Git Product home page Git Product logo

Comments (8)

fabpot avatar fabpot commented on July 23, 2024 1

This repository accepts all contributions, and makes no choices about which packages should be listed or not.

from security-advisories.

ohader avatar ohader commented on July 23, 2024 1

@tomasnorre We should discuss that internally on our Slack #security channel, not via GitHub and please also not via Twitter.

@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.

Our (TYPO3 security team) idea would have been to keep vendor related advisories (just TYPO3 core in our case) in this repository and provide advisories for 3rd party plugins in a dedicated repository/platform, e.g. https://advisories.typo3.org (work-in-progress, not published yet).

from security-advisories.

fabpot avatar fabpot commented on July 23, 2024 1

This database is (at least for now) a hub for all security issues. I think it would make sense to consolidate everything here.

from security-advisories.

stof avatar stof commented on July 23, 2024 1

@ohader conflict rules are not what makes composer update costly (at least not with an uptodate version of composer). These conflict rules are check only among packages which are already in the scope of the solver (as they can only reject a package from the solution, not include it in it).

from security-advisories.

Ocramius avatar Ocramius commented on July 23, 2024 1

@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.

Not a big deal, as @stof has highlighted: exclusions ("conflict" section) are much cheaper than inclusion of ranges ("require")

from security-advisories.

tomasnorre avatar tomasnorre commented on July 23, 2024

To understand you correct. I can make a PR that includes the TYPO3 Extension then?

from security-advisories.

fabpot avatar fabpot commented on July 23, 2024

Yes, sure. This repository accepts PR for any Composer package, no restrictions.

from security-advisories.

fabpot avatar fabpot commented on July 23, 2024

We do have entries for Symfony bundles for instance.

from security-advisories.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.