From cbd6df655594821bef3cad165108b09fdeed1660 Mon Sep 17 00:00:00 2001 From: "ondrej@mirtes.cz" Date: Sun, 1 Nov 2026 15:27:21 +0000 Subject: [PATCH] Do not block mongodb/mongodb versions that support PHP < 8.1 Composer 2.9 blocks package versions with security advisories when resolving dependencies. CVE-2026-81525 and CVE-2026-88023 affect every mongodb/mongodb release that supports PHP < 8.1 (up to 1.20.0), so doctrine/mongodb-odm cannot be installed on PHP 7.4 and 8.0 and composer install/update fails there. mongodb/mongodb is only a dev dependency used by the test suite, so ignore the two advisories for blocking only; composer audit still reports them. Amp-Thread-ID: https://ampcode.com/threads/T-01a197ab-5c2e-71e3-9f7a-7dfb82a80328 --- composer.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/composer.json b/composer.json index 1affb520..667f1811 100644 --- a/composer.json +++ b/composer.json @@ -45,6 +45,18 @@ "sort-packages": true, "allow-plugins": { "cweagans/composer-patches": true + }, + "audit": { + "ignore": { + "CVE-2026-81525": { + "apply": "block", + "reason": "mongodb/mongodb is a dev dependency for tests; all versions that support PHP < 8.1 are affected" + }, + "CVE-2026-88023": { + "apply": "block", + "reason": "mongodb/mongodb is a dev dependency for tests; all versions that support PHP < 8.1 are affected" + } + } } }, "extra": {