Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update composer/composer from ~2.0 or ~2.6.0 to minimum of ~2.7.0 following with changes by Drupal 10.2.4 #118

Open
Natshah opened this issue Mar 6, 2024 · 0 comments

Comments

@Natshah
Copy link

Natshah commented Mar 6, 2024

What in this template can be improved or added as a feature?

Drupal 10.2.4 was released on: 6 Mar 2024 by: quietone
https://www.drupal.org/project/drupal/releases/10.2.4
Thanks, to the Drupal release and testing teams
This is a patch (bugfix) release of Drupal 10 and is ready for use on production sites. Learn more about Drupal 10.

Issue #3421371: Security update composer/composer (CVE-2023-43655)
Minimum composer version was changed in Drupal Core to ^2.7

What exactly should be updated?

"composer/composer": "^2.7",
must do composer self-update
and in platform.sh hosted sites .. the default version should be changed to ~2.7.0 - or latest

How important is this feature to you?

GHSA-7c6p-848j-wh5h
https://www.cve.org/CVERecord?id=CVE-2024-24821

Additional context

No response

Natshah added a commit to Natshah/drupal10 that referenced this issue Mar 6, 2024
Natshah added a commit to Natshah/drupal10 that referenced this issue Mar 10, 2024
Natshah added a commit to Natshah/drupal10 that referenced this issue Apr 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant