From a2f02322b1f747587973a32d450bbc0d07ff0439 Mon Sep 17 00:00:00 2001 From: Adrien Dupuis <61695653+adriendupuis@users.noreply.github.com> Date: Thu, 11 Jun 2026 16:53:15 +0200 Subject: [PATCH 1/2] =?UTF-8?q?PKSA-fs5b-x5k4-1h39=20for=20PHP=20=E2=89=A4?= =?UTF-8?q?=208.2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/update_and_migration/from_4.6/update_from_4.6.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/update_and_migration/from_4.6/update_from_4.6.md b/docs/update_and_migration/from_4.6/update_from_4.6.md index a2b8490f51..5ae7a9ba52 100644 --- a/docs/update_and_migration/from_4.6/update_from_4.6.md +++ b/docs/update_and_migration/from_4.6/update_from_4.6.md @@ -672,6 +672,8 @@ For security reasons, it's highly recommenced to update `twig/twig` and `twig/in For more information, see the following security advisories: +* PHP 8.2 and older + * [PKSA-fs5b-x5k4-1h39](https://packagist.org/security-advisories/PKSA-fs5b-x5k4-1h39) * PHP 8.0 and PHP 7.4 * [PKSA-5k7f-wvjj-jrgw](https://packagist.org/security-advisories/PKSA-5k7f-wvjj-jrgw) * [PKSA-sjvz-tbbr-vwth](https://packagist.org/security-advisories/PKSA-sjvz-tbbr-vwth) @@ -690,7 +692,6 @@ For more information, see the following security advisories: * [PKSA-n7sg-8f52-pqtf](https://packagist.org/security-advisories/PKSA-n7sg-8f52-pqtf) * [PKSA-8kk8-h2xr-h5nx](https://packagist.org/security-advisories/PKSA-8kk8-h2xr-h5nx) * [PKSA-2rbx-bjdx-4d4d](https://packagist.org/security-advisories/PKSA-2rbx-bjdx-4d4d) - * [PKSA-fs5b-x5k4-1h39](https://packagist.org/security-advisories/PKSA-fs5b-x5k4-1h39) * PHP 7.4 only * [PKSA-fbvq-z33h-r2np](https://packagist.org/security-advisories/PKSA-fbvq-z33h-r2np) * [PKSA-g9zw-qxh8-pq8w](https://packagist.org/security-advisories/PKSA-g9zw-qxh8-pq8w) From bc5bf11914af260f50e2fc696d87928cb076a08e Mon Sep 17 00:00:00 2001 From: Adrien Dupuis <61695653+adriendupuis@users.noreply.github.com> Date: Fri, 12 Jun 2026 16:32:18 +0200 Subject: [PATCH 2/2] =?UTF-8?q?PKSA-fs5b-x5k4-1h39=20for=20PHP=20=E2=89=A4?= =?UTF-8?q?=208.2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../from_4.6/update_from_4.6.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/docs/update_and_migration/from_4.6/update_from_4.6.md b/docs/update_and_migration/from_4.6/update_from_4.6.md index 5ae7a9ba52..ed3557b449 100644 --- a/docs/update_and_migration/from_4.6/update_from_4.6.md +++ b/docs/update_and_migration/from_4.6/update_from_4.6.md @@ -668,7 +668,7 @@ Run the provided SQL upgrade script to update your database: ### Update Twig to v3.26.0 -For security reasons, it's highly recommenced to update `twig/twig` and `twig/intl-extra` to version v3.26.0 or higher. +For security reasons, it's highly recommenced to update `twig/twig`, `twig/intl-extra`, and `twig/cssinliner-extra` to version v3.26.0 or higher. For more information, see the following security advisories: @@ -699,33 +699,29 @@ For more information, see the following security advisories: * [PKSA-1tmc-rt7x-12w6](https://packagist.org/security-advisories/PKSA-1tmc-rt7x-12w6) * [PKSA-xx6c-6d96-db2w](https://packagist.org/security-advisories/PKSA-xx6c-6d96-db2w) -To use these packages in versions not affected by security vulnerabilities, PHP 8.1 is the minimum required version. +To use these packages in versions not affected by security vulnerabilities, PHP 8.3 is the minimum required version. For projects meeting this requirement, you can update the packages with Composer. -If you're using PHP 7.4 or 8.0, to do the [[= product_name =]] update, you have two options: +If you're using PHP 8.2 or an older version, to do the [[= product_name =]] update, you have two options: #### Update PHP, the custom code, then the platform (recommended) -Make sure to use PHP 8.1 or higher. Since PHP 8.1 has reached its End of Life (EOL), it's recommended that you use PHP 8.2 or higher. -Migrate custom code to be compatible with PHP 8.1 or higher, for example by using [Rector](https://github.com/rectorphp/rector). +Make sure to use PHP 8.3 or higher. Since PHP 8.1 has reached its End of Life (EOL), it's recommended that you use PHP 8.2 or higher. +Migrate custom code to be compatible with PHP 8.3 or higher, for example by using [Rector](https://github.com/rectorphp/rector). Then, update Ibexa DXP. #### Implement other countermeasures If updating the Twig packages isn't possible, for example, because the project is using PHP 7.4 or 8.0 where the fixes are not available, review the security issues carefully and assess the danger. -If you choose to implement countermeasures without upgrading PHP and updating Twig, you can silence the advisories in `composer.json`: +If you choose to implement countermeasures without upgrading PHP and updating Twig, you can silence the advisories in `composer.json`. For example, here for PHP 7.4: ```json "config": { "audit": { "ignore": { - "PKSA-fbvq-z33h-r2np": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", - "PKSA-g9zw-qxh8-pq8w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", - "PKSA-yd6k-t2gh-1m43": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", - "PKSA-1tmc-rt7x-12w6": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", - "PKSA-xx6c-6d96-db2w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", + "PKSA-fs5b-x5k4-1h39": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", "PKSA-5k7f-wvjj-jrgw": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", "PKSA-sjvz-tbbr-vwth": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", "PKSA-h8hf-ytnd-5t9q": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", @@ -743,7 +739,11 @@ If you choose to implement countermeasures without upgrading PHP and updating Tw "PKSA-n7sg-8f52-pqtf": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", "PKSA-8kk8-h2xr-h5nx": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", "PKSA-2rbx-bjdx-4d4d": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", - "PKSA-fs5b-x5k4-1h39": "Description of the countermeasures you've implemented causing this one to be safe to ignore." + "PKSA-fbvq-z33h-r2np": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", + "PKSA-g9zw-qxh8-pq8w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", + "PKSA-yd6k-t2gh-1m43": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", + "PKSA-1tmc-rt7x-12w6": "Description of the countermeasures you've implemented causing this one to be safe to ignore.", + "PKSA-xx6c-6d96-db2w": "Description of the countermeasures you've implemented causing this one to be safe to ignore." } } }