Skip to content
Snippets Groups Projects
Commit 3e497b76 authored by Thomas Hohn's avatar Thomas Hohn Committed by Benjamin Franzke
Browse files

[TASK] Replace former extension packages using self.version

The so called "death star" range for replacements has to be
used with caution [1] as it replaces all versions of the
replaced packages, including old or insecure versions.

That effectively means the replacing package marks itself as matching
in queries for insecure versions, once a security advisory[2]
is submitted for the replaced packages.

The extension replacements are now adapted to use the more precise
self.version qualifier to avoid matching named security advisories as
suggested by:
https://github.com/Roave/SecurityAdvisories/issues/127#issuecomment-1933647035

[1] https://getcomposer.org/doc/04-schema.md#replace
[2] https://github.com/advisories/GHSA-cgr9-h9qq-x9fx

Resolves: #103082
Releases: main, 13.0, 12.4, 11.5
Change-Id: I6353df15d6cbf039bab60644a103669495b26605
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/82863


Tested-by: default avatarOliver Klee <typo3-coding@oliverklee.de>
Tested-by: default avatarOliver Hader <oliver.hader@typo3.org>
Tested-by: default avatarcore-ci <typo3@b13.com>
Tested-by: default avatarBenjamin Franzke <ben@bnf.dev>
Reviewed-by: default avatarOliver Klee <typo3-coding@oliverklee.de>
Reviewed-by: default avatarOliver Hader <oliver.hader@typo3.org>
Reviewed-by: default avatarBenjamin Franzke <ben@bnf.dev>
parent c0a0c292
Branches
Tags
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment