search

razorpay / omnipay-razorpay

Razorpay plugin for Omnipay Payment Processing Library
MIT License
1 stars 11 forks source link

[Security] Bump symfony/http-foundation from 3.2.3 to 3.4.44 #30

Closed dependabot-preview[bot] closed 4 years ago

dependabot-preview[bot] commented 4 years ago

Bumps symfony/http-foundation from 3.2.3 to 3.4.44. This update includes security fixes.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

CVE-2018-14773: Remove support for legacy and risky HTTP headers

Affected versions: >=2.0.0, =4.1.0, <4.1.3

Sourced from The PHP Security Advisories Database.

CVE-2018-11386: Denial of service when using PDOSessionHandler

Affected versions: >=2.0.0, =4.0.0, <4.0.11

Sourced from The PHP Security Advisories Database.

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

Affected versions: >=2.0.0, =4.3.0, <4.3.8

Sourced from The PHP Security Advisories Database.

CVE-2018-11386: Denial of service when using PDOSessionHandler

Affected versions: >=2.0.0, =4.0.0, <4.0.11

Sourced from The PHP Security Advisories Database.

CVE-2019-10913: Reject invalid HTTP method overrides

Affected versions: >=2.7.0, =4.2.0, <4.2.7

Release notes

Sourced from symfony/http-foundation's releases.

v3.4.44

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.43...v3.4.44)

  • no changes

v3.4.43

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.42...v3.4.43)

  • bug #37291 Duplicated MimeType due to PHP Bug (juanmrad)
  • bug #37389 Change file extension of "audio/mpeg" from "mpga" to "mp3" (YaFou)

v3.4.42

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.41...v3.4.42)

  • no changes

v3.4.41

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.40...v3.4.41)

  • no changes

v3.4.40

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.39...v3.4.40)

  • bug #36490 workaround PHP bug in the session module (nicolas-grekas)
  • bug #35656 Fixed session migration with custom cookie lifetime (Guite)

v3.4.39

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.38...v3.4.39)

  • bug #36173 Fix clear cookie samesite (guillbdx)

v3.4.38

Changelog (https://github.com/symfony/http-foundation/compare/v3.4.37...v3.4.38)

  • bug #35605 fix support for samesite in session cookies (fabpot)
  • bug #35305  Fix stale-if-error behavior, add tests (mpdude)
Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

5.2.0

  • added support for X-Forwarded-Prefix header
  • added HeaderUtils::parseQuery(): it does the same as parse_str() but preserves dots in variable names
  • added File::getContent()

5.1.0

  • added Cookie::withValue, Cookie::withDomain, Cookie::withExpires, Cookie::withPath, Cookie::withSecure, Cookie::withHttpOnly, Cookie::withRaw, Cookie::withSameSite
  • Deprecate Response::create(), JsonResponse::create(), RedirectResponse::create(), and StreamedResponse::create() methods (use __construct() instead)
  • added Request::preferSafeContent() and Response::setContentSafe() to handle "safe" HTTP preference according to RFC 8674
  • made the Mime component an optional dependency
  • added MarshallingSessionHandler, IdentityMarshaller
  • made Session accept a callback to report when the session is being used
  • Add support for all core cache control directives
  • Added Symfony\Component\HttpFoundation\InputBag
  • Deprecated retrieving non-string values using InputBag::get(), use InputBag::all() if you need access to the collection of values

5.0.0

  • made Cookie auto-secure and lax by default
  • removed classes in the MimeType namespace, use the Symfony Mime component instead
  • removed method UploadedFile::getClientSize() and the related constructor argument
  • made Request::getSession() throw if the session has not been set before
  • removed Response::HTTP_RESERVED_FOR_WEBDAV_ADVANCED_COLLECTIONS_EXPIRED_PROPOSAL
  • passing a null url when instantiating a RedirectResponse is not allowed

4.4.0

  • passing arguments to Request::isMethodSafe() is deprecated.
  • ApacheRequest is deprecated, use the Request class instead.
  • passing a third argument to HeaderBag::get() is deprecated, use method all() instead
  • [BC BREAK] PdoSessionHandler with MySQL changed the type of the lifetime column, make sure to run ALTER TABLE sessions MODIFY sess_lifetime INTEGER UNSIGNED NOT NULL to update your database.
  • PdoSessionHandler now precalculates the expiry timestamp in the lifetime column, make sure to run CREATE INDEX EXPIRY ON sessions (sess_lifetime) to update your database to speed up garbage collection of expired sessions.
Commits
  • e5a4288 stop using the deprecated at() PHPUnit matcher
  • 91bdbf8 Modernized deprecated PHPUnit assertion calls
  • 5219dba Fix PHPUnit 8.5 deprecations.
  • b11fb1a [SCA] Minor fixes on tests
  • 3f65b22 Removed comments and requirements relative to php <5.5 (not supported anymore)
  • b454f04 Fix test that fails on old distros
  • b78af31 bug #37291 [MimeType] Duplicated MimeType due to PHP Bug (juanmrad)
  • cd70a52 [MimeType] Duplicated MimeType due to PHP Bug
  • 13edce2 [HttpFondation] Change file extension of "audio/mpeg" from "mpga" to "mp3"
  • fbd216d Properties $originalName and $mimeType are never null in UploadedFile
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)
dependabot-preview[bot] commented 4 years ago

Superseded by #31.