Skip to content

v1.0.1 — Saloon 4 security upgrade

Choose a tag to compare

View all tags
@jordanpartridge jordanpartridge released this 19 May 20:53
· 2 commits to master since this release
v1.0.1
831ad4b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security release. Upgrades Saloon to v4 and bumps two dev dependencies to clear all pending Composer audit advisories. No public API changes — drop-in upgrade from v1.0.0.

CVEs resolved

Package CVE Severity
saloonphp/saloon CVE-2026-33942 high — insecure deserialization in AccessTokenAuthenticator
saloonphp/saloon CVE-2026-33183 medium — fixture name path traversal
saloonphp/saloon CVE-2026-33182 medium — SSRF / credential leak via absolute URL overriding base URL
phpunit/phpunit (dev) CVE-2026-24765 unsafe deserialization in PHPT code coverage handling
symfony/process (dev) CVE-2026-24739 argument escaping under MSYS2/Git Bash

Changes

  • saloonphp/saloon ^3.10 → ^4.0
  • phpunit/phpunit 11.5.33 → 11.5.50 (transitive via Pest)
  • symfony/process v7.4.0 → v7.4.11 (transitive)

Downstream impact

Zero. The connector does not leak any Saloon type whose shape changed in v4. Consumers (e.g. `conduit-ui/pr`) using the `^1.0` constraint receive this update automatically via `composer update` and require no code changes.

Closes #28.

Assets 2
Loading