Update PHP and firebase/php-jwt version requirements#229
Update PHP and firebase/php-jwt version requirements#229rfeiner merged 4 commits intomessagebird:masterfrom
Conversation
Only allow firebase/php-jwt to resolve GHSA-2x45-7fc3-mxwq. Also drop duplicate version constraints for PHP (>=7.2 is also valid for any PHP 8 or later versions).
|
PHP JWT uses ^8.0 fir PHP dep so composer.json of this package might/should drop PHP7 too. |
Hmm, did not want to make that decision for this PR, but it does make sense indeed. |
Also, support for PHP 7 has been discontinued since 03 Nov 2022.
bobvandevijver
changed the title
|
Is there any way we can expedite the release of a new version with this PR? I am not using Github often (only for private projects) so I don't know how to approve the waiting approval or is this something that can only be done by maintainers (if so, can we tag them?) |
|
It's in the message:
I prefer to not tag maintainers so soon after PR creation. |
|
But this security advisory is having big implications: people cannot install their packages because of it. |
|
So if @rfeiner could follow this up, that would be great. |
|
I submitted a support ticket to Bird linking to the issue and this PR. |
|
@rfeiner @ErikBooijMB Could you guys take a look? This is a security concern. |
- Replace Docker-based Psalm action (bundles PHP 7.4) with setup-php - Drop PHP 7.4 from test matrix - Set phpVersion in psalm.xml for PHP 8.0+ analysis Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
6 participants
Only allow firebase/php-jwt to resolve GHSA-2x45-7fc3-mxwq. Also bumps PHP to >= 8.0 (Support for PHP 7 has been discontinued since 03 Nov 2022).
Resolves #227, #228.