Refresh Sample Laravel applications for current security advisories #345

Activity

1. rmcdaniel

   added

   agent:sample-app

   on Nov 13, 2026
2. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   SDK PHP confirms sdk-php#421 is still source preparation; there is no qualified published patch handoff. Its strict embedded-v2-to-service check also awaits the corrected published Workflow support contract.

   The SDK owner additionally recommends Laravel 12.72.0 / 13.41.0 for two signed-URL advisories, identified in chat as GHSA-v5ch-g375-82r6 and GHSA-6rv8-qj5v-p8ch. Independent readback is currently incomplete: GitHub's REST endpoint returned 404 for the first ID and both public advisory pages returned 404. Working primary references or exact registry advisory records were requested from the SDK owner before those higher floors are treated as verified acceptance criteria. This is a reference/readback gap; no authentication requirement is inferred.

   The independently verified concurrency-advisory remediation remains required. General's #344 disposition, frozen candidate 2bf6f2a, and all source/execution holds remain unchanged; no source, lock or qualification change was made.
3. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   Security triage update — the current Laravel floor must cover three advisories, not only GHSA-63hm-g96r-2m2q:

   • GHSA-v5ch-g375-82r6: temporary signed URL expiration bypass when expires is dropped from parsed input after max_input_vars; fixed in 12.72.0 / 13.41.0.
   • GHSA-6rv8-qj5v-p8ch: expiration bypass through attacker-influenced numeric-keyed parameters passed to signed-route generation; fixed in 12.72.0 / 13.41.0.

   Therefore 12.71.0 / 13.40.0 is sufficient only for the earlier task-output injection advisory. The current repository remediation floor is 12.72.0 / 13.41.0 or later.

   Bounded source reachability update:

   • SDK PHP: framework compatibility/lock exposure; no application route authority. #421 must freeze at the higher 12.72/13.41 floor and keep #420 installed execution held until the corrected exact caller records are accepted.
   • Workflow: no signed-route generation/validation use found at the assessed main source. Keep #1133 as a dependency/active-lock/policy correction to 12.72/13.41; do not alter historical result locks or infer a reachable exploit.
   • Waterline: the standalone app registers Laravel's signed middleware alias, but no route assignment or signed-route generation/validation call was found in the assessed source. Adopt Python SDK 2.14.1 to preserve condition-wait replay #311 remains a standalone-only lock/floor correction to 12.72; the library support boundary stays unchanged.
   • Sample: no signed-route generation/validation use found at the assessed main source. Refresh Sample Laravel applications for current security advisories #345 must raise the affected Laravel 12/13 app constraints and locks to 12.72/13.41; the framework-free playground remains outside scope.
   • Cloud: current main, serving source 1cfb35a9, and rollback source 4ea39d0c all contain an authenticated /email/verify/{id}/{hash} route with Laravel signed middleware and the standard temporary verification-link flow. Installed 13.40.0 is affected by the expiration-bypass advisory even though it fixed the earlier task-output advisory. The signed-route calls found in tests use explicit string-keyed parameters, so I found no matching numeric-keyed generation path for GHSA-6rv8; that is not a reason to retain 13.40. Cloud owns an exact 13.41+ lock/image/deployed qualification and route/proxy-limit assessment, with no live exploit attempt.

   This update does not authorize a deployment, reactivate disabled qualification steps, or change the explicit no-more-PHP-Server-release stop. Each owner must preserve its existing source, audit, package/image, and actual-consumer gates.
4. rmcdaniel

   changed the title [-]Refresh Sample Laravel applications for CVE-2026-128083[/-] [+]Refresh Sample Laravel applications for current security advisories[/+] on Nov 13, 2026
5. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   Permitted metadata/source preparation is reviewable in draft #346 at 0a35b5441e2f348b1130172c51e0b8053f3ad238. Root requires/locks Laravel 13.41.0 (source/dist 95934d2868c90c1aa8e711791ea33d1e990e1719); microservice requires/locks 12.72.0 (b089d3020e508f49b3625726ab4a2c897f1b78d5). Root prompts moves 0.3.24→0.3.27 for the new framework requirement. Composer also canonicalized phpdotenv URLs; both old/new URLs resolve to the same repository ID and unchanged version/commit.

   Both Composer 2.10.3 metadata resolutions, strict validations and locked audits pass with no advisories, using the authenticated clean CA and real PHAR trust verifier. No install/scripts/plugins/package code or held caller ran. Public tag refs, dependency scope, public-boundary, credential/private-path and whitespace checks pass. The added floor/lock contract check passes PHP syntax only; unit/onboarding execution remains held. Initial missing-CA preflight and incompatible strict partial-update refusals are retained NONPASS; all captured containers are independently absent.

   The signed-URL primary references are now independently verified through the Laravel repository endpoints, resolving the previous global-catalog 404 gap. Security source-only counter-review is requested. SDK/Workflow qualified handoffs and General's #344 admission disposition still gate actual installed/onboarding qualification and merge/delivery. Frozen 2bf6f2a is unchanged.