Repository navigation
Do not block mongodb/mongodb versions that support PHP < 8.1 - #810
Merged
Merged
Conversation
Composer 2.9 blocks package versions with security advisories when resolving dependencies. CVE-2026-81525 and CVE-2026-88023 affect every mongodb/mongodb release that supports PHP < 8.1 (up to 1.20.0), so doctrine/mongodb-odm cannot be installed on PHP 7.4 and 8.0 and composer install/update fails there. mongodb/mongodb is only a dev dependency used by the test suite, so ignore the two advisories for blocking only; composer audit still reports them. Amp-Thread-ID: https://ampcode.com/threads/T-01a197ab-5c2e-71e3-9f7a-7dfb82a80328
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Composer 2.9 blocks package versions with security advisories during
composer install/update. CVE-2026-81525 and CVE-2026-88023 cover everymongodb/mongodbrelease up to 1.21.4. The fixed releases (1.21.5+) require PHP ^8.1, sodoctrine/mongodb-odmcan't be installed on PHP 7.4 and 8.0:This breaks every PHP 7.4 and 8.0 job here and the phpstan-doctrine extension tests in phpstan-src (e.g. https://github.com/phpstan/phpstan-src/actions/runs/41318224514/job/124885326539).
mongodb/mongodbis only a dev dependency for the test suite. This change ignores the two advisories for blocking only (apply: block), socomposer auditstill reports them. With a simulated PHP 7.4 and 8.0 platform, Composer now resolvesmongodb/mongodbagain for both highest and lowest dependencies.The PHP 8.1+
make phpstanfailure in phpstan-src (NameNode::$name) is a separate problem caused by phpdoc-parser 2.4. #808 fixes it.