|
52557
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52557
|
|
52558
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52558
|
|
52559
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52559
|
|
52561
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52561
|
|
52562
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52562
|
|
52563
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52563
|
|
52564
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
#434 (high)
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
All 5 alerts from the PR description are accounted for in the diff. The lock file hashes, references, and timestamps all look consistent with legitimate upstream releases.
One minor observation:
google/protobuf
's dev-dependency on
phpunit/phpunit
changed from
>=5.0.0 <8.5.27
to
>=10.5.62 <11.0.0
— this is a dev-only constraint in the transitive dep and has no production impact.
SonarQube quality gate passed with 0 new issues. Safe to merge.
Add or remove reactions
@yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
self-requested a review
5 days ago
5 days ago
yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
approved these changes
5 days ago
5 days ago
View reviewed changes
View reviewed changes
TodorStamatovJiminny
TodorStamatovJiminny
TodorStamatovJiminny
approved these changes
5 days ago
5 days ago
View reviewed changes
View reviewed changes
@ilian-jiminny
ilian-jiminny
ilian-jiminny
self-requested a review
4 days ago
4 days ago
ilian-jiminny
ilian-jiminny
ilian-jiminny
approved these changes
4 days ago
4 days ago
View reviewed changes...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52564
|
|
52568
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52568
|
|
52569
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52569
|
|
52570
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52570
|
|
52571
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52571
|
|
52572
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52572
|
|
52573
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52573
|
|
52574
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52574
|
|
52575
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52575
|
|
52576
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52576
|
|
52577
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52577
|
|
52578
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
#434 (high)
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
All 5 alerts from the PR description are accounted for in the diff. The lock file hashes, references, and timestamps all look consistent with legitimate upstream releases.
One minor observation:
google/protobuf
's dev-dependency on
phpunit/phpunit
changed from
>=5.0.0 <8.5.27
to
>=10.5.62 <11.0.0
— this is a dev-only constraint in the transitive dep and has no production impact.
SonarQube quality gate passed with 0 new issues. Safe to merge.
Add or remove reactions
@yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
self-requested a review
5 days ago
5 days ago
yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
approved these changes
5 days ago
5 days ago
View reviewed changes
View reviewed changes
TodorStamatovJiminny
TodorStamatovJiminny
TodorStamatovJiminny
approved these changes
5 days ago
5 days ago
View reviewed changes
View reviewed changes
@ilian-jiminny
ilian-jiminny
ilian-jiminny
self-requested a review...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52578
|
|
52579
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
#434 (high)
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
All 5 alerts from the PR description are accounted for in the diff. The lock file hashes, references, and timestamps all look consistent with legitimate upstream releases.
One minor observation:
google/protobuf
's dev-dependency on
phpunit/phpunit
changed from
>=5.0.0 <8.5.27
to
>=10.5.62 <11.0.0
— this is a dev-only constraint in the transitive dep and has no production impact.
SonarQube quality gate passed with 0 new issues. Safe to merge....
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52579
|
|
52580
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454)....
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52580
|
|
52581
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Ready to merge
Ready to merge
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (1)
Commits
(
1
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 1 commit into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 1 commit into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52581
|
|
52589
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52589
|
|
52590
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52590
|
|
52591
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52591
|
|
52593
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52593
|
|
52594
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
#434 (high)
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
All 5 alerts from the PR description are accounted for in the diff. The lock file hashes, references, and timestamps all look consistent with legitimate upstream releases.
One minor observation:
google/protobuf
's dev-dependency on
phpunit/phpunit
changed from
>=5.0.0 <8.5.27
to
>=10.5.62 <11.0.0
— this is a dev-only constraint in the transitive dep and has no production impact.
SonarQube quality gate passed with 0 new issues. Safe to merge.
Add or remove reactions
@yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
self-requested a review
5 days ago
5 days ago
yalokin-jiminny
yalokin-jiminny
yalokin-jiminny
approved these changes
5 days ago
5 days ago
View reviewed changes
View reviewed changes
TodorStamatovJiminny
TodorStamatovJiminny...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52594
|
|
52595
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52595
|
|
52596
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52596
|
|
52597
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52597
|
|
52598
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52598
|
|
52599
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52599
|
|
52600
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52600
|
|
52601
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52601
|
|
52604
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading....
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52604
|
|
52605
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52605
|
|
52606
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52606
|
|
52611
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Open
fix(security): composer dependency updates – 2026-04-15 #11970 github-actions[bot] wants to merge 2 commits into master from secfix/composer-20260415 Copy head branch name to clipboard
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52611
|
|
52612
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK
7f8b428
7f8b428
@sonarqubecloud
Show options
sonarqubecloud bot commented 5 days ago
sonarqubecloud
sonarqubecloud
bot
commented
5 days ago
5 days ago
Quality Gate Passed Quality Gate passed
Quality Gate Passed
Quality Gate passed
Issues
0 New issues
0 New issues
0 Accepted issues
0 Accepted issues
Measures
0 Security Hotspots
0 Security Hotspots
0.0% Coverage on New Code
0.0% Coverage on New Code
0.0% Duplication on New Code
0.0% Duplication on New Code
See analysis details on SonarQube Cloud
See analysis details on SonarQube Cloud
Add or remove reactions
@yalokin-jiminny
Show options
yalokin-jiminny commented 5 days ago
yalokin-jiminny
yalokin-jiminny
commented
5 days ago
5 days ago
@claude
@claude
Add or remove reactions
react with eyes
👀
1
@claude
Show options
claude bot commented 5 days ago •
claude
claude
bot
commented
5 days ago
5 days ago
•
edited
edited
Claude finished
@yalokin-jiminny
@yalokin-jiminny
's task in 36s
——
View job
View job
PR Review
PR Review
Completed task
Gather context
Completed task
Review composer.lock changes
Completed task
Verify security alerts are addressed
Completed task
Post review feedback
LGTM.
This is a clean automated security bump — only
composer.lock
is modified, no
composer.json
changes required.
Changes verified
Changes verified
Package
Old
New
Alerts fixed
laravel/passport
v13.6.0
v13.7.4
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
phpseclib/phpseclib
3.0.49
3.0.51
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
google/protobuf
v4.33.5
v4.33.6
#434 (high)
league/commonmark
2.8.1
2.8.2
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
Package
laravel/passport
phpseclib/phpseclib
google/protobuf
league/commonmark
Old
v13.6.0
3.0.49
v4.33.5
2.8.1
New
v13.7.4
3.0.51
v4.33.6
2.8.2
Alerts fixed
#457
#457
(
CVE-2026-39976
CVE-2026-39976
, high)
#425 (
CVE-2026-32935
CVE-2026-32935
, high) + #454 (
CVE-2026-40194
CVE-2026-40194
, low)
#434 (high)
#429 (
CVE-2026-33347
CVE-2026-33347
, medium)
All 5 alerts from the PR description are accounted for in the diff. The lock file hashes, references, and timestamps all look consistent with legitimate upstream releases.
One minor observation:
google/protobuf
's dev-dependency on
phpunit/phpunit
changed from
>=5.0.0 <8.5.27
to
>=10.5.62 <11.0.0
— this is a dev-only constraint in the transitive dep and has no production impact.
SonarQube quality gate passed with 0 new issues. Safe to merge.
Add or remove reactions...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52612
|
|
52613
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52613
|
|
52614
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (6)
Checks
(
6
)
Files changed (1)
Files changed
(
1
)
Conversation
Conversation
@github-actions
Show options
github-actions bot commented 5 days ago •
github-actions
github-actions
bot
commented
5 days ago
5 days ago
•
edited
edited
Security dependency updates — composer — 2026-04-15
Security dependency updates — composer — 2026-04-15
This PR was opened automatically by the secfix bot. For this ecosystem, one commit carries every dependency upgrade from this run; see
Fixed alerts
below.
CI run logs →
CI run logs →
Upgrade safety (changelog review)
Upgrade safety (changelog review)
Overall verdict:
Mixed
— All previously-actionable alerts were fixed as safe patch/minor bumps. Alert
#463
#463
(phpunit/phpunit) is listed under
Skipped alerts
: the patched version (12.5.22) requires a major version jump from 11.x that includes documented breaking API removals and requires manual migration.
This does not replace CI, tests, or manual smoke checks before merge.
Fixed alerts
Fixed alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#457
#457
laravel/passport
high
CVE-2026-39976
CVE-2026-39976
13.7.1
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
#434
#434
google/protobuf
high
CVE-2026-6409
CVE-2026-6409
4.33.6
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
#425
#425
phpseclib/phpseclib
high
CVE-2026-32935
CVE-2026-32935
3.0.50
releases
releases
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
#429
#429
league/commonmark
medium
CVE-2026-33347
CVE-2026-33347
2.8.2
releases
releases
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
#454
#454
phpseclib/phpseclib
low
CVE-2026-40194
CVE-2026-40194
3.0.51
releases
releases
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Alert
#457
#457
#434
#434
#425
#425
#429
#429
#454
#454
Package
laravel/passport
google/protobuf
phpseclib/phpseclib
league/commonmark
phpseclib/phpseclib
Severity
high
high
high
medium
low
CVE
CVE-2026-39976
CVE-2026-39976
CVE-2026-6409
CVE-2026-6409
CVE-2026-32935
CVE-2026-32935
CVE-2026-33347
CVE-2026-33347
CVE-2026-40194
CVE-2026-40194
Patched version
13.7.1
4.33.6
3.0.50
2.8.2
3.0.51
Changelog
releases
releases
releases
releases
releases
releases
releases
releases
releases
releases
Notes
Breaking-change risk:
none observed (patch/minor). Bumped from v13.6.0 to v13.7.4 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Transitive dep; bumped from v4.33.5 to v4.33.6 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Bumped from 3.0.49 to 3.0.51 (also
fixes
#454).
Breaking-change risk:
none observed (patch/minor). Transitive dep (via laravel/framework); bumped from 2.8.1 to 2.8.2 via
composer update
.
Breaking-change risk:
none observed (patch/minor). Covered by bump to 3.0.51 (also
fixes
#425).
Skipped alerts
Skipped alerts
Alert
Package
Severity
CVE
Patched version
Changelog
Notes
#463
#463
phpunit/phpunit
high
—
12.5.22
releases
releases
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Alert
#463
#463
Package
phpunit/phpunit
Severity
high
CVE
—
Patched version
12.5.22
Changelog
releases
releases
Notes
Not safe:
Major bump 11.x → 12.x. PHPUnit 12.0.0 removes multiple
TestCase
and
MockBuilder
methods (
iniSet()
,
setLocale()
,
getMockForAbstractClass()
,
getMockForTrait()
,
getObjectForTrait()
,
createTestProxy()
, etc.), drops support for doc-comment metadata (
@covers
,
@uses
annotations must be migrated to PHP 8 attributes), and removes several assert methods and CLI options. Breaking changes are fully documented — manual test-suite migration required before upgrading.
Automated by secfix-bot.
Add or remove reactions
fix(security): bump composer dependencies (alerts
fix(security): bump composer dependencies (alerts
#457
#457
#454 #434 #429…
#454 #434 #429…
…
12 / 13 checks OK...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970
|
52614
|
|
52615
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
All commits
All commits
0
/
1
viewed
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Load Diff
Load Diff
Some generated files are not rendered by default. Learn more about
customizing how changed files appear on GitHub.
customizing how changed files appear on GitHub.
Merge branch 'master' into secfix/composer-20260415 e4e0e6d...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52615
|
|
52616
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
All commits
All commits
0
/
1
viewed
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Loading
Some generated files are not rendered by default. Learn more about
customizing how changed files appear on GitHub.
customizing how changed files appear on GitHub.
Merge branch 'master' into secfix/composer-20260415 e4e0e6d...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52616
|
|
52617
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
All commits
All commits
0
/
1
viewed
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Loading
Some generated files are not rendered by default. Learn more about
customizing how changed files appear on GitHub.
customizing how changed files appear on GitHub.
Merge branch 'master' into secfix/composer-20260415 e4e0e6d...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52617
|
|
52618
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
All commits
All commits
0
/
1
viewed
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",
2882
"url": "[URL_WITH_CREDENTIALS] -2914,9 +2914,9 @@
2914
"proto"
2914
"proto"
2915
],
2915
],
2916
"support": {
2916
"support": {
2917
-
"source": "[URL_WITH_CREDENTIALS] -5076,16 +5076,16 @@
5076
},
5076
},
5077
{
5077
{
5078
"name": "laravel/passport",
5078
"name": "laravel/passport",
5079
-
"version": "v13.
6.0
",
5079
+
"version": "v13.
7.4
",
5080
"source": {
5080
"source": {
5081
"type": "git",
5081
"type": "git",
5082
"url": "[URL_WITH_CREDENTIALS] -5147,7 +5147,7 @@...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52618
|
|
52619
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
All commits
All commits
0
/
1
viewed
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",
2882
"url": "[URL_WITH_CREDENTIALS] -2914,9 +2914,9 @@
2914
"proto"
2914
"proto"
2915
],
2915
],
2916
"support": {
2916
"support": {
2917
-
"source": "[URL_WITH_CREDENTIALS] -5076,16 +5076,16 @@
5076
},
5076
},
5077
{
5077
{
5078
"name": "laravel/passport",
5078
"name": "laravel/passport",
5079
-
"version": "v13.
6.0
",
5079
+
"version": "v13.
7.4
",
5080
"source": {
5080
"source": {
5081
"type": "git",
5081
"type": "git",
5082
"url": "[URL_WITH_CREDENTIALS] -5147,7 +5147,7 @@
5147
"issues": "https://github.com/laravel/passport/issues",
5147
"issues": "https://github.com/laravel/passport/issues",
5148
"source": "https://github.com/laravel/passport"
5148
"source": "https://github.com/laravel/passport"
5149
},
5149...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52619
|
|
52620
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
Open
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
All commits
All commits
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
0
/
1
viewed
Checks pending
Checks pending
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",
2882
"url": "[URL_WITH_CREDENTIALS] -2914,9 +2914,9 @@
2914
"proto"
2914
"proto"
2915
],
2915
],
2916
"support": {
2916
"support": {
2917
-
"source": "[URL_WITH_CREDENTIALS] -5076,16 +5076,16 @@
5076
},
5076
},
5077
{
5077
{
5078
"name": "laravel/passport",
5078
"name": "laravel/passport",
5079
-
"version": "v13.
6.0
",
5079
+
"version": "v13.
7.4
",
5080
"source": {
5080
"source": {
5081
"type": "git",
5081
"type": "git",
5082
"url": "https://github.com/laravel/passport.git",
5082
"url": "https://github.com/laravel/passport.git",
5083
-
"reference": "
d97be1147f3dc2857e5a5cc4be0842c3ed46c5d8
"
5083
+
"reference": "
16c45794c6a6176792fdf555f986aa1b944d9081
"
5084
},
5084
},
5085
"dist": {
5085
"dist": {
5086
"type": "zip",
5086
"type": "zip",
5087
-
"url": "https://api.github.com/repos/laravel/passport/zipball/
d97be1147f3dc2857e5a5cc4be0842c3ed46c5d8
",
5087
+
"url": "https://api.github.com/repos/laravel/passport/zipball/
16c45794c6a6176792fdf555f986aa1b944d9081
",
5088
-
"reference": "
d97be1147f3dc2857e5a5cc4be0842c3ed46c5d8
",
5088
+
"reference": "...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52620
|
|
52666
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52666
|
|
52667
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
Open
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
All commits
All commits
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
0
/
1
viewed
Checks pending
Checks pending
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52667
|
|
52668
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
Close tab
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
Open
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
All commits
All commits
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
0
/
1
viewed
Checks pending
Checks pending
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",
2882
"url": "[URL_WITH_CREDENTIALS] -2914,9 +2914,9 @@
2914
"proto"
2914
"proto"
2915
],
2915
],
2916
"support": {
2916
"support": {
2917
-
"source": "https://github.com/protocolbuffers/protobuf-php/tree/v4.33.
5
"
2917
+
"source": "https://github.com/protocolbuffers/protobuf-php/tree/v4.33.
6
"
2918
},
2918
},
2919
-
"time": "2026-
01-29T20:49:00
+00:00"
2919...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52668
|
|
52669
|
Platform Sprint 2 Q2 - Platform Team - Scrum Board Platform Sprint 2 Q2 - Platform Team - Scrum Board - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
[SRD-6793] Les Mills activity types not pulling in - Jira
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20698 handle failed field sync on playbook import activity types by LakyLak · Pull Request #11988 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
JY-20692 change confirmation parameter by LakyLak · Pull Request #11986 · jiminny/app
[JY-20543] AJ Reports > Tracking - Jira
[JY-20543] AJ Reports > Tracking - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
[JY-18909] [Part2] Automated reports with Ask Jiminny - Jira
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
Ask Jiminny Reports by nikolay-yankov · Pull Request #11894 · jiminny/app
New Tab
New Tab
Product Growth Platform | Userpilot
Product Growth Platform | Userpilot
Userpilot | Events
Userpilot | Events
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Close bookmarks (⌘B)
Bookmarks
Bookmarks
Close sidebar
Search bookmarks
Skip to content
Skip to content
Open menu
Homepage (g then d)
jiminny
jiminny
app
app
Search or jump to…
Type
/
to search
Chat with Copilot
Open Copilot…
Create new...
Issues(g then i)
Pull requests
Repositories
You have unread notifications(g then n)
Open user navigation menu
Repository navigation
Repository navigation
Code
Code
Pull requests (32)
Pull requests
(
32
)
Agents
Agents
Actions
Actions
Wiki
Wiki
Security and quality (28)
Security and quality
(
28
)
Insights
Insights
Settings
Settings
Important update
Important update
On April 24 we'll start using GitHub Copilot interaction data for AI model training unless you opt out.
Review this update
Review this update
and manage your preferences in your
GitHub account settings
GitHub account settings
.
Dismiss banner
fix(security): composer dependency updates – 2026-04-15 #11970 Edit title
fix(security): composer dependency updates – 2026-04-15
#
11970
Edit title
Preview
Preview
Checks pending
Checks pending
Code
Code
Open
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
Lines changed: 23 additions & 23 deletions
Conversation (3)
Conversation
(
3
)
Commits (2)
Commits
(
2
)
Checks (2)
Checks
(
2
)
Files changed (1)
Files changed
(
1
)
Pull Request Toolbar
Pull Request Toolbar
Collapse file tree
Open
fix(security): composer dependency updates – 2026-04-15
fix(security): composer dependency updates – 2026-04-15
#
11970
All commits
All commits
github-actions[bot]
github-actions[bot]
wants to merge 2 commits into
master
master
from
secfix/composer-20260415
secfix/composer-20260415
Copy head branch name to clipboard
0
/
1
viewed
Checks pending
Checks pending
Submit review
Submit
review
Open diff view settings
Open overview panel
Open comments panel
(
0
)
Filter files…
Filter options
File tree
File tree
composer.lock
composer.lock
Collapse file
composer.lock
composer.lock
composer.lock
Copy file name to clipboard
Expand all lines: composer.lock
Lines changed: 23 additions & 23 deletions
Display the source diff
Display the rich diff
Not Viewed
Viewed
Comment on this file
More options
Original file line number
Original file line
Diff line number
Diff line change
@@ -2876,23 +2876,23 @@
2876
},
2876
},
2877
{
2877
{
2878
"name": "google/protobuf",
2878
"name": "google/protobuf",
2879
-
"version": "v4.33.
5
",
2879
+
"version": "v4.33.
6
",
2880
"source": {
2880
"source": {
2881
"type": "git",
2881
"type": "git",
2882
"url": "[URL_WITH_CREDENTIALS] -2914,9 +2914,9 @@
2914
"proto"
2914
"proto"
2915
],
2915
],
2916
"support": {
2916
"support": {
2917
-
"source": "https://github.com/protocolbuffers/protobuf-php/tree/v4.33.
5
"
2917
+
"source": "https://github.com/protocolbuffers/protobuf-php/tree/v4.33.
6
"
2918
},
2918
},
2919...
|
Firefox
|
fix(security): composer dependency updates – 2026- fix(security): composer dependency updates – 2026-04-15 by github-actions[bot] · Pull Request #11970 · jiminny/app — Work...
|
github.com/jiminny/app/pull/11970/changes
|
52669
|