search

yellowtree / geoip-detect

Wordpress plugin "Geolocation IP Detection": Provides geographic information detected by an IP adress.
http://wordpress.org/plugins/geoip-detect/
GNU General Public License v3.0
163 stars 38 forks source link

fix(deps): update dependency symfony/http-foundation to v5.4.46 [security] #272

Open renovate[bot] opened 1 day ago

renovate[bot] commented 1 day ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
symfony/http-foundation (source) 5.4.22 -> 5.4.46 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-50345

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush for reporting the issue and Nicolas Grekas for providing the fix.

Release Notes

symfony/http-foundation (symfony/http-foundation) ### [`v5.4.46`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.46) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.45...v5.4.46) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.45...v5.4.46) - security symfony/symfony#cve-2024-50345 \[HttpFoundation] Reject URIs that contain invalid characters ([@​nicolas-grekas](https://redirect.github.com/nicolas-grekas)) ### [`v5.4.45`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.45) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.44...v5.4.45) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.44...v5.4.45) - bug [symfony/symfony#58619](https://redirect.github.com/symfony/symfony/issues/58619) \[HttpFoundation]\[Lock] Ensure compatibility with ext-mongodb v2 ([@​GromNaN](https://redirect.github.com/GromNaN)) ### [`v5.4.44`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.44) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.42...v5.4.44) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.43...v5.4.44) - bug [symfony/symfony#58181](https://redirect.github.com/symfony/symfony/issues/58181) \[HttpFoundation] Update links for `X-Accel-Redirect` and fail properly when `X-Accel-Mapping` is missing ([@​nicolas-grekas](https://redirect.github.com/nicolas-grekas)) - bug [symfony/symfony#58218](https://redirect.github.com/symfony/symfony/issues/58218) Work around `parse_url()` bug (@​nicolas-grekas) ### [`v5.4.42`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.42) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.40...v5.4.42) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.41...v5.4.42) - bug [symfony/symfony#57585](https://redirect.github.com/symfony/symfony/issues/57585) \[HttpFoundation] Fix MockArraySessionStorage to generate more conform ids ([@​Seldaek](https://redirect.github.com/Seldaek)) ### [`v5.4.40`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.40) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.39...v5.4.40) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.39...v5.4.40) - bug [symfony/symfony#54910](https://redirect.github.com/symfony/symfony/issues/54910) \[HttpFoundation]  filter out empty HTTP header parts ([@​xabbuh](https://redirect.github.com/xabbuh)) - bug [symfony/symfony#54816](https://redirect.github.com/symfony/symfony/issues/54816) \[Cache] Fix support for predis/predis:^2.0 ([@​mfettig](https://redirect.github.com/mfettig)) ### [`v5.4.39`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.39) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.38...v5.4.39) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.38...v5.4.39) - bug [symfony/symfony#54506](https://redirect.github.com/symfony/symfony/issues/54506) \[HttpFoundation] Set content-type header in RedirectResponse ([@​smnandre](https://redirect.github.com/smnandre)) ### [`v5.4.38`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.38) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.35...v5.4.38) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.37...v5.4.38) - no significant changes ### [`v5.4.35`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.35) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.34...v5.4.35) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.34...v5.4.35) - bug [symfony/symfony#53432](https://redirect.github.com/symfony/symfony/issues/53432) \[HttpFoundation] Request without content-type or content-length header should result in null values, not empty strings ([@​priyadi](https://redirect.github.com/priyadi)) ### [`v5.4.34`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.34) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.32...v5.4.34) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.33...v5.4.34) - no significant changes ### [`v5.4.32`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.32) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.31...v5.4.32) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.31...v5.4.32) - bug [symfony/symfony#52459](https://redirect.github.com/symfony/symfony/issues/52459) \[Cache]\[HttpFoundation]\[Lock] Fix PDO store not creating table + add tests ([@​HypeMC](https://redirect.github.com/HypeMC)) ### [`v5.4.31`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.31) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.30...v5.4.31) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.30...v5.4.31) - bug [symfony/symfony#52474](https://redirect.github.com/symfony/symfony/issues/52474) \[HttpFoundation] ensure string type with mbstring func overloading enabled ([@​xabbuh](https://redirect.github.com/xabbuh)) - bug [symfony/symfony#52457](https://redirect.github.com/symfony/symfony/issues/52457) \[Cache]\[HttpFoundation]\[Lock] Fix empty username/password for PDO PostgreSQL ([@​HypeMC](https://redirect.github.com/HypeMC)) - bug [symfony/symfony#52444](https://redirect.github.com/symfony/symfony/issues/52444) Remove full DSNs from exception messages ([@​nicolas-grekas](https://redirect.github.com/nicolas-grekas)) ### [`v5.4.30`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.30) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.28...v5.4.30) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.29...v5.4.30) - no significant changes ### [`v5.4.28`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.28) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.26...v5.4.28) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.27...v5.4.28) - bug [symfony/symfony#51424](https://redirect.github.com/symfony/symfony/issues/51424) \[HttpFoundation] Fix base URI detection on IIS with UrlRewriteModule ([@​derrabus](https://redirect.github.com/derrabus)) ### [`v5.4.26`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.26) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.25...v5.4.26) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.25...v5.4.26) - bug [symfony/symfony#51031](https://redirect.github.com/symfony/symfony/issues/51031) Fix deprecations on PHP 8.3 ([@​nicolas-grekas](https://redirect.github.com/nicolas-grekas)) ### [`v5.4.25`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.25) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.24...v5.4.25) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.24...v5.4.25) - bug [symfony/symfony#50524](https://redirect.github.com/symfony/symfony/issues/50524) Fix Doctrine deprecations ([@​nicolas-grekas](https://redirect.github.com/nicolas-grekas)) ### [`v5.4.24`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.24) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.23...v5.4.24) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.23...v5.4.24) - bug [symfony/symfony#50315](https://redirect.github.com/symfony/symfony/issues/50315) \[Translation] Fix handling of null messages in `ArrayLoader` (@​rob006) - bug [symfony/symfony#50338](https://redirect.github.com/symfony/symfony/issues/50338) \[Console] Remove `exec` and replace it by `shell_exec` ([@​maxbeckers](https://redirect.github.com/maxbeckers)) - bug [symfony/symfony#50362](https://redirect.github.com/symfony/symfony/issues/50362) \[FrameworkBundle] Fix Workflow without a marking store definition uses marking store definition of previously defined workflow ([@​krciga22](https://redirect.github.com/krciga22)) - bug [symfony/symfony#50309](https://redirect.github.com/symfony/symfony/issues/50309) \[HttpFoundation] UrlHelper is now aware of RequestContext changes ([@​giosh94mhz](https://redirect.github.com/giosh94mhz)) - bug [symfony/symfony#50309](https://redirect.github.com/symfony/symfony/issues/50309) \[HttpFoundation] UrlHelper is now aware of RequestContext changes ([@​giosh94mhz](https://redirect.github.com/giosh94mhz)) - bug [symfony/symfony#49063](https://redirect.github.com/symfony/symfony/issues/49063) \[Messenger] Respect `isRetryable` decision of the retry strategy for re-delivery (@​FlyingDR) - bug [symfony/symfony#50266](https://redirect.github.com/symfony/symfony/issues/50266) \[HttpFoundation] Fix file streaming after connection aborted ([@​rlshukhov](https://redirect.github.com/rlshukhov)) - bug [symfony/symfony#49557](https://redirect.github.com/symfony/symfony/issues/49557) \[PropertyInfo] Fix phpDocExtractor nullable array value type ([@​fabpot](https://redirect.github.com/fabpot)) ### [`v5.4.23`](https://redirect.github.com/symfony/http-foundation/releases/tag/v5.4.23) [Compare Source](https://redirect.github.com/symfony/http-foundation/compare/v5.4.22...v5.4.23) **Changelog** (https://github.com/symfony/http-foundation/compare/v5.4.22...v5.4.23) - bug [#​48972](https://redirect.github.com/symfony/http-foundation/issues/48972) Fix memory limit problems in BinaryFileResponse (glady)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.

renovate[bot] commented 1 day ago

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update symfony/http-foundation:5.4.46 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Dependency symfony/deprecation-contracts is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - phpunit/phpunit is locked to version 9.6.19 and an update of this package was not requested.
    - doctrine/instantiator 2.0.0 requires php ^8.1 -> your php version (7.3; overridden via config.platform, same as actual) does not satisfy that requirement.
    - phpunit/phpunit 9.6.19 requires doctrine/instantiator ^1.3.1 || ^2 -> satisfiable by doctrine/instantiator[2.0.0].