From 829aa9d00164efad0c971350ca5f5882d82c7f78 Mon Sep 17 00:00:00 2001 From: Gerard Oosterhof Date: Mon, 7 Sep 2026 14:05:19 +0200 Subject: [PATCH 1/3] =?UTF-8?q?chore(deps):=20bump=20league/commonmark=202?= =?UTF-8?q?.9.0=20=E2=86=92=202.10.0=20(GHSA-8rr7-cvq3-gmfh)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit HIGH DoS advisory PKSA-zyf5-hrxv-hrd7, affected >=1.5.0,<2.10.0. commonmark is a PRODUCTION dependency here (illuminate/mail in require), so the audit-gated release lane was blocked. Lockfile-only. WR-1256. Co-Authored-By: Claude Fable 5.1 --- composer.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/composer.lock b/composer.lock index 44adda3..675ffda 100644 --- a/composer.lock +++ b/composer.lock @@ -1217,16 +1217,16 @@ }, { "name": "league/commonmark", - "version": "2.9.0", + "version": "2.10.0", "source": { "type": "git", "url": "https://github.com/thephpleague/commonmark.git", - "reference": "5703d83ba3da3b2e356a5fedc848ed6d8ffb6529" + "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/5703d83ba3da3b2e356a5fedc848ed6d8ffb6529", - "reference": "5703d83ba3da3b2e356a5fedc848ed6d8ffb6529", + "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/d2d1aa8b35e072966c89bc0c66cf926e56767dc4", + "reference": "d2d1aa8b35e072966c89bc0c66cf926e56767dc4", "shasum": "" }, "require": { @@ -1263,7 +1263,7 @@ "type": "library", "extra": { "branch-alias": { - "dev-main": "2.9-dev" + "dev-main": "2.11-dev" } }, "autoload": { @@ -1320,7 +1320,7 @@ "type": "tidelift" } ], - "time": "2026-07-12T15:29:16+00:00" + "time": "2026-08-11T16:06:25+00:00" }, { "name": "league/config", From 0bcc73db082d1199459c1813d41a2b93ebc72eb3 Mon Sep 17 00:00:00 2001 From: Gerard Oosterhof Date: Mon, 7 Sep 2026 19:51:35 +0200 Subject: [PATCH 2/3] docs(changelog): record the commonmark 2.10.0 security bump under Unreleased crit round 1 on #72: the lock moved without a changelog line. Dev-only dependency, but the pin was reddening every CI job's composer audit (WR-1256). Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JMk9fRGSpbtAdYfFSSToP5 --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 80fd55f..5a1a20b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -81,6 +81,10 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and **Versioning: PATCH** — CI, tests, self-analysis configuration and documentation only. No rule is added, removed or changed; no consumer sees a new or missing error, and nothing here is reachable from `extension.neon`. +### Security + +- `league/commonmark` 2.9.0 → 2.10.0 in `composer.lock` (GHSA-8rr7-cvq3-gmfh; the 2.9.1 advisories GHSA-jjv6-8j6v-6j52, GHSA-f8fg-pg57-v4j8 and GHSA-j8pm-gj4c-rq4x close with it). A dev-only dependency here — the package never ships to a consumer — but `composer install` audits the lock on every CI job, so the stale pin was reddening every check on every open PR (WR-1256). + ## [0.8.0] — 2026-08-11 **Release-as-a-whole: candidate MAJOR** — `EnforceActionResultDtoRule` (war-room enforcement queue #136), `ForbidInlineArrayJsonResponseInControllersRule` (queue #137) and `ForbidRawExceptionMessageInResponseRule` (queue #140) all surface new errors in already-clean consumer code, as does the `ForbidEloquentMutationInControllersRule` receiver-scope fix (see their bullets). Per the pre-1.0 caret convention `^0.7` excludes this minor, so tagging auto-adopts nobody — each consumer adopts on its own pin-bump PR. Seeds: kendo PR #1653 (queue #136 + #137), war-room queue #140 (ublgenie/codebook MCP-tool leak sites), tc-api PR #133 (baseline-unmatched finding). _(Section originally dated 2026-07-13 covering only the queue #136/#137 pair; the tag was cut 2026-08-11 at `30c5145` and this section was folded to match the shipped payload.)_ From b0057d964608ab040bbd2f38c268260baf26dbf8 Mon Sep 17 00:00:00 2001 From: Gerard Oosterhof Date: Mon, 7 Sep 2026 20:16:45 +0200 Subject: [PATCH 3/3] docs(changelog): commonmark is a runtime dependency via illuminate/mail, not dev-only crit round 2 on #72 (d30936987875): `illuminate/mail` is in `require` and pulls `league/commonmark ^2.7`; the earlier note would have had a release reviewer classify the bump as CI-only. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01JMk9fRGSpbtAdYfFSSToP5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a1a20b..f3c8a16 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -83,7 +83,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and ### Security -- `league/commonmark` 2.9.0 → 2.10.0 in `composer.lock` (GHSA-8rr7-cvq3-gmfh; the 2.9.1 advisories GHSA-jjv6-8j6v-6j52, GHSA-f8fg-pg57-v4j8 and GHSA-j8pm-gj4c-rq4x close with it). A dev-only dependency here — the package never ships to a consumer — but `composer install` audits the lock on every CI job, so the stale pin was reddening every check on every open PR (WR-1256). +- `league/commonmark` 2.9.0 → 2.10.0 in `composer.lock` (GHSA-8rr7-cvq3-gmfh; the 2.9.1 advisories GHSA-jjv6-8j6v-6j52, GHSA-f8fg-pg57-v4j8 and GHSA-j8pm-gj4c-rq4x close with it). A **runtime** dependency of this package: `illuminate/mail` is in `require` and pulls `league/commonmark ^2.7`, so `composer install --no-dev` installs it. This lock pins only what this repo's own CI and self-analysis tree install — a consumer territory resolves the range through its own lock and must bump there — but the stale pin here was reddening every check on every open PR, because `composer install` audits the lock on every job (WR-1256). ## [0.8.0] — 2026-08-11