fix(ci): skip composer advisory audit for framework integration test installs#3950
Draft
Leiyks wants to merge 1 commit into
Draft
fix(ci): skip composer advisory audit for framework integration test installs#3950Leiyks wants to merge 1 commit into
Leiyks wants to merge 1 commit into
Conversation
…installs A Packagist security advisory (PKSA-mdq4-51ck-6kdq / CVE-2026-48019, CRLF injection in the default email validation rule) flags essentially all Laravel framework versions this repo pins for integration tests (>=9,<12.60.0 and >=13,<13.10.0). Composer's resolver refuses to load the pinned versions, so every Laravel integration job fails during the composer setup phase before any test runs. These are intentionally pinned test fixtures, not shipped code, so disable composer's resolver-level 'block-insecure' audit at the shared composer invocation point (run_composer_with_retry). --no-audit only skips the post-install audit report and does NOT lift the resolver block, so the audit.block-insecure config must be set on the project being updated. This is applied at the single shared point used by all framework/integration composer installs, so it covers every affected Laravel version at once (and harmlessly also covers other frameworks such as Symfony).
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
A Packagist security advisory PKSA-mdq4-51ck-6kdq / CVE-2026-48019 (CRLF injection in Laravel's default email validation rule, published ~2026-06-03) flags essentially all Laravel framework versions this repo pins for integration tests (affected ranges
>=9,<12.60.0and>=13,<13.10.0; Latest pins12.44.0, plus the 9.x/10.x/11.x fixtures).As a result, composer's resolver refuses to load the pinned versions and all Laravel integration jobs fail during the composer setup phase, before any test runs:
This is an external/environmental break, not a code regression. We intentionally pin these Laravel versions as test fixtures, so we do not want to bump them.
The fix
Disable composer's resolver-level
block-insecureaudit at the single shared composer invocation point (run_composer_with_retryin the Makefile), by runningcomposer config audit.block-insecure falseon the project beforecomposer update.Note:
--no-auditonly skips the post-install audit report and does not lift the resolver block — verified in docker. Theaudit.block-insecureconfig must be set on the project being updated.Because the change is at the shared point used by every framework/integration composer install, it unblocks all affected Laravel versions at once. It also harmlessly applies to other frameworks (Symfony, etc.) — acceptable for CI test fixtures.
Verification (docker,
datadog/dd-trace-ci:php-8.3_bookworm-8, composer 2.9.8)make tests/Frameworks/Laravel/Latest/composer.lock-php83failed with the advisory resolver error;--no-auditdid not clear it.laravel/framework v12.44.0resolves + installs, lock file andvendor/created (the only remaining step that fails is the post-autoload-dump script reaching themysql-integrationhost, expected without the full CI service network).laravel/framework 10.50.2) now installs cleanly.