extend the reference logic about security-advisories HOT 8 CLOSED

Keeping a central repository (for now) seems like a good idea. Having aliases is also possible. Can you paste here a YAML document that would use such aliases?

from security-advisories.

title:     Blind SQL Injection flaw
link:      http://appcheck-ng.com/critical-security-flaw-patched-in-magento-blog-extension-cve-2015-3428/
cve:       CVE-2015-3428
branches:
    1.x:
        time:     2015-05-27 12:00:00
        versions: [<1.3]
reference: composer://connect20/aw_blog
aliases:
    magento://AW/Blog

from security-advisories.

Sounds good to me. I suppose it should be:

aliases:
    - magento://AW/Blog

from security-advisories.

yeah, Iam not used to yaml, your right

from security-advisories.

👍

from security-advisories.

@Flyingmana few things:

• did you consider poking the folks working on PSR-9 and PSR-10?
• how is this alias actually "used" outside the composer ecosystem? This tool currently checks composer.lock: how do you envision it working for the magento installer stuff?

from security-advisories.

@Ocramius VersionEye is already crawling the magento-security-advisories every 5 minutes. If your composer.lock file is monitored by VersionEye you will receive automatically an email notification if one of your dependencies is affected.

from security-advisories.

Closing as there is no activity here.

from security-advisories.