[TikiWiki-commits] [Git][tikiwiki/tiki][30.x] 2 commits: [FIX] Composer: Ignore inapplicable WebAuthn security advisory

ushindi bienvenu pushed to branch 30.x at Tiki Wiki CMS Groupware / Tiki


Commits:
e431219c by ushindi bienvenu at 2026-07-16T23:23:10+02:00
[FIX] Composer: Ignore inapplicable WebAuthn security advisory
---
* [FIX] Composer: Ignore inapplicable WebAuthn security advisory

See merge request tikiwiki/tiki!10739

- - - - -
69425ea3 by ushindi bienvenu at 2026-07-16T23:23:10+02:00
[FIX] Restore TWVersion after beta release

- - - - -


2 changed files:

- lib/setup/twversion.class.php
- vendor_bundled/composer.json


Changes:

=====================================
lib/setup/twversion.class.php
=====================================
@@ -46,7 +46,7 @@ class TWVersion
         $this->branch   = 'unstable';
 
         // Set everything else, including defaults.
-        $this->version  = '30.0beta';
+        $this->version  = '30.0vcs';
         $this->star     = 'Alpheratz';
         $this->releases = [];
 


=====================================
vendor_bundled/composer.json
=====================================
@@ -375,6 +375,13 @@
     "config": {
         "process-timeout": 5000,
         "bin-dir": "../bin",
+        "policy": {
+            "advisories": {
+                "ignore-id": [
+                    "PKSA-zk1n-qbm6-d3rq"
+                ]
+            }
+        },
         "_comment": [
             "platform-check CANNOT be enabled, because it would check the ext-* requirements of our dependencies not just ours.",
             "See the workarounds below.  So for example anything that uses the autoloader, including console.php wouldn't work on a server ",
@@ -408,6 +415,9 @@
             "php-http/discovery": true
         },
         "audit": {
+            "ignore": {
+                "PKSA-zk1n-qbm6-d3rq": "Tiki does not use SimpleFakeCredentialGenerator or username-based fake credential lists. Its WebAuthn login uses discoverable credentials and resolves the user from the submitted credential ID, so the affected code path is unreachable. Upgrade to web-auth/webauthn-lib 5.x is deferred while Tiki supports PHP 8.1."
+            },
             "ignore-abandoned": {
                 "candy-chat/xmpp-prebind-php": "Work scheduled for removal next month.",
                 "laminas/laminas-loader": "Required transitively by laminas/laminas-http but will be solved in 3.0 https://github.com/laminas/laminas-http/pull/110",



View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/compare/d879c35af5f7a603d1e1282594240f33d6899835...69425ea3190b82a9e85b7b6c445af68f00892b59

-- 
View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/compare/d879c35af5f7a603d1e1282594240f33d6899835...69425ea3190b82a9e85b7b6c445af68f00892b59
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help

_______________________________________________
TikiWiki-cvs mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs