Skip to content

More SA to ignore #3246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
adriendupuis wants to merge 2 commits into
base: 4.6
Choose a base branch
from
Draft

More SA to ignore #3246

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a2f0232
PKSA-fs5b-x5k4-1h39 for PHP ≤ 8.2
adriendupuis Jun 11, 2026
bc5bf11
PKSA-fs5b-x5k4-1h39 for PHP ≤ 8.2
adriendupuis Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 14 additions & 13 deletions docs/update_and_migration/from_4.6/update_from_4.6.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -668,10 +668,12 @@

### Update Twig to v3.26.0

For security reasons, it's highly recommenced to update `twig/twig` and `twig/intl-extra` to version v3.26.0 or higher.
For security reasons, it's highly recommenced to update `twig/twig`, `twig/intl-extra`, and `twig/cssinliner-extra` to version v3.26.0 or higher.

For more information, see the following security advisories:

* PHP 8.2 and older
* [PKSA-fs5b-x5k4-1h39](https://packagist.org/security-advisories/PKSA-fs5b-x5k4-1h39)
* PHP 8.0 and PHP 7.4
* [PKSA-5k7f-wvjj-jrgw](https://packagist.org/security-advisories/PKSA-5k7f-wvjj-jrgw)
* [PKSA-sjvz-tbbr-vwth](https://packagist.org/security-advisories/PKSA-sjvz-tbbr-vwth)
Expand All @@ -690,41 +692,36 @@
* [PKSA-n7sg-8f52-pqtf](https://packagist.org/security-advisories/PKSA-n7sg-8f52-pqtf)
* [PKSA-8kk8-h2xr-h5nx](https://packagist.org/security-advisories/PKSA-8kk8-h2xr-h5nx)
* [PKSA-2rbx-bjdx-4d4d](https://packagist.org/security-advisories/PKSA-2rbx-bjdx-4d4d)
* [PKSA-fs5b-x5k4-1h39](https://packagist.org/security-advisories/PKSA-fs5b-x5k4-1h39)
* PHP 7.4 only
* [PKSA-fbvq-z33h-r2np](https://packagist.org/security-advisories/PKSA-fbvq-z33h-r2np)
* [PKSA-g9zw-qxh8-pq8w](https://packagist.org/security-advisories/PKSA-g9zw-qxh8-pq8w)
* [PKSA-yd6k-t2gh-1m43](https://packagist.org/security-advisories/PKSA-yd6k-t2gh-1m43)
* [PKSA-1tmc-rt7x-12w6](https://packagist.org/security-advisories/PKSA-1tmc-rt7x-12w6)
* [PKSA-xx6c-6d96-db2w](https://packagist.org/security-advisories/PKSA-xx6c-6d96-db2w)

To use these packages in versions not affected by security vulnerabilities, PHP 8.1 is the minimum required version.
To use these packages in versions not affected by security vulnerabilities, PHP 8.3 is the minimum required version.

Check warning on line 702 in docs/update_and_migration/from_4.6/update_from_4.6.md

View workflow job for this annotation

GitHub Actions / vale

[vale] docs/update_and_migration/from_4.6/update_from_4.6.md#L702 

[Ibexa.EOLWhitespace] Remove whitespace characters from the end of the line.
Raw output 
{"message": "[Ibexa.EOLWhitespace] Remove whitespace characters from the end of the line.", "location": {"path": "docs/update_and_migration/from_4.6/update_from_4.6.md", "range": {"start": {"line": 702, "column": 117}}}, "severity": "WARNING"}

For projects meeting this requirement, you can update the packages with Composer.

If you're using PHP 7.4 or 8.0, to do the [[= product_name =]] update, you have two options:
If you're using PHP 8.2 or an older version, to do the [[= product_name =]] update, you have two options:

Check notice on line 706 in docs/update_and_migration/from_4.6/update_from_4.6.md

View workflow job for this annotation

GitHub Actions / vale

[vale] docs/update_and_migration/from_4.6/update_from_4.6.md#L706 

[Ibexa.ByUsing] Prefer 'by using' or 'with' to plain 'using'.
Raw output 
{"message": "[Ibexa.ByUsing] Prefer 'by using' or 'with' to plain 'using'.", "location": {"path": "docs/update_and_migration/from_4.6/update_from_4.6.md", "range": {"start": {"line": 706, "column": 4}}}, "severity": "INFO"}

#### Update PHP, the custom code, then the platform (recommended)

Make sure to use PHP 8.1 or higher. Since PHP 8.1 has reached its End of Life (EOL), it's recommended that you use PHP 8.2 or higher.
Migrate custom code to be compatible with PHP 8.1 or higher, for example by using [Rector](https://github.com/rectorphp/rector).
Make sure to use PHP 8.3 or higher. Since PHP 8.1 has reached its End of Life (EOL), it's recommended that you use PHP 8.2 or higher.
Migrate custom code to be compatible with PHP 8.3 or higher, for example by using [Rector](https://github.com/rectorphp/rector).
Then, update Ibexa DXP.

#### Implement other countermeasures

If updating the Twig packages isn't possible, for example, because the project is using PHP 7.4 or 8.0 where the fixes are not available, review the security issues carefully and assess the danger.

If you choose to implement countermeasures without upgrading PHP and updating Twig, you can silence the advisories in `composer.json`:
If you choose to implement countermeasures without upgrading PHP and updating Twig, you can silence the advisories in `composer.json`. For example, here for PHP 7.4:

```json
"config": {
"audit": {
"ignore": {
"PKSA-fbvq-z33h-r2np": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-g9zw-qxh8-pq8w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-yd6k-t2gh-1m43": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-1tmc-rt7x-12w6": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-xx6c-6d96-db2w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-fs5b-x5k4-1h39": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-5k7f-wvjj-jrgw": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-sjvz-tbbr-vwth": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-h8hf-ytnd-5t9q": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
Expand All @@ -742,7 +739,11 @@
"PKSA-n7sg-8f52-pqtf": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-8kk8-h2xr-h5nx": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-2rbx-bjdx-4d4d": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-fs5b-x5k4-1h39": "Description of the countermeasures you've implemented causing this one to be safe to ignore."
"PKSA-fbvq-z33h-r2np": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-g9zw-qxh8-pq8w": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-yd6k-t2gh-1m43": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-1tmc-rt7x-12w6": "Description of the countermeasures you've implemented causing this one to be safe to ignore.",
"PKSA-xx6c-6d96-db2w": "Description of the countermeasures you've implemented causing this one to be safe to ignore."
}
}
}
Expand Down
Loading