search

barryvdh / laravel-dompdf

A DOMPDF Wrapper for Laravel
MIT License
6.74k stars 971 forks source link

Update dompdf dependencies to 1.2.1 to address security issues #878

Open adisnabawi opened 2 years ago

adisnabawi commented 2 years ago

Hi, currently the dompdf has update to 1.2.1 to address high security issues. I try to install and update the latest version but it stuck up to the older release of dompdf which is 1.1.1. https://github.com/dompdf/dompdf/releases/tag/v1.2.1

allanvb commented 2 years ago

@adisnabawi most probably it is locked by another dependency. Check your composer.lock.

Also if you're using roave/security-advisories it can stuck because of wrong app name in your composer.json. Check this https://github.com/Roave/SecurityAdvisories/commit/21d0504612c544af1d8ce000e5e0301aa8bbde7c#r71824701

anthony-ab commented 2 years ago

@adisnabawi I had the same problem than you. And as @allanvb said, it's locked by another dependency. In my case, it was blocked by PhpSpreadSheet because I'm using Laravel Excel on my application. PhpSpreadSheet has the dompdf requirement like this : 

"require-dev": {
    "dompdf/dompdf": "^1.0"
}

As PhpSpreadSheet still has this v1.0 constraint, I had to use this command to fix my security issue : 

composer require dompdf/dompdf:^1

Hope it'll help !

stale[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any issues with PDF rendering itself that are not directly related to this package, should be reported on https://github.com/dompdf/dompdf instead. When having doubts, please try to reproduce the issue with just dompdf. If you believe this is an actual issue with the latest version of laravel-dompdf, please reply to this issue so we can investigate further. Thank you for your contribution! Apologies for any delayed response on our side.