Fix dependency CVEs and provide shared PR base #173

Merged

Twyco merged 3 commits from fix/dependency-cves into main 2026-09-30 10:07:54 +00:00

Conversation 0 Commits 3 Files Changed 4

+50 -101

Twyco commented 2026-09-30 09:19:48 +00:00

Owner

Copy Link

Copy Source

Security audits reported denial-of-service vulnerabilities in all three locked brace-expansion versions, debug-page XSS in Laravel, and a malformed UTF-8 path validation bypass in Flysystem. Update only the affected packages: brace-expansion to 1.1.21 / 2.1.7 / 5.0.12, Laravel to 13.34.0, and Flysystem to 3.36.0. Keep the seven-day package release delay with exceptions scoped to the three reviewed security patch versions.

Add a regression test for malformed/control-character paths, preserving valid Unicode paths. Allow application CI for PRs targeting this security branch so #171 and #172 can be rebased and reviewed against it.

Validation: pnpm and Composer audits report no vulnerabilities; frozen-lockfile install, Composer validation, ESLint, TypeScript, production build, Pint, and 87 PHPUnit tests (759 assertions) pass. The regression test reproduces two failures with the previous Flysystem version and passes after updating. Existing missing Inter font build warnings remain.

Security advisories: brace expansion CPU DoS, nested group stack exhaustion, comma parser stack exhaustion, Laravel CVE-2026-102279, Flysystem CVE-2026-102601.

Security audits reported denial-of-service vulnerabilities in all three locked brace-expansion versions, debug-page XSS in Laravel, and a malformed UTF-8 path validation bypass in Flysystem. Update only the affected packages: brace-expansion to 1.1.21 / 2.1.7 / 5.0.12, Laravel to 13.34.0, and Flysystem to 3.36.0. Keep the seven-day package release delay with exceptions scoped to the three reviewed security patch versions. Add a regression test for malformed/control-character paths, preserving valid Unicode paths. Allow application CI for PRs targeting this security branch so #171 and #172 can be rebased and reviewed against it. Validation: pnpm and Composer audits report no vulnerabilities; frozen-lockfile install, Composer validation, ESLint, TypeScript, production build, Pint, and 87 PHPUnit tests (759 assertions) pass. The regression test reproduces two failures with the previous Flysystem version and passes after updating. Existing missing Inter font build warnings remain. Security advisories: [brace expansion CPU DoS](https://github.com/advisories/GHSA-q2hr-2g5m-vwhr), [nested group stack exhaustion](https://github.com/advisories/GHSA-qhr7-859c-m2p7), [comma parser stack exhaustion](https://github.com/advisories/GHSA-6j4f-fj2g-mc7p), [Laravel CVE-2026-102279](https://github.com/advisories/GHSA-jh5r-qr3c-85q8), [Flysystem CVE-2026-102601](https://github.com/advisories/GHSA-cxf4-7mrp-vvpr).

Twyco added 1 commit 2026-09-30 09:19:49 +00:00

fix: patch vulnerable framework and build dependencies ce36060ba1

Twyco referenced this pull request 2026-09-30 09:22:13 +00:00

KAN-64: Allow project admins to delete projects #171

Twyco referenced this pull request 2026-09-30 09:22:13 +00:00

KAN-68: Add WYSIWYG ticket description editor #172

Twyco added 1 commit 2026-09-30 09:53:47 +00:00

fix 1a022c257f

Twyco added 1 commit 2026-09-30 09:57:22 +00:00

fix 3b110f08ae

Twyco merged commit 10f88f6029 into main 2026-09-30 10:07:54 +00:00

Twyco deleted branch fix/dependency-cves 2026-09-30 10:07:54 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Eric Twyco flux-image-automation (Flux Image Automation)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: PetschStudios/KanbanGit#173