mirror of
https://github.com/linuxserver/Heimdall.git
synced 2026-08-07 07:16:13 +00:00
KodeStar
f69cbba6cd
Bumps the packages reported by CVE/GHSA scans in #1564 to their patched releases (with transitive dependencies): - symfony/http-foundation 7.3.1 -> 7.4.14 (CVE-2025-64500 / GHSA-3rg7-wf37-54rm) - phpunit/phpunit 10.5.47 -> 10.5.64 (CVE-2026-24765 / GHSA-vvj3-c3rp-c85p) - aws/aws-sdk-php 3.349.3 -> 3.388.0 (GHSA-27qh-8cxx-2cr5) - enshrined/svg-sanitize 0.21.0 -> 0.22.0 (GHSA-22wq-q86m-83fh) Some transitive dependencies now require PHP 8.4, which matches the runtime shipped in the official LinuxServer image, so the composer requirement is raised to ^8.4, CI is pinned to PHP 8.4, and the readme is updated to match. The remaining advisories in the report (php84, curl, libpq, git, sqlite, busybox, coreutils) come from the LinuxServer base image, not this repository, and are addressed by rebuilding the image on an updated base. Refs #1564
540 B
540 B
SECURITY POLICY
Supported Versions
After each new major release, the previous release will be supported for no less than 24 months, unless explicitly stated otherwise. This may mean that there are multiple supported versions at any given time.
Reporting a Vulnerability
If you discover a security vulnerability within this package, please send an email to security@gjcampbell.co.uk. All security vulnerabilities will be promptly addressed. Please do not disclose security-related issues publicly until a fix has been announced.