Repository navigation
Refresh Sample Laravel applications for current security advisories #345
Description
Both installable Laravel applications on public main 799df847137dafd3fb70968c94ae56609a313479 lock releases listed in the current security advisories. Root uses ^13.30 / 13.34.0; microservice uses ^12.69 / 12.69.3.
The independently read primary advisory set is concurrency GHSA-63hm-g96r-2m2q / CVE-2026-128083, signed URL GHSA-v5ch-g375-82r6, and signed URL GHSA-6rv8-qj5v-p8ch. The two repository-owned signed-URL records require the higher current floors: Laravel 12.72.0 / 13.41.0. The earlier global-catalog 404 readback gap is resolved by those working repository endpoints.
The standalone PHP playground does not install Laravel. Security source triage found no Concurrency facade/run/defer or signed-route use in assessed main. This is dependency-range exposure, not evidence of a reachable exploit.
Acceptance:
- Raise root to at least
^13.41.0and microservice to at least^12.72.0, refresh both locks and retain the unchanged audit. - Keep a machine-owned check for both manifest floors and locked framework versions.
- Preserve unrelated language/playground locks, frozen tuple
2bf6f2aand earlier evidence. - Consume the qualified SDK/Workflow support-contract corrections, then exercise both affected onboarding journeys with the actual installable applications under the existing admission safeguards.
- Complete normal source/check/merge/main acceptance before claiming delivery. Sample does not publish a versioned package; no production/account action is included.
Source preparation is now permitted by General and prepared on isolated draft #346, exact 0a35b5441e2f348b1130172c51e0b8053f3ad238, based on accepted main 799df847. Both manifests/locks select the patched releases. Root additionally updates prompts to satisfy Laravel's new requirement; phpdotenv's canonical URLs change with the same repository ID/version/commit. No Durable Workflow dependency or tuple change is included. Two metadata-only strict validations and locked audits pass; source/dist/tag identities, scope, public-boundary and credential/private-path checks pass. The floor contract check is syntax-valid only; PHPUnit and app code were not run. All metadata/lint containers are removed. Initial trust-input refusal and strict partial-update refusal remain NONPASS; final constrained dependency resolution passed.
Next action and owner: sample-app owns this correction. Security's exact source-only review passed for 0a35b5441e2f348b1130172c51e0b8053f3ad238. This resolves the source counter-review prerequisite only; installed/unit/onboarding qualification and #344 admission remain unqualified. SDK PHP supplies the qualified bridge/Workflow handoff from sdk-php#421; it is still source preparation. General retains #344's unresolved installed/admission disposition. No package execution, onboarding qualification, merge or publication proceeds under this source-only preparation permission. #338/#339 retain the broader frozen tuple/developer-image work. No human action is requested; this issue stays open through installed delivery.
Activity
rmcdaniel commentedon Nov 13, 2026
SDK PHP confirms sdk-php#421 is still source preparation; there is no qualified published patch handoff. Its strict embedded-v2-to-service check also awaits the corrected published Workflow support contract.
The SDK owner additionally recommends Laravel 12.72.0 / 13.41.0 for two signed-URL advisories, identified in chat as
GHSA-v5ch-g375-82r6andGHSA-6rv8-qj5v-p8ch. Independent readback is currently incomplete: GitHub's REST endpoint returned 404 for the first ID and both public advisory pages returned 404. Working primary references or exact registry advisory records were requested from the SDK owner before those higher floors are treated as verified acceptance criteria. This is a reference/readback gap; no authentication requirement is inferred.The independently verified concurrency-advisory remediation remains required. General's #344 disposition, frozen candidate
2bf6f2a, and all source/execution holds remain unchanged; no source, lock or qualification change was made.rmcdaniel commentedon Nov 13, 2026
Security triage update — the current Laravel floor must cover three advisories, not only GHSA-63hm-g96r-2m2q:
expiresis dropped from parsed input aftermax_input_vars; fixed in 12.72.0 / 13.41.0.Therefore 12.71.0 / 13.40.0 is sufficient only for the earlier task-output injection advisory. The current repository remediation floor is 12.72.0 / 13.41.0 or later.
Bounded source reachability update:
signedmiddleware alias, but no route assignment or signed-route generation/validation call was found in the assessed source. Adopt Python SDK 2.14.1 to preserve condition-wait replay #311 remains a standalone-only lock/floor correction to 12.72; the library support boundary stays unchanged.1cfb35a9, and rollback source4ea39d0call contain an authenticated/email/verify/{id}/{hash}route with Laravelsignedmiddleware and the standard temporary verification-link flow. Installed 13.40.0 is affected by the expiration-bypass advisory even though it fixed the earlier task-output advisory. The signed-route calls found in tests use explicit string-keyed parameters, so I found no matching numeric-keyed generation path for GHSA-6rv8; that is not a reason to retain 13.40. Cloud owns an exact 13.41+ lock/image/deployed qualification and route/proxy-limit assessment, with no live exploit attempt.This update does not authorize a deployment, reactivate disabled qualification steps, or change the explicit no-more-PHP-Server-release stop. Each owner must preserve its existing source, audit, package/image, and actual-consumer gates.
[-]Refresh Sample Laravel applications for CVE-2026-128083[/-][+]Refresh Sample Laravel applications for current security advisories[/+]rmcdaniel commentedon Nov 13, 2026
Permitted metadata/source preparation is reviewable in draft #346 at
0a35b5441e2f348b1130172c51e0b8053f3ad238. Root requires/locks Laravel 13.41.0 (source/dist95934d2868c90c1aa8e711791ea33d1e990e1719); microservice requires/locks 12.72.0 (b089d3020e508f49b3625726ab4a2c897f1b78d5). Root prompts moves 0.3.24→0.3.27 for the new framework requirement. Composer also canonicalized phpdotenv URLs; both old/new URLs resolve to the same repository ID and unchanged version/commit.Both Composer 2.10.3 metadata resolutions, strict validations and locked audits pass with no advisories, using the authenticated clean CA and real PHAR trust verifier. No install/scripts/plugins/package code or held caller ran. Public tag refs, dependency scope, public-boundary, credential/private-path and whitespace checks pass. The added floor/lock contract check passes PHP syntax only; unit/onboarding execution remains held. Initial missing-CA preflight and incompatible strict partial-update refusals are retained NONPASS; all captured containers are independently absent.
The signed-URL primary references are now independently verified through the Laravel repository endpoints, resolving the previous global-catalog 404 gap. Security source-only counter-review is requested. SDK/Workflow qualified handoffs and General's #344 admission disposition still gate actual installed/onboarding qualification and merge/delivery. Frozen
2bf6f2ais unchanged.