Unrelated conflict changes (typo3/cms-* vs. mediawiki/semantic-media-wiki)
#127
Labels
Comments
|
See:
This repo only tracks the advisories: check https://github.com/advisories for the latest updates. |
|
|
|
For the records: A recent change at GitHub "hallucinated" a Composer package, which caused this behavior (side-note: the original advisory was from 2010, Composer was established in 2012 - two years later). |
reviewtypo3org
pushed a commit
to TYPO3/typo3
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82841 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
reviewtypo3org
pushed a commit
to TYPO3/typo3
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by: Oliver Klee <[email protected]> Tested-by: Oliver Hader <[email protected]> Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Oliver Klee <[email protected]> Reviewed-by: Oliver Hader <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
reviewtypo3org
pushed a commit
to TYPO3/typo3
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
reviewtypo3org
pushed a commit
to TYPO3/typo3
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/backend
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82841 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/core
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82841 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/info
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82841 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/workspaces
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82841 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/backend
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by: Oliver Klee <[email protected]> Tested-by: Oliver Hader <[email protected]> Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Oliver Klee <[email protected]> Reviewed-by: Oliver Hader <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/core
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by: Oliver Klee <[email protected]> Tested-by: Oliver Hader <[email protected]> Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Oliver Klee <[email protected]> Reviewed-by: Oliver Hader <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/info
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by: Oliver Klee <[email protected]> Tested-by: Oliver Hader <[email protected]> Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Oliver Klee <[email protected]> Reviewed-by: Oliver Hader <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/workspaces
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863 Tested-by: Oliver Klee <[email protected]> Tested-by: Oliver Hader <[email protected]> Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Oliver Klee <[email protected]> Reviewed-by: Oliver Hader <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/backend
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/core
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/info
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/workspaces
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82874 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/backend
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/core
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/info
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
TYPO3IncTeam
pushed a commit
to TYPO3-CMS/workspaces
that referenced
this issue
Feb 9, 2024
The so called "death star" range for replacements has to be used with caution [1] as it replaces all versions of the replaced packages, including old or insecure versions. That effectively means the replacing package marks itself as matching in queries for insecure versions, once a security advisory[2] is submitted for the replaced packages. The extension replacements are now adapted to use the more precise self.version qualifier to avoid matching named security advisories as suggested by: Roave/SecurityAdvisories#127 (comment) [1] https://getcomposer.org/doc/04-schema.md#replace [2] GHSA-cgr9-h9qq-x9fx Resolves: #103082 Releases: main, 13.0, 12.4, 11.5 Change-Id: I6353df15d6cbf039bab60644a103669495b26605 Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873 Tested-by: core-ci <[email protected]> Tested-by: Benjamin Franzke <[email protected]> Reviewed-by: Benjamin Franzke <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
The package
typo3/cms-saltedpasswords <0.2.13suddenly is marked as insecure and blocks the installation thetypo3/cms-corepackage (due to having areplacesdeclaration fortypo3/cms-saltedpasswords: *intypo3/cms-core).Observation
A bunch of changes were committed recently to
roave/security-advisories- where theconflictdeclaration does not match with the actual original commit insensiolabs/security-advisories, for instance:changes
conflictfortypo3/cms-saltedpasswords, original commit is aboutmediawiki/semantic-media-wiki(FriendsOfPHP/security-advisories@baf9dd7)changes
conflictfortypo3/cms-frontend,typo3/cms-backendandtypo3/cms-install, original commit is aboutmediawiki/semantic-media-wiki(FriendsOfPHP/security-advisories@baf9dd7)changes
conflictfortypo3/cms-frontend, original commit is aboutmediawiki/semantic-media-wiki(FriendsOfPHP/security-advisories@baf9dd7)CLI commands used to reproduce the behavior
The text was updated successfully, but these errors were encountered: