Update dependency symfony/phpunit-bridge to v3.4.26 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/phpunit-bridge (source)	3.3.9 → 3.4.26

---

Deserialization of untrusted data in Symfony

CVE-2019-10912 / GHSA-w2fr-65vp-mxw3

More information

Details

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-10912
• https://github.com/symfony/symfony/commit/4fb975281634b8d49ebf013af9e502e67c28816b
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-10912.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/phpunit-bridge/CVE-2019-10912.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10912.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
• https://seclists.org/bugtraq/2019/May/21
• https://symfony.com/blog/cve-2019-10912-prevent-destructors-with-side-effects-from-being-unserialized
• https://symfony.com/cve-2019-10912
• https://typo3.org/security/advisory/typo3-core-sa-2019-016/
• https://www.debian.org/security/2019/dsa-4441
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-10912.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2019-10912.yaml
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42UEKSLKJB72P24JBWVN6AADHLMYSUQD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QEAOZXVNDA63537A2OIH4QE77EKZR5O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAC2TQVEEH5FDJSSWPM2BCRIPTCOEMMO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BHHIG4GMSGEIDT3RITSW7GJ5NT6IBHXU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LFARAUAWZE4UDSKVDWRD35D75HI5UGSD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDSM576XIOVXVCMHNJHLBBZBTOD62LDA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTJGZJLPG5FHKFH7KNAKNTWOGBB6LXAL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLOZX5BZMQKWG7PJRQL6MB5CAMKBQAWD/
• https://typo3.org/security/advisory/typo3-core-sa-2019-016
• https://github.com/advisories/GHSA-w2fr-65vp-mxw3

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

symfony/phpunit-bridge (symfony/phpunit-bridge)

v3.4.26

Compare Source

v3.4.25

Compare Source

v3.4.24

Compare Source

v3.4.23

Compare Source

v3.4.22

Compare Source

v3.4.21

Compare Source

v3.4.20

Compare Source

v3.4.19

Compare Source

v3.4.18

Compare Source

v3.4.17

Compare Source

v3.4.16

Compare Source

v3.4.15

Compare Source

v3.4.14

Compare Source

v3.4.13

Compare Source

v3.4.12

Compare Source

v3.4.11

Compare Source

v3.4.10

Compare Source

v3.4.9

Compare Source

v3.4.8

Compare Source

v3.4.7

Compare Source

v3.4.6

Compare Source

v3.4.5

Compare Source

v3.4.4

Compare Source

v3.4.3

Compare Source

v3.4.2

Compare Source

v3.4.1

Compare Source

v3.4.0

Compare Source

• added a CoverageListener to enhance the code coverage report
• all deprecations but those from tests marked with @group legacy are always
  displayed when not in weak mode

v3.3.18

Compare Source

v3.3.17

Compare Source

v3.3.16

Compare Source

v3.3.15

Compare Source

v3.3.14

Compare Source

v3.3.13

Compare Source

v3.3.12

Compare Source

v3.3.11

Compare Source

v3.3.10

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update symfony/phpunit-bridge:3.4.26 --with-dependencies --ignore-platform-reqs --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Deprecation Notice: Composer\Command\ShowCommand::printPackageInfo(): Implicitly marking parameter $latestPackage as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Command/ShowCommand.php:586
Deprecation Notice: Composer\Command\ShowCommand::printMeta(): Implicitly marking parameter $latestPackage as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Command/ShowCommand.php:614
Deprecation Notice: Composer\Command\ShowCommand::printPackageInfoAsJson(): Implicitly marking parameter $latestPackage as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Command/ShowCommand.php:762
Deprecation Notice: Composer\Command\ArchiveCommand::archive(): Implicitly marking parameter $composer as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Command/ArchiveCommand.php:108
Deprecation Notice: Constant E_STRICT is deprecated since 8.4, the error level was removed in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Util/Silencer.php:36
Deprecation Notice: Composer\Json\JsonFile::__construct(): Implicitly marking parameter $rfs as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Json/JsonFile.php:51
Deprecation Notice: Composer\Json\JsonFile::__construct(): Implicitly marking parameter $io as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Json/JsonFile.php:51
Deprecation Notice: JsonSchema\Constraints\BaseConstraint::__construct(): Implicitly marking parameter $factory as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/BaseConstraint.php:41
Deprecation Notice: JsonSchema\Constraints\BaseConstraint::addError(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/BaseConstraint.php:46
Deprecation Notice: JsonSchema\Constraints\BaseConstraint::addError(): Implicitly marking parameter $more as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/BaseConstraint.php:46
Deprecation Notice: JsonSchema\Constraints\Factory::__construct(): Implicitly marking parameter $schemaStorage as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Factory.php:77
Deprecation Notice: JsonSchema\Constraints\Factory::__construct(): Implicitly marking parameter $uriRetriever as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Factory.php:78
Deprecation Notice: JsonSchema\Constraints\Constraint::incrementPath(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:42
Deprecation Notice: JsonSchema\Constraints\Constraint::checkArray(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:68
Deprecation Notice: JsonSchema\Constraints\Constraint::checkObject(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:86
Deprecation Notice: JsonSchema\Constraints\Constraint::checkType(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:103
Deprecation Notice: JsonSchema\Constraints\Constraint::checkUndefined(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:119
Deprecation Notice: JsonSchema\Constraints\Constraint::checkString(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:136
Deprecation Notice: JsonSchema\Constraints\Constraint::checkNumber(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:152
Deprecation Notice: JsonSchema\Constraints\Constraint::checkEnum(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:168
Deprecation Notice: JsonSchema\Constraints\Constraint::checkFormat(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/Constraint.php:184
Deprecation Notice: JsonSchema\Constraints\ConstraintInterface::addError(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ConstraintInterface.php:43
Deprecation Notice: JsonSchema\Constraints\ConstraintInterface::addError(): Implicitly marking parameter $more as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ConstraintInterface.php:43
Deprecation Notice: JsonSchema\Constraints\ConstraintInterface::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ConstraintInterface.php:64
Deprecation Notice: JsonSchema\SchemaStorage::__construct(): Implicitly marking parameter $uriRetriever as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/SchemaStorage.php:20
Deprecation Notice: JsonSchema\SchemaStorage::__construct(): Implicitly marking parameter $uriResolver as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/SchemaStorage.php:21
Deprecation Notice: JsonSchema\Constraints\SchemaConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/SchemaConstraint.php:31
Deprecation Notice: JsonSchema\Constraints\UndefinedConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/UndefinedConstraint.php:34
Deprecation Notice: The predefined locally scoped $http_response_header variable is deprecated, call http_get_last_response_headers() instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Uri/Retrievers/FileGetContents.php:55
Deprecation Notice: JsonSchema\Constraints\TypeConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/TypeConstraint.php:42
Deprecation Notice: JsonSchema\Constraints\ObjectConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ObjectConstraint.php:30
Deprecation Notice: JsonSchema\Constraints\ObjectConstraint::validatePatternProperties(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ObjectConstraint.php:54
Deprecation Notice: JsonSchema\Constraints\ObjectConstraint::validateElement(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ObjectConstraint.php:93
Deprecation Notice: JsonSchema\Constraints\ObjectConstraint::validateProperties(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ObjectConstraint.php:135
Deprecation Notice: JsonSchema\Constraints\ObjectConstraint::validateMinMaxConstraint(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/ObjectConstraint.php:177
Deprecation Notice: JsonSchema\Constraints\StringConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/StringConstraint.php:25
Deprecation Notice: JsonSchema\Constraints\FormatConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/FormatConstraint.php:27
Deprecation Notice: JsonSchema\Constraints\EnumConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/EnumConstraint.php:25
Deprecation Notice: JsonSchema\Constraints\CollectionConstraint::check(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/CollectionConstraint.php:25
Deprecation Notice: JsonSchema\Constraints\CollectionConstraint::validateItems(): Implicitly marking parameter $path as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/vendor/justinrainbow/json-schema/src/JsonSchema/Constraints/CollectionConstraint.php:64
Deprecation Notice: Composer\Config::prohibitUrlByConfig(): Implicitly marking parameter $io as nullable is deprecated, the explicit nullable type must be used instead in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Config.php:450
Deprecation Notice: Constant E_STRICT is deprecated since 8.4, the error level was removed in phar:///opt/containerbase/tools/composer/1.10.27/bin/composer/src/Composer/Util/Silencer.php:36

                                                                                                                                                                                                                                                                                                                                                                                                                                                                  
  [UnexpectedValueException]                                                                                                                                                                                                                                                                                                                                                                                                                                      
  Your github oauth token for github.com contains invalid characters: "**redacted**"  
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  

update [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--lock] [--no-custom-installers] [--no-autoloader] [--no-scripts] [--no-progress] [--no-suggest] [--with-dependencies] [--with-all-dependencies] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--ignore-platform-reqs] [--prefer-stable] [--prefer-lowest] [-i|--interactive] [--root-reqs] [--] [<packages>]...

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request