Bug #94784

Updated by Dan Untenzu 4 months ago

*What did I do?* 

 - Update an existing installation with typo3/cms-core:10.4.18 and roave/security-advisories:dev-latest 

 *What did I expect?* 

 - Composer update runs though, installs typo3/cms-core:10.4.19 

 *What happend instead* 

 - Composer keeps typo3/cms-core:10.4.18 

 *Additional information* 

 After removing roave/security-advisories, updating and adding roave/security-advisories it became clear, that this has to be an issue with #94719. 
 In this commit typo3/cms-core replaces t3g/svg-sanitizer, which is blocked for all versions < 1.0.3 by roave/security-advisories (See https://github.com/Roave/SecurityAdvisories/blob/latest/composer.json#L285). 

 <pre> 
 Your requirements could not be resolved to an installable set of packages. 

   Problem 1 
     - bk2k/bootstrap-package is locked to version 11.0.3 and an update of this package was not requested. 
     - roave/security-advisories dev-master conflicts with t3g/svg-sanitizer <1.0.3 (typo3/cms-core v10.4.19 replaces t3g/svg-sanitizer *). 
     - bk2k/bootstrap-package 11.0.3 requires typo3/cms-core ^9.5 || ^10.0 || 10.*@dev -> satisfiable by typo3/cms-core[v10.4.19]. 
     - Root composer.json requires roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master]. 
 </pre> <pre> 

 <pre> 
 Your requirements could not be resolved to an installable set of packages. 

   Problem 1 
     - Root composer.json requires roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master]. 
     - roave/security-advisories dev-master conflicts with t3g/svg-sanitizer <1.0.3 (typo3/cms-core v10.4.19 replaces t3g/svg-sanitizer *). 
     - typo3/cms-core is locked to version v10.4.19 and an update of this package was not requested. 
 </pre> 

 Suggested Solution 1: Remove the block in roave/security-advisories - Since the affected versions are fixed in all replacement versions (typo3/cms-core) 

 Suggested Solution 2: Replace a specific version, not a joker version: Use <code>"t3g/svg-sanitizer": ">=1.0.3"</code> instead of <code>"t3g/svg-sanitizer": "*"</code>. 

Back