Repository navigation
chore: fix composer dependencies and stop committing composer.lock - #25
Merged
Merged
Conversation
MostafaShehab
approved these changes
Nov 12, 2026
Member
|
@omarabdelazizgamal then we should release v3.0.0 as this breaks the compatility |
Collaborator
Author
This is now released: https://github.com/RobustaStudio/Resala/releases/tag/v3.0.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the dependency setup of the package and removes the committed
composer.lock, which is the source of the open Dependabot alerts.Closes #24
Why
composer.lockshould not be in a library. The app that installs Resala resolves its own versions, so the lock was never used by consumers. It pinned an old Laravel 10 dev setup (laravel/framework10.50.2, Symfony 6.x, league/commonmark, older Guzzle/psr7), which produced all 42 open Dependabot alerts. They should close once this is merged.composer.jsonnever declared:illuminate/console:PublishProviderEnvVariablesCommandextendsIlluminate\Console\Command.illuminate/filesystem: the same command uses theFilefacade.psr/http-message: drivers and responses type-hintResponseInterface.mockery/mockery: used by the tests, previously only pulled in through testbench.masterallowed Laravel 9 (end of life) but not Laravel 13, and the testbench/PHPUnit ranges didn't match the Laravel range.Breaking changes
guzzlehttp/guzzle7.15.2 or later. That's the first release with the fixes for the Guzzle advisories.I suggest releasing this as 3.0.0. The latest tag, 2.3.5, only supports Laravel 9 and 10, so the Laravel 11 and 12 work already on
master(#22, #23) isn't installable from Packagist until a new release is tagged.Security notes
The latest releases of every supported major version have no known advisories, with one exception:
laravel/framework10.x and 11.x still have three advisories that weren't fixed for those versions (email rule CRLF injection, signed URL path confusion, debug page XSS). Resala doesn't depend onlaravel/framework, only onilluminate/support,consoleandfilesystem, which have no advisories. Apps on Laravel 10 or 11 are affected whether or not they use Resala.