Case studies¶
Every case below is a real project at a real commit, frozen with the package metadata and advisories
that existed at the time, so the result reproduces exactly (see Test fixtures for the
format). Each shows the situation a developer faced, what a competent human chose, and what
composer remediate recommends. The stored console, JSON, HTML and SARIF reports are the tool's
actual output for that fixture, generated by bin/run-fixture.php --write-reports. These are the
same fixtures the test suite asserts on, so a case study that stopped being true would fail CI.
| Case | Advisories | Packages | Outcome | Combined command |
|---|---|---|---|---|
| acquiacms-drupal-core-direct | 6 | 5 | all fixable | composer update drupal/core symfony/http-client symfony/http-foundation symfony/process twig/twig |
| bookstack-guzzle-stale-lock | 6 | 2 | all fixable | composer require --no-update barryvdh/laravel-dompdf:^2.0 && composer update barryvdh/laravel-dompdf guzzlehttp/guzzle -W -m |
| bookstack-phpseclib-knpsnappy | 2 | 2 | all fixable | composer update knplabs/knp-snappy phpseclib/phpseclib |
| bookstack-socialite-phpjwt-parent-minor | 12 | 9 | all fixable | composer update aws/aws-sdk-php laravel/framework laravel/socialite:v5.24.1 league/commonmark nesbot/carbon onelogin/php-saml symfony/http-foundation symfony/process -W -m --with 'firebase/php-jwt:>=7.0.0' |
| bookstack-symfony-php80-no-fix | 6 | 4 | 2 of 4 packages fixable | composer update phenx/php-svg-lib phpseclib/phpseclib |
| invoiceninja-phpjwt-two-level | 3 | 2 | 1 of 2 packages fixable | composer update google/apiclient:v2.12.2 -W -m --with 'firebase/php-jwt:>=6.0.0' |
| islandora-drupal-twig-meta-package | 4 | 4 | 2 of 4 packages fixable | composer update drupal/core-recommended:10.3.4 symfony/validator -W -m |
| kimai1-symfony44-artifact-repo | 14 | 6 | 4 of 6 packages fixable | composer update symfony/http-foundation symfony/process symfony/twig-bridge twig/twig -w -m --with 'twig/twig:>=3.11.2,<3.12.0 || >=3.14.1' |
| koel-symfony-parent-permits | 2 | 2 | all fixable | composer update symfony/http-foundation symfony/process |
| mautic-symfony54-multi | 16 | 7 | 6 of 7 packages fixable | composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator twig/twig |
| openmass-drupal-tilde-pins | 5 | 4 | all fixable | composer update symfony/http-client symfony/http-foundation symfony/process twig/twig |
| opensocial-drupal-distribution-pins | 3 | 3 | all fixable | composer update drupal/core symfony/validator -w -m |
| pixelfed-laravel11-symfony | 2 | 2 | all fixable | composer update symfony/http-foundation symfony/process |
| shopware-6420-twig-no-fix | 26 | 10 | 4 of 10 packages fixable | composer update aws/aws-sdk-php composer/composer shopware/core symfony/twig-bridge -W -m --with 'symfony/validator:>=5.4.43,<6.0.0 || >=6.4.11,<7.0.0 || >=7.1.4' |
| shopware-twig-parent-pin | 4 | 2 | 1 of 2 packages fixable | composer update shopware/storefront:6.4.15.2 shopware/recovery shopware/elasticsearch shopware/administration -W -m |
| usagov-drupal-core-recommended-twig | 4 | 4 | 2 of 4 packages fixable | composer update drupal/core-recommended symfony/validator -W -m |
| wallabag-symfony54-php74-guzzle5 | 16 | 8 | 7 of 8 packages fixable | composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator tecnickcom/tcpdf twig/twig |
acquiacms-drupal-core-direct¶
Fifth Drupal instance, a monorepo distribution without the meta-package: Acquia CMS on Drupal 10.3.5 (September 2024), snapshot 2024-11-25. drupal/core is required directly (no core-recommended pin) and the distribution's own modules come from path repositories at dev-develop with branch aliases, so the frozen repository must carry the lock's entries for them and nothing else under those names. Six advisories on five transitive packages are each a plain one-package update and one combined command fixes all six. Two things a scratch copy cannot know are recorded: root_version dev-develop (the modules conflict with the root package below 1.5.2, which Composer's git version guess avoids in the real checkout) and PHP 8.3.
Fifth Drupal instance: a monorepo distribution that requires core directly.
- Source: acquia/acquia-cms, Acquia's Drupal distribution,
at commit
3822bc67e3f49fddebbd7ee211c3a5ed5a550929(2024-09-30, "ACMS-000: Pinned the default_content module and updated patch as per latest release"). The next lock changes are 2024-10-10 and 2024-10-15 ("ACMS-4275: Updated minimum Drupal Core dependencies"). - Snapshot date (
--as-of): 2024-11-25, after Symfony's November releases and Drupal 10.3.7. - Platform: no
config.platform; the fixture pins PHP 8.3.0. Repositories:https://packages.drupal.org/8, apackagerepository for a JavaScript library,vcsrepositories for three drupal.org issue forks (dropped by the builder) and eighteenpathrepositories, one permodules/acquia_cms_*directory of the monorepo, each atdev-develop. root_version:dev-develop. The distribution's modules declareconflict: acquia/acquia_cms <1.5.2against the root package; in a git checkout Composer guesses the root version from the branch and the conflict never matches, whereas a copy without.gitis "1.0.0+no-version-set" and every update fails. The fixture records what the checkout would have had.
Findings¶
Unlike the Islandora, USAGov and Mass.gov fixtures there is no drupal/core-recommended; the root
requires drupal/core with a caret constraint and Drupal core requires its Symfony components with
carets too, so every fix is a plain update:
| Package | Advisory | Command | Lands on |
|---|---|---|---|
drupal/core 10.3.5 |
CVE-2024-45440 | composer update drupal/core |
10.3.7 |
symfony/http-foundation v6.4.10 |
CVE-2024-50345 | composer update symfony/http-foundation |
v6.4.16 |
symfony/process v6.4.8 |
CVE-2024-51736 | composer update symfony/process |
v6.4.15 |
symfony/http-client v7.1.4 |
CVE-2024-50342 | composer update symfony/http-client |
v7.1.8 |
twig/twig v3.14.0 |
CVE-2024-51754, CVE-2024-51755 | composer update twig/twig |
v3.15.0 |
The combined command composer update drupal/core symfony/http-client symfony/http-foundation
symfony/process twig/twig fixes all six with five changes.
This fixture drove three builder changes. The path modules exist on drupal.org under the same names,
so the builder takes them from the lock file (with extra.branch-alias, which is how dev-develop
satisfies a sibling's ^3.1), gives them a neutral dist (a path dist makes Composer refuse the locked
version in partial updates) and drops every other version of those names, because a path repository
takes precedence for the names it provides and Composer would never consider the drupal.org releases
in the real checkout. Without the last change every plan dragged eight modules from dev-develop to
release versions that the project could not install.
Built with bin/build-fixture.php --as-of=2024-11-25 --platform-php=8.3.0, then root_version added.
Planner result¶
6 advisories on 5 packages; 5 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| symfony/process v6.4.8 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| drupal/core 10.3.5 | CVE-2024-45440 | composer update drupal/core |
1 | verified |
| symfony/http-client v7.1.4 | CVE-2024-50342 | composer update symfony/http-client |
1 | verified |
| symfony/http-foundation v6.4.10 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| twig/twig v3.14.0 | CVE-2024-51755, CVE-2024-51754 | composer update twig/twig |
1 | verified |
Combined command (6 of 6 findings): composer update drupal/core symfony/http-client symfony/http-foundation symfony/process twig/twig
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: acquiacms-drupal-core-direct.
bookstack-guzzle-stale-lock¶
Case 1, direct dependency with a stale lock: BookStack requires guzzlehttp/guzzle ^7.4 and locks 7.4.2, affected by five 2022 advisories fixed in 7.4.5. The root constraint already permits the fix. composer update guzzlehttp/guzzle alone stops at 7.4.4 because 7.4.5 needs guzzlehttp/psr7 ^2.4.1, so the human command is composer update guzzlehttp/guzzle -w. A second, incidental finding (dompdf via barryvdh/laravel-dompdf ^1.0) can only be fixed by widening the root constraint to ^2.0, which as of 2022-07-01 resolves to a beta because the project allows dev stability.
Case 1: direct dependency, the root constraint already permits the fix (stale lock).
- Source: BookStackApp/BookStack at commit
4a2a044f3d0715de441aa4de9e000305d48dc7ab(2022-05-09, "Updated PHP deps"). - Snapshot date (
--as-of): 2022-07-01. Package versions released and advisories reported after that date are absent from the fixture. - Platform:
config.platform.php7.4.0 (from the project), extensions from the build environment.
Findings¶
guzzlehttp/guzzle 7.4.2 is a root requirement (^7.4) affected by CVE-2022-31042, CVE-2022-31043,
CVE-2022-29248, CVE-2022-31090 and CVE-2022-31091; all are fixed in 7.4.5. Every other parent
(aws/aws-sdk-php, laravel/socialite, league/oauth1-client, league/oauth2-client) permits 7.4.5.
Human choice: composer update guzzlehttp/guzzle. That alone resolves to 7.4.4, still affected by
two advisories, because 7.4.5 requires guzzlehttp/psr7 ^2.4.1 and the lock holds 2.2.1; the
working command is composer update guzzlehttp/guzzle -w (two changes). The planner recommends
composer update guzzlehttp/guzzle -w -m.
Incidental finding: dompdf/dompdf 1.2.2 (CVE-2022-0085, fixed in 2.0.0) is pinned by
barryvdh/laravel-dompdf 1.0.0 (dompdf/dompdf ^1), a root requirement at ^1.0. Only widening the
root constraint to ^2.0 works, and as of 2022-07-01 that resolves to v2.0.0-beta2 because the
project sets minimum-stability: dev. The planner flags the pre-release.
Built with bin/build-fixture.php --as-of=2022-07-01.
Planner result¶
6 advisories on 2 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| guzzlehttp/guzzle 7.4.2 | CVE-2022-31043, CVE-2022-29248, CVE-2022-31042, CVE-2022-31090, CVE-2022-31091 | composer update guzzlehttp/guzzle -w -m |
2 | verified |
| dompdf/dompdf v1.2.2 | CVE-2022-0085 | composer require --no-update barryvdh/laravel-dompdf:^2.0 && composer update barryvdh/laravel-dompdf -W -m |
3 | verified |
Combined command (6 of 6 findings): composer require --no-update barryvdh/laravel-dompdf:^2.0 && composer update barryvdh/laravel-dompdf guzzlehttp/guzzle -W -m
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: bookstack-guzzle-stale-lock.
bookstack-phpseclib-knpsnappy¶
Case 1 and case 2 in one lock: phpseclib/phpseclib 3.0.18 is a direct requirement (^3.0) fixed in 3.0.19, and knplabs/knp-snappy 1.4.1 is transitive via barryvdh/laravel-snappy ^1.0 (requires ^1.4) and fixed in 1.4.2. Both are plain partial updates; the combined command fixes everything.
Cases 1 and 2 together: a direct and a transitive dependency whose constraints already permit the fix.
- Source: BookStackApp/BookStack at commit
f9fcc9f3c7851fec07923f335972a50efe11ba26(2023-02-16). - Snapshot date (
--as-of): 2023-03-25. - Platform:
config.platform.php8.0.2 (from the project).
Findings¶
phpseclib/phpseclib 3.0.18 (direct, root ^3.0) is affected by CVE-2023-27560, fixed in 3.0.19.
knplabs/knp-snappy v1.4.1 is transitive via barryvdh/laravel-snappy 1.0.x (root ^1.0, requires
knplabs/knp-snappy ^1.4), affected by CVE-2023-28115, fixed in 1.4.2.
Human choice: composer update phpseclib/phpseclib knplabs/knp-snappy. The planner recommends one
partial update per package and the same combined command in the summary.
Built with bin/build-fixture.php --as-of=2023-03-25.
Planner result¶
2 advisories on 2 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| knplabs/knp-snappy v1.4.1 | CVE-2023-28115 | composer update knplabs/knp-snappy |
1 | verified |
| phpseclib/phpseclib 3.0.18 | CVE-2023-27560 | composer update phpseclib/phpseclib |
1 | verified |
Combined command (2 of 2 findings): composer update knplabs/knp-snappy phpseclib/phpseclib
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: bookstack-phpseclib-knpsnappy.
bookstack-socialite-phpjwt-parent-minor¶
Case 3 in a modern Laravel lock: firebase/php-jwt 6.10.1 (CVE-2025-45769, fixed in 7.0.0) is pinned ^6.4 by laravel/socialite 5.16.0; laravel/socialite 5.24.1 (2026-01-01) is the first release allowing ^7.0 and the root constraint ^5.10 permits it. The same lock carries eleven other advisories (Laravel, Symfony, Carbon, CommonMark, AWS SDK, xmlseclibs), all fixable, so the summary's combined command covers every finding.
Case 3 in a modern Laravel lock: the parent excludes the fix and a same-major parent release lifts it.
- Source: BookStackApp/BookStack at commit
abda9bc00a6d64a352ff8896887d95b1768c6961(2024-09-27). - Snapshot date (
--as-of): 2026-01-10, chosen so that both the fixedfirebase/php-jwt 7.0.0(2025-12-15) andlaravel/socialite 5.24.1(2026-01-01) exist. - Platform:
config.platform.php8.1.0 (from the project).
Findings¶
firebase/php-jwt v6.10.1 is affected by CVE-2025-45769 (weak encryption), fixed in 7.0.0. It is
required by laravel/socialite v5.16.0 with ^6.4; every socialite release up to 5.24.0 keeps that
constraint and 5.24.1 widens it to ^6.4|^7.0. Root requires laravel/socialite ^5.10, so the fix
is reachable without touching composer.json.
Human choice: composer update laravel/socialite firebase/php-jwt. The planner recommends
composer update laravel/socialite:v5.24.1 -W -m --with 'firebase/php-jwt:>=7.0.0': three
changes (php-jwt 7.0.2, socialite 5.24.1, league/oauth1-client). The --with stays because with
-m alone Composer would keep php-jwt on 6.x, which ^6.4|^7.0 still allows.
Eleven further advisories in the same lock (laravel/framework, symfony/http-foundation and process, nesbot/carbon, league/commonmark, aws/aws-sdk-php, robrichards/xmlseclibs via onelogin/php-saml) are all fixable by partial updates, so the summary offers one combined command:
composer update aws/aws-sdk-php laravel/framework laravel/socialite:v5.24.1 league/commonmark nesbot/carbon onelogin/php-saml symfony/http-foundation symfony/process -W -m --with 'firebase/php-jwt:>=7.0.0'
robrichards/xmlseclibs is not named: the global search found that the onelogin/php-saml update
already moves it past its advisory, and dropping it keeps all twelve findings fixed.
Built with bin/build-fixture.php --as-of=2026-01-10.
Planner result¶
12 advisories on 9 packages; 9 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| onelogin/php-saml 4.2.0 | PKSA-67d7-mg8j-87zx | composer update onelogin/php-saml -w |
2 | verified |
| laravel/framework v10.48.22 | CVE-2025-27515, CVE-2024-52301 | composer update laravel/framework |
1 | verified |
| league/commonmark 2.5.3 | PKSA-fndg-qryc-dyc9, CVE-2025-46734 | composer update league/commonmark |
1 | verified |
| symfony/http-foundation v6.4.12 | CVE-2025-64500, CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| symfony/process v6.4.12 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| aws/aws-sdk-php 3.322.6 | CVE-2025-14761 | composer update aws/aws-sdk-php |
2 | verified |
| nesbot/carbon 2.72.5 | CVE-2025-22145 | composer update nesbot/carbon |
1 | verified |
| robrichards/xmlseclibs 3.1.1 | CVE-2025-66578 | composer update robrichards/xmlseclibs |
1 | verified |
| firebase/php-jwt v6.10.1 | CVE-2025-45769 | composer update laravel/socialite:v5.24.1 -W -m --with 'firebase/php-jwt:>=7.0.0' |
3 | verified |
Combined command (12 of 12 findings): composer update aws/aws-sdk-php laravel/framework laravel/socialite:v5.24.1 league/commonmark nesbot/carbon onelogin/php-saml symfony/http-foundation symfony/process -W -m --with 'firebase/php-jwt:>=7.0.0'
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: bookstack-socialite-phpjwt-parent-minor.
bookstack-symfony-php80-no-fix¶
Case 5, no valid remediation under the platform constraint: BookStack pins config.platform.php 8.0.2 and locks symfony/http-foundation 6.0.20 and symfony/process 6.0.19 through laravel/framework 9.52.16 (^6.0). The fixed releases 6.4.14 require PHP >=8.1, 5.4.46 is excluded by ^6.0, and laravel/framework 10 requires PHP ^8.1 as well. Two other findings in the same lock are fixable by partial updates.
Case 5: no valid remediation under the project's platform constraints.
- Source: BookStackApp/BookStack at commit
88ee33ee49c0c920d8ad3fb1161fe27b62c64004(2023-12-22, the last dependency update before the project's PHP 8.1 bump). - Snapshot date (
--as-of): 2024-11-10. - Platform:
config.platform.php8.0.2 (from the project).
Findings¶
symfony/http-foundation v6.0.20 (CVE-2024-50345) and symfony/process v6.0.19 (CVE-2024-51736)
come from laravel/framework v9.52.16, a root requirement at ^9.0 that requires ^6.0 for both.
The fixed releases are 5.4.46, 6.4.14 and 7.1.7: 5.4.46 is excluded by ^6.0, every 6.1+ release
requires PHP >=8.1, 7.x requires 8.2, and upgrading Laravel does not help because laravel/framework
10 requires PHP ^8.1 too. Under config.platform.php 8.0.2 there is no fix; the human answer is
"raise the platform to PHP 8.1 and upgrade Laravel". The planner must report no verified
remediation and show the PHP requirement as the blocker.
The same lock has two fixable findings: phpseclib/phpseclib 3.0.34 (direct, CVE-2024-27354 and
CVE-2024-27355) and phenx/php-svg-lib 0.5.1 (CVE-2024-25117), both by a plain partial update.
Built with bin/build-fixture.php --as-of=2024-11-10.
Planner result¶
6 advisories on 4 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| phenx/php-svg-lib 0.5.1 | CVE-2024-25117, PKSA-qsyb-3psh-f1t3 | composer update phenx/php-svg-lib |
1 | verified |
| phpseclib/phpseclib 3.0.34 | CVE-2024-27355, CVE-2024-27354 | composer update phpseclib/phpseclib |
1 | verified |
| symfony/process v6.0.19 | CVE-2024-51736 | none found within the search budget | ||
| symfony/http-foundation v6.0.20 | CVE-2024-50345 | none found within the search budget |
Combined command (4 of 6 findings): composer update phenx/php-svg-lib phpseclib/phpseclib
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: bookstack-symfony-php80-no-fix.
invoiceninja-phpjwt-two-level¶
Case 3 with a two-level chain: firebase/php-jwt 5.5.1 (CVE-2021-46743, fixed in 6.0.0) is required by google/apiclient 2.12.1 (root ^2.7) with ~5.0 and by google/auth 1.19.0 (not a root requirement) with ~5.0. google/apiclient 2.12.2 (2022-04-05) adds ~6.0 and google/auth 1.21.0 (2022-04-13) allows ^6.0; -W moves both. maximebf/debugbar's bundled jQuery advisories have no fix at the snapshot date.
Case 3 with a two-level chain: the direct parent and an intermediate package both pin the fix out.
- Source: invoiceninja/invoiceninja at commit
5a4614da1f8836bc9a6482b5ef24588402da6aac(2022-04-01, branch v5-stable). - Snapshot date (
--as-of): 2022-04-20. - Platform: the project requires
php ^7.4|^8.0withoutconfig.platform; the fixture pins 8.0.30.
Findings¶
firebase/php-jwt v5.5.1 is affected by CVE-2021-46743 (algorithm confusion), fixed in 6.0.0. It is
required with ~5.0 by google/apiclient v2.12.1 (root ^2.7) and by google/auth v1.19.0, which is
not a root requirement. google/apiclient 2.12.2 (2022-04-05) adds ~6.0 and google/auth 1.21.0
(2022-04-13) allows ^6.0.
Human choice: composer update firebase/php-jwt google/apiclient google/auth. The planner recommends
composer update google/apiclient:v2.12.2 -W -m --with 'firebase/php-jwt:>=6.0.0': three changes
(php-jwt 6.1.1, google/apiclient 2.12.2 pinned by the descent, google/auth 1.21.0 moved by -W).
maximebf/debugbar 1.18.0 carries two advisories for its bundled jQuery (CVE-2019-11358,
CVE-2020-11022) with no fixed release at the snapshot date, so no remediation is expected there.
Built with bin/build-fixture.php --as-of=2022-04-20 --platform-php=8.0.30.
Planner result¶
3 advisories on 2 packages; 1 package with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| firebase/php-jwt v5.5.1 | CVE-2021-46743 | composer update google/apiclient:v2.12.2 -W -m --with 'firebase/php-jwt:>=6.0.0' |
3 | verified |
| maximebf/debugbar v1.18.0 (dev) | CVE-2020-11022, CVE-2019-11358 | none |
Combined command (1 of 3 findings): composer update google/apiclient:v2.12.2 -W -m --with 'firebase/php-jwt:>=6.0.0'
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: invoiceninja-phpjwt-two-level.
islandora-drupal-twig-meta-package¶
Case 4, deep transitive dependency pinned by a meta-package: drupal/core-recommended 10.3.1 pins twig/twig ~v3.10.2 while CVE-2024-45411 is fixed in 3.11.0/3.14.0; drupal/core itself allows ^3.9.3. core-recommended 10.3.4 (2024-09-11) is the first release pinning ~v3.14.0. drupal/core 10.3.1 is also affected by CVE-2024-45440, whose fix (10.3.6) does not exist yet at the snapshot date.
Case 4: deep transitive dependency that requires a framework meta-package upgrade.
- Source: Islandora/islandora-starter-site at
commit
d8ec76241e2a7c029521d039d158e42ef62d2dbc(2024-08-21, "Drush 13, second attempt"). - Snapshot date (
--as-of): 2024-09-20. - Platform: no
config.platformin the project; the fixture pins PHP 8.3.0. - Repositories:
https://packages.drupal.org/8plus an inlinepackagerepository forlibrary/pdf.js, which the builder copies from the lock file.
Findings¶
twig/twig v3.10.3 is affected by CVE-2024-45411 (sandbox bypass), fixed in 3.11.0 and 3.14.0.
Root requires drupal/core-recommended ^10.1, locked at 10.3.1, which pins twig/twig ~v3.10.2 and
so excludes every fix, while drupal/core 10.3.1 allows ^3.9.3. drupal/core-recommended 10.3.4
(2024-09-11) is the first release pinning ~v3.14.0.
Human choice: Drupal's documented composer update drupal/core-recommended -W, which as of the
snapshot date resolves to 10.3.5. The planner recommends composer update drupal/core-recommended:10.3.4 -W -m,
the lowest release that admits the fix (three changes: core, core-recommended, twig).
drupal/core 10.3.1 and the meta-package are also affected by CVE-2024-45440 (SA-CORE-2024-003);
the fixed release 10.3.6 does not exist at the snapshot date, so no remediation is expected.
symfony/validator v6.4.9 (CVE-2024-50343) is fixed by a plain partial update.
Built with bin/build-fixture.php --as-of=2024-09-20 --platform-php=8.3.0.
Planner result¶
4 advisories on 4 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| drupal/core 10.3.1 | CVE-2024-45440 | none found within the search budget | ||
| drupal/core-recommended 10.3.1 | CVE-2024-45440 | none | ||
| twig/twig v3.10.3 | CVE-2024-45411 | composer update drupal/core-recommended:10.3.4 -W -m |
3 | verified |
| symfony/validator v6.4.9 | CVE-2024-50343 | composer update symfony/validator |
1 | verified |
Combined command (2 of 4 findings): composer update drupal/core-recommended:10.3.4 symfony/validator -W -m
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: islandora-drupal-twig-meta-package.
kimai1-symfony44-artifact-repo¶
Legacy platform mix on Symfony 4.4 and config.platform.php 7.3, with an artifact repository in composer.json. Transitive Symfony components move to 5.4 patch releases because symfony/framework-bundle 4.4 allows ^4.4|^5.0; twig 3.5.1 moves within 3.x; phpoffice/phpspreadsheet (direct) and symfony/validator (direct, ^4.4) have no fix reachable on PHP 7.3 or within the root constraint.
A legacy Symfony 4.4 application on PHP 7.3, with mixed outcomes and an artifact repository.
- Source: kimai/kimai branch
1.xat commit2d809b4f06d5083a66bb618d9e2adabe9b152e15(2023-02-17). - Snapshot date (
--as-of): 2024-11-10. - Platform:
config.platform.php7.3 (from the project). The project declares anartifactrepository (var/packages/); the builder drops it and copies its locked packages from the lock file.
Findings¶
Fourteen advisories on six packages. Fixable: symfony/http-foundation 4.4.49 and symfony/process
4.4.44 move to 5.4.x because symfony/framework-bundle 4.4 requires them with ^4.4|^5.0 and
5.4 still supports PHP 7.2.5; symfony/twig-bridge moves to 4.4.51; twig/twig 3.5.1 moves to 3.11.3
with its dependencies. Not fixable: phpoffice/phpspreadsheet 1.25.2 (direct) needs a release that
requires PHP 8, and symfony/validator 4.4.48 (direct, ^4.4) has its fix only in 5.4/6.4/7.1.
The summary's combined command fixes 6 of 14 findings:
composer update symfony/http-foundation symfony/process symfony/twig-bridge twig/twig -w -m --with 'twig/twig:>=3.11.2,<3.12.0 || >=3.14.1'
Built with bin/build-fixture.php --as-of=2024-11-10.
Planner result¶
14 advisories on 6 packages; 4 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| phpoffice/phpspreadsheet 1.25.2 | CVE-2024-45291, CVE-2024-45060, CVE-2024-45046, CVE-2024-45293, CVE-2024-45292, CVE-2024-45290, CVE-2024-45048 | none | ||
| symfony/twig-bridge v4.4.49 | CVE-2023-46734 | composer update symfony/twig-bridge |
1 | verified |
| twig/twig v3.5.1 | CVE-2024-51755, CVE-2024-45411, CVE-2024-51754 | composer update twig/twig -w -m --with 'twig/twig:>=3.11.2,<3.12.0 || >=3.14.1' |
2 | verified |
| symfony/http-foundation v4.4.49 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| symfony/validator v4.4.48 | CVE-2024-50343 | none | ||
| symfony/process v4.4.44 (dev) | CVE-2024-51736 | composer update symfony/process |
1 | verified |
Combined command (6 of 14 findings): composer update symfony/http-foundation symfony/process symfony/twig-bridge twig/twig -w -m --with 'twig/twig:>=3.11.2,<3.12.0 || >=3.14.1'
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: kimai1-symfony44-artifact-repo.
koel-symfony-parent-permits¶
Case 2, transitive dependency whose parent already permits the fix: koel locks symfony/http-foundation and symfony/process 6.4.4 (CVE-2024-50345, CVE-2024-51736, fixed in 6.4.14) through laravel/framework 10.48.8, which requires ^6.4 / ^6.2. A partial update of each package is enough; the next two commits in the project's history are exactly those Dependabot bumps.
Case 2: transitive dependency, the parent's constraint already permits the fix.
- Source: koel/koel at commit
3848e8b52da79d953d04ce72ce468926287fa295(2024-10-31, "chore(build): upgrade poddle"). - Snapshot date (
--as-of): 2024-11-10. - Platform: the project has no
config.platform; the fixture pins PHP 8.3.0 (--platform-php).
Findings¶
symfony/http-foundation v6.4.4 (CVE-2024-50345, open redirect) and symfony/process v6.4.4
(CVE-2024-51736, command execution hijack on Windows), both fixed in 6.4.14. They are transitive:
root requires laravel/framework ^10.0, locked at 10.48.8, which requires symfony/http-foundation
^6.4 and symfony/process ^6.2. Every other parent also permits 6.4.14.
Human choice: composer update symfony/http-foundation symfony/process. The project's next two
commits (2024-11-08) are Dependabot bumps of exactly these two packages to 6.4.14. With the
snapshot date of 2024-11-10 the newest permitted release is 6.4.15.
The planner produces one plan per package: composer update symfony/http-foundation and
composer update symfony/process, one change each. Merging them into a single command is a
Phase 1 item.
Built with bin/build-fixture.php --as-of=2024-11-10 --platform-php=8.3.0.
Planner result¶
2 advisories on 2 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| symfony/process v6.4.4 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| symfony/http-foundation v6.4.4 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
Combined command (2 of 2 findings): composer update symfony/http-foundation symfony/process
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: koel-symfony-parent-permits.
mautic-symfony54-multi¶
Fifth plain-Symfony instance, a monorepo: Mautic 5 (Symfony 5.4, PHP 8.1) on its 5.x branch in September 2024, snapshot 2024-11-20. The application's own code is the path package mautic/core-lib, so every finding is transitive through it. Seven advisories on six Symfony components and Twig are plain updates that one combined command fixes. Nine PhpSpreadsheet advisories have no fix: mautic/core-lib requires phpoffice/phpspreadsheet ^1.15 <1.28 while the fixes start at 1.29.4; only editing the monorepo's own constraint would help, which is outside a remediation planner's remit. The project needs ext-imap, which the fixture's platform declares.
Fifth plain-Symfony instance: a monorepo whose own package pins a dependency below the fix.
- Source: mautic/mautic at commit
daad1994fff57d91414a4ee3a545810eab97154e(2024-09-16, "Bump twig/twig from 3.8.0 to 3.14.0"), a Symfony 5.4 application. The repository is a monorepo: the root manifest requires the application itself asmautic/core-lib ^5.0from apathrepository (app/), locked at5.0.0-dev. - Snapshot date (
--as-of): 2024-11-20, after Symfony's November releases, Twig 3.15.0 and PhpSpreadsheet 1.29.4 (2024-11-10). - Platform:
config.platform.php8.1.0 from the project. The project requiresext-imap, which the build environment lacks; the fixture adds it to the platform.
Findings¶
Sixteen advisories on seven packages, all transitive through mautic/core-lib.
| Package | Advisories | Command | Lands on |
|---|---|---|---|
symfony/http-foundation v5.4.35 |
CVE-2024-50345 | composer update symfony/http-foundation |
v5.4.48 |
symfony/http-client v5.4.35 |
CVE-2024-50342 | composer update symfony/http-client |
v5.4.47 |
symfony/security-http v5.4.35 |
CVE-2024-51996 | composer update symfony/security-http |
v5.4.47 |
symfony/validator v5.4.35 |
CVE-2024-50343 | composer update symfony/validator |
v5.4.47 |
symfony/process v5.4.40 |
CVE-2024-51736 | composer update symfony/process |
v5.4.47 |
twig/twig v3.14.0 |
CVE-2024-51754, CVE-2024-51755 | composer update twig/twig |
v3.15.0 |
phpoffice/phpspreadsheet 1.27.1 |
nine advisories (CVE-2024-45046 to CVE-2024-48917) | none | — |
The combined command fixes 7 of 16:
composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator twig/twig
PhpSpreadsheet has no fix within the project's constraints: mautic/core-lib 5.0.0-dev requires
phpoffice/phpspreadsheet ^1.15 <1.28 and the fixes are in 1.29.4 and the 2.x/3.x lines. The
constraint lives in the monorepo's own app/composer.json, so the human fix is a code change to that
file (Mautic's 5.x branch later moved to ^1.29.4); the planner reports "no verified fix" rather than
inventing an update the constraints forbid.
This fixture motivated a builder change: a locked package that comes from a path repository may
also exist on Packagist (mautic/core-lib does), and the public metadata for "5.0.0-dev" is not what
the project resolved against. The builder now takes such packages from the lock file.
Built with bin/build-fixture.php --as-of=2024-11-20, then ext-imap added to the platform.
Planner result¶
16 advisories on 7 packages; 6 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| phpoffice/phpspreadsheet 1.27.1 | CVE-2024-45291, CVE-2024-47873, CVE-2024-45060, CVE-2024-48917, CVE-2024-45046, CVE-2024-45293, CVE-2024-45292, CVE-2024-45290, CVE-2024-45048 | none | ||
| symfony/process v5.4.40 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| symfony/security-http v5.4.35 | CVE-2024-51996 | composer update symfony/security-http |
1 | verified |
| symfony/http-client v5.4.35 | CVE-2024-50342 | composer update symfony/http-client |
1 | verified |
| symfony/http-foundation v5.4.35 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| symfony/validator v5.4.35 | CVE-2024-50343 | composer update symfony/validator |
1 | verified |
| twig/twig v3.14.0 | CVE-2024-51755, CVE-2024-51754 | composer update twig/twig |
1 | verified |
Combined command (7 of 16 findings): composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator twig/twig
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: mautic-symfony54-multi.
openmass-drupal-tilde-pins¶
Third Drupal instance: Mass.gov on Drupal 10.3.6, where drupal/core-recommended pins the Symfony components and Twig with tilde constraints (~v6.4.7, ~v6.4.8, ~v3.14.0) that permit the patch releases carrying the November 2024 fixes. Five advisories on four packages (symfony/http-foundation, symfony/process, symfony/http-client, twig/twig x2) are each a plain one-package update and one combined command fixes all five; the http-client path runs through two abandoned packages (fabpot/goutte, behat/mink-goutte-driver), which the report flags.
Third Drupal instance: a meta-package whose tilde pins let the fixes through.
- Source: massgov/openmass (Mass.gov, the Commonwealth of
Massachusetts' site) at commit
aecbd0717c32ccc9e2fcbdefa8341a2034e09701(2024-10-25, "Upgrade Drupal Test traits to 2.4. Also upgrade_status module, drush"). - Snapshot date (
--as-of): 2024-11-25, after Symfony's 6 November releases (6.4.14, 6.4.15) and Twig's 3.14.1 / 3.14.2. - Platform:
config.platform.php8.3 from the project, recorded as 8.3.0. Repository:https://packages.drupal.org/8, plus twopackagerepositories the project declares.
Findings¶
Drupal 10.3's drupal/core-recommended pins its dependencies with tilde constraints
(symfony/http-foundation ~v6.4.7, symfony/process ~v6.4.8, twig/twig ~v3.14.0), unlike the
exact pins of the 10.2 fixtures (Islandora, USAGov). Every fix therefore fits inside the pin and the
planner recommends a plain update for each package:
| Package | Advisory | Command | Lands on |
|---|---|---|---|
symfony/http-foundation v6.4.12 |
CVE-2024-50345 | composer update symfony/http-foundation |
v6.4.14 |
symfony/process v6.4.12 |
CVE-2024-51736 | composer update symfony/process |
v6.4.15 |
symfony/http-client v6.4.10 (direct) |
CVE-2024-50342 | composer update symfony/http-client |
v6.4.15 |
twig/twig v3.14.0 |
CVE-2024-51754, CVE-2024-51755 | composer update twig/twig |
v3.14.2 |
The combined command composer update symfony/http-client symfony/http-foundation symfony/process
twig/twig fixes all five advisories with four changes. symfony/http-client is also reached through
behat/mink-goutte-driver and fabpot/goutte, both abandoned on Packagist (replacements
behat/mink-browserkit-driver and symfony/browser-kit); the report names them.
Drupal core's own November 2024 advisories (SA-CORE-2024-003 to -008, released 2024-11-20) are not
in this snapshot: the Packagist feed carries no drupal/core record with a report date before the
snapshot, so drupal/core 10.2.6-style findings appear in the Open Social fixture (August advisory)
rather than here.
Built with bin/build-fixture.php --as-of=2024-11-25 --platform-php=8.3.0.
Planner result¶
5 advisories on 4 packages; 4 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| symfony/process v6.4.12 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| symfony/http-client v6.4.10 | CVE-2024-50342 | composer update symfony/http-client |
1 | verified |
| symfony/http-foundation v6.4.12 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| twig/twig v3.14.0 | CVE-2024-51755, CVE-2024-51754 | composer update twig/twig |
1 | verified |
Combined command (5 of 5 findings): composer update symfony/http-client symfony/http-foundation symfony/process twig/twig
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: openmass-drupal-tilde-pins.
opensocial-drupal-distribution-pins¶
Fourth Drupal instance, a distribution: Open Social's project template on Open Social 12.4.2 / Drupal 10.2.6 (May 2024), snapshot mid-October 2024. The distribution package goalgorilla/open_social pins drupal/core ~10.2.5, which permits the 10.2.9 patch carrying the fix for CVE-2024-45440 (released 2024-10-08, so a snapshot one week earlier has no fix). Twig 3.10.3 (CVE-2024-45411) moves to 3.14.0 and needs symfony/polyfill-php81, a package absent from the lock, which the frozen repository must therefore carry. symfony/validator is a plain update. One combined command fixes all three.
Fourth Drupal instance: a distribution package pins core, and the pin permits the patch.
- Source: goalgorilla/social_template, the
Composer project template for the Open Social distribution, at commit
b5b634ccaf48347c7e46143b1a248dea4555e987(2024-05-21, "updated to 12.4.2"). - Snapshot date (
--as-of): 2024-10-15, one week after Drupal 10.2.9 (2024-10-08). The same project snapshotted at 2024-10-01 has no fix for core at all: 10.2.9 did not exist yet. - Platform: no
config.platform; the fixture pins PHP 8.2.0 because the lock holdslcobucci/clock 3.0.0, which requires~8.1.0 || ~8.2.0. Repositories:https://packages.drupal.org/8andhttps://asset-packagist.org.
Findings¶
The root requires only goalgorilla/open_social ~12.4.0 (plus monolog); everything else, Drupal
core included, arrives through the distribution, which requires drupal/core ~10.2.5.
| Package | Advisory | Command | Lands on |
|---|---|---|---|
drupal/core 10.2.6 |
CVE-2024-45440 | composer update drupal/core -w -m |
10.2.9 (plus twig 3.14.0 and symfony/polyfill-php81) |
twig/twig v3.10.3 |
CVE-2024-45411 | composer update twig/twig |
v3.14.0 (adds symfony/polyfill-php81) |
symfony/validator v6.4.7 |
CVE-2024-50343 | composer update symfony/validator |
v6.4.12 |
composer update drupal/core alone stops at 10.2.7 (still affected): 10.2.9 requires a newer Twig,
so -w is needed and the planner adds it. Human choice: Drupal's standard
composer update drupal/core --with-dependencies, which is what the planner recommends. The combined
command composer update drupal/core symfony/validator -w -m fixes all three: the merged winners
also named twig/twig, but the global search found the drupal/core update carries it and dropped it.
This fixture also motivated a builder change: Twig 3.11+ requires symfony/polyfill-php81, a package
the locked graph never contained, so a frozen repository built only from what Composer loaded for
the locked graph could not express the fix. The builder now fetches the requirement closure of every
version it keeps.
Built with bin/build-fixture.php --as-of=2024-10-15 --platform-php=8.2.0.
Planner result¶
3 advisories on 3 packages; 3 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| drupal/core 10.2.6 | CVE-2024-45440 | composer update drupal/core -w -m |
3 | verified |
| twig/twig v3.10.3 | CVE-2024-45411 | composer update twig/twig |
2 | verified |
| symfony/validator v6.4.7 | CVE-2024-50343 | composer update symfony/validator |
1 | verified |
Combined command (3 of 3 findings): composer update drupal/core symfony/validator -w -m
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: opensocial-drupal-distribution-pins.
pixelfed-laravel11-symfony¶
Case 2 on Laravel 11: symfony/http-foundation and symfony/process 7.1.5 (CVE-2024-50345, CVE-2024-51736, fixed in 7.1.7) via laravel/framework 11.26.0 (^7.0). Plain partial updates; process lands on 7.2.0 because Packagist records that release on 2024-11-06.
Case 2 on Laravel 11: transitive dependencies whose parent already permits the fix.
- Source: pixelfed/pixelfed at commit
6c4b9dda86e00bbea395d0f5cb5f02f549e2658e(2024-10-06). - Snapshot date (
--as-of): 2024-11-10. - Platform: the project requires
php ^8.2|^8.3withoutconfig.platform; the fixture pins 8.3.0.
Findings¶
symfony/http-foundation v7.1.5 (CVE-2024-50345) and symfony/process v7.1.5 (CVE-2024-51736),
fixed in 7.1.7, both required by laravel/framework v11.26.0 with ^7.0.
Human choice: composer update symfony/http-foundation symfony/process. The planner produces one
plan per package and that combined command. symfony/process resolves to 7.2.0 because Packagist
dates that release 2024-11-06, inside the snapshot window.
Built with bin/build-fixture.php --as-of=2024-11-10 --platform-php=8.3.0.
Planner result¶
2 advisories on 2 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| symfony/process v7.1.5 | CVE-2024-51736 | composer update symfony/process |
1 | verified |
| symfony/http-foundation v7.1.5 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
Combined command (2 of 2 findings): composer update symfony/http-foundation symfony/process
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: pixelfed-laravel11-symfony.
shopware-6420-twig-no-fix¶
Case 5 by constraint rather than platform: Shopware 6.4.20.2 is the final 6.4 release, pins twig/twig ~3.4.3, and the root requires shopware/core ~v6.4.0; twig 3.4.3 is affected by CVE-2024-45411 (fixed in 3.11.0/3.14.0) and shopware/core 6.5+ needs PHP 8.1 while the platform is 7.4.3. No remediation exists for twig, dompdf, tcpdf, php-svg-lib or the shopware/core advisories themselves; a handful of unrelated packages are still fixable.
Case 5 by constraint: the fix exists upstream but no release within the root constraint can reach it.
- Source: shopware/production at tag
v6.4.20.2, commit0e41d421dee0dcc6cbc579813347836c23c1ba49(2023-05-05), the final 6.4 release. - Snapshot date (
--as-of): 2024-09-15, a few days after CVE-2024-45411 was published. - Platform:
config.platform.php7.4.3 (from the project). Two emptypathrepository globs are dropped by the builder.
Findings¶
Twenty-six advisories on ten packages. twig/twig v3.4.3 is affected by CVE-2024-45411 (fixed in
3.11.0 and 3.14.0); every 6.4 release of shopware/core pins twig/twig ~3.4.3, the root requires
shopware/core ~v6.4.0, and shopware/core 6.5+ requires PHP 8.1 against a 7.4.3 platform. The
planner must report no verified remediation for twig, for the shopware/core advisories themselves, and
for the packages shopware/core pins exactly (shopwarelabs/dompdf, tecnickcom/tcpdf, phenx/php-svg-lib).
Still fixable by partial updates: composer/composer, symfony/twig-bridge, aws/aws-sdk-php (with
its dependencies) and symfony/validator. The summary's combined command fixes 7 of 26 findings:
composer update aws/aws-sdk-php composer/composer shopware/core symfony/twig-bridge -W -m --with 'symfony/validator:>=5.4.43,<6.0.0 || >=6.4.11,<7.0.0 || >=7.1.4'
The honest answer for this project is a Shopware 6.5/6.6 migration; the report says so by listing what cannot be fixed in place.
Built with bin/build-fixture.php --as-of=2024-09-15.
Planner result¶
26 advisories on 10 packages; 4 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| phenx/php-svg-lib 0.3.4 | CVE-2024-25117, CVE-2023-50251, PKSA-qsyb-3psh-f1t3 | none | ||
| shopware/core 6.4.20.2 | CVE-2024-42354, CVE-2024-42355, CVE-2024-42356, CVE-2024-22406, CVE-2024-22407, CVE-2024-31447, CVE-2024-42357 | none found within the search budget | ||
| shopwarelabs/dompdf v1.0.3 | CVE-2023-23924, CVE-2023-50262, CVE-2022-0085, CVE-2022-41343, CVE-2022-2400 | none | ||
| composer/composer 2.2.21 | CVE-2024-35242, CVE-2024-24821, CVE-2023-43655, CVE-2024-35241 | composer update composer/composer |
1 | verified |
| league/oauth2-server 8.3.6 | CVE-2023-37260 | none | ||
| aws/aws-sdk-php 3.269.6 | CVE-2023-51651 | composer update aws/aws-sdk-php -w -m |
2 | verified |
| symfony/twig-bridge v5.4.22 | CVE-2023-46734 | composer update symfony/twig-bridge |
1 | verified |
| tecnickcom/tcpdf 6.4.4 | CVE-2024-32489, CVE-2024-22640 | none found within the search budget | ||
| twig/twig v3.4.3 | CVE-2024-45411 | none found within the search budget | ||
| symfony/validator v5.4.23 | CVE-2024-50343 | composer update shopware/core -W -m --with 'symfony/validator:>=5.4.43,<6.0.0 || >=6.4.11,<7.0.0 || >=7.1.4' |
3 | verified |
Combined command (7 of 26 findings): composer update aws/aws-sdk-php composer/composer shopware/core symfony/twig-bridge -W -m --with 'symfony/validator:>=5.4.43,<6.0.0 || >=6.4.11,<7.0.0 || >=7.1.4'
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: shopware-6420-twig-no-fix.
shopware-twig-parent-pin¶
Case 3, transitive dependency pinned by the parent: Shopware 6.4.15.1 requires twig/twig ~3.3.8 while CVE-2022-39261 is fixed in 3.4.3; shopware/core 6.4.15.2 (a patch release allowed by the root constraint ~v6.4.0) is the first to require ~3.4.3. The shopware/ siblings pin core exactly, so they must move together; the planner discovers them through Composer's conflict output and descends to the lowest working version.*
Case 3: transitive dependency whose parent excludes the fix; the parent needs a newer patch release.
- Source: shopware/production at tag
v6.4.15.1, commit5e1b7fec0050e5e118467e944222d7d4ffca9c39(2022-09-21). - Snapshot date (
--as-of): 2022-10-10. - Platform:
config.platform.php7.4.3 (from the project). - The project declares two
pathrepositories with globs that match nothing; the builder drops them and copies the locked packages from the lock file.
Findings¶
twig/twig v3.3.10 is affected by CVE-2022-39261 (template loading outside the configured
directory), fixed in 3.4.3. Root requires shopware/core ~v6.4.0 and shopware/storefront ~v6.4.0;
both locked at 6.4.15.1 and both require twig/twig ~3.3.8, which excludes 3.4.3. shopware/core
6.4.15.2 (2022-10-05) is the first release requiring ~3.4.3. shopware/administration,
shopware/elasticsearch and shopware/recovery pin shopware/core to the exact version, so the whole
family has to move together.
Human choice: composer update "shopware/*" twig/twig -w, landing on 6.4.15.2 everywhere and twig
3.4.3 (seven changes: the five Shopware packages, twig, and shopware/conflicts, which keeps version
0.0.1 while its commit moves, the same-version reference change the lock diff counts). The planner
recommends
composer update shopware/storefront:6.4.15.2 shopware/recovery shopware/elasticsearch shopware/administration -W -m:
the same seven changes, with the parent pinned to the lowest working version rather than 6.4.16.0.
shopwarelabs/dompdf v1.0.3 (a fork that replaces dompdf/dompdf) is affected by three advisories
fixed only in 2.x; every 6.4 release of shopware/core pins it exactly, so no remediation exists as of
the snapshot date.
Built with bin/build-fixture.php --as-of=2022-10-10.
Planner result¶
4 advisories on 2 packages; 1 package with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| shopwarelabs/dompdf v1.0.3 | CVE-2022-0085, CVE-2022-41343, CVE-2022-2400 | none | ||
| twig/twig v3.3.10 | CVE-2022-39261 | composer update shopware/storefront:6.4.15.2 shopware/recovery shopware/elasticsearch shopware/administration -W -m |
7 | verified |
Combined command (1 of 4 findings): composer update shopware/storefront:6.4.15.2 shopware/recovery shopware/elasticsearch shopware/administration -W -m
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: shopware-twig-parent-pin.
usagov-drupal-core-recommended-twig¶
Case 4, second Drupal instance: drupal/core-recommended 10.2.7 pins twig/twig ~v3.8.0 while CVE-2024-45411 is fixed in 3.11.0/3.14.0; core-recommended 10.2.8 (2024-09-11) pins ~v3.14.0. The project's next commit is literally 'Upgrading Core-Recommended for a Twig upgrade'. drupal/core 10.2.7 is also affected by CVE-2024-45440 whose fix (10.2.9) postdates the snapshot.
Case 4, second Drupal instance: a meta-package pin that a patch release lifts.
- Source: usagov/usagov-2021 at commit
e29cb9ca5c8707de08c041032a1486861a2a7814(2024-08-19). The following commit,62ccb7ec…(2024-09-16), is titled "Upgrading Core-Recommended for a Twig upgrade". - Snapshot date (
--as-of): 2024-09-20. - Platform: no
config.platform; the fixture pins PHP 8.3.0. Repository:https://packages.drupal.org/8.
Findings¶
twig/twig v3.8.0 (CVE-2024-45411, fixed in 3.11.0 and 3.14.0) is pinned ~v3.8.0 by
drupal/core-recommended 10.2.7 while drupal/core 10.2.7 allows ^3.5.0. drupal/core-recommended
10.2.8 (2024-09-11) pins ~v3.14.0 and is the only newer 10.2 release at the snapshot date, so no
descent is needed.
Human choice: composer update drupal/core-recommended -W, which the project did. The planner
recommends composer update drupal/core-recommended -W -m (three changes: core, core-recommended,
twig 3.14.0). drupal/core and the meta-package are also affected by CVE-2024-45440, fixed only in
10.2.9 (2024-09-25), so no remediation is expected for those. symfony/validator 6.4.8
(CVE-2024-50343) is a plain partial update.
Built with bin/build-fixture.php --as-of=2024-09-20 --platform-php=8.3.0.
Planner result¶
4 advisories on 4 packages; 2 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| drupal/core 10.2.7 | CVE-2024-45440 | none found within the search budget | ||
| drupal/core-recommended 10.2.7 | CVE-2024-45440 | none | ||
| twig/twig v3.8.0 | CVE-2024-45411 | composer update drupal/core-recommended -W -m |
3 | verified |
| symfony/validator v6.4.8 | CVE-2024-50343 | composer update symfony/validator |
1 | verified |
Combined command (2 of 4 findings): composer update drupal/core-recommended symfony/validator -W -m
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: usagov-drupal-core-recommended-twig.
wallabag-symfony54-php74-guzzle5¶
Fourth plain-Symfony instance: wallabag (Symfony 5.4 on a declared PHP 7.4 platform, October 2024, snapshot January 2025). Sixteen advisories on eight direct dependencies. Eleven are plain updates that one combined command fixes: five Symfony 5.4 components, Twig 3.11.1 to 3.11.3 (still supporting PHP 7.2.5) and TCPDF 6.7.7 to 6.8.0. The five Guzzle advisories have no fix: the root requires guzzlehttp/guzzle ^5.3.4 and the abandoned php-http/guzzle5-adapter also pins the 5.x line, while the fixes live in 6.5.8 and 7.4.5; the report names the abandoned adapter. The project needs ext-tidy, which the fixture's platform declares.
Fourth plain-Symfony instance: many plain updates and one dependency stuck on an EOL major.
- Source: wallabag/wallabag at commit
91baac7e128140563cd21837edb3f2b996920574(2024-10-31, "Bump doctrine/persistence from 3.3.3 to 3.4.0"), a Symfony 5.4 application. - Snapshot date (
--as-of): 2025-01-15, after Symfony's November 2024 releases and TCPDF 6.8.0 (2024-12-23). - Platform:
config.platform.php7.4.29 andrequire.php >=7.4from the project. The project requiresext-tidy, which the build environment lacks; the fixture adds it to the platform (the repository copies the build machine's extension list, so a project-required extension that is not installed there has to be added by hand or nothing resolves).
Findings¶
Sixteen advisories on eight packages, all direct requirements of the application.
| Package | Advisories | Command | Lands on |
|---|---|---|---|
symfony/http-foundation v5.4.45 |
CVE-2024-50345 | composer update symfony/http-foundation |
v5.4.48 |
symfony/http-client v5.4.41 |
CVE-2024-50342 | composer update symfony/http-client |
v5.4.47 |
symfony/security-http v5.4.41 |
CVE-2024-51996 | composer update symfony/security-http |
v5.4.47 |
symfony/validator v5.4.41 |
CVE-2024-50343 | composer update symfony/validator |
v5.4.48 |
symfony/process v5.4.45 (dev) |
CVE-2024-51736 | composer update symfony/process |
v5.4.47 |
twig/twig v3.11.1 |
CVE-2024-51754, CVE-2024-51755 | composer update twig/twig |
v3.11.3 (3.11 still supports PHP 7.2.5) |
tecnickcom/tcpdf 6.7.7 |
CVE-2024-56519, -56521, -56522, -56527 | composer update tecnickcom/tcpdf |
6.8.0 |
guzzlehttp/guzzle 5.3.4 |
CVE-2022-29248, -31042, -31043, -31090, -31091 | none | — |
The combined command fixes 11 of 16:
composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator tecnickcom/tcpdf twig/twig
Guzzle has no fix within the project's constraints: the root requires guzzlehttp/guzzle ^5.3.4,
the fixes are in 6.5.8 and 7.4.5, and widening the root constraint does not help because
php-http/guzzle5-adapter (also a root requirement, abandoned on Packagist) requires the 5.x line.
The report flags the abandoned adapter. Moving off Guzzle 5 is a code change, which is what wallabag
eventually did; a remediation planner must say "no verified fix" here rather than invent one.
Built with bin/build-fixture.php --as-of=2025-01-15, then ext-tidy added to the platform.
Planner result¶
16 advisories on 8 packages; 7 packages with a verified fix.
| Package | Advisories | Recommended command | Changes | Outcome |
|---|---|---|---|---|
| guzzlehttp/guzzle 5.3.4 | CVE-2022-31043, CVE-2022-29248, CVE-2022-31042, CVE-2022-31090, CVE-2022-31091 | none | ||
| symfony/security-http v5.4.41 | CVE-2024-51996 | composer update symfony/security-http |
1 | verified |
| tecnickcom/tcpdf 6.7.7 | CVE-2024-56521, CVE-2024-56519, CVE-2024-56522, CVE-2024-56527 | composer update tecnickcom/tcpdf |
1 | verified |
| symfony/http-client v5.4.41 | CVE-2024-50342 | composer update symfony/http-client |
1 | verified |
| symfony/http-foundation v5.4.45 | CVE-2024-50345 | composer update symfony/http-foundation |
1 | verified |
| symfony/validator v5.4.41 | CVE-2024-50343 | composer update symfony/validator |
1 | verified |
| twig/twig v3.11.1 | CVE-2024-51755, CVE-2024-51754 | composer update twig/twig |
1 | verified |
| symfony/process v5.4.45 (dev) | CVE-2024-51736 | composer update symfony/process |
1 | verified |
Combined command (11 of 16 findings): composer update symfony/http-client symfony/http-foundation symfony/process symfony/security-http symfony/validator tecnickcom/tcpdf twig/twig
Stored reports: console, JSON, HTML, SARIF, CycloneDX, GitLab. Fixture: wallabag-symfony54-php74-guzzle5.