Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency livewire/livewire to v3 [security] - autoclosed #58

Closed
wants to merge 1 commit into from
Closed

fix(deps): update dependency livewire/livewire to v3 [security] - autoclosed #58

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 1, 2024

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
livewire/livewire ^2.10 -> ^3.0 age adoption passing confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-22859

Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken function.

Release Notes

livewire/livewire (livewire/livewire)

v3.0.4

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v3.0.3...v3.0.4

v3.0.3

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v3.0.2...v3.0.3

v3.0.2

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v3.0.1...v3.0.2

v3.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: livewire/livewire@v3.0.0...v3.0.1

v3.0.0

Compare Source

Official release for Livewire 3.0 🎉

Far too much has changed since the last version 2 release to document here. The best place to view the changes is the official upgrade guide: https://livewire.laravel.com/docs/upgrading

Thank you for all your encouragement and support!

Below is a list of all contributions since the first beta release:

What's Changed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate Renovate
Copy link
Contributor Author

renovate bot commented Feb 1, 2024

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update livewire/livewire:3.0.4 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Dependency laravel/framework is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires livewire/livewire ^3.0, found livewire/livewire[v3.0.0-beta.1, ..., v3.4.4] but these were not loaded, likely because it conflicts with another require.
  Problem 2
    - filament/filament is locked to version v2.16.37 and an update of this package was not requested.
    - filament/filament v2.16.37 requires livewire/livewire ^2.10.7 -> found livewire/livewire[v2.10.7, ..., 2.x-dev] but it conflicts with your root composer.json require (^3.0).
  Problem 3
    - cocur/slugify v4.2.0 requires php ^7.1 || ~8.0.0 || ~8.1.0 -> your php version (8.3.2) does not satisfy that requirement.
    - cviebrock/eloquent-sluggable 9.0.0 requires cocur/slugify ^4.0 -> satisfiable by cocur/slugify[v4.2.0].
    - cviebrock/eloquent-sluggable is locked to version 9.0.0 and an update of this package was not requested.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@renovate renovate bot changed the title fix(deps): update dependency livewire/livewire to v3 [security] fix(deps): update dependency livewire/livewire to v3 [security] - autoclosed Feb 2, 2024
@renovate renovate bot closed this Feb 2, 2024
@renovate renovate bot deleted the renovate/packagist-livewire/livewire-vulnerability branch February 2, 2024 13:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants