chore(deps): league/commonmark 2.9.0 — clear composer audit - #62
chore(deps): league/commonmark 2.9.0 — clear composer audit#62dmooibroek wants to merge 1 commit into
Conversation
Six advisories (2 CVEs + DoS PKSAs, all <2.9.0) published 2026-08-06 fail the Audit dependencies step, which runs before format/test and kills every CI leg repo-wide on an unchanged lock. Transitive dev dependency; 2.9.0 require set is identical to 2.8.3. Lock-only bump (version + zipball ref), verified against packagist metadata.
dmooibroek
added
the
Agent Review Requested
Goosterhof
left a comment
Goosterhof
left a comment
There was a problem hiding this comment.
✅ Approve-worthy
0 blockers · 0 majors · 0 minors · 0 nits · 1 praise · 0 inline
Lockfile-only bump of league/commonmark 2.8.3 → 2.9.0, clearing six advisories (<2.9.0) that were failing the repo's composer audit gate on an unchanged lock. Diff is exactly the version, source reference, and dist reference/URL on composer.lock:1219-1227 — require is unchanged between the two tags per packagist metadata, matching the PR body's claim. No composer.json change, so no semver-range widening to scrutinize. All three checks (check (8.4), check (8.5), ci-passed) plus town-crier/gate are green on b570879fb, and the audit-clearing claim is self-verifying here — a broken bump would have failed check outright.
praise: correctly diagnosing that Audit gating the whole CI leg means any fresh advisory on an unchanged lock blackouts every other check repo-wide (format/test/coverage never ran on #61/#58 until this landed) is the right read of the actual failure mode, not just "audit is red, bump the dep." The PR body's own follow-up note (split audit into its own required job so a future advisory doesn't hide real signal) is a fair scope call to leave for later rather than fold into this fix.
Automated war-room agent review — posted because this PR carries the Agent Review Requested label.
2 participants
Six
league/commonmarkadvisories (2 CVEs + DoS PKSAs, all<2.9.0) published 2026-08-06 failcomposer auditon the unchanged lock — and the Audit step runs before format/test, so every CI leg repo-wide dies before running a single check (first hit: #61; #58 goes red on its next push too).Lock-only bump of the transitive dev dependency: version + zipball reference,
requireset identical between 2.8.3 and 2.9.0 (verified against packagist metadata). No composer.json change.CI on this PR is the verification: install resolves the new ref, audit clears, format/test/coverage actually run.
Note for a follow-up: Audit gating the whole leg means any fresh advisory on an unchanged lock hides all test signal repo-wide — worth splitting audit into its own required job.