Unclear why laravel-filemanager is marked as insecure

[MaxKorlaar]

Hi,

I noticed that unisharp/laravel-filemanager has been added to the conflicts in the following commit: 5369c56. The commit description links to a codeigniter security advisory, which doesn't seem relevant for this package. I've noticed the following issue on the filemanager's repository: UniSharp/laravel-filemanager#1096, does it have anything to do with this?

[Ocramius]

Related: Roave/SecurityAdvisoriesBuilder#451

As for the specific advisory, see GHSA-f8x6-m9f5-ffp8

[MaxKorlaar]

Thanks! I missed that one. Too bad it's not shown on https://github.com/UniSharp/laravel-filemanager/security/advisories, which is where I looked first.

[Ocramius]

The advisory at GHSA-f8x6-m9f5-ffp8 is not linked to the repo.

[MaxKorlaar]

Noticed, thanks again!

[mfn]

I too was surprised how @Ocramius even found that advisory 🤷‍♀️

[Ocramius]

Please read Roave/SecurityAdvisoriesBuilder#451

This contains all the advisories at https://github.com/advisories, and composer.json is re-generated every hour.

[mfn]

Thank you 🙏🏼