Repository navigation
Composer reports advisory for flysystem #41877
Description
composer is reporting a new vulnerability in https://github.com/thephpleague/flysystem
https://github.com/owncloud/core/security/dependabot/101
Check the report and see if it is applicable to ownCloud Classic, and take appropriate action.
Note: the advisory is fixed in major version 3, core still references major version 1.
$ composer update
[bamarni-bin] The setting "extra.bamarni-bin.forward-command" will be set to "true" from 2.x onwards. If you wish to keep it to "false", you need to set it explicitly.
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- Root composer.json requires league/flysystem ^1.1, found league/flysystem[1.1.0, ..., 1.1.10] but these were not loaded, because they are affected by security advisories ("PKSA-w9tt-7782-78jx", "PKSA-pwh8-d4fr-nywn"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
The 2nd one reported is actually fixed in the flysystem version that we are using. Not sure why composer referenced that.
GHSA-9f46-5r25-5wfm
Activity