Comments (8)
This repository accepts all contributions, and makes no choices about which packages should be listed or not.
from security-advisories.
@tomasnorre We should discuss that internally on our Slack #security
channel, not via GitHub and please also not via Twitter.
@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.
Our (TYPO3 security team) idea would have been to keep vendor related advisories (just TYPO3 core in our case) in this repository and provide advisories for 3rd party plugins in a dedicated repository/platform, e.g. https://advisories.typo3.org (work-in-progress, not published yet).
from security-advisories.
This database is (at least for now) a hub for all security issues. I think it would make sense to consolidate everything here.
from security-advisories.
@ohader conflict
rules are not what makes composer update
costly (at least not with an uptodate version of composer). These conflict rules are check only among packages which are already in the scope of the solver (as they can only reject a package from the solution, not include it in it).
from security-advisories.
@fabpot That information also was new to me. In a consequence that could mean that hundreds and thousands of advisories from other projects (Symfony, TYPO3, Joomla, Drupal, Wordpress, Yii2, ...) would be bundled in this repository... in the next consequence having a growth in https://github.com/Roave/SecurityAdvisories/blob/master/composer.json and potential impact on Composer actions, having to verify all version constraints.
Not a big deal, as @stof has highlighted: exclusions ("conflict"
section) are much cheaper than inclusion of ranges ("require"
)
from security-advisories.
To understand you correct. I can make a PR that includes the TYPO3 Extension then?
from security-advisories.
Yes, sure. This repository accepts PR for any Composer package, no restrictions.
from security-advisories.
We do have entries for Symfony bundles for instance.
from security-advisories.
Related Issues (20)
- TYPO3 extension advisories HOT 4
- Using exact version constraint without boundaries are faling the validation HOT 5
- Advisories didn't pushed
- simplesamlphp v1.17.8 reported as insecure HOT 2
- alterphp/easyadmin-extension-bundle/2018-10-02.yaml HOT 2
- Consider adding a vulnerability id for non CVEs HOT 2
- Mr
- Add level of severity for PHP Security Advisories HOT 3
- Flag unsupported versions HOT 1
- propel: 2.0.0-alpha11 HOT 11
- Laravel 5.8 marked as insecure when it's not in fact vulnerable to CVE-2021-3129 HOT 4
- Work with Github to fix their Advisory Database importer? HOT 3
- facade/ignition seems to be fixed in 2.4.2 HOT 3
- [Discussion] Adopt OSV unified vulnerability schema for open source HOT 1
- Typosquatting Malware symfont/process HOT 3
- Import advisories from the Github security vulnerability database automatically HOT 10
- PHP Deprecated: Return type of Composer\Repository\ArrayRepository::count() should either be compatible with Countable::count() HOT 2
- Support for Composer 1 is deprecated and some packages will not be available. HOT 5
- Missing api-platform CVE HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from security-advisories.