search

picocms / Pico

Pico is a stupidly simple, blazing fast, flat file CMS.
http://picocms.org/
MIT License
3.81k stars 616 forks source link

old twig-version: v2.12.5; eol in 2023; Security issue? How to update? #679

Closed new-on-github closed 6 months ago

new-on-github commented 7 months ago

The latest pico release 3.0.0 seems to use a old twig version. Twig 2.* is eol in December 2023.

Is this a security issue? Seems to be.

Is it possible to update the twig version? How to do this without a composer (I use only a webspace).

Thanks a lot.

github-actions[bot] commented 7 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in two days if no further activity occurs. Thank you for your contributions! :+1:

PhrozenByte commented 7 months ago

You might wanna switch to the dev-pico-3.0 branch, it uses Twig 3.0, but keep the breaking changes in mind. You'll need Composer for that (not on the web server though, you can install it locally and then simply upload the files; release archives aren't any different). It's no security issue though, Twig templates aren't modifiable online in Pico.

new-on-github commented 7 months ago

You might wanna switch to the dev-pico-3.0 branch, it uses Twig 3.0, but keep the breaking changes in mind. You'll need Composer for that (not on the web server though, you can install it locally and then simply upload the files; release archives aren't any different). It's no security issue though, Twig templates aren't modifiable online in Pico. Thanks a lot for your reply!

How can I switch to the dev-pico-3.0 branch? There is no release and a also cannot find a repository with this name. Maybe I am to stupid...

It's no security issue though, Twig templates aren't modifiable online in Pico. Ok, this is the very important information. The website works and therefore I can stay on the old twig version. Thank you.

Btw: Thanks a lot for pico cms, it's really cool.

PhrozenByte commented 7 months ago

How can I switch to the dev-pico-3.0 branch?

You'll need Composer. Try the following commands locally, then just upload everything to your webserver:

$ curl -sSL https://getcomposer.org/installer | php
$ php composer.phar create-project picocms/pico-composer pico
$ php composer.phar require --working-dir pico/ --update-with-all-dependencies "picocms/Pico dev-pico-3.0" "picocms/pico-deprecated dev-pico-3.0" "picocms/pico-theme dev-pico-3.0" "picocms/composer-installer dev-pico-3.0"
new-on-github commented 7 months ago

How can I switch to the dev-pico-3.0 branch?

You'll need Composer. Try the following commands locally, then just upload everything to your webserver:

$ curl -sSL https://getcomposer.org/installer | php
$ php composer.phar create-project picocms/pico-composer pico
$ php composer.phar require --working-dir pico/ --update-with-all-dependencies "picocms/Pico dev-pico-3.0" "picocms/pico-deprecated dev-pico-3.0" "picocms/pico-theme dev-pico-3.0" "picocms/composer-installer dev-pico-3.0"

Thanks a lot. But you told me that there are maybe changes in the new twig version, which will break my pico website. I have to test it therefore before.

github-actions[bot] commented 6 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in two days if no further activity occurs. Thank you for your contributions! :+1: