search

drupal-composer / drupal-security-advisories

Other
51 stars 19 forks source link

Drupal GraphQL version 3.x is incorrectly marked as vulnerable #26

Closed gaards closed 2 years ago

gaards commented 2 years ago

GraphQL version 3 is incorrectly marked as a conflict in this project, this causes issues with composer when trying to update existing dependencies or install new dependencies. The conflict is marked here:

https://github.com/drupal-composer/drupal-security-advisories/blob/432c09b99d4a47a04446f3b9449e71526c5794ff/composer.json#L49

In the security advisory it's mentioned that the 3.x branch is not affected by the issue:

The 8.x-3.x branch is not affected by this issue.

https://www.drupal.org/sa-contrib-2021-013

webflo commented 2 years ago

The v2 branch of this project has the proper information (https://github.com/drupal-composer/drupal-security-advisories/blob/8.x-v2/composer.json) this is used in Drush 11.