Update dependency laravel/framework to v12.61.1 [SECURITY]#123
Open
renovate[bot] wants to merge 1 commit into
Open
Update dependency laravel/framework to v12.61.1 [SECURITY]#123renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
12.19.3→12.61.1Laravel Framework: Temporary Signed URL Path Confusion
GHSA-crmm-hgp2-wgrp
More information
Details
A vulnerability in Laravel's local filesystem driver allows temporary signed URLs to be parsed ambiguously, potentially misrouting requests and bypassing expiration enforcement.
Under certain conditions, a generated temporary signed URL can be interpreted differently by the server than intended at signing time. This may cause requests to resolve to an unintended resource, and can prevent expiration from being enforced, allowing expired URLs to remain valid indefinitely.
Impact
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Laravel Framework: CRLF injection in default email rule
GHSA-5vg9-5847-vvmq
More information
Details
Summary
A CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing in applications that send mail to user-supplied addresses.
Description
Laravel applications that send email to addresses provided by users — for example during authentication flows or contact forms — may be vulnerable to manipulation of outbound mail content if the address is not adequately sanitized before it reaches the mail transport layer.
An attacker who can supply an email address to such a flow may, under certain conditions, be able to influence the content of emails sent by the application, cause those emails to be delivered to unintended recipients, or cause the application's mail server to send unintended messages.
Impact
Affected applications may be exposed to unauthorized access and mail relay abuse. The severity depends on what the application sends by email and how its mail infrastructure is configured.
Remediation
Upgrade to version 12.60.0 or later, or 13.10.0 or later.
Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
laravel/framework (laravel/framework)
v12.61.1Compare Source
configis bound before trying to log deprecation notice by @crynobone in #60376v12.61.0Compare Source
v12.60.2Compare Source
v12.60.1Compare Source
v12.60.0Compare Source
v12.59.0Compare Source
v12.58.0Compare Source
v12.57.0Compare Source
@mixinon Connection by @AJenbo in #59532v12.56.0Compare Source
schedule:listdisplay expression in the correct timezone by @xiCO2k in #59307v12.55.1Compare Source
v12.55.0Compare Source
BelongsToManyby @SanderMuller in #59153tapPendingRequest by @cosmastech in #59188touch()to accept multiple columns by @devajmeireles in #59175Command::withProgressBarphpdoc to account for arrow functions and non-void return types by @billypoke in #58766HasOneOrManyThroughby @Jacobs63 in #59231Util::getParameterClassName()call in container resolution by @SanderMuller in #59220array_pushwith spread operator inMessageBag::all()by @SanderMuller in #59217route:listby @devajmeireles in #59237v12.54.1Compare Source
v12.54.0Compare Source
repeatEvery()method by @amirhshokri in #58987BinaryFileResponseby @axlon in #59018int-mask-ofannotation by @shaedrich in #59082interval()method toInteractsWithDataby @SanderMuller in #59114for()method by @amirhshokri in #59144v12.53.0Compare Source
buildMorphMapFromModels()function by @josephkerkhof in #58891PhpRedisClusterConnectionflushdb method by @miladev95 in #58917downcommand to refresh maintenance mode options by @alies-dev in #58918matchexpression by @josephkerkhof in #58928convertValuesToBooleanto usematchfor cleaner logic by @josephkerkhof in #58927Eventmacros to be applied to schedule groups by @stevebauman in #58926assertSessionHasAllfailure output by @dxnter in #58946Cache::funnel()for concurrency limiting with any cache driver by @mathiasgrimm in #58439oldest_pendingis displayed inqueue:monitorby @jackbayliss in #58952SerializerandTypeclasses inIlluminate/JsonSchemaby @mrvipchien in #58981v12.52.0Compare Source
@returnin doc blocks by @alipowerful7 in #58746Arr::wrap()and addCollection::wrap()by @alipowerful7 in #58748temporaryUploadUrlto thelocalfilesystem by @mnapoli in #58499Batch::progress()return value tointby @zjbarg in #58767AbstractRouteCollectionby @jackbayliss in #58769@returnforresolveResourceRelationshipIdentifiers()by @alipowerful7 in #58764Mailable::later()does not set delay onSendQueuedMailableinstance by @amirhshokri in #58765enum_value()helper for environment value extraction by @alipowerful7 in #58785new Collection()by @alipowerful7 in #58793makeManymethod to Factory by @jackbayliss in #58795withoutAfterMaking()andwithoutAfterCreating()factory helpers by @ziadoz in #58794|arrayin doc block by @alipowerful7 in #58805\BackedEnumby @alipowerful7 in #58807JSON decodedby @alipowerful7 in #58830@throwstag in dock block by @alipowerful7 in #58829matchexpression by @alipowerful7 in #58824compileSelectmethod return by @amirhshokri in #58821\BackedEnumby @alipowerful7 in #58818JSON decodedtodecoded JSONby @alipowerful7 in #58849composer.jsonby @amirhshokri in #58875forgetDriver()from TestCaches by @jackbayliss in #58878v12.51.0Compare Source
Lang::get()when locale matches fallback by @jackbayliss in #58626reloadtasks to includeschedule:interruptionby @adevade in #58637firstOrCreateandcreateOrFirstby @gcavanunez in #58639afterSendingmethod on notification by @gdebrauwer in #58654assertJobsmethod onPendingBatchFakeby @gdebrauwer in #58606whenFailsandwhenPassesmethods onValidatorby @gdebrauwer in #58655Illuminate\Console\Parsertypehint fix. by @LastDragon-ru in #58670??by @alipowerful7 in #58679header/headerswith standardizedheader(s)by @alipowerful7 in #58678orderByPivotDesc()by @alipowerful7 in #58720@throws \InvalidArgumentExceptionto doc blocks by @alipowerful7 in #58714_to more readability digit by @alipowerful7 in [#58738](https://redirect.github.com/laravel/framework/pull/58Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.