fix(deps): update dependency symfony/http-client to 6.4.* [security] by renovate[bot] · Pull Request #613 · labstag/old-withouteasyadmin

renovate · 2024-11-06T16:48:37Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
symfony/http-client (source)	`6.2.` -> `6.4.`

GitHub Vulnerability Alerts

CVE-2024-50342

Description

When using the NoPrivateNetworkHttpClient, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration.

Resolution

The NoPrivateNetworkHttpClient now filters blocked IPs earlier to prevent such leaks.

The fisrt patch for this issue is available here for branch 5.4.

The second one is available here for branch 5.4 also.

Credits

We would like to thank Linus Karlsson and Chris Smith for reporting the issue and Nicolas Grekas for providing the fix.

Release Notes

symfony/http-client (symfony/http-client)

`v6.4.15`

Compare Source

`v6.4.14`

Compare Source

Changelog (symfony/http-client@v6.4.13...v6.4.14)

security symfony/symfony#cve-2024-50342 [HttpClient] Filter private IPs before connecting when Host == IP (@nicolas-grekas)
bug symfony/symfony#58704 [HttpClient] fix for HttpClientDataCollector fails if proc_open is disabled via php.ini (@ZaneCEO)

`v6.4.13`

Compare Source

`v6.4.12`

Compare Source

Changelog (symfony/http-client@v6.4.11...v6.4.12)

bug symfony/symfony#58278 [HttpClient] Fix setting CURLMOPT_MAXCONNECTS (@HypeMC)
bug symfony/symfony#58218 Work around parse_url() bug (@nicolas-grekas)

`v6.4.11`

Compare Source

Changelog (symfony/http-client@v6.4.10...v6.4.11)

bug symfony/symfony#58044 [HttpClient] Do not overwrite the host to request when using option "resolve" (@xabbuh)
bug symfony/symfony#57981 [HttpClient] reject malformed URLs with a meaningful exception (@xabbuh)
bug symfony/symfony#57870 [HttpClient] Disable HTTP/2 PUSH by default when using curl (@nicolas-grekas)

`v6.4.10`

Compare Source

Changelog (symfony/http-client@v6.4.9...v6.4.10)

no significant changes

`v6.4.9`

Compare Source

Changelog (symfony/http-client@v6.4.8...v6.4.9)

bug symfony/symfony#57569 [HttpClient][Mailer] Revert "Let curl handle transfer encoding", use HTTP/1.1 for Mailgun (@nicolas-grekas)
bug symfony/symfony#57453 [HttpClient] Fix parsing SSE (@fancyweb)

`v6.4.8`

Compare Source

Changelog (symfony/http-client@v6.4.7...v6.4.8)

bug symfony/symfony#54860 [HttpClient] Revert fixing curl default options (@alexandre-daubois)
bug symfony/symfony#54830 [HttpClient] Fix cURL default options for PHP 8.4 (@alexandre-daubois)

`v6.4.7`

Compare Source

Changelog (symfony/http-client@v6.4.6...v6.4.7)

bug symfony/symfony#54517 [HttpClient] Let curl handle transfer encoding (@michaelhue)
bug symfony/symfony#54242 [HttpClient] [EventSourceHttpClient] Fix consuming SSEs with \r\n separator (@fancyweb)

`v6.4.6`

Compare Source

Changelog (symfony/http-client@v6.4.5...v6.4.6)

bug symfony/symfony#54400 [HttpClient] stop all server processes after tests have run (@xabbuh)
bug symfony/symfony#54207 [HttpClient] Lazily initialize CurlClientState (@arjenm)
bug symfony/symfony#54146 [HttpClient] Preserve float in JsonMockResponse (@Jibbarth)

`v6.4.5`

Compare Source

Changelog (symfony/http-client@v6.4.4...v6.4.5)

bug symfony/symfony#54102 [HttpClient] Fix deprecation on PHP 8.3 (@nicolas-grekas)

`v6.4.4`

Compare Source

Changelog (symfony/http-client@v6.4.3...v6.4.4)

bug symfony/symfony#53889 [HttpClient] Make retry strategy work again (@Nyholm)

`v6.4.3`

Compare Source

Changelog (symfony/http-client@v6.4.2...v6.4.3)

bug symfony/symfony#53671 [HttpClient] Fix pausing responses before they start when using curl (@nicolas-grekas)
bug symfony/symfony#53506 [HttpClient] Fix error chunk creation in passthru (@rmikalkenas)

`v6.4.2`

Compare Source

Changelog (symfony/http-client@v6.4.1...v6.4.2)

bug symfony/symfony#52864 [HttpClient][Mailer][Process] always pass microseconds to usleep as integers (@xabbuh)

`v6.4.0`

Compare Source

Changelog (symfony/http-client@v6.4.0-RC2...v6.4.0)

no significant changes

`v6.3.12`

Compare Source

Changelog (symfony/http-client@v6.3.11...v6.3.12)

bug symfony/symfony#53671 [HttpClient] Fix pausing responses before they start when using curl (@nicolas-grekas)
bug symfony/symfony#53506 [HttpClient] Fix error chunk creation in passthru (@rmikalkenas)

`v6.3.11`

Compare Source

Changelog (symfony/http-client@v6.3.10...v6.3.11)

bug symfony/symfony#52864 [HttpClient][Mailer][Process] always pass microseconds to usleep as integers (@xabbuh)

`v6.3.8`

Compare Source

Changelog (symfony/http-client@v6.3.7...v6.3.8)

bug symfony/symfony#52472 [HttpClient][WebProfilerBundle] Do not generate cURL command when files are uploaded (@MatTheCat)
bug symfony/symfony#52429 [HttpClient] Replace escapeshellarg to prevent overpassing ARG_MAX (@alexandre-daubois)
bug symfony/symfony#52442 Disable the "Copy as cURL" button when the debug info are disabled (@stof)

`v6.3.7`

Compare Source

Changelog (symfony/http-client@v6.3.6...v6.3.7)

bug symfony/symfony#52329 [HttpClient] Psr18Client: parse HTTP Reason Phrase for Response (@Hanmac)

`v6.3.6`

Compare Source

Changelog (symfony/http-client@v6.3.5...v6.3.6)

bug symfony/symfony#51876 [HttpClient] Fix type error with http_version 1.1 (@Filnor)

`v6.3.5`

Compare Source

Changelog (symfony/http-client@v6.3.4...v6.3.5)

bug symfony/symfony#51659 [HttpClient] Fix TraceableResponse if response has no destruct method (@maxhelias)

`v6.3.2`

Compare Source

Changelog (symfony/http-client@v6.3.1...v6.3.2)

no significant changes

`v6.3.1`

Compare Source

Changelog (symfony/http-client@v6.3.0...v6.3.1)

bug symfony/symfony#50728 [HttpClient] Explicitly exclude CURLOPT_POSTREDIR (@nicolas-grekas)
bug symfony/symfony#50671 [HttpClient] Fix encoding some characters in query strings (Daniel Kozák)
bug symfony/symfony#50698 [HttpClient] Fix int conversion for GenericRetryStrategy with floated multiplier (@francisbesset)
bug symfony/symfony#50577 [HttpClient] Remove final keyword on AsyncResponse (@lyrixx)

`v6.3.0`

Compare Source

Changelog (symfony/http-client@v6.3.0-RC2...v6.3.0)

`v6.2.13`

Compare Source

Changelog (symfony/http-client@v6.2.12...v6.2.13)

no significant changes

`v6.2.12`

Compare Source

Changelog (symfony/http-client@v6.2.11...v6.2.12)

bug symfony/symfony#50728 [HttpClient] Explicitly exclude CURLOPT_POSTREDIR (@nicolas-grekas)
bug symfony/symfony#50671 [HttpClient] Fix encoding some characters in query strings (Daniel Kozák)
bug symfony/symfony#50698 [HttpClient] Fix int conversion for GenericRetryStrategy with floated multiplier (@francisbesset)

`v6.2.11`

Compare Source

Changelog (symfony/http-client@v6.2.10...v6.2.11)

bug symfony/symfony#50193 [Serializer] Fix SerializedPath not working with constructor arguments (@HypeMC)
bug symfony/symfony#50280 [PropertyAccess] Fix nullsafe operator on array index (@HypeMC)
bug symfony/symfony#49063 [Messenger] Respect isRetryable decision of the retry strategy for re-delivery (@FlyingDR)
bug symfony/symfony#50256 [HttpClient] Fix setting duplicate-name headers when redirecting with AmpHttpClient (@nicolas-grekas)
bug symfony/symfony#50214 [WebProfilerBundle] Remove legacy filters remnants (@MatTheCat)
bug symfony/symfony#50235 [HttpClient] Fix getting through proxies via CONNECT (@nicolas-grekas)
bug symfony/symfony#50241 [HttpKernel] Prevent initialising lazy services during services reset (@tucksaun)
bug symfony/symfony#49557 [PropertyInfo] Fix phpDocExtractor nullable array value type (@fabpot)
bug symfony/symfony#50213 [ErrorHandler] Prevent conflicts with WebProfilerBundle’s JavaScript (@MatTheCat)
bug symfony/symfony#50192 [Serializer] backed enum throw notNormalizableValueException outside construct method (@alli83)
bug symfony/symfony#50226 [HttpClient] Ensure HttplugClient ignores invalid HTTP headers (@nicolas-grekas)

`v6.2.10`

Compare Source

Changelog (symfony/http-client@v6.2.9...v6.2.10)

bug symfony/symfony#50066 [Dumper] Trim leading newlines when checking if value begins with a space (@bradtreloar)
bug symfony/symfony#50115 [FrameworkBundle] Make service edges unique (@rmikalkenas)
bug symfony/symfony#50072 [HttpClient] Fix global state preventing two CurlHttpClient instances from working together (@nicolas-grekas)
bug symfony/symfony#48886 [Console] Fix computing column width containing multibyte chars (@cay89)
bug symfony/symfony#47505 [Mime] Form field values with integer keys not resolved correctly (@claudiu-cristea)
bug symfony/symfony#48837 [Messenger] [Redis] Fixed problem where worker stops handling messages on first empty message (@jvmanji)
bug symfony/symfony#49317 [Messenger] Fix warning message on failed messenger show command (@gstapinato)
bug symfony/symfony#49992 [Mailer] [Mailjet] Use body MessageID instead of X-MJ-Request-GUID (@Starfox64)
bug symfony/symfony#48972 [HttpFoundation] Fix memory limit problems in BinaryFileResponse (@glady)
bug symfony/symfony#49009 [Form] Cast choices value callback result to string (@Matth--)
bug symfony/symfony#49537 [Serializer] Unexpected value should throw UnexpectedValueException (@ThomasTr)
bug symfony/symfony#49581 Avoid leading .. for temporary files from Filesystem recursive remove (@giosh94mhz)
bug symfony/symfony#50004 [HttpClient] fix proxied redirects in curl client (@matthi4s)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-11-06T16:48:38Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apps/composer.lock

Command failed: composer update symfony/http-client:6.4.14 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - api-platform/core is locked to version v3.1.9 and an update of this package was not requested.
    - Root composer.json requires symfony/http-client 6.4.* -> satisfiable by symfony/http-client[v6.4.14].
    - api-platform/core v3.1.9 requires symfony/http-foundation ^6.1 -> satisfiable by symfony/http-foundation[v6.2.8].
    - symfony/http-client v6.4.14 conflicts with symfony/http-foundation <6.3.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

fix(deps): update dependency symfony/http-client to 6.4.* [security]

63d1c45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency symfony/http-client to 6.4.* [security]#613

fix(deps): update dependency symfony/http-client to 6.4.* [security]#613
renovate[bot] wants to merge 1 commit into
developfrom
renovate/packagist-symfony-http-client-vulnerability

renovate Bot commented Nov 6, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Nov 6, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Description

Resolution

Credits

Release Notes

Configuration

Uh oh!

renovate Bot commented Nov 6, 2024

⚠️ Artifact update problem

File name: apps/composer.lock

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Nov 6, 2024 •

edited

Loading