Repository navigation
Refresh parity fixture locks for new Symfony denial-of-service advisories #820
Description
Security intake
GitHub published two high-severity Symfony denial-of-service advisories on 2026-10-27, which opened Dependabot alerts 69–77 against six committed tests/Fixtures/ServerParityProfiles/**/composer.lock files:
- GHSA-r925-mgvr-h9cc / CVE-2026-108082:
symfony/http-foundationbefore 7.4.19 - GHSA-2v3c-qxhr-7vpv / CVE-2026-109413:
symfony/yamlbefore 7.4.18
The affected fixture locks currently contain symfony/http-foundation 7.4.14. Three corrected-marker fixtures also contain symfony/yaml 7.4.17; the remaining alerted YAML locks already contain 7.4.20.
Reachability and disposition
This is not a production-runtime incident:
- current
mainlocks both packages at 7.4.21; - the affected files are parity-test fixtures;
- the release image
.dockerignoreexcludestests/; - no customer-facing rollback or emergency Server release is indicated.
The Rust Server owner owns these native/shared/frozen parity fixtures under #325. Preserve their authority and semantics rather than applying an unbounded dependency refresh.
Acceptance
- Refresh only the affected fixture dependencies to patched compatible releases, following the fixture-generation authority.
- Preserve frozen-profile roles, marker behavior, checksums/manifests and differential expectations.
- Run the relevant parity/profile verifier and scoped Server qualification.
- Confirm Dependabot alerts 69–77 close from the merged default-branch state.
- Record exact commits and checks run; no operator action is required unless the fixture contract cannot be preserved.
Activity
rmcdaniel commentedon Oct 27, 2026
Rust Server owner acknowledges. Bounded refresh in progress on
rust-325-fixture-symfony-820: onlysymfony/http-foundation(to ≥ 7.4.19) and, in the three corrected-marker locks,symfony/yaml(to ≥ 7.4.18) change, through the pinned Composer path. Each profile'sartifacts.jsonlock pins are updated to match, and the profiles' install/integrity checks are rerun. Exact commits and checks will follow in the PR.rmcdaniel commentedon Oct 27, 2026
Hosted verification receipt: PR #823 exact accepted head
693ef96757ce55b7421df21b68ade75bc6bc87bccompleted 57/57 protected checks acceptably with zero failures. GitHub accepted that exact head into themainmerge queue at 2026-10-27T21:05:52Z (queue position 3). Remaining Security action is to verify the queued integration/merge, then confirm Dependabot alerts 69–77 close against the merged default branch before closing this issue. No operator action is needed.rmcdaniel commentedon Oct 27, 2026
Completed and verified against the merged default branch.
693ef96757ce55b7421df21b68ade75bc6bc87bcand merged through the protected queue asa21da69fac1a1436c4368b94426f987ad037fa48at 2026-10-27T22:10:54Z.state: fixedwithfixed_attimestamps from 2026-10-27T22:11:01Z through 22:11:04Z. None was dismissed.Acceptance is satisfied; no operator action, credential change, release rollback, or production intervention was required.