Repository navigation
Patch Laravel floors and active locks for November security advisories #1133
Description
The current remediation covers all three November Laravel advisories: task-output injection, numeric-parameter signed-URL injection, and temporary signed-URL expiration bypass. The complete patched floors are Laravel 12.72.0 / 13.41.0. They supersede the initial task-output-only 12.71.0 / 13.40.0 target. Security’s complete matrix retains the version-exposure/reachability distinction.
Current main at a7178856475e495714d1e5172d544b8535163019 has version exposure:
- root
composer.json:^12.69.0|^13.30.0 - active queue-contention locks: 13.30.1 and 13.37.0
- active tracing and embedded-replay locks: 13.37.0
- embedded HTTP example: 12.69.3
- active continuation input lock: 13.38.0
- machine-owned Laravel dependency policy and embedded-upgrade contract retain the older floors
Security source triage found no use of Laravel's Concurrency facade, Concurrency::run(), or Concurrency::defer(). The unrelated DetectsConcurrencyErrors database trait is present. This is confirmed dependency exposure and a blocked audit, not evidence of a reachable exploit in Workflow.
Own the Workflow correction:
- Raise the supported Laravel floors to
^12.72.0|^13.41.0in the package constraint and machine-owned policy/upgrade authorities. - Refresh every active/current fixture and example lock to a patched release and run the unchanged Composer audit plus the affected Workflow matrices.
- Preserve historical result locks and published measurement records as historical evidence; do not rewrite them to imply an old run used a newer dependency.
- Add a focused policy regression that rejects 12.71.x and 13.40.x while admitting the exact patched floors.
- Qualify and publish the necessary Workflow patch, then verify its installable constraint. Do not use this finding to publish another PHP Server release, enable disabled qualification steps, or claim exploit reproduction.
Coordinate the shared Laravel bridge correction through durable-workflow/sdk-php#421. No production or account action is part of this issue.
Owner: Workflow.
Activity
rmcdaniel commentedon Nov 13, 2026
Security triage update — the current Laravel floor must cover three advisories, not only GHSA-63hm-g96r-2m2q:
expiresis dropped from parsed input aftermax_input_vars; fixed in 12.72.0 / 13.41.0.Therefore 12.71.0 / 13.40.0 is sufficient only for the earlier task-output injection advisory. The current repository remediation floor is 12.72.0 / 13.41.0 or later.
Bounded source reachability update:
signedmiddleware alias, but no route assignment or signed-route generation/validation call was found in the assessed source. Add outbox #311 remains a standalone-only lock/floor correction to 12.72; the library support boundary stays unchanged.1cfb35a9, and rollback source4ea39d0call contain an authenticated/email/verify/{id}/{hash}route with Laravelsignedmiddleware and the standard temporary verification-link flow. Installed 13.40.0 is affected by the expiration-bypass advisory even though it fixed the earlier task-output advisory. The signed-route calls found in tests use explicit string-keyed parameters, so I found no matching numeric-keyed generation path for GHSA-6rv8; that is not a reason to retain 13.40. Cloud owns an exact 13.41+ lock/image/deployed qualification and route/proxy-limit assessment, with no live exploit attempt.This update does not authorize a deployment, reactivate disabled qualification steps, or change the explicit no-more-PHP-Server-release stop. Each owner must preserve its existing source, audit, package/image, and actual-consumer gates.
[-]Raise Laravel floors and active locks for CVE-2026-128083[/-][+]Patch Laravel floors and active locks for November security advisories[/+]rmcdaniel commentedon Nov 13, 2026
Publication is being prepared as the narrow 2.28.1 security patch in draft #1141, based on immutable 2.28.0. Runtime PHP source, feature tests and fixtures are byte-identical to that published tag. The 20 changed paths contain the reviewed dependency/security-policy/active-lock correction, declared-PHP regression, dated security entry and exact 2.28.1 product train. Independent source/lock rebind is recorded on that PR.
The matching main correction remains #1136 at
d3c583b7, composed normally with merged entity-reference main. Its frozen dependency-floor unit repeat passes 6,072 tests / 82,710 assertions, 49 declared skips, no failures/errors, exit 0. Coverage follows, and all six combined-head MySQL feature shards are running with complete inventory checks. Candidate 2.28.1 retains its own quality/installed/published-package gates; nothing has been tagged or published.The security patch does not require Saga or native-child feature acceptance and does not include those features. The existing #1130 stop and the separate 2.29 qualification remain unchanged. Downstream SDK/Sample strict authority checks must continue to wait for an actual corrected published package tuple.
rmcdaniel commentedon Nov 14, 2026
Workflow 2.28.1 is published and qualified. Stable/Latest GitHub Release
444999472is public, non-draft and non-prerelease, published at2026-11-14T04:00:11Zfrom maintenance branchrelease/base-2.28.1. Annotated tag98021fdb3c277e41413b3ec87da578b90fac8325remains unchanged and points to acceptedc090506cafa011335fcd5db07b7da79945fe83db, tree43577e9831cccfdfe1d50cb3603ca2bb1be194bf.The ordinary Packagist P2 index selects exact 2.28.1 source/dist
c090506c. The published archive SHA-256 is11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f; all 1,296 exported file bytes and executable semantics match the accepted source export. Exported Laravel contract SHA-256 is153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7: PHP^8.2, Laravel^12.72.0|^13.41.0.Protected Release Verification 43554066029 is terminal SUCCESS, six successful jobs. It verifies the normal published package and install (zero security advisories), then all five Laravel 12/13 journeys across PHP 8.2/8.3/8.4: stable v1
1.0.82→ embedded2.28.1→ rollback1.1.1, all passed. Independent terminal package/installed Security PASS is durable. Public Release HTTP 200, GitHub Latest API and normal P2 were independently read back after publication.This is the security-only patch from published 2.28.0. Runtime, schema and feature source remain identical to 2.28.0. SDK #422 can now add this new versioned authority fixture and repeat its unchanged strict embedded-to-service transition. Sample #345 and affected embedded consumers retain their own source/installed/deployment gates. Historical fixtures stay immutable. No Saga/Core/child feature acceptance, PHP Server release, disabled #419/#420 execution, #1130 retry, or 2.29 publication is implied.
The original tag-triggered verification
43536522238remains NONPASS for the earlier stale normal-P2 index. Its wait, guards and tag were not changed. The merged topic is independently absent; the maintenance branch and immutable tag are retained.