Raise Laravel security floors and refresh the example lock for November advisories #421

Activity

1. rmcdaniel

   added

   agent:sdk-phpWork done by the sdk-php repo agentWork done by the sdk-php repo agent

   on Nov 13, 2026
2. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   Security cross-repository triage for GHSA-63hm-g96r-2m2q / CVE-2026-128083:

   The primary advisory identifies affected Laravel versions below 12.71.0 and Laravel 13 versions below 13.40.0. Its exploit prerequisites include an application-reachable Concurrency::run() path and attacker-controlled task stdout that can forge the internal result framing. I searched the current SDK, Workflow, Waterline and Sample PHP/Blade sources for the Laravel Concurrency facade and its run / defer calls; none are present. The results below therefore distinguish confirmed dependency exposure from unproven reachable impact.

   Surface	Version evidence	Reachability evidence	Owner / required action
   SDK PHP	Laravel floor cells 12.69.0 / 13.30.0 and HTTP example lock 12.69.3 are affected	no Concurrency facade call found	This issue: raise source/platform/CI/docs floors to 12.71.0 / 13.40.0, refresh the example lock, qualify and publish the SDK patch
   Workflow	root floors and several active fixtures/locks are affected	no Concurrency facade call found; the database DetectsConcurrencyErrors trait is unrelated	Workflow #1133: update machine-owned policy, active locks and installable package constraint; preserve historical measurement locks
   Waterline	library package does not require laravel/framework; standalone host is locked to affected 12.69.3	no Concurrency facade call found	Waterline #311: raise and lock the standalone host at a patched Laravel 12 floor; keep the library's independent Illuminate boundary scoped
   Sample App	root lock 13.34.0 and microservice lock 12.69.3 are affected	no Concurrency facade call found	Sample #345: raise both constraints, refresh both locks and rerun the runnable onboarding journeys

   Cloud's deployed/locked/source assessment is recorded in its private maintenance record; no private deployment details are copied here. Documentation follow-through should consume the qualified SDK/Workflow results rather than publishing speculative version guidance.

   There is no live-exploit claim, no advisory suppression, and no reason to enable disabled qualification steps or publish another PHP Server release. Each owner must retain the unchanged audit and normal source/package/consumer gates.
3. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   Security triage update — the current Laravel floor must cover three advisories, not only GHSA-63hm-g96r-2m2q:

   • GHSA-v5ch-g375-82r6: temporary signed URL expiration bypass when expires is dropped from parsed input after max_input_vars; fixed in 12.72.0 / 13.41.0.
   • GHSA-6rv8-qj5v-p8ch: expiration bypass through attacker-influenced numeric-keyed parameters passed to signed-route generation; fixed in 12.72.0 / 13.41.0.

   Therefore 12.71.0 / 13.40.0 is sufficient only for the earlier task-output injection advisory. The current repository remediation floor is 12.72.0 / 13.41.0 or later.

   Bounded source reachability update:

   • SDK PHP: framework compatibility/lock exposure; no application route authority. Raise Laravel security floors and refresh the example lock for November advisories #421 must freeze at the higher 12.72/13.41 floor and keep Add published PHP command-key acceptance #420 installed execution held until the corrected exact caller records are accepted.
   • Workflow: no signed-route generation/validation use found at the assessed main source. Keep #1133 as a dependency/active-lock/policy correction to 12.72/13.41; do not alter historical result locks or infer a reachable exploit.
   • Waterline: the standalone app registers Laravel's signed middleware alias, but no route assignment or signed-route generation/validation call was found in the assessed source. Require fixed APT before building the Bookworm PHP example #311 remains a standalone-only lock/floor correction to 12.72; the library support boundary stays unchanged.
   • Sample: no signed-route generation/validation use found at the assessed main source. Carry workflow polls on activity task completions #345 must raise the affected Laravel 12/13 app constraints and locks to 12.72/13.41; the framework-free playground remains outside scope.
   • Cloud: current main, serving source 1cfb35a9, and rollback source 4ea39d0c all contain an authenticated /email/verify/{id}/{hash} route with Laravel signed middleware and the standard temporary verification-link flow. Installed 13.40.0 is affected by the expiration-bypass advisory even though it fixed the earlier task-output advisory. The signed-route calls found in tests use explicit string-keyed parameters, so I found no matching numeric-keyed generation path for GHSA-6rv8; that is not a reason to retain 13.40. Cloud owns an exact 13.41+ lock/image/deployed qualification and route/proxy-limit assessment, with no live exploit attempt.

   This update does not authorize a deployment, reactivate disabled qualification steps, or change the explicit no-more-PHP-Server-release stop. Each owner must preserve its existing source, audit, package/image, and actual-consumer gates.
4. rmcdaniel

   changed the title [-]Raise Laravel floors for CVE-2026-128083 and refresh the example lock[/-] [+]Raise Laravel security floors and refresh the example lock for November advisories[/+] on Nov 13, 2026
5. rmcdaniel commented on Nov 13, 2026

   

   rmcdaniel

   on Nov 13, 2026

   MemberAuthor

   More actions

   SDK422 is prepared at exact6d33d1acbfd00cdd98c1b742d307037da1e5092b with independent bounded Docs PASS5897134413 and Security source/floor/lock PASS6863399261. Final selected floors are12.72.0/13.41.0 across all three primary advisories. The example lock changes only Laravel and its content hash; real242c trust, normal metadata validation and locked audit pass. Focused exact-source72tests/216assertions pass. Historical published fixtures/results and the strict transition checker remain unchanged.

   Current required CI43496288756 still has the expected failed embedded-v2 job132130446782; remaining PHP source lanes are finishing without a failure so far. The observed blocker is the old installed Workflow support authority, not authentication, the installer or an unaccepted central profile. All84 existing source/mode bindings and absent-file controls match accepted central54c6a2b, and the actual hosted policy preflight passes.

   The external action that clears this gate is Workflow1133 qualifying and publishing its matching corrected Laravel support authority. Then SDK owns the fresh exact installed embedded-v2 transition, terminal required checks, normal merge/main verification, patch package/publication checks and named installed Laravel follow-through. No equality/parser waiver or skipped required job will replace that receipt. No SDK tag/publication has started. Source-only command-key420 remains separately execution-HOLD;419's set-aside step stays disabled.
6. rmcdaniel commented on Nov 14, 2026

   

   rmcdaniel

   on Nov 14, 2026

   MemberAuthor

   More actions

   The corrected producer prerequisite is cleared by published Workflow2.28.1/c090506c. SDK #422 is now normally merged at 32cc885abb3bad914b3af098a5c908c7b5037ce0, tree ca3cf5385b89826fa02c2fd5268807fd1c1abcab, exactly equal to independently reviewed/tested f3364f5.

   Current-head qualification completed35success/one declared skip. The unchanged embedded-v2 transition passed against installed Workflow2.28.1. Fresh candidate run43555406729 and inspected artifact14097574479 bind exact archive a7605df7,467 normalized files and300 runtime inputs. Independent source PASS6871510080 and package/member/hash PASS6871605688 are recorded. The initial setup HTTP403 remains historical runner NONPASS; one targeted unchanged-source retry passed.

   Actual main workflows are now running. After those finish, the remaining owner actions are immutable3.18.3 publication, normal-registry source/dist/archive and installed baseline plus named Laravel follow-through, stable PHP portal verification and the concrete Docs/Sample handoff. This issue remains open until the required delivery evidence exists. No #419/#420 operation or held counter-review is resumed.
7. rmcdaniel commented on Nov 14, 2026

   

   rmcdaniel

   on Nov 14, 2026

   MemberAuthor

   More actions

   SDK3.18.3 is published, Release445013587. All five actual-main workflows at32cc885 passed, including CI43556237275's release identity and archive checks. Annotated tag66a0a999 points to32cc885/treeca3cf538, exactly equal to reviewed f336. A fresh public tagged-source ZIP is1132316bytes/SHA256fe6ff479cdcba9eaf70c128c3321ea1ffa317786dda39c510a76dd05fac1173a; all467 normalized regular bodies/modes equal the approved candidate archivea7605df7. Raw generated ZIP wrapper hashes remain observational.

   The normal maintainer tag push reported the existing tag-creation-rule bypass, as in3.18.2; no force/admin option, moved tag or policy change was used, and General was notified immediately. The actual refs/tags/3.18.3 webhook delivery received202/success and queued the registry update. The normal Packagist P2/API have not exposed3.18.3 yet; no registry-installed result is claimed.

   The concrete remaining Laravel receipt is tracked by #423, exacte22122a. Existing framework CI consumes a checkout, so two opt-in registry-only floors12.72/13.41 extend the maintained published-worker workflow, reusing qualified411a PHP8.3/242c and existing bridge/cached-role controls. Independent source/workflow PASS is recorded; normal CI/main and actual version propagation precede dispatch. This excluded CI-only change does not alter the3.18.3 package or require another SDK release.

   After P2 identity is visible and #423's normal gates pass, I own the normal-registry baseline/two Laravel cells, retained graph/member review, exact-tag PHP portal/live verification and concrete Docs/Sample handoff. #421 remains open. The original HTTP403 and old Workflow authority refusal remain historical NONPASS; no #419/#420 step or set-aside review is resumed.
8. rmcdaniel commented on Nov 14, 2026

   

   rmcdaniel

   on Nov 14, 2026

   MemberAuthor

   More actions

   SDK source and ordinary integration are complete:

   • #422 merged at 32cc885abb3bad914b3af098a5c908c7b5037ce0, tree-equal to independently reviewed and tested f336. All five actual-main workflows passed. GitHub Release 3.18.3, annotated tag 66a0a9994ec5dbf931509a02c1e6118699ff6d4a, points to that immutable source. The downloaded public archive's complete 467 file bodies/modes equal the approved candidate; all 300 runtime inputs remain.
   • The existing installed transition passed against published Workflow 2.28.1 through the unchanged strict checker. The former authority refusal and first HTTP403 remain scoped historical NONPASS.
   • #423 adds the required two normal-registry Laravel consumers. Exact e221 passed 36 checks with two declared skips and independent source/workflow review. Normal merge 92053fc1b017b3284d1cacef2b7cceb98febdcc5 is tree-equal; all five actual-main workflows now pass, including CI 43557689196 and ordinary installed-worker 43557689200. Both merged remote topic branches are absent. All 467 shipped package bodies/modes remain identical to tagged 3.18.3; no further SDK release is needed.

   The remaining external dependency is normal Composer P2 delivery. Packagist's package page/API expose 3.18.3 at 32cc, and its metadata update feed records the stable update at 04:29:48 UTC. The original tag webhook received 202/success. A single ordinary redelivery through the existing hook at 04:45:00 UTC also received 202/success (delivery 3853941802285400064). The ordinary, unmodified P2 URL still returned latest 3.18.2, Last-Modified November 13 15:52:45, on the subsequent read. Independent matching observation. No source/registry/cache substitution or installed attempt was used to overcome this discrepancy.

   Owner remains sdk-php. After the ordinary P2 URL positively exposes 3.18.3 with source/dist 32cc885, run the accepted main workflow once:

   gh workflow run published-worker-metrics.yml --repo durable-workflow/sdk-php --ref main \
     -f sdk_version=3.18.3 -F laravel_bridges=true \
     -f expected_sdk_reference=32cc885abb3bad914b3af098a5c908c7b5037ce0

   This selects the unchanged native 3.8 baseline and two PHP 8.3 registry-only Laravel floors, 12.72.0 and 13.41.0. It supplies no candidate source or broader native flags. Inspect the actual baseline and both Laravel artifacts/graphs/audits, obtain the scoped independent artifact review, then deploy and verify the exact-tag PHP portal and hand off the qualified tuple to Docs/Sample. Do not close #421 or claim completed registry/Laravel delivery before those receipts exist. No #419/#420 operation, held counter-review, credentials/vault or additional local runtime is selected.
9. rmcdaniel commented on Nov 14, 2026

   

   rmcdaniel

   on Nov 14, 2026

   Last edited by rmcdaniel

   MemberAuthor

   More actions

   Read-only downstream diagnostic for the existing 3.18.3 delivery defect, using the ordinary public URLs and the checked clean CA. No query/cache override, alternate Composer source, webhook, registry setting, installation or consumer execution was selected.

   At HTTP dates 2026-11-14 10:43:47–48 UTC:

   • https://repo.packagist.org/p2/durable-workflow/sdk.json returns 200, latest 3.18.2, no 3.18.3. ETag remains "6af7324d-2f4b5" and Last-Modified remains November 13 15:52:45, matching the earlier independent P2 readback. Cache-Control is public, max-age=900.
   • https://packagist.org/packages/durable-workflow/sdk.json returns 200 and the correct repository URL, but its ordinary 220-entry version map now also omits 3.18.3. Its 3.18 keys are 3.18.0, 3.18.1 and 3.18.2. Cache-Control is public, s-maxage=43200.

   This differs from the 04:39 API observation, which positively exposed 3.18.3 / 32cc. Preserve that earlier evidence. Packagist documents a twelve-hour cache for this dynamic package API, so the current API omission does not establish a removed version or failed ingest. The concrete consumer defect remains the ordinary static P2 response. The GitHub 3.18.3 source/Release is unchanged.

   SDK ownership of metadata delivery repair and the accepted registry-only baseline/Laravel cells remains unchanged. The next repair should account for both ordinary API and P2 publication/readback and produce exact source/dist 32cc885abb3bad914b3af098a5c908c7b5037ce0 before dispatching the existing consumer. Sample #345 continues its permitted source work with qualified Workflow 2.28.1; it does not use a registry or source substitution to bypass this defect.

   Bounded read-only ingress/source checks found no package-name or hard-coded-version mismatch: both 3.18.2/3.18.3 composer manifests name durable-workflow/sdk, omit a top-level version, keep PHP ^8.1, and contain no root repository override. The existing active push webhook's recorded 04:45 redelivery names refs/tags/3.18.3 / unchanged annotated object 66a0a999, not a deletion/forced update; Packagist returned 202 with success and one queued job identifier. Later ordinary pushes also received 202. This establishes ingress acknowledgement, not completed metadata export. No webhook was sent or modified during diagnosis. SDK ownership should carry the accepted job/tag and stale ordinary-P2 evidence through the provider's ingest/export/mirroring repair; no public job-status endpoint is documented in the API reference.