From 7f54914db7f05c8592071f35a584b6b25a560d31 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Wed, 7 Oct 2026 10:07:34 +0200 Subject: [PATCH 1/4] fix: update packages with security advisories and audit lock file --- .github/workflows/composer.yaml | 2 +- composer.lock | 119 +++++++++++++++++--------------- 2 files changed, 63 insertions(+), 58 deletions(-) diff --git a/.github/workflows/composer.yaml b/.github/workflows/composer.yaml index a0e5a94..3b43b64 100644 --- a/.github/workflows/composer.yaml +++ b/.github/workflows/composer.yaml @@ -77,4 +77,4 @@ jobs: docker network create frontend - run: | - docker compose run --rm phpfpm composer audit + docker compose run --rm phpfpm composer audit --locked diff --git a/composer.lock b/composer.lock index c162754..51fd225 100644 --- a/composer.lock +++ b/composer.lock @@ -8,16 +8,16 @@ "packages": [ { "name": "api-platform/core", - "version": "v4.1.28", + "version": "v4.1.30", "source": { "type": "git", "url": "https://github.com/api-platform/core.git", - "reference": "654f8e626ed1e3e0c084bf3a695fba551308ac95" + "reference": "0720d3bbace33e74111c44d566ad77fec5b963c9" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/api-platform/core/zipball/654f8e626ed1e3e0c084bf3a695fba551308ac95", - "reference": "654f8e626ed1e3e0c084bf3a695fba551308ac95", + "url": "https://api.github.com/repos/api-platform/core/zipball/0720d3bbace33e74111c44d566ad77fec5b963c9", + "reference": "0720d3bbace33e74111c44d566ad77fec5b963c9", "shasum": "" }, "require": { @@ -218,9 +218,9 @@ ], "support": { "issues": "https://github.com/api-platform/core/issues", - "source": "https://github.com/api-platform/core/tree/v4.1.28" + "source": "https://github.com/api-platform/core/tree/v4.1.30" }, - "time": "2025-12-05T14:51:01+00:00" + "time": "2026-06-13T05:00:33+00:00" }, { "name": "doctrine/deprecations", @@ -477,25 +477,26 @@ }, { "name": "guzzlehttp/guzzle", - "version": "7.10.3", + "version": "7.15.5", "source": { "type": "git", "url": "https://github.com/guzzle/guzzle.git", - "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86" + "reference": "ee80339fd9177ba44c49cdb653ff02a4d1106b9a" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/guzzle/zipball/47ba23c7a55247e2e1b7407aca90e9bbed0d9d86", - "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86", + "url": "https://api.github.com/repos/guzzle/guzzle/zipball/ee80339fd9177ba44c49cdb653ff02a4d1106b9a", + "reference": "ee80339fd9177ba44c49cdb653ff02a4d1106b9a", "shasum": "" }, "require": { "ext-json": "*", - "guzzlehttp/promises": "^2.3", - "guzzlehttp/psr7": "^2.8", + "guzzlehttp/promises": "^2.5.3", + "guzzlehttp/psr7": "^2.13.1", "php": "^7.2.5 || ^8.0", "psr/http-client": "^1.0", - "symfony/deprecation-contracts": "^2.2 || ^3.0" + "symfony/deprecation-contracts": "^2.5 || ^3.0", + "symfony/polyfill-php80": "^1.25" }, "provide": { "psr/http-client-implementation": "1.0" @@ -503,8 +504,8 @@ "require-dev": { "bamarni/composer-bin-plugin": "^1.8.2", "ext-curl": "*", - "guzzle/client-integration-tests": "3.0.2", - "guzzlehttp/test-server": "^0.3.2", + "guzzle/client-integration-tests": "3.0.3", + "guzzlehttp/test-server": "^0.7", "php-http/message-factory": "^1.1", "phpunit/phpunit": "^8.5.52 || ^9.6.34", "psr/log": "^1.1 || ^2.0 || ^3.0" @@ -584,7 +585,7 @@ ], "support": { "issues": "https://github.com/guzzle/guzzle/issues", - "source": "https://github.com/guzzle/guzzle/tree/7.10.3" + "source": "https://github.com/guzzle/guzzle/tree/7.15.5" }, "funding": [ { @@ -600,24 +601,25 @@ "type": "tidelift" } ], - "time": "2026-05-20T22:59:19+00:00" + "time": "2026-08-24T09:21:06+00:00" }, { "name": "guzzlehttp/promises", - "version": "2.3.1", + "version": "2.5.3", "source": { "type": "git", "url": "https://github.com/guzzle/promises.git", - "reference": "d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e" + "reference": "cde49999552d185d64715fe9c1f77a2aadd2f9f1" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/promises/zipball/d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e", - "reference": "d2d8dfae4757f384d630fdffc2d8d6618d8f4c5e", + "url": "https://api.github.com/repos/guzzle/promises/zipball/cde49999552d185d64715fe9c1f77a2aadd2f9f1", + "reference": "cde49999552d185d64715fe9c1f77a2aadd2f9f1", "shasum": "" }, "require": { - "php": "^7.2.5 || ^8.0" + "php": "^7.2.5 || ^8.0", + "symfony/deprecation-contracts": "^2.5 || ^3.0" }, "require-dev": { "bamarni/composer-bin-plugin": "^1.8.2", @@ -667,7 +669,7 @@ ], "support": { "issues": "https://github.com/guzzle/promises/issues", - "source": "https://github.com/guzzle/promises/tree/2.3.1" + "source": "https://github.com/guzzle/promises/tree/2.5.3" }, "funding": [ { @@ -683,27 +685,29 @@ "type": "tidelift" } ], - "time": "2026-05-19T18:30:48+00:00" + "time": "2026-08-24T09:11:28+00:00" }, { "name": "guzzlehttp/psr7", - "version": "2.8.1", + "version": "2.13.1", "source": { "type": "git", "url": "https://github.com/guzzle/psr7.git", - "reference": "718f1ee6a878be5290af3557aeda0c91278361d9" + "reference": "95e7828100de18b4e269fb1703be530082d5166d" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/psr7/zipball/718f1ee6a878be5290af3557aeda0c91278361d9", - "reference": "718f1ee6a878be5290af3557aeda0c91278361d9", + "url": "https://api.github.com/repos/guzzle/psr7/zipball/95e7828100de18b4e269fb1703be530082d5166d", + "reference": "95e7828100de18b4e269fb1703be530082d5166d", "shasum": "" }, "require": { "php": "^7.2.5 || ^8.0", "psr/http-factory": "^1.0", "psr/http-message": "^1.1 || ^2.0", - "ralouphie/getallheaders": "^3.0" + "ralouphie/getallheaders": "^3.0", + "symfony/deprecation-contracts": "^2.5 || ^3.0", + "symfony/polyfill-php80": "^1.25" }, "provide": { "psr/http-factory-implementation": "1.0", @@ -711,8 +715,9 @@ }, "require-dev": { "bamarni/composer-bin-plugin": "^1.8.2", - "http-interop/http-factory-tests": "0.9.0", - "phpunit/phpunit": "^8.5.44 || ^9.6.25" + "http-interop/http-factory-tests": "1.1.0", + "jshttp/mime-db": "1.54.0.1", + "phpunit/phpunit": "^8.5.52 || ^9.6.34" }, "suggest": { "laminas/laminas-httphandlerrunner": "Emit PSR-7 responses" @@ -783,7 +788,7 @@ ], "support": { "issues": "https://github.com/guzzle/psr7/issues", - "source": "https://github.com/guzzle/psr7/tree/2.8.1" + "source": "https://github.com/guzzle/psr7/tree/2.13.1" }, "funding": [ { @@ -799,7 +804,7 @@ "type": "tidelift" } ], - "time": "2026-03-10T09:55:26+00:00" + "time": "2026-08-24T09:13:11+00:00" }, { "name": "nelmio/cors-bundle", @@ -3529,16 +3534,16 @@ }, { "name": "symfony/http-foundation", - "version": "v7.4.8", + "version": "v7.4.20", "source": { "type": "git", "url": "https://github.com/symfony/http-foundation.git", - "reference": "9381209597ec66c25be154cbf2289076e64d1eab" + "reference": "9d0761c0da6bd5b801b401666834901a9a1ffc33" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/http-foundation/zipball/9381209597ec66c25be154cbf2289076e64d1eab", - "reference": "9381209597ec66c25be154cbf2289076e64d1eab", + "url": "https://api.github.com/repos/symfony/http-foundation/zipball/9d0761c0da6bd5b801b401666834901a9a1ffc33", + "reference": "9d0761c0da6bd5b801b401666834901a9a1ffc33", "shasum": "" }, "require": { @@ -3587,7 +3592,7 @@ "description": "Defines an object-oriented layer for the HTTP specification", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/http-foundation/tree/v7.4.8" + "source": "https://github.com/symfony/http-foundation/tree/v7.4.20" }, "funding": [ { @@ -3607,7 +3612,7 @@ "type": "tidelift" } ], - "time": "2026-03-24T13:12:05+00:00" + "time": "2026-09-24T07:12:44+00:00" }, { "name": "symfony/http-kernel", @@ -4549,16 +4554,16 @@ }, { "name": "symfony/routing", - "version": "v7.4.12", + "version": "v7.4.20", "source": { "type": "git", "url": "https://github.com/symfony/routing.git", - "reference": "3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204" + "reference": "2bacb72be5eadeaf9874d5accb75bfb33d21c74b" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/routing/zipball/3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204", - "reference": "3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204", + "url": "https://api.github.com/repos/symfony/routing/zipball/2bacb72be5eadeaf9874d5accb75bfb33d21c74b", + "reference": "2bacb72be5eadeaf9874d5accb75bfb33d21c74b", "shasum": "" }, "require": { @@ -4610,7 +4615,7 @@ "url" ], "support": { - "source": "https://github.com/symfony/routing/tree/v7.4.12" + "source": "https://github.com/symfony/routing/tree/v7.4.20" }, "funding": [ { @@ -4630,7 +4635,7 @@ "type": "tidelift" } ], - "time": "2026-05-20T07:20:23+00:00" + "time": "2026-09-28T19:09:50+00:00" }, { "name": "symfony/runtime", @@ -4995,16 +5000,16 @@ }, { "name": "symfony/security-http", - "version": "v7.4.12", + "version": "v7.4.20", "source": { "type": "git", "url": "https://github.com/symfony/security-http.git", - "reference": "1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee" + "reference": "5fa566b8bfbb398cded6988f059c3d97506ed692" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/security-http/zipball/1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee", - "reference": "1fc7ca636cbd2cad29b42cc13c9fd0c681c6efee", + "url": "https://api.github.com/repos/symfony/security-http/zipball/5fa566b8bfbb398cded6988f059c3d97506ed692", + "reference": "5fa566b8bfbb398cded6988f059c3d97506ed692", "shasum": "" }, "require": { @@ -5063,7 +5068,7 @@ "description": "Symfony Security Component - HTTP Integration", "homepage": "https://symfony.com", "support": { - "source": "https://github.com/symfony/security-http/tree/v7.4.12" + "source": "https://github.com/symfony/security-http/tree/v7.4.20" }, "funding": [ { @@ -5083,7 +5088,7 @@ "type": "tidelift" } ], - "time": "2026-05-20T07:20:23+00:00" + "time": "2026-09-28T18:33:58+00:00" }, { "name": "symfony/serializer", @@ -6174,16 +6179,16 @@ }, { "name": "twig/twig", - "version": "v3.26.0", + "version": "v3.30.0", "source": { "type": "git", "url": "https://github.com/twigphp/Twig.git", - "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc" + "reference": "8c737079b726af72ff8ef3c595be9f6a810ea1ef" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/twigphp/Twig/zipball/1fcae487b180d78e6351f4e0afa91f9eab96a2bc", - "reference": "1fcae487b180d78e6351f4e0afa91f9eab96a2bc", + "url": "https://api.github.com/repos/twigphp/Twig/zipball/8c737079b726af72ff8ef3c595be9f6a810ea1ef", + "reference": "8c737079b726af72ff8ef3c595be9f6a810ea1ef", "shasum": "" }, "require": { @@ -6238,7 +6243,7 @@ ], "support": { "issues": "https://github.com/twigphp/Twig/issues", - "source": "https://github.com/twigphp/Twig/tree/v3.26.0" + "source": "https://github.com/twigphp/Twig/tree/v3.30.0" }, "funding": [ { @@ -6250,7 +6255,7 @@ "type": "tidelift" } ], - "time": "2026-05-20T07:31:59+00:00" + "time": "2026-09-25T13:20:01+00:00" }, { "name": "webmozart/assert", From 2231bc3f64f603b110461033622abf322c067478 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Wed, 7 Oct 2026 10:07:55 +0200 Subject: [PATCH 2/4] docs: update changelog --- CHANGELOG.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 92e3ab8..1f98265 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,9 @@ See [keep a changelog] for information about writing changes to this log. ## [Unreleased] +- [PR-64](https://github.com/itk-dev/event-database-api/pull/64) + Update packages with security advisories, audit lock file in CI + ## [1.2.2] - 2026-05-22 - [PR-26](https://github.com/itk-dev/event-database-api/pull/26) From d04bbcd3bb875a7756b2d6cae9b9634ce3430dbc Mon Sep 17 00:00:00 2001 From: turegjorup Date: Wed, 7 Oct 2026 10:22:11 +0200 Subject: [PATCH 3/4] docs: update changelog footer links --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e725dea..1b247d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -92,7 +92,10 @@ See [keep a changelog] for information about writing changes to this log. - Added multi-value filtering for Lactions and Organizations [keep a changelog]: https://keepachangelog.com/en/1.1.0/ -[Unreleased]: https://github.com/itk-dev/event-database-api/compare/1.2.0...HEAD +[Unreleased]: https://github.com/itk-dev/event-database-api/compare/1.2.3...HEAD +[1.2.3]: https://github.com/itk-dev/event-database-api/compare/1.2.2...1.2.3 +[1.2.2]: https://github.com/itk-dev/event-database-api/compare/1.2.1...1.2.2 +[1.2.1]: https://github.com/itk-dev/event-database-api/compare/1.2.0...1.2.1 [1.2.0]: https://github.com/itk-dev/event-database-api/compare/1.1.0...1.2.0 [1.1.0]: https://github.com/itk-dev/event-database-api/releases/tag/1.1.0 [1.0.1]: https://github.com/itk-dev/event-database-api/releases/tag/1.0.1 From 2a9d372d05fdcef9920afa535a7698fe2c8773d4 Mon Sep 17 00:00:00 2001 From: turegjorup Date: Wed, 7 Oct 2026 10:26:35 +0200 Subject: [PATCH 4/4] docs: changelog for 1.2.4 --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1b247d8..c3d19e2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ See [keep a changelog] for information about writing changes to this log. ## [Unreleased] +## [1.2.4] - 2026-10-07 + - [PR-64](https://github.com/itk-dev/event-database-api/pull/64) Update packages with security advisories, audit lock file in CI @@ -92,7 +94,8 @@ See [keep a changelog] for information about writing changes to this log. - Added multi-value filtering for Lactions and Organizations [keep a changelog]: https://keepachangelog.com/en/1.1.0/ -[Unreleased]: https://github.com/itk-dev/event-database-api/compare/1.2.3...HEAD +[Unreleased]: https://github.com/itk-dev/event-database-api/compare/1.2.4...HEAD +[1.2.4]: https://github.com/itk-dev/event-database-api/compare/1.2.3...1.2.4 [1.2.3]: https://github.com/itk-dev/event-database-api/compare/1.2.2...1.2.3 [1.2.2]: https://github.com/itk-dev/event-database-api/compare/1.2.1...1.2.2 [1.2.1]: https://github.com/itk-dev/event-database-api/compare/1.2.0...1.2.1