The WebSocket support added for TrueNAS JSON-RPC 2.0 requires the
phrity/websocket library to actually be available at runtime. This repo
commits the vendor/ tree (CI does not run composer install), so the
dependency and composer.lock must be committed for class_exists() checks
in the TrueNAS app to succeed.
- composer require phrity/websocket:^3.6 (resolves to 3.7.3) with lock
and vendor/ committed
- Fix TrueNASWebSocketClient to catch WebSocket\Exception\Exception
(phrity/websocket v3 namespace) instead of the non-existent
WebSocket\ConnectionException from the old textalk/websocket v1/v2 API,
so connection/call failures are logged and wrapped as intended
Bumps the packages reported by CVE/GHSA scans in #1564 to their patched
releases (with transitive dependencies):
- symfony/http-foundation 7.3.1 -> 7.4.14 (CVE-2025-64500 / GHSA-3rg7-wf37-54rm)
- phpunit/phpunit 10.5.47 -> 10.5.64 (CVE-2026-24765 / GHSA-vvj3-c3rp-c85p)
- aws/aws-sdk-php 3.349.3 -> 3.388.0 (GHSA-27qh-8cxx-2cr5)
- enshrined/svg-sanitize 0.21.0 -> 0.22.0 (GHSA-22wq-q86m-83fh)
Some transitive dependencies now require PHP 8.4, which matches the runtime
shipped in the official LinuxServer image, so the composer requirement is
raised to ^8.4, CI is pinned to PHP 8.4, and the readme is updated to match.
The remaining advisories in the report (php84, curl, libpq, git, sqlite,
busybox, coreutils) come from the LinuxServer base image, not this
repository, and are addressed by rebuilding the image on an updated base.
Refs #1564
KodeStar
KodeStar
Chris Hunt
Attila Kerekes
Attila Jozsef Kerekes