Skip to content

Conversation

@dependabot-preview
Copy link

Bumps symfony/http-foundation from 4.3.3 to 4.4.18. This update includes a security fix.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

Affected versions: >=2.0.0, =4.3.0, <4.3.8

Release notes

Sourced from symfony/http-foundation's releases.

v4.4.18

Changelog (symfony/http-foundation@v4.4.17...v4.4.18)

  • bug #39271 Fix TypeError: Argument 1 passed to JsonResponse::setJson() must be of the type string, object given (sidz)

v4.4.17

Changelog (symfony/http-foundation@v4.4.16...v4.4.17)

  • bug #38614 Fix for virtualhosts based on URL path (mvorisek)
  • bug #38894 Remove Symfony 3 compatibility code (derrabus)

v4.4.16

Changelog (symfony/http-foundation@v4.4.15...v4.4.16)

  • bug #38516 Fix Range Requests (BattleRattle)

v4.4.15

Changelog (symfony/http-foundation@v4.4.14...v4.4.15)

  • no changes

v4.4.14

Changelog (symfony/http-foundation@v4.4.13...v4.4.14)

  • no changes

v4.4.13

Changelog (symfony/http-foundation@v4.4.12...v4.4.13)

  • no changes

v4.4.12

Changelog (symfony/http-foundation@v4.4.11...v4.4.12)

  • no changes

v4.4.11

Changelog (symfony/http-foundation@v4.4.10...v4.4.11)

  • bug #37291 Duplicated MimeType due to PHP Bug (juanmrad)
  • bug #37389 Change file extension of "audio/mpeg" from "mpga" to "mp3" (YaFou)

v4.4.10

Changelog (symfony/http-foundation@v4.4.9...v4.4.10)

  • no changes

v4.4.9

Changelog (symfony/http-foundation@v4.4.8...v4.4.9)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

5.3.0

  • added ResponseFormatSame PHPUnit constraint

5.2.0

  • added support for X-Forwarded-Prefix header
  • added HeaderUtils::parseQuery(): it does the same as parse_str() but preserves dots in variable names
  • added File::getContent()
  • added ability to use comma separated ip addresses for RequestMatcher::matchIps()
  • added Request::toArray() to parse a JSON request body to an array
  • added RateLimiter\RequestRateLimiterInterface and RateLimiter\AbstractRequestRateLimiter
  • deprecated not passing a Closure together with FILTER_CALLBACK to ParameterBag::filter(); wrap your filter in a closure instead.
  • Deprecated the Request::HEADER_X_FORWARDED_ALL constant, use either HEADER_X_FORWARDED_FOR | HEADER_X_FORWARDED_HOST | HEADER_X_FORWARDED_PORT | HEADER_X_FORWARDED_PROTO or HEADER_X_FORWARDED_AWS_ELB or HEADER_X_FORWARDED_TRAEFIK constants instead.
  • Deprecated BinaryFileResponse::create(), use __construct() instead

5.1.0

  • added Cookie::withValue, Cookie::withDomain, Cookie::withExpires, Cookie::withPath, Cookie::withSecure, Cookie::withHttpOnly, Cookie::withRaw, Cookie::withSameSite
  • Deprecate Response::create(), JsonResponse::create(), RedirectResponse::create(), and StreamedResponse::create() methods (use __construct() instead)
  • added Request::preferSafeContent() and Response::setContentSafe() to handle "safe" HTTP preference according to RFC 8674
  • made the Mime component an optional dependency
  • added MarshallingSessionHandler, IdentityMarshaller
  • made Session accept a callback to report when the session is being used
  • Add support for all core cache control directives
  • Added Symfony\Component\HttpFoundation\InputBag
  • Deprecated retrieving non-string values using InputBag::get(), use InputBag::all() if you need access to the collection of values

5.0.0

  • made Cookie auto-secure and lax by default
  • removed classes in the MimeType namespace, use the Symfony Mime component instead
  • removed method UploadedFile::getClientSize() and the related constructor argument
  • made Request::getSession() throw if the session has not been set before
  • removed Response::HTTP_RESERVED_FOR_WEBDAV_ADVANCED_COLLECTIONS_EXPIRED_PROPOSAL
  • passing a null url when instantiating a RedirectResponse is not allowed

4.4.0

Commits
  • 5ebda66 Remove :void in test function signatures
  • 700457b Apply "visibility_required" CS rule to constants
  • e28b3dc minor #39246 [HttpFoundation] Throws cleanup (kick-the-bucket)
  • f92cec8 bug #39271 [HttpFoundation] Fix TypeError: Argument 1 passed to JsonResponse:...
  • 92a50b0 [HttpFoundation] Fix TypeError: Argument 1 passed to JsonResponse::setJson() ...
  • d852399 [HttpFoundation] Make test pass without Xdebug.
  • 39929b8 [HttpFoundation] Make sure we reuse the current PHP binary for the webserver ...
  • ae29023 [HttpFoundation] Ignore stack trace printed by Xdebug 3.
  • 7d0b2a7 Remove unused @throws tags and handling of never thrown exceptions
  • 9eeb37e [HttpFoundation] Fix for virtualhosts based on URL path
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Bumps [symfony/http-foundation](https://github.com/symfony/http-foundation) from 4.3.3 to 4.4.18. **This update includes a security fix.**
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/5.x/CHANGELOG.md)
- [Commits](symfony/http-foundation@v4.3.3...v4.4.18)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Jan 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant