Skip to content

Commit

Permalink
[TASK] Replace former extension packages using self.version
Browse files Browse the repository at this point in the history
The so called "death star" range for replacements has to be
used with caution [1] as it replaces all versions of the
replaced packages, including old or insecure versions.

That effectively means the replacing package marks itself as matching
in queries for insecure versions, once a security advisory[2]
is submitted for the replaced packages.

The extension replacements are now adapted to use the more precise
self.version qualifier to avoid matching named security advisories as
suggested by:
Roave/SecurityAdvisories#127 (comment)

[1] https://getcomposer.org/doc/04-schema.md#replace
[2] GHSA-cgr9-h9qq-x9fx

Resolves: #103082
Releases: main, 13.0, 12.4, 11.5
Change-Id: I6353df15d6cbf039bab60644a103669495b26605
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82873
Tested-by: core-ci <[email protected]>
Tested-by: Benjamin Franzke <[email protected]>
Reviewed-by: Benjamin Franzke <[email protected]>
  • Loading branch information
thomashohn authored and bnf committed Feb 9, 2024
1 parent 58acb47 commit 92bd754
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions composer.json
Original file line number Diff line number Diff line change
Expand Up @@ -92,9 +92,9 @@
"typo3/cms": "*"
},
"replace": {
"typo3/cms-lang": "*",
"typo3/cms-saltedpasswords": "*",
"typo3/cms-sv": "*"
"typo3/cms-lang": "self.version",
"typo3/cms-saltedpasswords": "self.version",
"typo3/cms-sv": "self.version"
},
"provide": {
"psr/http-factory-implementation": "1.0",
Expand Down

0 comments on commit 92bd754

Please sign in to comment.