Bump dependencies to resolve open Dependabot alerts - #62
Conversation
Updates guzzlehttp/guzzle, guzzlehttp/psr7, laravel/framework, league/commonmark, phpoffice/phpspreadsheet, phpseclib/phpseclib, dompdf/dompdf, symfony/http-kernel, symfony/mime, symfony/routing, symfony/http-foundation, symfony/mailer, symfony/polyfill-intl-idn, and npm qs — all within existing composer.json/package.json version constraints. Clears 33 composer + 1 npm open Dependabot alerts, including the critical phpspreadsheet RCE (CVE-2026-45034).
|
What's the purpose of adding As for the specific mention of the PhpSpreadsheet vulnerability, it doesn't really apply to Tracker (to my knowledge) since it's only used to generate files and not parse them. This is actually the case (not applying to Tracker) for nearly all of the security alerts this repo sees - not that that means we shouldn't update them, of course. |
@inertiajs/core already requires qs at ^6.15.0, so npm resolves the patched version.
|
While going through the Dependabot alerts, Re-running my updates without New commit removes the direct entry and re-runs On PhpSpreadsheet, The vulnerability doesn't really apply as Tracker only generates files, not parses them but it's good to still update this and other things to clear the alerts. |
2 participants
Bumps composer/npm deps within existing version constraints (no composer.json/package.json range changes except adding
qsas a direct dep since it was previously only transitive).Clears 33 open composer Dependabot alerts + 1 npm alert.
Includes critical phpspreadsheet RCE fix (CVE-2026-45034).
Manual test of phpspreadsheet export / dompdf PDF generation / guzzle-based integrations recommended before merge