Recent Composer versions (2.8+) block resolving to package versions with known CVEs by default. Just disable the check temporarily, update, then re-enable it:
Since you're already on a vulnerable version before the upgrade, there's no real added risk in passing through it on the way to a patched release, just don't forget to re-enable the check afterward and run symfony composer audit to confirm you're clean. Hope this saves someone some time!
2 Comments
Recent Composer versions (2.8+) block resolving to package versions with known CVEs by default. Just disable the check temporarily, update, then re-enable it:
Since you're already on a vulnerable version before the upgrade, there's no real added risk in passing through it on the way to a patched release, just don't forget to re-enable the check afterward and run
symfony composer auditto confirm you're clean. Hope this saves someone some time!Thanks for the tip @gaelv!
Yeah, since Symfony 7.3 is EOL, there isn't a version without security vulnerabilities.
--Kevin
"Houston: no signs of life"
Start the conversation!