[Security] Bump laravel/framework from 5.3.31 to 5.5.42

[dependabot-preview]

Bumps laravel/framework from 5.3.31 to 5.5.42. This update includes security fixes.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

Cookie serialization vulnerability

Affected versions: >=4.0.0, <=4.0.11; >=4.1.0, <=4.1.31; >=4.2.0, <=4.2.22; >=5.0.0, <=5.0.35; >=5.1.0, <=5.1.46; >=5.2.0, <=5.2.45; >=5.3.0, <=5.3.31; >=5.4.0, <=5.4.36; >=5.5.0, <5.5.42; >=5.6.0, <5.6.30

Sourced from The PHP Security Advisories Database.

Timing attack vector for remember me token

Affected versions: >=4.1.26, <=4.1.31; >=4.2.0, <=4.2.22; >=5.0.0, <=5.0.35; >=5.1.0, <=5.1.46; >=5.2.0, <=5.2.45; >=5.3.0, <=5.3.31; >=5.4.0, <=5.4.36; >=5.5.0, <5.5.10

Sourced from The PHP Security Advisories Database.

Password reset phishing vulnerability

Affected versions: >=5.3.0, <=5.3.31; >=5.4.0, <5.4.22

Sourced from The PHP Security Advisories Database.

Exploit of encryption failure vulnerability

Affected versions: >=4.0.0, <=4.0.11; >=4.1.0, <=4.1.31; >=4.2.0, <=4.2.22; >=5.0.0, <=5.0.35; >=5.1.0, <=5.1.46; >=5.2.0, <=5.2.45; >=5.3.0, <=5.3.31; >=5.4.0, <=5.4.36; >=5.5.0, <5.5.40; >=5.6.0, <5.6.15

Release notes

Sourced from laravel/framework's releases.

v5.5.40

Changed

• Only set id on NotificationFake if no id is set (#23474)
• Removed attribute filling from pivot models (#23554)

Fixed

• Fixed to not mistakenly release mutex (#23607)
• Revert breaking changes in ManagesLoops (#23681)

Security

• Check iv length in Encrypter::validPayload() (28e53f2)

v5.5.39

Fixed

• Fix for Carbon 1.24.1 (b3a5608, 72286b3)

v5.5.38

Fixed

• Fix for Carbon 1.24.0 (#23459)
• Fixed --force flag on GeneratorCommand (#23427)

v5.5.37

Changed

• Added v-pre to dropdown link in app.stub (987c19f)

Fixed

• Queue::bulk() fake now properly pushes expected jobs (#23389)
• Set up loop variable correctly on all Traversable objects (#23388)
• Fixed SQLiteGrammar::whereTime() formatting (#23408)

v5.5.36

Changed

• Upgrade Parsedown to 1.7.0 (14adb99)

Fixed

• Fixed PostgresGrammar::whereTime() casting (#23318)

v5.5.35

Fixed

• Fixed an issue with orWhere*() arguments (3368494)
• Fixed tightenco/collect version (#23152, #23159)

v5.5.34

Changed

• Use path helpers in console commands (#22971)
• Remove unnecessary escapeshellarg() call (#23025)
• Use original attribute values in pivot where clauses (#23031, #23035)

v5.5.33

Added

... (truncated)

Commits

• 6550ae9 version
• c5dc9c8 update serialization logic
• 6df8767 add variable
• 3716d14 disable serialization on all cookies
• f0df637 dont serialize session id cookie
• 7fc1dc5 dont serialize xsrf token (#25122)
• a2c54e6 version
• c13b084 Merge branch 'withcount-bindings' of https://github.com/staudenmeir/framework...
• a5ec8c2 comment tests
• feefbfb Two Azure SQL Server "connection lost" messages (#24566) (#24954)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

---

[dependabot-preview]

Superseded by #53.