Repository navigation
chore(deps): update AWS SDK and Guzzle to fix security advisories - #686
Merged
Merged
Conversation
Makes Model_Uri __sleep and __wakeup public: PHP 8 warns about private magic methods and prints the warning into the first page after FPM start.
PHP 8.4.27 fixes CVE-2026-109618 and CVE-2026-109619 (RCE in PHP-FPM), PHP 7.2 does not get security fixes. - use Debian Bookworm image: it ships ImageMagick 6 where Imagick::setImageOpacity() used by social covers still exists - install memcache 8.2, imagick 3.8.1 and redis 6.3.0 from PECL - use new GD configure flags - build fontconfig cache to avoid errors in FPM logs
- codex-team/hawk.php 2.1.4 requires PHP ^7.1, update to 2.3.0 - phpunit 3.7 can not be installed or run on PHP 8, the only test is a sample
- Arr::path() passed Config_Group to array_key_exists(), which throws TypeError since PHP 8.0 and broke every POST request via XSS filter - replace each() removed in PHP 8.0 in Response::cookie() - drop imagerotate() ignore_transparent argument removed in PHP 8.3
Kohana converts every reported error into an exception, and Kohana 3.3 raises a lot of deprecations on PHP 8, so production returned 500 on every page. E_STRICT constant is deprecated in PHP 8.4.
composer update aws/aws-sdk-php guzzlehttp/guzzle guzzlehttp/psr7 \
guzzlehttp/promises mtdowling/jmespath.php -W
Closes 18 advisories reported by `composer audit`:
- mtdowling/jmespath.php 2.6.1 -> 2.9.2: CVE-2026-54133
- aws/aws-sdk-php 3.256.2 -> 3.401.4: CVE-2023-51651, CVE-2025-14761,
GHSA-27qh-8cxx-2cr5 (CloudFront policy injection, no CVE)
- guzzlehttp/guzzle 7.5.0 -> 7.16.0: CVE-2026-55568, CVE-2026-55767,
CVE-2026-59883, CVE-2026-67339, CVE-2026-67353, CVE-2026-67354,
CVE-2026-67355, CVE-2026-69245, CVE-2026-69246
- guzzlehttp/psr7 2.4.3 -> 2.13.2: CVE-2023-29197, CVE-2026-48998,
CVE-2026-49214, CVE-2026-55766, CVE-2026-59882
Dependencies updated along: guzzlehttp/promises 1.5.2 -> 2.6.0,
aws/aws-crt-php v1.0.2 -> v1.2.7, psr/http-message 1.0.1 -> 2.0,
psr/http-client 1.0.1 -> 1.0.3, psr/http-factory 1.0.1 -> 1.1.0,
symfony/deprecation-contracts v2.5.2 -> v3.7.1,
symfony/polyfill-ctype v1.23.0 -> v1.37.0,
symfony/polyfill-mbstring v1.27.0 -> v1.43.0,
new symfony/filesystem v8.1.9 and symfony/polyfill-php80 v1.43.0.
aws/aws-sdk-php now requires PHP >= 8.1 and symfony/filesystem 8.1
requires PHP >= 8.4.1, so this lock needs the php-8.4-upgrade image.
Since PHP 8.0 GD returns GdImage objects instead of resources, so _load_image() treated a loaded image as not loaded and reloaded the original file on save() and render(), losing rotate, resize and crop.
…ecurity-update # Conflicts: # www/public/build/release.json
There was a problem hiding this comment.
🔵 Needs a closer look
Human review should confirm that #685 is merged first and assess production S3 compatibility beyond the reported local checks.
No open issues 🎉
What changed in this PR
Updates AWS SDK, Guzzle, and related dependencies to address security advisories, following the PHP 8.4 upgrade in #685.
Changes:
- Refreshes Composer dependencies, including JMESPath security fixes and new Symfony dependencies.
- Updates the build timestamp without changing the release identifier.
| File | Description |
|---|---|
www/public/build/release.json |
Refreshes the build timestamp. |
www/composer.lock |
Locks updated security dependencies requiring PHP ≥8.4.1. |
Review effort: Balanced
…ecurity-update # Conflicts: # www/public/build/release.json
…pdate # Conflicts: # www/composer.lock # www/public/build/release.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Продолжение #685.
composer auditна lock-файле из #685 находит 18 уязвимостей в 4 пакетах. Самая серьёзная из них — critical code injection вmtdowling/jmespath.php(CVE-2026-54133). Обновляем эти пакеты вместе с их зависимостями:#685 уже влит, PR можно мержить. Новым версиям нужен PHP 8.4 из #685: aws-sdk-php 3.401 требует PHP ≥ 8.1, а
symfony/filesystem8.1, которую он подтягивает, требует PHP ≥ 8.4.1. Если #685 придётся откатить, этот PR нужно откатить вместе с ним: на PHP 7.2 composer эти зависимости не поставит.Что изменилось
Изменился только
www/composer.lock.composer.jsonне менялся: ограничение^3.256уже допускает 3.401.4.Вместе с ними обновились зависимости: guzzlehttp/promises 1.5.2 → 2.6.0, aws/aws-crt-php 1.0.2 → 1.2.7, psr/http-message 1.0.1 → 2.0, psr/http-client 1.0.1 → 1.0.3, psr/http-factory 1.0.1 → 1.1.0, symfony/deprecation-contracts 2.5.2 → 3.7.1, symfony/polyfill-ctype 1.23.0 → 1.37.0, symfony/polyfill-mbstring 1.27.0 → 1.43.0. Добавились symfony/filesystem 8.1.9 и symfony/polyfill-php80 1.43.0. Остальные пакеты не изменились.
Код проекта менять не пришлось. AWS SDK используется только в
Model_S3(S3ClientиputObject), а Guzzle — только черезstichoza/google-translate-phpвController_Editor. Эти API не изменились.Как проверено
На
php:8.4.27-fpm-bookwormс кодом из #685:composer auditчистый,composer check-platform-reqs --lockпроходит.Model_S3::upload()отправлял файл в локальный фейковый S3 черезAWS_ENDPOINT_URL_S3. Ушёл подписанный SigV4 PUT с нужными бакетом и ключом, файл дошёл целиком, метод вернул URL. Новая версия SDK по умолчанию добавляет заголовокx-amz-checksum-crc32. AWS S3 его поддерживает, а свой endpoint в коде не задан.GoogleTranslate::translate()с подменённым HTTP-транспортом отправляет запрос и разбирает ответ./articlesотдают 200 и анонимно, и под админом./article/writingпод админом отдаёт 200, редактор открывается. Новых ошибок в логах Kohana нет. На рабочей копии chore: upgrade PHP from 7.2 to 8.4.27 #685 HTML этих страниц совпал с версией на старых библиотеках.Настоящую загрузку в S3 не проверял: локально нет ключей AWS.
Что учесть
/article/writingотдаёт 500 с текстомHTTP_Exception_403вместо страницы 403. Со старыми библиотеками то же самое, к этому PR не относится.