Skip to content

fix(ci): skip composer advisory audit for framework integration test installs #3950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Leiyks wants to merge 1 commit into
base: master
Choose a base branch
from
+5 −0
Draft

fix(ci): skip composer advisory audit for framework integration test installs #3950

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1213,7 +1213,12 @@ MAX_RETRIES := 3
RUN_WEB_BENCHES_WITH_DDPROF ?=

# Note: The "composer show" command below outputs a csv with pairs of dependency;version such as "phpunit/phpunit;9.6.17"
# Note: We disable composer's "block-insecure" audit so that pinned dependency versions flagged by a
# security advisory (e.g. Laravel/framework PKSA-mdq4-51ck-6kdq / CVE-2026-48019) still resolve. These
# are intentionally pinned test fixtures, not shipped code; --no-audit only skips the post-install report
# and does NOT lift the resolver-level block, so the config must be set on the project being updated.
define run_composer_with_retry
$(COMPOSER) --working-dir=$(if $1,$1,.) config audit.block-insecure false
for i in $$(seq 1 $(MAX_RETRIES)); do \
echo "Attempting composer update (attempt $$i of $(MAX_RETRIES))..."; \
$(COMPOSER) --working-dir=$(if $1,$1,.) update $2 && break || (echo "Retry $$i failed, waiting 5 seconds before next attempt..." && sleep 5); \
Expand Down
Loading