One entryMerged PR· StuMason/shop-template· PHP
PR #13 merged: fix(security): patch guzzle, psr7 and phpseclib advisories
additions
+37
deletions
-37
files changed
1
Lockfile-only change — no code touched, no unrelated package bumps beyond what --with-all-dependencies required.
Fixes the composer audit failure that is currently red on main and blocking the dependabot queue:
- guzzlehttp/guzzle 7.11.1 → 7.14.0 — CVE-2026-55767 (dot-only cookie domains match all hosts), CVE-2026-55568 (silent HTTPS proxy downgrade to cleartext)
- guzzlehttp/psr7 2.11.0 → 2.12.4 — CVE-2026-55766 (CRLF injection in HTTP start-line serialization)
- phpseclib/phpseclib 3.0.53 → 3.0.55 — CVE-2026-55599 / GHSA-m557-wrgg-6rp4 (SSRF via X.509 Authority Information Access)
Transitive updates pulled in by --with-all-dependencies: guzzlehttp/promises 2.5.0 → 2.5.1, symfony/deprecation-contracts v3.7.0 → v3.7.1.
Also brings the composer.lock content hash back in sync with composer.json (composer validate was warning). Verified locally: composer audit passes, composer validate clean.
🤖 Generated with Claude Code