Update dependency symfony/http-foundation to v5.4.46 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
symfony/http-foundation (source)	5.4.22 -> 5.4.46

GitHub Vulnerability Alerts

CVE-2024-50345

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

---

Release Notes

symfony/http-foundation (symfony/http-foundation)

v5.4.46

Compare Source

Changelog (symfony/http-foundation@v5.4.45...v5.4.46)

• security symfony/symfony#cve-2024-50345 [HttpFoundation] Reject URIs that contain invalid characters (@​nicolas-grekas)

v5.4.45

Compare Source

Changelog (symfony/http-foundation@v5.4.44...v5.4.45)

• bug symfony/symfony#58619 [HttpFoundation][Lock] Ensure compatibility with ext-mongodb v2 (@​GromNaN)

v5.4.44

Compare Source

Changelog (symfony/http-foundation@v5.4.43...v5.4.44)

• bug symfony/symfony#58181 [HttpFoundation] Update links for X-Accel-Redirect and fail properly when X-Accel-Mapping is missing (@​nicolas-grekas)
• bug symfony/symfony#58218 Work around parse_url() bug (@​nicolas-grekas)

v5.4.42

Compare Source

Changelog (symfony/http-foundation@v5.4.41...v5.4.42)

• bug symfony/symfony#57585 [HttpFoundation] Fix MockArraySessionStorage to generate more conform ids (@​Seldaek)

v5.4.40

Compare Source

Changelog (symfony/http-foundation@v5.4.39...v5.4.40)

• bug symfony/symfony#54910 [HttpFoundation]  filter out empty HTTP header parts (@​xabbuh)
• bug symfony/symfony#54816 [Cache] Fix support for predis/predis:^2.0 (@​mfettig)

v5.4.39

Compare Source

Changelog (symfony/http-foundation@v5.4.38...v5.4.39)

• bug symfony/symfony#54506 [HttpFoundation] Set content-type header in RedirectResponse (@​smnandre)

v5.4.38

Compare Source

Changelog (symfony/http-foundation@v5.4.37...v5.4.38)

• no significant changes

v5.4.35

Compare Source

Changelog (symfony/http-foundation@v5.4.34...v5.4.35)

• bug symfony/symfony#53432 [HttpFoundation] Request without content-type or content-length header should result in null values, not empty strings (@​priyadi)

v5.4.34

Compare Source

Changelog (symfony/http-foundation@v5.4.33...v5.4.34)

• no significant changes

v5.4.32

Compare Source

Changelog (symfony/http-foundation@v5.4.31...v5.4.32)

• bug symfony/symfony#52459 [Cache][HttpFoundation][Lock] Fix PDO store not creating table + add tests (@​HypeMC)

v5.4.31

Compare Source

Changelog (symfony/http-foundation@v5.4.30...v5.4.31)

• bug symfony/symfony#52474 [HttpFoundation] ensure string type with mbstring func overloading enabled (@​xabbuh)
• bug symfony/symfony#52457 [Cache][HttpFoundation][Lock] Fix empty username/password for PDO PostgreSQL (@​HypeMC)
• bug symfony/symfony#52444 Remove full DSNs from exception messages (@​nicolas-grekas)

v5.4.30

Compare Source

Changelog (symfony/http-foundation@v5.4.29...v5.4.30)

• no significant changes

v5.4.28

Compare Source

Changelog (symfony/http-foundation@v5.4.27...v5.4.28)

• bug symfony/symfony#51424 [HttpFoundation] Fix base URI detection on IIS with UrlRewriteModule (@​derrabus)

v5.4.26

Compare Source

Changelog (symfony/http-foundation@v5.4.25...v5.4.26)

• bug symfony/symfony#51031 Fix deprecations on PHP 8.3 (@​nicolas-grekas)

v5.4.25

Compare Source

Changelog (symfony/http-foundation@v5.4.24...v5.4.25)

• bug symfony/symfony#50524 Fix Doctrine deprecations (@​nicolas-grekas)

v5.4.24

Compare Source

Changelog (symfony/http-foundation@v5.4.23...v5.4.24)

• bug symfony/symfony#50315 [Translation] Fix handling of null messages in ArrayLoader (@​rob006)
• bug symfony/symfony#50338 [Console] Remove exec and replace it by shell_exec (@​maxbeckers)
• bug symfony/symfony#50362 [FrameworkBundle] Fix Workflow without a marking store definition uses marking store definition of previously defined workflow (@​krciga22)
• bug symfony/symfony#50309 [HttpFoundation] UrlHelper is now aware of RequestContext changes (@​giosh94mhz)
• bug symfony/symfony#50309 [HttpFoundation] UrlHelper is now aware of RequestContext changes (@​giosh94mhz)
• bug symfony/symfony#49063 [Messenger] Respect isRetryable decision of the retry strategy for re-delivery (@​FlyingDR)
• bug symfony/symfony#50266 [HttpFoundation] Fix file streaming after connection aborted (@​rlshukhov)
• bug symfony/symfony#49557 [PropertyInfo] Fix phpDocExtractor nullable array value type (@​fabpot)

v5.4.23

Compare Source

Changelog (symfony/http-foundation@v5.4.22...v5.4.23)

• bug #​48972 Fix memory limit problems in BinaryFileResponse (glady)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update symfony/http-foundation:5.4.46 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Dependency symfony/deprecation-contracts is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - phpunit/phpunit is locked to version 9.6.19 and an update of this package was not requested.
    - doctrine/instantiator 2.0.0 requires php ^8.1 -> your php version (7.3; overridden via config.platform, same as actual) does not satisfy that requirement.
    - phpunit/phpunit 9.6.19 requires doctrine/instantiator ^1.3.1 || ^2 -> satisfiable by doctrine/instantiator[2.0.0].