Project

General

Profile

Actions

Task #103082

closed

Replace former extension packages using self.version

Added by Thomas Hohn 3 months ago. Updated 3 months ago.

Status:
Resolved
Priority:
Must have
Assignee:
Category:
composer
Target version:
Start date:
2024-02-08
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
13
PHP Version:
8.2
Tags:
Complexity:
Sprint Focus:

Description

The so called "death star" range for replacements has to be
used with caution [1] as it replaces all versions of the
replaced packages, including old or insecure versions.

That effectively means the replacing package marks itself as matching
in queries for insecure versions, once a security advisory2
is submitted for the replaced packages.

The extension replacements needs to be adapted to use the more precise
self.version qualifier to avoid matching named security advisories as
suggested by:
https://github.com/Roave/SecurityAdvisories/issues/127#issuecomment-1933647035

[1] https://getcomposer.org/doc/04-schema.md#replace
[2] https://github.com/advisories/GHSA-cgr9-h9qq-x9fx

Actions

Also available in: Atom PDF