search

drupalwxt / docker-scaffold

Docker Scaffold for Drupal WxT
4 stars 7 forks source link

Update Composer version to address vulnerability from GitHub #44

Open chrislaick opened 1 month ago

chrislaick commented 1 month ago

https://github.com/advisories/GHSA-47f6-5gq3-vx9c

We are currently using 10.2.x-php8.2 branch of drupalwxt/docker-scaffold and Composer is locked at 2.7.6:

https://github.com/drupalwxt/docker-scaffold/blob/10.2.x-php8.2/Dockerfile

The current latest stable release of Composer is 2.7.9. Recommend updating the Composer version to address the vulnerability for both 10.2.x and 10.2.x-php8.2 branches.

smulvih2 commented 1 month ago

Hey Chris, thanks for posting the issue! Take a look at this PR - https://github.com/drupalwxt/docker-scaffold/pull/45

This provides the update to 2.7.9 as a default, as well as supports passing the COMPOSER_VERSION through the .env file so this can be done per project while waiting for docker-scaffold to upgrade. I haven't tested this yet, but I was looking to do this for other things as well so would be great to get your input on this approach and if it works for you.

chrislaick commented 1 month ago

Hi Stephen, this approach would work nicely for us. It'll be great to have control over the COMPOSER_VERSION on a per project basis without having to wait for updates.

smulvih2 commented 1 month ago

If you can test out my feature branch and let me know it works for you that would be great. I'll test it on my end based on 10.3.x and report back.

chrislaick commented 1 month ago

Tested on 10.2.x and is working as expected. See comments.

chrislaick commented 3 weeks ago

Hi @smulvih2. Anything I can do to help move this along? I can also test the PR on 10.3.x. Thanks!