Security vulnerabilities and automated fixes for composer issues
2 posts found
A high-severity denial-of-service vulnerability (GHSA-g2gp-3wwq-f4ph) was discovered in `league/commonmark`, a popular PHP Markdown parsing library. The flaw allows an attacker to craft Markdown input containing adjacent inline attribute blocks that trigger catastrophic processing, potentially exhausting server resources. Upgrading from version 2.7.1 to 2.9.0 resolves the issue by hardening how the parser handles these malformed constructs.
A missing cooldown configuration in Dependabot allowed the automatic proposal of newly published (and potentially malicious) package versions, creating a supply chain attack vector that could have facilitated the exploitation of CVE-2026-47343 — a broken access control vulnerability in TYPO3's File Abstraction Layer. The fix adds a 7-day cooldown period to all package ecosystem entries in `.github/dependabot.yml`, ensuring newly published packages are vetted by the community before being propose