Compare commits

..

5 commits

Author SHA1 Message Date
Jan Böhmer
805319c6b0 Updated dependencies
Some checks failed
Build assets artifact / Build assets artifact (push) Has been cancelled
Docker Image Build / build (linux/amd64, amd64, ubuntu-latest) (push) Has been cancelled
Docker Image Build / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Has been cancelled
Docker Image Build / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Has been cancelled
Docker Image Build (FrankenPHP) / build (linux/amd64, amd64, ubuntu-latest) (push) Has been cancelled
Docker Image Build (FrankenPHP) / build (linux/arm/v7, armv7, ubuntu-24.04-arm) (push) Has been cancelled
Docker Image Build (FrankenPHP) / build (linux/arm64, arm64, ubuntu-24.04-arm) (push) Has been cancelled
Static analysis / Static analysis (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, mysql) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, mysql) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, mysql) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, mysql) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, postgres) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, postgres) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, postgres) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, postgres) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.2, sqlite) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.3, sqlite) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.4, sqlite) (push) Has been cancelled
PHPUnit Tests / PHPUnit and coverage Test (PHP 8.5, sqlite) (push) Has been cancelled
Docker Image Build / merge (push) Has been cancelled
Docker Image Build (FrankenPHP) / merge (push) Has been cancelled
2026-07-14 18:42:06 +02:00
Jan Böhmer
b604128afa Merge remote-tracking branch 'origin/master' 2026-07-14 18:15:03 +02:00
Jan Böhmer
5110915de2 Prevent formula injection into XLSX export 2026-07-14 18:14:59 +02:00
Jan Böhmer
f53f77f6dc Updated dependencies 2026-07-11 17:38:45 +02:00
Jan Böhmer
76a36386fc Refactored size checks for attachments and check base64 upload length 2026-07-09 19:33:11 +02:00
10 changed files with 894 additions and 889 deletions

View file

@ -27,7 +27,7 @@
"doctrine/doctrine-migrations-bundle": "^3.0", "doctrine/doctrine-migrations-bundle": "^3.0",
"doctrine/orm": "^3.2.0", "doctrine/orm": "^3.2.0",
"dompdf/dompdf": "^3.1.2", "dompdf/dompdf": "^3.1.2",
"gregwar/captcha-bundle": "^2.1.0", "gregwar/captcha-bundle": "^3.0.0",
"hshn/base64-encoded-file": "^6.0", "hshn/base64-encoded-file": "^6.0",
"jbtronics/2fa-webauthn": "^3.0.0", "jbtronics/2fa-webauthn": "^3.0.0",
"jbtronics/dompdf-font-loader-bundle": "^1.0.0", "jbtronics/dompdf-font-loader-bundle": "^1.0.0",

288
composer.lock generated
View file

@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically" "This file is @generated automatically"
], ],
"content-hash": "6a79fa73091c2e15bce035c85c2d61ed", "content-hash": "1b475df042448d8143469da476afbd8f",
"packages": [ "packages": [
{ {
"name": "amphp/amp", "name": "amphp/amp",
@ -615,16 +615,16 @@
}, },
{ {
"name": "amphp/pipeline", "name": "amphp/pipeline",
"version": "v1.2.5", "version": "v1.2.6",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/amphp/pipeline.git", "url": "https://github.com/amphp/pipeline.git",
"reference": "92f121dde31cd1d89d5d0f9eba64ac40271b236e" "reference": "10941bf38de5c585aa2407b2ec4265d806d4eef2"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/amphp/pipeline/zipball/92f121dde31cd1d89d5d0f9eba64ac40271b236e", "url": "https://api.github.com/repos/amphp/pipeline/zipball/10941bf38de5c585aa2407b2ec4265d806d4eef2",
"reference": "92f121dde31cd1d89d5d0f9eba64ac40271b236e", "reference": "10941bf38de5c585aa2407b2ec4265d806d4eef2",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -670,7 +670,7 @@
], ],
"support": { "support": {
"issues": "https://github.com/amphp/pipeline/issues", "issues": "https://github.com/amphp/pipeline/issues",
"source": "https://github.com/amphp/pipeline/tree/v1.2.5" "source": "https://github.com/amphp/pipeline/tree/v1.2.6"
}, },
"funding": [ "funding": [
{ {
@ -678,7 +678,7 @@
"type": "github" "type": "github"
} }
], ],
"time": "2026-06-27T14:17:20+00:00" "time": "2026-06-27T16:15:40+00:00"
}, },
{ {
"name": "amphp/process", "name": "amphp/process",
@ -976,7 +976,7 @@
}, },
{ {
"name": "api-platform/doctrine-common", "name": "api-platform/doctrine-common",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/doctrine-common.git", "url": "https://github.com/api-platform/doctrine-common.git",
@ -1060,22 +1060,22 @@
"rest" "rest"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/doctrine-common/tree/v4.3.16" "source": "https://github.com/api-platform/doctrine-common/tree/v4.3.17"
}, },
"time": "2026-06-16T14:59:18+00:00" "time": "2026-06-16T14:59:18+00:00"
}, },
{ {
"name": "api-platform/doctrine-orm", "name": "api-platform/doctrine-orm",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/doctrine-orm.git", "url": "https://github.com/api-platform/doctrine-orm.git",
"reference": "0ed8501b05c3e2ecd97aeb727987d6202812bfe9" "reference": "8da8676d5933235aa3592e613f837fe3c687a0cb"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/api-platform/doctrine-orm/zipball/0ed8501b05c3e2ecd97aeb727987d6202812bfe9", "url": "https://api.github.com/repos/api-platform/doctrine-orm/zipball/8da8676d5933235aa3592e613f837fe3c687a0cb",
"reference": "0ed8501b05c3e2ecd97aeb727987d6202812bfe9", "reference": "8da8676d5933235aa3592e613f837fe3c687a0cb",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -1149,13 +1149,13 @@
"rest" "rest"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/doctrine-orm/tree/v4.3.16" "source": "https://github.com/api-platform/doctrine-orm/tree/v4.3.17"
}, },
"time": "2026-07-03T05:41:53+00:00" "time": "2026-07-08T06:49:21+00:00"
}, },
{ {
"name": "api-platform/documentation", "name": "api-platform/documentation",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/documentation.git", "url": "https://github.com/api-platform/documentation.git",
@ -1218,7 +1218,7 @@
}, },
{ {
"name": "api-platform/http-cache", "name": "api-platform/http-cache",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/http-cache.git", "url": "https://github.com/api-platform/http-cache.git",
@ -1298,7 +1298,7 @@
}, },
{ {
"name": "api-platform/hydra", "name": "api-platform/hydra",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/hydra.git", "url": "https://github.com/api-platform/hydra.git",
@ -1379,13 +1379,13 @@
"rest" "rest"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/hydra/tree/v4.3.16" "source": "https://github.com/api-platform/hydra/tree/v4.3.17"
}, },
"time": "2026-06-22T16:14:53+00:00" "time": "2026-06-22T16:14:53+00:00"
}, },
{ {
"name": "api-platform/json-api", "name": "api-platform/json-api",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/json-api.git", "url": "https://github.com/api-platform/json-api.git",
@ -1461,13 +1461,13 @@
"rest" "rest"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/json-api/tree/v4.3.16" "source": "https://github.com/api-platform/json-api/tree/v4.3.17"
}, },
"time": "2026-06-17T18:14:46+00:00" "time": "2026-06-17T18:14:46+00:00"
}, },
{ {
"name": "api-platform/json-schema", "name": "api-platform/json-schema",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/json-schema.git", "url": "https://github.com/api-platform/json-schema.git",
@ -1542,13 +1542,13 @@
"swagger" "swagger"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/json-schema/tree/v4.3.16" "source": "https://github.com/api-platform/json-schema/tree/v4.3.17"
}, },
"time": "2026-06-29T14:45:14+00:00" "time": "2026-06-29T14:45:14+00:00"
}, },
{ {
"name": "api-platform/jsonld", "name": "api-platform/jsonld",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/jsonld.git", "url": "https://github.com/api-platform/jsonld.git",
@ -1622,13 +1622,13 @@
"rest" "rest"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/jsonld/tree/v4.3.16" "source": "https://github.com/api-platform/jsonld/tree/v4.3.17"
}, },
"time": "2026-06-13T05:11:46+00:00" "time": "2026-06-13T05:11:46+00:00"
}, },
{ {
"name": "api-platform/metadata", "name": "api-platform/metadata",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/metadata.git", "url": "https://github.com/api-platform/metadata.git",
@ -1720,13 +1720,13 @@
"swagger" "swagger"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/metadata/tree/v4.3.16" "source": "https://github.com/api-platform/metadata/tree/v4.3.17"
}, },
"time": "2026-07-03T06:30:28+00:00" "time": "2026-07-03T06:30:28+00:00"
}, },
{ {
"name": "api-platform/openapi", "name": "api-platform/openapi",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/openapi.git", "url": "https://github.com/api-platform/openapi.git",
@ -1811,22 +1811,22 @@
"swagger" "swagger"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/openapi/tree/v4.3.16" "source": "https://github.com/api-platform/openapi/tree/v4.3.17"
}, },
"time": "2026-06-16T10:01:53+00:00" "time": "2026-06-16T10:01:53+00:00"
}, },
{ {
"name": "api-platform/serializer", "name": "api-platform/serializer",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/serializer.git", "url": "https://github.com/api-platform/serializer.git",
"reference": "05762288751c2ef115992b46a1bf9341a8b9a37c" "reference": "946998cb8203e7dee5ddd716d4c0e20098d2bf69"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/api-platform/serializer/zipball/05762288751c2ef115992b46a1bf9341a8b9a37c", "url": "https://api.github.com/repos/api-platform/serializer/zipball/946998cb8203e7dee5ddd716d4c0e20098d2bf69",
"reference": "05762288751c2ef115992b46a1bf9341a8b9a37c", "reference": "946998cb8203e7dee5ddd716d4c0e20098d2bf69",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -1905,22 +1905,22 @@
"serializer" "serializer"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/serializer/tree/v4.3.16" "source": "https://github.com/api-platform/serializer/tree/v4.3.17"
}, },
"time": "2026-07-03T05:42:16+00:00" "time": "2026-07-11T23:00:58+00:00"
}, },
{ {
"name": "api-platform/state", "name": "api-platform/state",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/state.git", "url": "https://github.com/api-platform/state.git",
"reference": "648fc831bf5e918b8c907257f94be75205a389db" "reference": "2a9a18aad1c3363a32381f8c6e21c41334e23b88"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/api-platform/state/zipball/648fc831bf5e918b8c907257f94be75205a389db", "url": "https://api.github.com/repos/api-platform/state/zipball/2a9a18aad1c3363a32381f8c6e21c41334e23b88",
"reference": "648fc831bf5e918b8c907257f94be75205a389db", "reference": "2a9a18aad1c3363a32381f8c6e21c41334e23b88",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -2002,22 +2002,22 @@
"swagger" "swagger"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/state/tree/v4.3.16" "source": "https://github.com/api-platform/state/tree/v4.3.17"
}, },
"time": "2026-07-02T11:05:59+00:00" "time": "2026-07-11T07:03:31+00:00"
}, },
{ {
"name": "api-platform/symfony", "name": "api-platform/symfony",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/symfony.git", "url": "https://github.com/api-platform/symfony.git",
"reference": "4814552f6a47b5495d310779318cc2213ff46591" "reference": "55d387dc3d7384791015373030d1430c7c4d9f5e"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/api-platform/symfony/zipball/4814552f6a47b5495d310779318cc2213ff46591", "url": "https://api.github.com/repos/api-platform/symfony/zipball/55d387dc3d7384791015373030d1430c7c4d9f5e",
"reference": "4814552f6a47b5495d310779318cc2213ff46591", "reference": "55d387dc3d7384791015373030d1430c7c4d9f5e",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -2131,13 +2131,13 @@
"symfony" "symfony"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/symfony/tree/v4.3.16" "source": "https://github.com/api-platform/symfony/tree/v4.3.17"
}, },
"time": "2026-07-03T06:30:28+00:00" "time": "2026-07-08T06:54:33+00:00"
}, },
{ {
"name": "api-platform/validator", "name": "api-platform/validator",
"version": "v4.3.16", "version": "v4.3.17",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/api-platform/validator.git", "url": "https://github.com/api-platform/validator.git",
@ -2207,7 +2207,7 @@
"validator" "validator"
], ],
"support": { "support": {
"source": "https://github.com/api-platform/validator/tree/v4.3.16" "source": "https://github.com/api-platform/validator/tree/v4.3.17"
}, },
"time": "2026-05-07T11:45:31+00:00" "time": "2026-05-07T11:45:31+00:00"
}, },
@ -4510,27 +4510,30 @@
}, },
{ {
"name": "gregwar/captcha", "name": "gregwar/captcha",
"version": "v1.3.0", "version": "v2.1.0",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/Gregwar/Captcha.git", "url": "https://github.com/Gregwar/Captcha.git",
"reference": "4edbcd09fde4353b94ce550f43460eba73baf2cc" "reference": "3c2f6f0c301b94d9ec18ba769015a8a32b95765c"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/Gregwar/Captcha/zipball/4edbcd09fde4353b94ce550f43460eba73baf2cc", "url": "https://api.github.com/repos/Gregwar/Captcha/zipball/3c2f6f0c301b94d9ec18ba769015a8a32b95765c",
"reference": "4edbcd09fde4353b94ce550f43460eba73baf2cc", "reference": "3c2f6f0c301b94d9ec18ba769015a8a32b95765c",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"ext-fileinfo": "*", "ext-fileinfo": "*",
"ext-gd": "*", "ext-gd": "*",
"ext-mbstring": "*", "ext-mbstring": "*",
"php": ">=5.3.0", "php": "^8.2",
"symfony/finder": "*" "symfony/finder": "*"
}, },
"require-dev": { "require-dev": {
"phpunit/phpunit": "^4.8.35 || ^5.7.21 || ^6.4 || ^7.0 || ^8.0 || ^9.0" "phpstan/phpstan": "2.1.17",
"phpstan/phpstan-phpunit": "2.0.6",
"phpunit/phpunit": "^9.6",
"squizlabs/php_codesniffer": "4.0.1"
}, },
"type": "library", "type": "library",
"autoload": { "autoload": {
@ -4562,28 +4565,28 @@
], ],
"support": { "support": {
"issues": "https://github.com/Gregwar/Captcha/issues", "issues": "https://github.com/Gregwar/Captcha/issues",
"source": "https://github.com/Gregwar/Captcha/tree/v1.3.0" "source": "https://github.com/Gregwar/Captcha/tree/v2.1.0"
}, },
"time": "2025-06-23T12:25:54+00:00" "time": "2026-06-16T13:04:08+00:00"
}, },
{ {
"name": "gregwar/captcha-bundle", "name": "gregwar/captcha-bundle",
"version": "v2.5.0", "version": "v3.0.0",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/Gregwar/CaptchaBundle.git", "url": "https://github.com/Gregwar/CaptchaBundle.git",
"reference": "b129efda562bf8361ca6eb77043036813f749de6" "reference": "251aa803c9df56b755d342e455e1f5c572efc2f5"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/Gregwar/CaptchaBundle/zipball/b129efda562bf8361ca6eb77043036813f749de6", "url": "https://api.github.com/repos/Gregwar/CaptchaBundle/zipball/251aa803c9df56b755d342e455e1f5c572efc2f5",
"reference": "b129efda562bf8361ca6eb77043036813f749de6", "reference": "251aa803c9df56b755d342e455e1f5c572efc2f5",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"ext-gd": "*", "ext-gd": "*",
"gregwar/captcha": "^1.2.1", "gregwar/captcha": "^2.1",
"php": ">=8.0.2", "php": ">=8.2",
"symfony/form": "~6.0|~7.0|~8.0", "symfony/form": "~6.0|~7.0|~8.0",
"symfony/framework-bundle": "~6.0|~7.0|~8.0", "symfony/framework-bundle": "~6.0|~7.0|~8.0",
"symfony/translation": "~6.0|~7.0|~8.0", "symfony/translation": "~6.0|~7.0|~8.0",
@ -4591,7 +4594,7 @@
}, },
"require-dev": { "require-dev": {
"friendsofphp/php-cs-fixer": "^3.45", "friendsofphp/php-cs-fixer": "^3.45",
"phpstan/phpstan": "^1.10", "phpstan/phpstan": "^2.2.5",
"symplify/easy-coding-standard": "^12" "symplify/easy-coding-standard": "^12"
}, },
"type": "symfony-bundle", "type": "symfony-bundle",
@ -4629,28 +4632,28 @@
], ],
"support": { "support": {
"issues": "https://github.com/Gregwar/CaptchaBundle/issues", "issues": "https://github.com/Gregwar/CaptchaBundle/issues",
"source": "https://github.com/Gregwar/CaptchaBundle/tree/v2.5.0" "source": "https://github.com/Gregwar/CaptchaBundle/tree/v3.0.0"
}, },
"time": "2026-01-08T10:51:57+00:00" "time": "2026-07-09T10:41:14+00:00"
}, },
{ {
"name": "guzzlehttp/guzzle", "name": "guzzlehttp/guzzle",
"version": "7.13.3", "version": "7.14.1",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/guzzle/guzzle.git", "url": "https://github.com/guzzle/guzzle.git",
"reference": "caa5491e1030fd120247f42fb3331ecf38da3b26" "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/guzzle/guzzle/zipball/caa5491e1030fd120247f42fb3331ecf38da3b26", "url": "https://api.github.com/repos/guzzle/guzzle/zipball/6b1d2429a2c312474c523aa9017fba0c07b5f4a0",
"reference": "caa5491e1030fd120247f42fb3331ecf38da3b26", "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
"ext-json": "*", "ext-json": "*",
"guzzlehttp/promises": "^2.5.1", "guzzlehttp/promises": "^2.5.1",
"guzzlehttp/psr7": "^2.12.4", "guzzlehttp/psr7": "^2.12.5",
"php": "^7.2.5 || ^8.0", "php": "^7.2.5 || ^8.0",
"psr/http-client": "^1.0", "psr/http-client": "^1.0",
"symfony/deprecation-contracts": "^2.5 || ^3.0", "symfony/deprecation-contracts": "^2.5 || ^3.0",
@ -4743,7 +4746,7 @@
], ],
"support": { "support": {
"issues": "https://github.com/guzzle/guzzle/issues", "issues": "https://github.com/guzzle/guzzle/issues",
"source": "https://github.com/guzzle/guzzle/tree/7.13.3" "source": "https://github.com/guzzle/guzzle/tree/7.14.1"
}, },
"funding": [ "funding": [
{ {
@ -4759,7 +4762,7 @@
"type": "tidelift" "type": "tidelift"
} }
], ],
"time": "2026-07-08T16:10:19+00:00" "time": "2026-07-13T01:32:54+00:00"
}, },
{ {
"name": "guzzlehttp/promises", "name": "guzzlehttp/promises",
@ -4847,16 +4850,16 @@
}, },
{ {
"name": "guzzlehttp/psr7", "name": "guzzlehttp/psr7",
"version": "2.12.4", "version": "2.12.5",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/guzzle/psr7.git", "url": "https://github.com/guzzle/psr7.git",
"reference": "51e27f9e2b332ab3e72f4520d5ff4f3c68c3577c" "reference": "9365d578a9fd1552ad6ca9c3cb530708526feb09"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/guzzle/psr7/zipball/51e27f9e2b332ab3e72f4520d5ff4f3c68c3577c", "url": "https://api.github.com/repos/guzzle/psr7/zipball/9365d578a9fd1552ad6ca9c3cb530708526feb09",
"reference": "51e27f9e2b332ab3e72f4520d5ff4f3c68c3577c", "reference": "9365d578a9fd1552ad6ca9c3cb530708526feb09",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -4946,7 +4949,7 @@
], ],
"support": { "support": {
"issues": "https://github.com/guzzle/psr7/issues", "issues": "https://github.com/guzzle/psr7/issues",
"source": "https://github.com/guzzle/psr7/tree/2.12.4" "source": "https://github.com/guzzle/psr7/tree/2.12.5"
}, },
"funding": [ "funding": [
{ {
@ -4962,7 +4965,7 @@
"type": "tidelift" "type": "tidelift"
} }
], ],
"time": "2026-07-08T15:56:20+00:00" "time": "2026-07-13T01:27:20+00:00"
}, },
{ {
"name": "hshn/base64-encoded-file", "name": "hshn/base64-encoded-file",
@ -5963,16 +5966,16 @@
}, },
{ {
"name": "league/commonmark", "name": "league/commonmark",
"version": "2.8.2", "version": "2.8.3",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/thephpleague/commonmark.git", "url": "https://github.com/thephpleague/commonmark.git",
"reference": "59fb075d2101740c337c7216e3f32b36c204218b" "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/thephpleague/commonmark/zipball/59fb075d2101740c337c7216e3f32b36c204218b", "url": "https://api.github.com/repos/thephpleague/commonmark/zipball/1902f60f984235023acbe03db6ad614a37b3c3e7",
"reference": "59fb075d2101740c337c7216e3f32b36c204218b", "reference": "1902f60f984235023acbe03db6ad614a37b3c3e7",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -5994,8 +5997,8 @@
"github/gfm": "0.29.0", "github/gfm": "0.29.0",
"michelf/php-markdown": "^1.4 || ^2.0", "michelf/php-markdown": "^1.4 || ^2.0",
"nyholm/psr7": "^1.5", "nyholm/psr7": "^1.5",
"phpstan/phpstan": "^1.8.2", "phpstan/phpstan": "^2.0.0",
"phpunit/phpunit": "^9.5.21 || ^10.5.9 || ^11.0.0", "phpunit/phpunit": "^9.5.21 || ^10.5.9 || ^11.0.0 || ^12.0.0 || ^13.0.0",
"scrutinizer/ocular": "^1.8.1", "scrutinizer/ocular": "^1.8.1",
"symfony/finder": "^5.3 | ^6.0 | ^7.0 || ^8.0", "symfony/finder": "^5.3 | ^6.0 | ^7.0 || ^8.0",
"symfony/process": "^5.4 | ^6.0 | ^7.0 || ^8.0", "symfony/process": "^5.4 | ^6.0 | ^7.0 || ^8.0",
@ -6066,7 +6069,7 @@
"type": "tidelift" "type": "tidelift"
} }
], ],
"time": "2026-03-19T13:16:38+00:00" "time": "2026-07-12T15:29:16+00:00"
}, },
{ {
"name": "league/config", "name": "league/config",
@ -8958,16 +8961,16 @@
}, },
{ {
"name": "phpoffice/phpspreadsheet", "name": "phpoffice/phpspreadsheet",
"version": "5.8.0", "version": "5.9.0",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/PHPOffice/PhpSpreadsheet.git", "url": "https://github.com/PHPOffice/PhpSpreadsheet.git",
"reference": "01964d92536edf1a3a874b9580a52824bebf6fbb" "reference": "05e99ebf61238a70227b4d9cc02d0030d34f6339"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/PHPOffice/PhpSpreadsheet/zipball/01964d92536edf1a3a874b9580a52824bebf6fbb", "url": "https://api.github.com/repos/PHPOffice/PhpSpreadsheet/zipball/05e99ebf61238a70227b4d9cc02d0030d34f6339",
"reference": "01964d92536edf1a3a874b9580a52824bebf6fbb", "reference": "05e99ebf61238a70227b4d9cc02d0030d34f6339",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -8989,7 +8992,7 @@
"maennchen/zipstream-php": "^2.1 || ^3.0", "maennchen/zipstream-php": "^2.1 || ^3.0",
"markbaker/complex": "^3.0", "markbaker/complex": "^3.0",
"markbaker/matrix": "^3.0", "markbaker/matrix": "^3.0",
"php": "^8.1", "php": "^8.2",
"psr/simple-cache": "^1.0 || ^2.0 || ^3.0" "psr/simple-cache": "^1.0 || ^2.0 || ^3.0"
}, },
"require-dev": { "require-dev": {
@ -9003,7 +9006,7 @@
"phpstan/phpstan": "^1.1 || ^2.0", "phpstan/phpstan": "^1.1 || ^2.0",
"phpstan/phpstan-deprecation-rules": "^1.0 || ^2.0", "phpstan/phpstan-deprecation-rules": "^1.0 || ^2.0",
"phpstan/phpstan-phpunit": "^1.0 || ^2.0", "phpstan/phpstan-phpunit": "^1.0 || ^2.0",
"phpunit/phpunit": "^10.5", "phpunit/phpunit": "^10.5 || ^11.0",
"squizlabs/php_codesniffer": "^3.7", "squizlabs/php_codesniffer": "^3.7",
"tecnickcom/tcpdf": "^6.5" "tecnickcom/tcpdf": "^6.5"
}, },
@ -9061,9 +9064,9 @@
], ],
"support": { "support": {
"issues": "https://github.com/PHPOffice/PhpSpreadsheet/issues", "issues": "https://github.com/PHPOffice/PhpSpreadsheet/issues",
"source": "https://github.com/PHPOffice/PhpSpreadsheet/tree/5.8.0" "source": "https://github.com/PHPOffice/PhpSpreadsheet/tree/5.9.0"
}, },
"time": "2026-06-07T03:51:10+00:00" "time": "2026-07-12T19:17:39+00:00"
}, },
{ {
"name": "phpstan/phpdoc-parser", "name": "phpstan/phpdoc-parser",
@ -17559,16 +17562,16 @@
}, },
{ {
"name": "symplify/easy-coding-standard", "name": "symplify/easy-coding-standard",
"version": "13.2.6", "version": "13.2.7",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/ecsphp/ecs.git", "url": "https://github.com/ecsphp/ecs.git",
"reference": "47114ce652240df25763417eeab89d815323050b" "reference": "735c742244ae3b3b067d5aae3d1dd4b7a48759f7"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/ecsphp/ecs/zipball/47114ce652240df25763417eeab89d815323050b", "url": "https://api.github.com/repos/ecsphp/ecs/zipball/735c742244ae3b3b067d5aae3d1dd4b7a48759f7",
"reference": "47114ce652240df25763417eeab89d815323050b", "reference": "735c742244ae3b3b067d5aae3d1dd4b7a48759f7",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -17603,22 +17606,22 @@
"static analysis" "static analysis"
], ],
"support": { "support": {
"source": "https://github.com/ecsphp/ecs/tree/13.2.6" "source": "https://github.com/ecsphp/ecs/tree/13.2.7"
}, },
"time": "2026-07-04T21:15:32+00:00" "time": "2026-07-11T07:53:39+00:00"
}, },
{ {
"name": "tecnickcom/tc-lib-barcode", "name": "tecnickcom/tc-lib-barcode",
"version": "2.11.3", "version": "2.11.4",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/tecnickcom/tc-lib-barcode.git", "url": "https://github.com/tecnickcom/tc-lib-barcode.git",
"reference": "56d4ca6263b39f57b366161abbcfd37d06a78018" "reference": "8e8486a84b12ae55f8b233588a1ae64f08bf1b6d"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/tecnickcom/tc-lib-barcode/zipball/56d4ca6263b39f57b366161abbcfd37d06a78018", "url": "https://api.github.com/repos/tecnickcom/tc-lib-barcode/zipball/8e8486a84b12ae55f8b233588a1ae64f08bf1b6d",
"reference": "56d4ca6263b39f57b366161abbcfd37d06a78018", "reference": "8e8486a84b12ae55f8b233588a1ae64f08bf1b6d",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -17701,20 +17704,20 @@
"type": "github" "type": "github"
} }
], ],
"time": "2026-07-07T10:25:12+00:00" "time": "2026-07-13T08:24:02+00:00"
}, },
{ {
"name": "tecnickcom/tc-lib-color", "name": "tecnickcom/tc-lib-color",
"version": "2.12.4", "version": "2.12.5",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/tecnickcom/tc-lib-color.git", "url": "https://github.com/tecnickcom/tc-lib-color.git",
"reference": "a9f8b13b3885f5dccdc63ab4e04deb454caab73b" "reference": "71b30de968ca51832b64728a2727210adb3a1708"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/tecnickcom/tc-lib-color/zipball/a9f8b13b3885f5dccdc63ab4e04deb454caab73b", "url": "https://api.github.com/repos/tecnickcom/tc-lib-color/zipball/71b30de968ca51832b64728a2727210adb3a1708",
"reference": "a9f8b13b3885f5dccdc63ab4e04deb454caab73b", "reference": "71b30de968ca51832b64728a2727210adb3a1708",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -17767,7 +17770,7 @@
"type": "github" "type": "github"
} }
], ],
"time": "2026-07-07T10:23:26+00:00" "time": "2026-07-13T08:22:14+00:00"
}, },
{ {
"name": "thecodingmachine/safe", "name": "thecodingmachine/safe",
@ -19646,16 +19649,16 @@
}, },
{ {
"name": "phpstan/phpstan-doctrine", "name": "phpstan/phpstan-doctrine",
"version": "2.0.27", "version": "2.0.28",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/phpstan/phpstan-doctrine.git", "url": "https://github.com/phpstan/phpstan-doctrine.git",
"reference": "39b4ca45a07cdd6366eeefa2f7a993cddf3b9f9f" "reference": "b4623954d5ffee6311e4ddbaef65c074ae0f781a"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/39b4ca45a07cdd6366eeefa2f7a993cddf3b9f9f", "url": "https://api.github.com/repos/phpstan/phpstan-doctrine/zipball/b4623954d5ffee6311e4ddbaef65c074ae0f781a",
"reference": "39b4ca45a07cdd6366eeefa2f7a993cddf3b9f9f", "reference": "b4623954d5ffee6311e4ddbaef65c074ae0f781a",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -19717,9 +19720,9 @@
], ],
"support": { "support": {
"issues": "https://github.com/phpstan/phpstan-doctrine/issues", "issues": "https://github.com/phpstan/phpstan-doctrine/issues",
"source": "https://github.com/phpstan/phpstan-doctrine/tree/2.0.27" "source": "https://github.com/phpstan/phpstan-doctrine/tree/2.0.28"
}, },
"time": "2026-06-10T10:39:35+00:00" "time": "2026-07-13T08:43:43+00:00"
}, },
{ {
"name": "phpstan/phpstan-strict-rules", "name": "phpstan/phpstan-strict-rules",
@ -20289,16 +20292,16 @@
}, },
{ {
"name": "rector/rector", "name": "rector/rector",
"version": "2.5.4", "version": "2.5.7",
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/rectorphp/rector.git", "url": "https://github.com/rectorphp/rector.git",
"reference": "adaa18d7cd6b3c960967cfbc98c03efb3116ac0e" "reference": "ba22f8c087848278fed6b4910d4cf1108096d8d3"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/rectorphp/rector/zipball/adaa18d7cd6b3c960967cfbc98c03efb3116ac0e", "url": "https://api.github.com/repos/rectorphp/rector/zipball/ba22f8c087848278fed6b4910d4cf1108096d8d3",
"reference": "adaa18d7cd6b3c960967cfbc98c03efb3116ac0e", "reference": "ba22f8c087848278fed6b4910d4cf1108096d8d3",
"shasum": "" "shasum": ""
}, },
"require": { "require": {
@ -20337,7 +20340,7 @@
], ],
"support": { "support": {
"issues": "https://github.com/rectorphp/rector/issues", "issues": "https://github.com/rectorphp/rector/issues",
"source": "https://github.com/rectorphp/rector/tree/2.5.4" "source": "https://github.com/rectorphp/rector/tree/2.5.7"
}, },
"funding": [ "funding": [
{ {
@ -20345,7 +20348,7 @@
"type": "github" "type": "github"
} }
], ],
"time": "2026-07-06T12:41:46+00:00" "time": "2026-07-13T15:24:18+00:00"
}, },
{ {
"name": "roave/security-advisories", "name": "roave/security-advisories",
@ -20353,18 +20356,18 @@
"source": { "source": {
"type": "git", "type": "git",
"url": "https://github.com/Roave/SecurityAdvisories.git", "url": "https://github.com/Roave/SecurityAdvisories.git",
"reference": "f3cd286075d77e060417bf42edcc29917deab05e" "reference": "8f95407ba11cb3d30d131744f7396c6ad61f2e54"
}, },
"dist": { "dist": {
"type": "zip", "type": "zip",
"url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/f3cd286075d77e060417bf42edcc29917deab05e", "url": "https://api.github.com/repos/Roave/SecurityAdvisories/zipball/8f95407ba11cb3d30d131744f7396c6ad61f2e54",
"reference": "f3cd286075d77e060417bf42edcc29917deab05e", "reference": "8f95407ba11cb3d30d131744f7396c6ad61f2e54",
"shasum": "" "shasum": ""
}, },
"conflict": { "conflict": {
"3f/pygmentize": "<1.2", "3f/pygmentize": "<1.2",
"adaptcms/adaptcms": "<=1.3", "adaptcms/adaptcms": "<=1.3",
"admidio/admidio": "<=5.0.9", "admidio/admidio": "<=5.0.11",
"adodb/adodb-php": "<=5.22.9", "adodb/adodb-php": "<=5.22.9",
"aheinze/cockpit": "<2.2", "aheinze/cockpit": "<2.2",
"aimeos/ai-admin-graphql": ">=2022.04.1,<2022.10.10|>=2023.04.1,<2023.10.6|>=2024.04.1,<2024.07.2", "aimeos/ai-admin-graphql": ">=2022.04.1,<2022.10.10|>=2023.04.1,<2023.10.6|>=2024.04.1,<2024.07.2",
@ -20398,8 +20401,10 @@
"aoe/restler": "<1.7.1", "aoe/restler": "<1.7.1",
"apache-solr-for-typo3/solr": "<2.8.3", "apache-solr-for-typo3/solr": "<2.8.3",
"apereo/phpcas": "<1.6", "apereo/phpcas": "<1.6",
"api-platform/core": "<3.4.17|>=4,<4.0.22|>=4.1,<4.1.5", "api-platform/core": "<4.1.29|>=4.2,<4.2.25|>=4.3,<4.3.8",
"api-platform/graphql": "<3.4.17|>=4,<4.0.22|>=4.1,<4.1.5", "api-platform/graphql": "<3.4.17|>=4,<4.0.22|>=4.1,<4.1.5",
"api-platform/hal": ">=4,<4.1.29|>=4.2,<4.2.25|>=4.3,<4.3.8",
"api-platform/json-api": ">=4,<4.1.29|>=4.2,<4.2.25|>=4.3,<4.3.8",
"appwrite/server-ce": "<=1.2.1", "appwrite/server-ce": "<=1.2.1",
"arc/web": "<3", "arc/web": "<3",
"area17/twill": "<1.2.5|>=2,<2.5.3", "area17/twill": "<1.2.5|>=2,<2.5.3",
@ -20482,7 +20487,7 @@
"clickstorm/cs-seo": ">=6,<6.8|>=7,<7.5|>=8,<8.4|>=9,<9.3", "clickstorm/cs-seo": ">=6,<6.8|>=7,<7.5|>=8,<8.4|>=9,<9.3",
"co-stack/fal_sftp": "<0.2.6", "co-stack/fal_sftp": "<0.2.6",
"cockpit-hq/cockpit": "<=2.14", "cockpit-hq/cockpit": "<=2.14",
"code16/sharp": "<9.22", "code16/sharp": "<9.22.3",
"codeception/codeception": "<3.1.3|>=4,<4.1.22", "codeception/codeception": "<3.1.3|>=4,<4.1.22",
"codeigniter/framework": "<3.1.10", "codeigniter/framework": "<3.1.10",
"codeigniter4/framework": "<4.7.2", "codeigniter4/framework": "<4.7.2",
@ -20497,9 +20502,9 @@
"concrete5/core": "<8.5.8|>=9,<9.1", "concrete5/core": "<8.5.8|>=9,<9.1",
"contao-components/mediaelement": ">=2.14.2,<2.21.1", "contao-components/mediaelement": ">=2.14.2,<2.21.1",
"contao/comments-bundle": ">=2,<4.13.40|>=5.0.0.0-RC1-dev,<5.3.4", "contao/comments-bundle": ">=2,<4.13.40|>=5.0.0.0-RC1-dev,<5.3.4",
"contao/contao": ">=3,<3.5.37|>=4,<4.4.56|>=4.5,<4.13.56|>=5,<5.3.38|>=5.4.0.0-RC1-dev,<5.6.1", "contao/contao": ">=3,<3.5.37|>=4,<4.4.56|>=4.5,<5.3.48|>=5.4,<5.7.9",
"contao/core": "<3.5.39", "contao/core": "<3.5.39",
"contao/core-bundle": "<4.13.57|>=5,<5.3.42|>=5.4,<5.6.5", "contao/core-bundle": "<5.3.48|>=5.4,<5.7.9",
"contao/listing-bundle": ">=3,<=3.5.30|>=4,<4.4.8", "contao/listing-bundle": ">=3,<=3.5.30|>=4,<4.4.8",
"contao/managed-edition": "<=1.5", "contao/managed-edition": "<=1.5",
"coreshop/core-shop": "<4.1.9|==5", "coreshop/core-shop": "<4.1.9|==5",
@ -20632,7 +20637,7 @@
"ezsystems/repository-forms": ">=2.3,<2.3.2.1-dev|>=2.5,<2.5.15", "ezsystems/repository-forms": ">=2.3,<2.3.2.1-dev|>=2.5,<2.5.15",
"ezyang/htmlpurifier": "<=4.2", "ezyang/htmlpurifier": "<=4.2",
"facade/ignition": "<1.16.15|>=2,<2.4.2|>=2.5,<2.5.2", "facade/ignition": "<1.16.15|>=2,<2.4.2|>=2.5,<2.5.2",
"facturascripts/facturascripts": "<=2025.92|>=2026,<=2026.1", "facturascripts/facturascripts": "<=2026.2",
"fastly/magento2": "<1.2.26", "fastly/magento2": "<1.2.26",
"feehi/cms": "<=2.1.1", "feehi/cms": "<=2.1.1",
"feehi/feehicms": "<=2.1.1", "feehi/feehicms": "<=2.1.1",
@ -20792,7 +20797,7 @@
"kelvinmo/simplexrd": "<3.1.1", "kelvinmo/simplexrd": "<3.1.1",
"kevinpapst/kimai2": "<1.16.7", "kevinpapst/kimai2": "<1.16.7",
"khodakhah/nodcms": "<=3.4.1", "khodakhah/nodcms": "<=3.4.1",
"kimai/kimai": "<=2.57", "kimai/kimai": "<2.59",
"kitodo/presentation": "<3.2.3|>=3.3,<3.3.4", "kitodo/presentation": "<3.2.3|>=3.3,<3.3.4",
"klaviyo/magento2-extension": ">=1,<3", "klaviyo/magento2-extension": ">=1,<3",
"knplabs/knp-snappy": "<=1.7", "knplabs/knp-snappy": "<=1.7",
@ -20929,11 +20934,11 @@
"nilsteampassnet/teampass": "<3.1.3.1-dev", "nilsteampassnet/teampass": "<3.1.3.1-dev",
"nitsan/ns-backup": "<13.0.1", "nitsan/ns-backup": "<13.0.1",
"nonfiction/nterchange": "<4.1.1", "nonfiction/nterchange": "<4.1.1",
"notrinos/notrinos-erp": "<=0.7", "notrinos/notrinos-erp": "<=1",
"noumo/easyii": "<=0.9", "noumo/easyii": "<=0.9",
"novaksolutions/infusionsoft-php-sdk": "<1", "novaksolutions/infusionsoft-php-sdk": "<1",
"novosga/novosga": "<=2.2.12", "novosga/novosga": "<=2.2.12",
"nukeviet/nukeviet": "<4.5.02", "nukeviet/nukeviet": "<4.6.00",
"nyholm/psr7": "<1.6.1", "nyholm/psr7": "<1.6.1",
"nystudio107/craft-seomatic": "<3.4.12", "nystudio107/craft-seomatic": "<3.4.12",
"nzedb/nzedb": "<0.8", "nzedb/nzedb": "<0.8",
@ -21012,14 +21017,14 @@
"phpxmlrpc/phpxmlrpc": "<4.9.2", "phpxmlrpc/phpxmlrpc": "<4.9.2",
"phraseanet/phraseanet": "==4.0.3", "phraseanet/phraseanet": "==4.0.3",
"pi/pi": "<=2.5", "pi/pi": "<=2.5",
"pimcore/admin-ui-classic-bundle": "<=2.3.5", "pimcore/admin-ui-classic-bundle": "<1.7.18|>=2.0.0.0-RC1-dev,<=2.3.5",
"pimcore/customer-management-framework-bundle": "<4.2.1", "pimcore/customer-management-framework-bundle": "<4.2.1",
"pimcore/data-hub": "<1.2.4", "pimcore/data-hub": "<1.2.4",
"pimcore/data-importer": "<1.8.9|>=1.9,<1.9.3", "pimcore/data-importer": "<1.8.9|>=1.9,<1.9.3",
"pimcore/demo": "<10.3", "pimcore/demo": "<10.3",
"pimcore/ecommerce-framework-bundle": "<1.0.10", "pimcore/ecommerce-framework-bundle": "<1.0.10",
"pimcore/perspective-editor": "<1.5.1", "pimcore/perspective-editor": "<1.5.1",
"pimcore/pimcore": "<=12.3.8", "pimcore/pimcore": "<=12.3.8|>=2026.1,<2026.1.3",
"pimcore/web2print-tools-bundle": "<=5.2.1|>=6.0.0.0-RC1-dev,<=6.1", "pimcore/web2print-tools-bundle": "<=5.2.1|>=6.0.0.0-RC1-dev,<=6.1",
"piwik/piwik": "<1.11", "piwik/piwik": "<1.11",
"pixelfed/pixelfed": "<0.12.5", "pixelfed/pixelfed": "<0.12.5",
@ -21040,7 +21045,7 @@
"prestashop/ps_checkout": "<5.3", "prestashop/ps_checkout": "<5.3",
"prestashop/ps_contactinfo": "<=3.3.2", "prestashop/ps_contactinfo": "<=3.3.2",
"prestashop/ps_emailsubscription": "<2.6.1", "prestashop/ps_emailsubscription": "<2.6.1",
"prestashop/ps_facetedsearch": "<3.4.1", "prestashop/ps_facetedsearch": "<4.0.4",
"prestashop/ps_linklist": "<3.1", "prestashop/ps_linklist": "<3.1",
"privatebin/privatebin": "<1.4|>=1.5,<1.7.4|>=1.7.7,<2.0.3", "privatebin/privatebin": "<1.4|>=1.5,<1.7.4|>=1.7.7,<2.0.3",
"processwire/processwire": "<=3.0.255", "processwire/processwire": "<=3.0.255",
@ -21183,7 +21188,7 @@
"sylius/grid-bundle": "<1.10.1", "sylius/grid-bundle": "<1.10.1",
"sylius/paypal-plugin": "<1.6.2|>=1.7,<1.7.2|>=2,<2.0.2", "sylius/paypal-plugin": "<1.6.2|>=1.7,<1.7.2|>=2,<2.0.2",
"sylius/resource-bundle": ">=1,<1.3.14|>=1.4,<1.4.7|>=1.5,<1.5.2|>=1.6,<1.6.4", "sylius/resource-bundle": ">=1,<1.3.14|>=1.4,<1.4.7|>=1.5,<1.5.2|>=1.6,<1.6.4",
"sylius/sylius": "<1.9.12|>=1.10,<1.10.16|>=1.11,<1.11.17|>=1.12,<=1.12.22|>=1.13,<=1.13.14|>=1.14,<=1.14.17|>=2,<=2.0.15|>=2.1,<=2.1.11|>=2.2,<=2.2.2", "sylius/sylius": "<1.9.12|>=1.10,<1.10.16|>=1.11,<1.11.17|>=1.12,<=1.12.22|>=1.13,<=1.13.14|>=1.14,<=1.14.17|>=2,<2.0.18|>=2.1,<2.1.15|>=2.2,<2.2.6",
"symbiote/silverstripe-advancedworkflow": "<6.4.5|>=7,<7.1.3|>=7.2,<7.2.1", "symbiote/silverstripe-advancedworkflow": "<6.4.5|>=7,<7.1.3|>=7.2,<7.2.1",
"symbiote/silverstripe-multivaluefield": ">=3,<3.1", "symbiote/silverstripe-multivaluefield": ">=3,<3.1",
"symbiote/silverstripe-queuedjobs": ">=3,<3.0.2|>=3.1,<3.1.4|>=4,<4.0.7|>=4.1,<4.1.2|>=4.2,<4.2.4|>=4.3,<4.3.3|>=4.4,<4.4.3|>=4.5,<4.5.1|>=4.6,<4.6.4", "symbiote/silverstripe-queuedjobs": ">=3,<3.0.2|>=3.1,<3.1.4|>=4,<4.0.7|>=4.1,<4.1.2|>=4.2,<4.2.4|>=4.3,<4.3.3|>=4.4,<4.4.3|>=4.5,<4.5.1|>=4.6,<4.6.4",
@ -21274,7 +21279,7 @@
"twig/intl-extra": "<3.26", "twig/intl-extra": "<3.26",
"twig/markdown-extra": "<3.26", "twig/markdown-extra": "<3.26",
"twig/twig": "<3.27", "twig/twig": "<3.27",
"typicms/core": "<16.1.7", "typicms/core": "<12.0.5|>=13,<13.0.9|>=14,<14.0.27|>=15,<15.0.29|>=16,<16.1.7",
"typo3/cms": "<9.5.29|>=10,<10.4.35|>=11,<11.5.23|>=12,<12.2", "typo3/cms": "<9.5.29|>=10,<10.4.35|>=11,<11.5.23|>=12,<12.2",
"typo3/cms-backend": "<10.4.57|>=11,<11.5.51|>=12,<12.4.46|>=13,<13.4.31|>=14,<14.3.3", "typo3/cms-backend": "<10.4.57|>=11,<11.5.51|>=12,<12.4.46|>=13,<13.4.31|>=14,<14.3.3",
"typo3/cms-belog": ">=10,<=10.4.47|>=11,<=11.5.41|>=12,<=12.4.24|>=13,<=13.4.2", "typo3/cms-belog": ">=10,<=10.4.47|>=11,<=11.5.41|>=12,<=12.4.24|>=13,<=13.4.2",
@ -21355,6 +21360,7 @@
"winter/wn-system-module": "<1.2.4", "winter/wn-system-module": "<1.2.4",
"wintercms/winter": "<=1.2.3", "wintercms/winter": "<=1.2.3",
"wireui/wireui": "<1.19.3|>=2,<2.1.3", "wireui/wireui": "<1.19.3|>=2,<2.1.3",
"wnx/laravel-backup-restore": "<=1.9.3",
"woocommerce/woocommerce": "<6.6|>=8.8,<8.8.5|>=8.9,<8.9.3", "woocommerce/woocommerce": "<6.6|>=8.8,<8.8.5|>=8.9,<8.9.3",
"wp-cli/wp-cli": ">=0.12,<2.5", "wp-cli/wp-cli": ">=0.12,<2.5",
"wp-graphql/wp-graphql": "<=1.14.5", "wp-graphql/wp-graphql": "<=1.14.5",
@ -21368,7 +21374,7 @@
"xpressengine/xpressengine": "<3.0.15", "xpressengine/xpressengine": "<3.0.15",
"yab/quarx": "<2.4.5", "yab/quarx": "<2.4.5",
"yansongda/pay": "<=3.7.19", "yansongda/pay": "<=3.7.19",
"yeswiki/yeswiki": "<4.6.4", "yeswiki/yeswiki": "<4.6.6",
"yetiforce/yetiforce-crm": "<6.5", "yetiforce/yetiforce-crm": "<6.5",
"yidashi/yii2cmf": "<=2", "yidashi/yii2cmf": "<=2",
"yii2mod/yii2-cms": "<1.9.2", "yii2mod/yii2-cms": "<1.9.2",
@ -21463,7 +21469,7 @@
"type": "tidelift" "type": "tidelift"
} }
], ],
"time": "2026-07-08T02:37:08+00:00" "time": "2026-07-14T14:50:25+00:00"
}, },
{ {
"name": "sebastian/cli-parser", "name": "sebastian/cli-parser",

View file

@ -74,7 +74,7 @@ class ToolsController extends AbstractController
'detailed_error_pages' => $this->getParameter('partdb.error_pages.show_help'), 'detailed_error_pages' => $this->getParameter('partdb.error_pages.show_help'),
'error_page_admin_email' => $this->getParameter('partdb.error_pages.admin_email'), 'error_page_admin_email' => $this->getParameter('partdb.error_pages.admin_email'),
'configured_max_file_size' => $settings->system->attachments->maxFileSize, 'configured_max_file_size' => $settings->system->attachments->maxFileSize,
'effective_max_file_size' => $attachmentSubmitHandler->getMaximumAllowedUploadSize(), 'effective_max_file_size' => $attachmentSubmitHandler->getMaximumEffectiveUploadSize(),
'saml_enabled' => $this->getParameter('partdb.saml.enabled'), 'saml_enabled' => $this->getParameter('partdb.saml.enabled'),
//PHP section //PHP section

View file

@ -209,7 +209,7 @@ class AttachmentFormType extends AbstractType
public function finishView(FormView $view, FormInterface $form, array $options): void public function finishView(FormView $view, FormInterface $form, array $options): void
{ {
$view->vars['max_upload_size'] = $this->submitHandler->getMaximumAllowedUploadSize(); $view->vars['max_upload_size'] = $this->submitHandler->getMaximumEffectiveUploadSize();
} }
public function getBlockPrefix(): string public function getBlockPrefix(): string

View file

@ -218,6 +218,14 @@ class AttachmentSubmitHandler
//If no file was uploaded, but we have base64 encoded data, create a file from it //If no file was uploaded, but we have base64 encoded data, create a file from it
if (!$file && $upload->data !== null) { if (!$file && $upload->data !== null) {
if (strlen($upload->data) > $this->getMaximumUserConfiguredUploadSize() * 4 / 3) { //Base64 encoding increases the size of the data by 4/3, so we have to check for that
throw new RuntimeException(
sprintf(
'The given base64 data is too big! Maximum size is %.1f MB!',
$this->getMaximumUserConfiguredUploadSize() / 1000 / 1000
));
}
$file = new UploadedBase64EncodedFile(new Base64EncodedFile($upload->data), $upload->filename ?? 'base64'); $file = new UploadedBase64EncodedFile(new Base64EncodedFile($upload->data), $upload->filename ?? 'base64');
} }
@ -226,6 +234,15 @@ class AttachmentSubmitHandler
//When a file is given then upload it, otherwise check if we need to download the URL //When a file is given then upload it, otherwise check if we need to download the URL
if ($file instanceof UploadedFile) { if ($file instanceof UploadedFile) {
//Check the file size, to avoid uploading too big files.
//The file is not necessarily validated as it can also come from an Base64 source
if ($file->getSize() > $this->getMaximumUserConfiguredUploadSize()) {
throw new RuntimeException(
sprintf(
'The uploaded file is too big! Maximum size is %.1f MB!',
$this->getMaximumUserConfiguredUploadSize() / 1000 / 1000
));
}
$this->upload($attachment, $file, $secure_attachment); $this->upload($attachment, $file, $secure_attachment);
} elseif ($upload->downloadUrl && $attachment->hasExternal()) { } elseif ($upload->downloadUrl && $attachment->hasExternal()) {
@ -402,7 +419,7 @@ class AttachmentSubmitHandler
$fileHandler = fopen($tmp_path, 'wb'); $fileHandler = fopen($tmp_path, 'wb');
$bytesDownloaded = 0; $bytesDownloaded = 0;
$maxSize = $this->attachmentsSettings->getMaxFileSizeInMegabytes() * 1024 * 1024; //Convert to bytes $maxSize = $this->getMaximumUserConfiguredUploadSize(); //We use the maximum user configured size here, PHPs limits dont apply
//Write the downloaded data to file //Write the downloaded data to file
foreach ($this->httpClient->stream($response) as $chunk) { foreach ($this->httpClient->stream($response) as $chunk) {
@ -418,8 +435,8 @@ class AttachmentSubmitHandler
throw new AttachmentDownloadException( throw new AttachmentDownloadException(
sprintf( sprintf(
'The downloaded file is too big! Maximum size is %d MB!', 'The downloaded file is too big! Maximum size is %.1f MB!',
$this->settings->getMaxFileSizeInMegabytes() $maxSize / 1000 / 1000
)); ));
} }
@ -527,10 +544,10 @@ class AttachmentSubmitHandler
} }
/* /*
* Returns the maximum allowed upload size in bytes. * Returns the maximum effective upload size in bytes.
* This is the minimum value of Part-DB max_file_size, and php.ini's post_max_size and upload_max_filesize. * This is the minimum value of Part-DB max_file_size, and php.ini's post_max_size and upload_max_filesize.
*/ */
public function getMaximumAllowedUploadSize(): int public function getMaximumEffectiveUploadSize(): int
{ {
if ($this->max_upload_size_bytes) { if ($this->max_upload_size_bytes) {
return $this->max_upload_size_bytes; return $this->max_upload_size_bytes;
@ -545,6 +562,15 @@ class AttachmentSubmitHandler
return $this->max_upload_size_bytes; return $this->max_upload_size_bytes;
} }
/**
* Returns the maximum user configured upload size in bytes.
* @return int
*/
public function getMaximumUserConfiguredUploadSize(): int
{
return $this->parseFileSizeString($this->settings->maxFileSize);
}
/** /**
* Sanitizes the given SVG file, if the attachment is an internal SVG file. * Sanitizes the given SVG file, if the attachment is an internal SVG file.
* @param Attachment $attachment * @param Attachment $attachment

View file

@ -23,6 +23,7 @@ declare(strict_types=1);
namespace App\Services\ImportExportSystem; namespace App\Services\ImportExportSystem;
use PhpOffice\PhpSpreadsheet\Cell\Coordinate; use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
use PhpOffice\PhpSpreadsheet\Cell\DataType;
use App\Entity\Base\AbstractNamedDBElement; use App\Entity\Base\AbstractNamedDBElement;
use App\Entity\Base\AbstractStructuralDBElement; use App\Entity\Base\AbstractStructuralDBElement;
use App\Helpers\FilenameSanatizer; use App\Helpers\FilenameSanatizer;
@ -179,7 +180,11 @@ class EntityExporter
foreach ($columns as $column) { foreach ($columns as $column) {
$cellCoordinate = Coordinate::stringFromColumnIndex($colIndex) . $rowIndex; $cellCoordinate = Coordinate::stringFromColumnIndex($colIndex) . $rowIndex;
$worksheet->setCellValue($cellCoordinate, $column); if (is_numeric(trim($column, '"'))) { // Check if the column value is numeric after trimming quotes, as values are surrounded by quotes in CSV
$worksheet->setCellValueExplicit($cellCoordinate, $column, DataType::TYPE_NUMERIC);
} else {
$worksheet->setCellValueExplicit($cellCoordinate, $column, DataType::TYPE_STRING);
}
$colIndex++; $colIndex++;
} }
$rowIndex++; $rowIndex++;

View file

@ -65,18 +65,4 @@ class AttachmentsSettings
envVar: "bool:ATTACHMENT_SHOW_HTML_FILES", envVarMode: EnvVarMode::OVERWRITE envVar: "bool:ATTACHMENT_SHOW_HTML_FILES", envVarMode: EnvVarMode::OVERWRITE
)] )]
public bool $showHTMLAttachments = false; public bool $showHTMLAttachments = false;
public function getMaxFileSizeInMegabytes(): int
{
$size = $this->maxFileSize;
$unit = strtoupper(substr($size, -1));
$value = (int) rtrim($size, 'KMG');
return match ($unit) {
'K' => (int) ceil($value / 1024),
'M' => $value,
'G' => $value * 1024,
default => $value, // No unit specified, assume megabytes
};
}
} }

View file

@ -101,6 +101,28 @@ final class EntityExporterTest extends WebTestCase
unlink($tempFile); unlink($tempFile);
} }
public function testExportExcelFormulaInjectionPrevention(): void
{
// Values starting with formula characters must be stored as plain strings, not evaluated formulas
$entity = (new Category())->setName('=1+1')->setComment('@SUM(A1)');
$xlsxData = $this->service->exportEntities([$entity], ['format' => 'xlsx', 'level' => 'simple']);
$this->assertNotEmpty($xlsxData);
$tempFile = tempnam(sys_get_temp_dir(), 'test_formula') . '.xlsx';
file_put_contents($tempFile, $xlsxData);
$spreadsheet = IOFactory::load($tempFile);
$worksheet = $spreadsheet->getActiveSheet();
// The formula-prefixed name must be stored as a plain string, not a formula
$cell = $worksheet->getCell('A2');
$this->assertSame(\PhpOffice\PhpSpreadsheet\Cell\DataType::TYPE_STRING, $cell->getDataType());
$this->assertSame('=1+1', $cell->getValue());
unlink($tempFile);
}
public function testExportExcelFromRequest(): void public function testExportExcelFromRequest(): void
{ {
$entities = $this->getEntities(); $entities = $this->getEntities();

View file

@ -1,47 +0,0 @@
<?php
/*
* This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
*
* Copyright (C) 2019 - 2026 Jan Böhmer (https://github.com/jbtronics)
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published
* by the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
namespace App\Tests\Settings\SystemSettings;
use App\Settings\SystemSettings\AttachmentsSettings;
use App\Tests\SettingsTestHelper;
use PHPUnit\Framework\TestCase;
class AttachmentsSettingsTest extends TestCase
{
public function testGetMaxFileSizeInMegabytes(): void
{
$settings = SettingsTestHelper::createSettingsDummy(AttachmentsSettings::class);
$settings->maxFileSize = '100M';
$this->assertEquals(100, $settings->getMaxFileSizeInMegabytes());
$settings->maxFileSize = '1G';
$this->assertEquals(1024, $settings->getMaxFileSizeInMegabytes());
//We round up to the next megabyte if the file size is smaller than 1 MB
$settings->maxFileSize = '500K';
$this->assertEquals(1, $settings->getMaxFileSizeInMegabytes());
$settings->maxFileSize = '13.5M';
$this->assertEquals(13, $settings->getMaxFileSizeInMegabytes());
}
}

1361
yarn.lock

File diff suppressed because it is too large Load diff