Update dependency symfony/http-foundation to v5.4.50 [SECURITY] #272

renovate · 2024-11-06T21:54:26Z

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/http-foundation (source)	`5.4.22` -> `5.4.50`

GitHub Vulnerability Alerts

CVE-2024-50345

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

CVE-2025-64500

Description

The Request class improperly interprets some PATH_INFO in a way that leads to representing some URLs with a path that doesn't start with a /. This can allow bypassing some access control rules that are built with this /-prefix assumption.

Resolution

The Request class now ensures that URL paths always start with a /.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.

Release Notes

symfony/http-foundation (symfony/http-foundation)

`v5.4.50`

Compare Source

Changelog (symfony/http-foundation@v5.4.49...v5.4.50)

security symfony/symfony#cve-2025-64500 [HttpFoundation] Fix parsing pathinfo with no leading slash (@nicolas-grekas)

`v5.4.48`

Compare Source

Changelog (symfony/http-foundation@v5.4.47...v5.4.48)

bug symfony/symfony#58836 Work around parse_url() bug (bis) (@nicolas-grekas)

`v5.4.46`

Compare Source

Changelog (symfony/http-foundation@v5.4.45...v5.4.46)

security symfony/symfony#cve-2024-50345 [HttpFoundation] Reject URIs that contain invalid characters (@nicolas-grekas)

`v5.4.45`

Compare Source

Changelog (symfony/http-foundation@v5.4.44...v5.4.45)

bug symfony/symfony#58619 [HttpFoundation][Lock] Ensure compatibility with ext-mongodb v2 (@GromNaN)

`v5.4.44`

Compare Source

Changelog (symfony/http-foundation@v5.4.43...v5.4.44)

bug symfony/symfony#58181 [HttpFoundation] Update links for X-Accel-Redirect and fail properly when X-Accel-Mapping is missing (@nicolas-grekas)
bug symfony/symfony#58218 Work around parse_url() bug (@nicolas-grekas)

`v5.4.42`

Compare Source

Changelog (symfony/http-foundation@v5.4.41...v5.4.42)

bug symfony/symfony#57585 [HttpFoundation] Fix MockArraySessionStorage to generate more conform ids (@Seldaek)

`v5.4.40`

Compare Source

Changelog (symfony/http-foundation@v5.4.39...v5.4.40)

bug symfony/symfony#54910 [HttpFoundation] filter out empty HTTP header parts (@xabbuh)
bug symfony/symfony#54816 [Cache] Fix support for predis/predis:^2.0 (@mfettig)

`v5.4.39`

Compare Source

Changelog (symfony/http-foundation@v5.4.38...v5.4.39)

bug symfony/symfony#54506 [HttpFoundation] Set content-type header in RedirectResponse (@smnandre)

`v5.4.38`

Compare Source

Changelog (symfony/http-foundation@v5.4.37...v5.4.38)

no significant changes

`v5.4.35`

Compare Source

Changelog (symfony/http-foundation@v5.4.34...v5.4.35)

bug symfony/symfony#53432 [HttpFoundation] Request without content-type or content-length header should result in null values, not empty strings (@priyadi)

`v5.4.34`

Compare Source

Changelog (symfony/http-foundation@v5.4.33...v5.4.34)

no significant changes

`v5.4.32`

Compare Source

Changelog (symfony/http-foundation@v5.4.31...v5.4.32)

bug symfony/symfony#52459 [Cache][HttpFoundation][Lock] Fix PDO store not creating table + add tests (@HypeMC)

`v5.4.31`

Compare Source

Changelog (symfony/http-foundation@v5.4.30...v5.4.31)

bug symfony/symfony#52474 [HttpFoundation] ensure string type with mbstring func overloading enabled (@xabbuh)
bug symfony/symfony#52457 [Cache][HttpFoundation][Lock] Fix empty username/password for PDO PostgreSQL (@HypeMC)
bug symfony/symfony#52444 Remove full DSNs from exception messages (@nicolas-grekas)

`v5.4.30`

Compare Source

Changelog (symfony/http-foundation@v5.4.29...v5.4.30)

no significant changes

`v5.4.28`

Compare Source

Changelog (symfony/http-foundation@v5.4.27...v5.4.28)

bug symfony/symfony#51424 [HttpFoundation] Fix base URI detection on IIS with UrlRewriteModule (@derrabus)

bug symfony/symfony#50315 [Translation] Fix handling of null messages in ArrayLoader (@rob006)
bug symfony/symfony#50338 [Console] Remove exec and replace it by shell_exec (@maxbeckers)
bug symfony/symfony#50362 [FrameworkBundle] Fix Workflow without a marking store definition uses marking store definition of previously defined workflow (@krciga22)
bug symfony/symfony#50309 [HttpFoundation] UrlHelper is now aware of RequestContext changes (@giosh94mhz)
bug symfony/symfony#50309 [HttpFoundation] UrlHelper is now aware of RequestContext changes (@giosh94mhz)
bug symfony/symfony#49063 [Messenger] Respect isRetryable decision of the retry strategy for re-delivery (@FlyingDR)
bug symfony/symfony#50266 [HttpFoundation] Fix file streaming after connection aborted (@rlshukhov)
bug symfony/symfony#49557 [PropertyInfo] Fix phpDocExtractor nullable array value type (@fabpot)

`v5.4.23`

Compare Source

Changelog (symfony/http-foundation@v5.4.22...v5.4.23)

bug #48972 Fix memory limit problems in BinaryFileResponse (glady)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-11-06T21:54:27Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update symfony/http-foundation:5.4.50 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency symfony/deprecation-contracts is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - phpunit/phpunit is locked to version 9.6.19 and an update of this package was not requested.
    - doctrine/instantiator 2.0.0 requires php ^8.1 -> your php version (7.3; overridden via config.platform, same as actual) does not satisfy that requirement.
    - phpunit/phpunit 9.6.19 requires doctrine/instantiator ^1.3.1 || ^2 -> satisfiable by doctrine/instantiator[2.0.0].

renovate bot changed the title ~~fix(deps): update dependency symfony/http-foundation to v5.4.46 [security]~~ Update dependency symfony/http-foundation to v5.4.46 [SECURITY] Jan 9, 2025

renovate bot force-pushed the renovate/packagist-symfony-http-foundation-vulnerability branch from 8591a6a to b7ea6ac Compare August 10, 2025 12:53

Update dependency symfony/http-foundation to v5.4.50 [SECURITY]

08c0c45

renovate bot force-pushed the renovate/packagist-symfony-http-foundation-vulnerability branch from b7ea6ac to 08c0c45 Compare November 13, 2025 03:02

renovate bot changed the title ~~Update dependency symfony/http-foundation to v5.4.46 [SECURITY]~~ Update dependency symfony/http-foundation to v5.4.50 [SECURITY] Nov 13, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Update dependency symfony/http-foundation to v5.4.50 [SECURITY] #272

Update dependency symfony/http-foundation to v5.4.50 [SECURITY] #272

Uh oh!

renovate bot commented Nov 6, 2024 •

edited

Loading

Uh oh!

renovate bot commented Nov 6, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Update dependency symfony/http-foundation to v5.4.50 [SECURITY] #272

Are you sure you want to change the base?

Update dependency symfony/http-foundation to v5.4.50 [SECURITY] #272

Uh oh!

Conversation

renovate bot commented Nov 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Description

Resolution

Credits

Description

Resolution

Credits

Release Notes

Configuration

Uh oh!

renovate bot commented Nov 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: composer.lock

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Nov 6, 2024 •

edited

Loading

renovate bot commented Nov 6, 2024 •

edited

Loading