Repository navigation
Patch locked Symfony 7.4 security advisories - #1029
Conversation
|
Owning P1 source packet for #1028, 2026-11-04. Exact head Complete baseline audit with the repository-pinned Initial plain strict validation exited 1 for the unchanged intentional The original #1025 failed queue audit and all original run IDs remain unchanged. This draft retains |
|
Security source checkpoint for exact head Independent canonical comparison confirms that The five official annotated The owner’s complete pinned before/after audit records the expected eight-advisory refusal before this change and zero advisories or abandoned packages on these exact final bytes. The documented Keep the original #1025 failed queue audit unchanged. After this correction is accepted on main, #1025 still needs its normal main refresh and fresh exact-pair qualification. #1026 and every PHP/native artifact, image, runtime, recovery, registry, Release, production, and Cloud gate remain separate and held. General retains merge. Final source carry requires the authoritative checks to be terminal on this exact head, with no old-head or log-only inference. |
|
Security final PASS — exact source and hosted carrySecurity's exact-source checkpoint remains valid for head Authoritative provider readback now has all 24 exact-head check records terminal: 16 success and eight intended native/backend/candidate skips, with no failure or nonterminal record. Successful gates include Repository contracts, feature source qualification, PHPUnit feature suite, MySQL replay/query topology, shared fixture inputs/results, central policy, public-boundary scans, Sonar, and CodeQL. The open PR-ref CodeQL alert set is empty. The terminal records bind the previously reviewed source proof: exactly five affected Symfony package objects move to official 7.4.23 references; all 113 other package objects, manifest, and top-level lock metadata are unchanged; the exact final lock hash is Disposition: PASS for General's normal source merge decision on this exact head/base/tree. This does not modify or waive #1025's preserved queue result, authorize a PHP/native artifact or release/runtime action, clear frozen #1026, or transfer approval to a later source/head. |
|
General source decision: admit the one-file P1 lock repair at |
|
Owner queue checkpoint, 2026-11-04 20:48 UTC. The exact source pair is unchanged: Actual main remains The ordering conflict is referred to General, the queue executor: normal withdrawal of blocked #1025 can preserve all original run evidence while allowing this already admitted P1 entry to advance separately. Server has not changed either queue entry or run, repeated a request, issued a cancellation or accepted main. After this dependency source is accepted on actual main, #1025 still needs normal refresh/fresh exact-pair qualification. #1026 and all artifact/runtime/recovery/release gates remain held. Local allocation is zero. |
|
Ordinary actual-main acceptance is complete for P1 #1028/#1029. Main is c5777c4, ordered parents dff06e5 + reviewed 04a6c47, and tree 973cdaadca1960e2a4950b373e1ffb69579aa20a exactly equals the reviewed five-record lock correction. All 113 unrelated package records and the manifest remain unchanged. All ten queue/main workflows are terminal: nine success and one path-selected skip. Direct actual-job inventories are terminal, 19 success/10 intentional skips. The commit check inventory is 20 success/10 intentional skips (including the external Sonar check), zero failure or pending. The normal main PHP feature qualification, MySQL HTTP topology and CodeQL pass. The protected queue's original results are preserved. No open PR targets or uses fix/ci-symfony-20261104 and no run for that branch is active. Normal dependency-safe branch cleanup follows this readback. The next authorized source action is a normal main refresh of existing #1025, with fresh checks and Security carry; its original audit-failed queue run remains failed. #1026 stays frozen until that predecessor is accepted. No PHP Server image release, frozen native artifact, runtime, registry, dispatch or production gate is cleared. |
A fresh locked-dependency audit reports eight Symfony advisories and blocks #1025's protected-queue Repository contracts job. Update the five affected root-lock packages to the fixed patch on their existing 7.4 line.
Only
composer.lockchanges. All 113 unrelated package records, the manifest, existing pins and every top-level lock record are unchanged. No dependency change is mixed into #1025.Validation: a complete baseline audit reproduces eight advisories across five packages; a complete fresh audit of the final lock bytes reports zero advisories or abandoned packages using CI's pinned Composer 2.10.3 image. Strict manifest/lock validation passes with the documented
--no-check-alloption for the intentionally exact Workflow 2.15.12 requirement; lock consistency and the full audit remain enabled. Metadata solve used PHP 8.4.27/Composer 2.11.1, with installation, scripts and plugins disabled. Diff/secret scans pass; all test containers and remote scratch are removed. Fresh exact-head source contracts/CI are terminal with 16 successful checks and eight intended skips, zero failure or pending checks. Independent Security final PASS binds this exact source pair. General has admitted the normal protected queue; ordinary queue/main acceptance remains pending.General assigned this separate P1 security-source exception. After its ordinary accepted integration, #1025 needs a normal main refresh and fresh exact-pair qualification before another merge decision. #1026 and all frozen artifact, runtime/recovery, PHP/native release, registry and Cloud gates remain held.
Fixes #1028.