Cannot fix CVE because of constraints caused by this extension

[peterjaap]

Yesterday this CVE got published; CVE-2022-24894: Prevent storing cookie headers in HttpCache

To fix this in Magento 2, we need to update symfony/http-kernel to 4.4.50.

In an install with this Sentry module, Magento installs 4.4.13 because in 4.4.14, a dependency on symfony/http-client-contracts: ^1.1|^2 is introduced and this extension requires the sentry/sdk ^3.0 which in turn needs symfony/http-client ^4.3|^5.0|^6.0 which in turn needs symfony/http-client-contracts ^3.0. However, symfony/http-client-contracts ^1.1|^2 does not satisfy this constraint.

This all means we can't update symfony/http-kernel to 4.4.50 because the sentry/sdk required by this extension needs a newer version of symfony/http-client-contracts than symfony/http-kernel:4.4.50 allows.

Do you see any way around this?

[peterjaap]

Found a workaround; downgrade symfony/http-client to ^5; composer update symfony/http-client:^5 -W and then upgrade symfony/http-kernel to 4.4.50; composer why symfony/http-kernel 4.4.50