.4.x-dev requires php ^7.1 -> your php version (8.4.14) does not satisfy that requirement.
    - laminas/laminas-diactoros[2.5.x-dev, ..., 2.6.x-dev] require php ^7.3 || ~8.0.0 -> your php version (8.4.14) does not satisfy that requirement.
    - longwave/laminas-diactoros 2.14.x-dev requires php ^7.3 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 -> your php version (8.4.14) does not satisfy that requirement.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@coderabbitai
Copy link

coderabbitai bot commented Oct 3, 2024 •
edited
Loading

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate bot force-pushed the renovate/packagist-drupal-core-recommended-vulnerability branch from ae63904 to 92cc498 Compare October 8, 2024 16:01
@renovate renovate bot force-pushed the renovate/packagist-drupal-core-recommended-vulnerability branch from 92cc498 to 2188d82 Compare December 10, 2024 20:30
@renovate renovate bot changed the title chore(deps): update dependency drupal/core-recommended to v10 [security] chore(deps): update dependency drupal/core-recommended to v10 [security] - autoclosed Nov 19, 2025
@renovate renovate bot closed this Nov 19, 2025
@renovate renovate bot deleted the renovate/packagist-drupal-core-recommended-vulnerability branch November 19, 2025 17:52
@renovate renovate bot changed the title chore(deps): update dependency drupal/core-recommended to v10 [security] - autoclosed chore(deps): update dependency drupal/core-recommended to v10 [security] Nov 19, 2025
@renovate renovate bot reopened this Nov 19, 2025
@renovate renovate bot force-pushed the renovate/packagist-drupal-core-recommended-vulnerability branch 2 times, most recently from 2188d82 to c15cc34 Compare November 19, 2025 20:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant