FEDORA-2022-617a6df23e — security update for composer

stable

FEDORA-2022-617a6df23e created by remi 2 years ago for Fedora 34

Version 2.2.12 - 2022-04-13

Security: Fixed command injection vulnerability in HgDriver/GitDriver (GHSA-x7cr-6qr6-2hh6 / CVE-2022-24828)
Fixed curl downloader not retrying when a DNS resolution failure occurs (#10716)
Fixed composer.lock file still being used/read when the lock config option is disabled (#10726)
Fixed validate command checking the lock file even if the lock option is disabled (#10723)

Version 2.2.11 - 2022-04-01

Added missing config.bitbucket-oauth in composer-schema.json
Added --2.2 flag to self-update to pin the Composer version to the 2.2 LTS range (#10682)
Updated semver, jsonlint deps for minor fixes
Fixed generation of autoload crashing if a package has a broken path (#10688)
Removed dev-master=>dev-main alias from #10372 as it does not work when reloading from lock file and extracting dev deps (#10651)

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-617a6df23e

This update has been submitted for testing by remi.

This update's test gating status has been changed to 'ignored'.

This update has been pushed to testing.

This update has been submitted for stable by bodhi.

This update has been pushed to stable.

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

2 years ago

in testing

2 years ago

in stable

2 years ago

Builds

ignored