composer update fails on my Flarum 1.8 install because flarum/core 1.8.x requires league/flysystem ^1.0.11, and all 1.x versions are affected by advisories PKSA-w9tt-7782-78jx and PKSA-pwh8-d4fr-nywn. Composer blocks them by default, so no flarum/core version can be installed. composer update -W --prefer-dist --no-dev -a if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Error (trimmed) flarum/core[v1.8.16, ..., v1.8.20] require league/flysystem ^1.0.11 -> found league/flysystem[1.0.11, ..., 1.1.10] but these were not loaded, because they are affected by security advisories if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Questions Is ignoring these advisories the recommended approach for 1.8.x? Do they actually affect Flarum's use of Flysystem? Is a core patch planned? Thanks!

DLBB In composer.json, add the following ignore line "config": { "allow-plugins": { "php-http/discovery": true }, "audit": { "ignore": { "GHSA-cxf4-7mrp-vvpr": "league/flysystem 1.x (required by flarum/core 1.x) has no patched release; low severity control-character check bypass, path traversal unaffected." } } } if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } Credits to @IanM DLBB Is ignoring these advisories the recommended approach for 1.8.x? Yes.

Composer update blocked by league/flysystem 1.x security advisories

DLBB

composer update fails on my Flarum 1.8 install because flarum/core 1.8.x requires league/flysystem ^1.0.11, and all 1.x versions are affected by advisories PKSA-w9tt-7782-78jx and PKSA-pwh8-d4fr-nywn. Composer blocks them by default, so no flarum/core version can be installed.

composer update -W --prefer-dist --no-dev -a

Error (trimmed)

flarum/core[v1.8.16, ..., v1.8.20] require league/flysystem ^1.0.11 -> found league/flysystem[1.0.11, ..., 1.1.10]
but these were not loaded, because they are affected by security advisories

Questions

Is ignoring these advisories the recommended approach for 1.8.x?
Do they actually affect Flarum's use of Flysystem?
Is a core patch planned?

Thanks!

Karl

DLBB

In composer.json, add the following ignore line

"config": {
        "allow-plugins": {
            "php-http/discovery": true
        },
        "audit": {
            "ignore": {
                "GHSA-cxf4-7mrp-vvpr": "league/flysystem 1.x (required by flarum/core 1.x) has no patched release; low severity control-character check bypass, path traversal unaffected."
            }
        }
    }

Credits to @IanM

DLBB Is ignoring these advisories the recommended approach for 1.8.x?

Yes.

DLBB

Karl @IanM Thank you both.