0

Right now there are some security updates for Symfony:

curl -sS https://get.symfony.com/cli/installer | bash
echo y | ~/.symfony/bin/symfony self:update
~/.symfony/bin/symfony security:check
Symfony Security Check Report
=============================

2 packages have known vulnerabilities.

symfony/cache (v4.1.6)
----------------------

 * [CVE-2019-10912][]: Prevent destructors with side-effects from being unserialized

symfony/phpunit-bridge (v3.4.22)
--------------------------------

 * [CVE-2019-10912][]: Prevent destructors with side-effects from being unserialized

[CVE-2019-10912]: https://symfony.com/cve-2019-10912
[CVE-2019-10912]: https://symfony.com/cve-2019-10912

Note that this checker can only detect vulnerabilities that are referenced in the security advisories database.
Execute this command regularly to check the newly discovered vulnerabilities.

These can be easily updated:

composer update symfony/cache symfony/phpunit-bridge --with-dependencies

The question is, should we do these dependency updates ourselves or wait for the next Drupal core release that includes them?

For example, I'm thinking about a scenario where we would update a Symfony package that is a Drupal core dependency and something would go wrong with the update because the updated dependency hasn't been fully tested with Drupal.

  • Those packages are no dependencies of Drupal. If Symfony releases a security update for a package used by Drupal, Drupal will publish a new patch version including those security fixes. – Hudri Apr 25 at 11:20
  • @Hudri Thanks. On the specifics, you're right symfony/cache isn't a Drupal dependency. symfony/phpunit-bridge is a dependency of webflo/drupal-core-require-dev, which is for using BLT and updated along with drupal/core. – Hugo Apr 25 at 11:29
  • @Hudri In general (for dependencies of Drupal), do you recommend waiting for the Drupal core release that patches, and not doing it before that? – Hugo Apr 25 at 11:30
  • So far I've always relied on Drupal itself for updates, it was more than just fast enough for me with security fixes. webflo/drupal-core... is always tied 1:1 to a drupal/core patch release and is for dev environments only. – Hudri Apr 25 at 11:46
  • 1
    webflo uses symfony/phpunit-bridge: ^3.4.3 which means it will be updated when using the recommended update command composer update drupal/core webflo/drupal-core-require-dev "symfony/*" --with-dependencies (this is from drupal composer) – Hudri Apr 25 at 11:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.