From df9cb7f9d7847893119001598f10c440ed8c6d8e Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 19:57:05 +0000 Subject: [PATCH 1/2] Document retired PHP advisory action and refresh source Laravel lock --- README.md | 5 ++ composer.json | 2 +- composer.lock | 61 +++++++++---------- .../security/retired-php-server-2026-11-13.md | 59 ++++++++++++++++++ 4 files changed, 93 insertions(+), 34 deletions(-) create mode 100644 docs/security/retired-php-server-2026-11-13.md diff --git a/README.md b/README.md index bbd8ffaef..2f8afdc35 100644 --- a/README.md +++ b/README.md @@ -21,6 +21,11 @@ Laravel applications can also run the engine directly in ## Run Server +PHP Server 2.11.8 is retired and contains Laravel dependencies affected by +published advisories. Existing PHP installations should follow the +[PHP retirement and security notice](docs/security/retired-php-server-2026-11-13.md) +for immediate exposure reduction and the supported native migration guidance. + For the 21 October 2026 critical PHP update, follow the [PHP runtime security notice](docs/security/php-runtime-2026-10-21.md) and verify the patched runtime in every deployed role. diff --git a/composer.json b/composer.json index 6c4a3033a..bec17b2e6 100644 --- a/composer.json +++ b/composer.json @@ -7,7 +7,7 @@ "php": "^8.2", "apache/avro": "^1.12", "durable-workflow/workflow": "2.15.12", - "laravel/framework": "^13.30", + "laravel/framework": "^13.41", "laravel/tinker": "^3.0", "league/flysystem-aws-s3-v3": "^3.35.3" }, diff --git a/composer.lock b/composer.lock index 8f24ddc81..e960acdcc 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "26f05963a35e77fc93c3cc53a277a070", + "content-hash": "1dbf9e15409dab89a890bcb1ee92b70b", "packages": [ { "name": "apache/avro", @@ -1355,16 +1355,16 @@ }, { "name": "laravel/framework", - "version": "v13.34.0", + "version": "v13.41.0", "source": { "type": "git", "url": "https://github.com/laravel/framework.git", - "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4" + "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/framework/zipball/c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4", - "reference": "c829b4982d29344cbcf1d7ad78eb5d2bb8ae66c4", + "url": "https://api.github.com/repos/laravel/framework/zipball/95934d2868c90c1aa8e711791ea33d1e990e1719", + "reference": "95934d2868c90c1aa8e711791ea33d1e990e1719", "shasum": "" }, "require": { @@ -1385,12 +1385,12 @@ "guzzlehttp/promises": "^2.0.3 || ^3.0", "guzzlehttp/psr7": "^2.9 || ^3.0", "guzzlehttp/uri-template": "^1.0 || ^2.0", - "laravel/prompts": "^0.3.11", + "laravel/prompts": "^0.3.25", "laravel/serializable-closure": "^2.0.10", "league/commonmark": "^2.8.1", "league/flysystem": "^3.25.1", "league/flysystem-local": "^3.25.1", - "league/uri": "^7.5.1", + "league/uri": "^7.6", "monolog/monolog": "^3.10", "nesbot/carbon": "^3.8.4", "nunomaduro/termwind": "^2.0", @@ -1467,11 +1467,12 @@ "spatie/once": "*" }, "require-dev": { - "ably/ably-php": "^1.0", + "ably/pubsub-server": "^1.0|^2.0", "aws/aws-sdk-php": "^3.322.9", "ext-gmp": "*", "fakerphp/faker": "^1.24", - "intervention/image": "^4.0", + "intervention/image": "^4.2", + "jasonmccreary/double": "^1.1", "laravel/pint": "^1.18", "league/flysystem-aws-s3-v3": "^3.25.1", "league/flysystem-ftp": "^3.25.1", @@ -1480,10 +1481,10 @@ "league/flysystem-sftp-v3": "^3.25.1", "mockery/mockery": "^1.6.10", "opis/json-schema": "^2.4.1", - "orchestra/testbench-core": "^11.5.0", + "orchestra/testbench-core": "^11.6.0", "pda/pheanstalk": "^7.0.0 || ^8.0.0", "php-http/discovery": "^1.15", - "phpstan/phpstan": "2.2.15", + "phpstan/phpstan": "2.3.5", "phpunit/phpunit": "^11.5.50 || ^12.5.8 || ^13.0.3", "predis/predis": "^2.3 || ^3.0", "rector/rector": "2.6.3", @@ -1496,7 +1497,7 @@ "web-token/jwt-library": "^4.1" }, "suggest": { - "ably/ably-php": "Required to use the Ably broadcast driver (^1.0).", + "ably/pubsub-server": "Required to use the Ably broadcast driver (^1.0|^2.0).", "aws/aws-sdk-php": "Required to use the SQS queue driver, DynamoDb failed job storage, and SES mail driver (^3.322.9).", "brianium/paratest": "Required to run tests in parallel (^7.0 || ^8.0).", "ext-apcu": "Required to use the APC cache driver.", @@ -1510,7 +1511,7 @@ "ext-redis": "Required to use the Redis cache and queue drivers (^4.0 || ^5.0 || ^6.0).", "fakerphp/faker": "Required to generate fake data using the fake() helper (^1.23).", "filp/whoops": "Required for friendly error pages in development (^2.14.3).", - "intervention/image": "Required to use the image processing features (^4.0).", + "intervention/image": "Required to use the image processing features (^4.2).", "laravel/tinker": "Required to use the tinker console command (^2.0).", "league/flysystem-aws-s3-v3": "Required to use the Flysystem S3 driver (^3.25.1).", "league/flysystem-ftp": "Required to use the Flysystem FTP driver (^3.25.1).", @@ -1582,20 +1583,20 @@ "issues": "https://github.com/laravel/framework/issues", "source": "https://github.com/laravel/framework" }, - "time": "2026-09-29T12:46:21+00:00" + "time": "2026-11-10T15:44:39+00:00" }, { "name": "laravel/prompts", - "version": "v0.3.21", + "version": "v0.3.27", "source": { "type": "git", "url": "https://github.com/laravel/prompts.git", - "reference": "7753c65c281c2550c7c183f14e18062073b7d821" + "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/laravel/prompts/zipball/7753c65c281c2550c7c183f14e18062073b7d821", - "reference": "7753c65c281c2550c7c183f14e18062073b7d821", + "url": "https://api.github.com/repos/laravel/prompts/zipball/abdfc75a1ae6c6f21522daed50da7124cbff09d2", + "reference": "abdfc75a1ae6c6f21522daed50da7124cbff09d2", "shasum": "" }, "require": { @@ -1638,10 +1639,9 @@ ], "description": "Add beautiful and user-friendly forms to your command-line applications.", "support": { - "issues": "https://github.com/laravel/prompts/issues", - "source": "https://github.com/laravel/prompts/tree/v0.3.21" + "source": "https://github.com/laravel/prompts/tree/v0.3.27" }, - "time": "2026-06-26T00:11:25+00:00" + "time": "2026-11-09T16:07:10+00:00" }, { "name": "laravel/serializable-closure", @@ -4432,8 +4432,7 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00", - "published-time": "2026-11-04T11:28:00+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "symfony/finder", @@ -4583,8 +4582,7 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00", - "published-time": "2026-11-04T11:28:53+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "symfony/http-kernel", @@ -4703,8 +4701,7 @@ "type": "tidelift" } ], - "time": "2026-11-04T11:26:18+00:00", - "published-time": "2026-11-04T11:27:47+00:00" + "time": "2026-11-04T11:26:18+00:00" }, { "name": "symfony/mailer", @@ -5936,8 +5933,7 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00", - "published-time": "2026-11-04T11:28:04+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "symfony/service-contracts", @@ -6538,8 +6534,7 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00", - "published-time": "2026-11-04T11:28:41+00:00" + "time": "2026-11-04T08:27:22+00:00" }, { "name": "tijsverkoyen/css-to-inline-styles", @@ -6601,12 +6596,12 @@ "version": "v5.6.4", "source": { "type": "git", - "url": "https://github.com/vlucas/phpdotenv.git", + "url": "https://github.com/phpdotenv/phpdotenv.git", "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/416df702837983f8d5ff48c9c3fee4f5f57b980b", + "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/416df702837983f8d5ff48c9c3fee4f5f57b980b", "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b", "shasum": "" }, diff --git a/docs/security/retired-php-server-2026-11-13.md b/docs/security/retired-php-server-2026-11-13.md new file mode 100644 index 000000000..d1509f8a7 --- /dev/null +++ b/docs/security/retired-php-server-2026-11-13.md @@ -0,0 +1,59 @@ +# Retired PHP Server security notice, 13 November 2026 + +PHP Server 2.11.8 is retired and unpatched for the Laravel advisories below. +Its published image contains Laravel framework 13.34.0. No new PHP Server +release is planned. Existing PHP version tags and comparison images remain +unchanged. Updating a source checkout's Composer dependencies does not patch +an installed image. + +The supported native Server uses a Rust runtime and is outside this Laravel +dependency finding. Use the [native deployment guidance](../server-reference.md) +and a qualified [published native release](https://github.com/durable-workflow/server/releases/latest) +for new installations. + +## Affected dependency and conditions + +The upstream fixes covering these advisories are Laravel 12.72.0 and 13.41.0 +or later in their respective release lines: + +| Advisory | Reviewed PHP Server exposure | +| --- | --- | +| [Task-output injection, GHSA-63hm-g96r-2m2q](https://github.com/laravel/framework/security/advisories/GHSA-63hm-g96r-2m2q) | The dependency is affected. No shipped application call to Laravel `Concurrency::run()` was found. The advisory requires that call path and a task that writes attacker-controlled output. | +| [Numeric-parameter signed-URL injection, GHSA-6rv8-qj5v-p8ch](https://github.com/laravel/framework/security/advisories/GHSA-6rv8-qj5v-p8ch) | The dependency is affected. No shipped signed-URL generation path was found. The advisory requires application code to pass attacker-influenced numeric parameters into signed-URL generation. | +| [Temporary signed-URL expiration bypass, GHSA-v5ch-g375-82r6](https://github.com/laravel/framework/security/advisories/GHSA-v5ch-g375-82r6) | The dependency is affected and the framework's signed storage routes are present. Exposure is conditional on obtaining or issuing a valid temporary signed URL and the advisory's request-parsing conditions. | + +The frozen configuration enables local-disk serving. Laravel therefore +registers signed `GET /storage/{path}` and `PUT /storage/{path}` routes even +though the shipped application does not issue their temporary signed URLs. +Operator extensions that issued those links use the affected verification +path. This assessment does not demonstrate an exploitable default Server +journey. Review custom routes and extensions separately. + +## Operator action + +Stop exposing the retired PHP service and plan migration to the supported +native runtime. Until the PHP service is retired: + +1. Block all `/storage/*` requests at ingress, including both GET and PUT. + Verify the rule on the actual HTTP endpoint. These framework routes are + separate from the authenticated `/api/external-payloads/v1` transport. +2. Stop issuing and reusing local-disk temporary download or upload URLs. + Review extensions that generate signed routes or call Laravel Concurrency. +3. Preserve a restorable backup of the database and external-payload storage. + Keep every PHP role stopped during any migration that writes the database. + +Blocking these routes reduces the identified storage-route exposure. It does +not install the upstream fixes or establish that custom extensions are safe. + +An existing PHP database must not be opened by native startup as an assumed +conversion. The [backup-first takeover runbook](../rust-server-upgrade-takeover.md) +states the exact layouts, refused state, backend/version limits and historical +published-image evidence. Rehearse only the applicable procedure on a restored +copy and preserve the original backup. That runbook's published takeover +evidence is not a new qualification of PHP-to-native conversion by the latest +native release. Subsequent native schema upgrades have their own +[stop, backup, explicit upgrade and restore requirements](../server-reference.md). + +See [Server #1214](https://github.com/durable-workflow/server/issues/1214) for +the exact published-artifact inventory, independent exposure assessment and +retirement decision. The PHP publisher remains disabled. From 2c808ecf90c6684aa16468191dad8a05333a83da Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 19:57:49 +0000 Subject: [PATCH 2/2] Preserve unchanged package metadata in the focused lock update --- composer.lock | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/composer.lock b/composer.lock index e960acdcc..ad23c5b69 100644 --- a/composer.lock +++ b/composer.lock @@ -4432,7 +4432,8 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00" + "time": "2026-11-04T08:27:22+00:00", + "published-time": "2026-11-04T11:28:00+00:00" }, { "name": "symfony/finder", @@ -4582,7 +4583,8 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00" + "time": "2026-11-04T08:27:22+00:00", + "published-time": "2026-11-04T11:28:53+00:00" }, { "name": "symfony/http-kernel", @@ -4701,7 +4703,8 @@ "type": "tidelift" } ], - "time": "2026-11-04T11:26:18+00:00" + "time": "2026-11-04T11:26:18+00:00", + "published-time": "2026-11-04T11:27:47+00:00" }, { "name": "symfony/mailer", @@ -5933,7 +5936,8 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00" + "time": "2026-11-04T08:27:22+00:00", + "published-time": "2026-11-04T11:28:04+00:00" }, { "name": "symfony/service-contracts", @@ -6534,7 +6538,8 @@ "type": "tidelift" } ], - "time": "2026-11-04T08:27:22+00:00" + "time": "2026-11-04T08:27:22+00:00", + "published-time": "2026-11-04T11:28:41+00:00" }, { "name": "tijsverkoyen/css-to-inline-styles", @@ -6596,12 +6601,12 @@ "version": "v5.6.4", "source": { "type": "git", - "url": "https://github.com/phpdotenv/phpdotenv.git", + "url": "https://github.com/vlucas/phpdotenv.git", "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/phpdotenv/phpdotenv/zipball/416df702837983f8d5ff48c9c3fee4f5f57b980b", + "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/416df702837983f8d5ff48c9c3fee4f5f57b980b", "reference": "416df702837983f8d5ff48c9c3fee4f5f57b980b", "shasum": "" },