Update dependency symfony/yaml to 7.4.* [SECURITY]#2623
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
added
bump-patch
|
Terraform plan in ./services/publish/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.publish.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-publish-prod"
!~ last_modified = "2026-05-24T10:40:22.000+0000" -> (known after apply)
!~ source_code_hash = "nPtHlCv5GvI91haJ1WVX0E0hQjIOvJHwe1MTGVLEKBA=" -> "RmgiAOf8xPz4Icqx2ynbvi8BugLPyJi/PgFS9u8Wd3U="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Publish #2592 |
|
Terraform plan in ./services/orchestrator/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.orchestrator.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-orchestrator-prod"
!~ last_modified = "2026-05-23T00:31:51.000+0000" -> (known after apply)
!~ source_code_hash = "zTTKyMrJYo6V7l718Sq5ruTaJQw1MKOE1FO0WgB+Pnw=" -> "hs30tx6aOwjKOp/PSTS0qBzup4PB926pQ5sOpT8NHeA="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.
Warning: Argument is deprecated
with module.event_store.aws_dynamodb_table.event_table,
on event_store/main.tf line 1, in resource "aws_dynamodb_table" "event_table":
1: resource "aws_dynamodb_table" "event_table" {
range_key is deprecated. Use key_schema instead.
(and one more similar warning elsewhere)
Warning: Deprecated value used
on event_store/outputs.tf line 2, in output "event_table":
2: value = aws_dynamodb_table.event_table
The deprecation originates from module.event_store.aws_dynamodb_table.event_table.global_secondary_index[...].range_key
range_key is deprecated. Use key_schema instead.
(and one more similar warning elsewhere)📝 Plan generated in Orchestrator #2392 |
|
Terraform plan in ./services/api/infrastructure in the prod workspace Plan: 0 to add, 3 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.api.aws_lambda_function.api will be updated in-place
!~ resource "aws_lambda_function" "api" {
id = "coverage-api-prod"
!~ last_modified = "2026-05-24T10:40:32.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "pB4RTCYNll7PbxBWxuIQW94JoUBUtkmfwigXSUqM+io="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
# module.event_listener.aws_lambda_function.events will be updated in-place
!~ resource "aws_lambda_function" "events" {
id = "coverage-api-event-listener-prod"
!~ last_modified = "2026-05-24T10:40:17.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "pB4RTCYNll7PbxBWxuIQW94JoUBUtkmfwigXSUqM+io="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
# module.webhook_handler.aws_lambda_function.webhooks will be updated in-place
!~ resource "aws_lambda_function" "webhooks" {
id = "coverage-api-webhook-handler-prod"
!~ last_modified = "2026-05-24T10:40:25.000+0000" -> (known after apply)
!~ source_code_hash = "FpKMhQmvJWm353SwiER1CFWtQ2fsOX8R0RLnc4MSHnU=" -> "pB4RTCYNll7PbxBWxuIQW94JoUBUtkmfwigXSUqM+io="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 3 to change, 0 to destroy.📝 Plan generated in API #3386 |
|
Terraform plan in ./services/ingest/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.ingest.aws_lambda_function.service will be updated in-place
!~ resource "aws_lambda_function" "service" {
id = "coverage-ingest-prod"
!~ last_modified = "2026-05-24T11:11:01.000+0000" -> (known after apply)
!~ source_code_hash = "uYMcukVKQ5JeVzFnFdrBWDB2iCbmLDYS00Q5mKN5q4U=" -> "NYaF/k4qQ83Pyf/pPMsl7UDnA7wLVov8i+xcGRvpwq0="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Ingest #3344 |
|
Terraform plan in ./services/analyse/infrastructure in the prod workspace Plan: 0 to add, 1 to change, 0 to destroy.Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~ update in-place
Terraform will perform the following actions:
# module.analyse.aws_lambda_function.analyse will be updated in-place
!~ resource "aws_lambda_function" "analyse" {
id = "coverage-analyse-prod"
!~ last_modified = "2026-05-24T11:11:14.000+0000" -> (known after apply)
!~ source_code_hash = "XjrPWJz+0Kqjh22CTkk10Hvj82HdnqtZkWAVmnxJFLY=" -> "drieL+kx38ATLWcOXyNkm2yfGXRoz3hF+85IY4ygTVs="
tags = {}
# (30 unchanged attributes hidden)
# (4 unchanged blocks hidden)
}
Plan: 0 to add, 1 to change, 0 to destroy.📝 Plan generated in Analyse #3661 |
Coverage Report
Tags
Impacted Files
Last update to 07a34ff at 07:00am UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.3.*→7.4.*Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Symfony hardened the parser when handling untrusted input
CVE-2026-45133 / GHSA-c2p3-7m5p-cv8x
More information
Details
Description
Symfony\Component\Yaml\Parseris the entry point for parsing YAML strings into PHP values viaYaml::parse(). When the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence()/Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker.Resolution
The
Parsernow tracks recursion depth in a sharedParserStateobject across both block-level and inline parsing, with a default limit of 128. The limit is configurable via a new$maxNestingLevelargument onParser::__construct(),Yaml::parse()andYaml::parseFile().The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Symfony's YAML Parser has a ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex
CVE-2026-45305 / GHSA-9frc-8383-795m
More information
Details
Description
Symfony\Component\Yaml\Parser::cleanup()strips the optional%YAMLdirective header, leading comments, and document start/end markers before parsing. The original regexes contained overlapping quantifiers, most notably'#^%YAML[: ][\d.]+.*\n#u', whose[\d.]+and.*overlap on the dot, that exhibit catastrophic backtracking on crafted input. A single oversized%YAMLdirective header (or comment / document-marker line) makes the parser hang for an arbitrarily long time, denying service.Resolution
The four regexes in
Parser::cleanup()(YAML directive header, leading comments, document-start marker, document-end marker) have been rewritten with possessive quantifiers and unambiguous character classes so backtracking cannot occur.The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
CVE-2026-45304 / GHSA-4qpc-3hr4-r2p4
More information
Details
Description
Symfony\Component\Yaml\Parserresolves YAML aliases (*anchor) during parsing. Aliases that reference collections (arrays,stdClass,TaggedValue-wrapped collections) can themselves point to other collections containing aliases, creating exponential expansion at resolution time. A small input can blow up into a multi-gigabyte structure and exhaust memory: the classic "Billion Laughs" denial-of-service against any parser exposed to untrusted YAML.Resolution
The
Parsernow counts collection alias resolutions in a sharedParserStateobject, with a default limit of 128, following the SnakeYAML model. Scalar aliases remain unrestricted since they cannot drive exponential growth. The limit is configurable via a new$maxAliasesForCollectionsargument onParser::__construct(),Yaml::parse()andYaml::parseFile(). A newYaml::PARSE_EXCEPTION_ON_ALIASflag also rejects all aliases outright when parsing fully untrusted input.The patch for this issue is available here for branch 5.4.
Credits
Symfony would like to thank Pietro Tirenna (Shielder) for reporting the issue and Nicolas Grekas for fixing it.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:UReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
symfony/yaml (symfony/yaml)
v7.4.12Compare Source
Changelog (symfony/yaml@v7.4.11...v7.4.12)
v7.4.11Compare Source
Changelog (symfony/yaml@v7.4.10...v7.4.11)
v7.4.10Compare Source
Changelog (symfony/yaml@v7.4.6...v7.4.10)
&anchorand!!str &anchoritems (@ousamabenyounes)v7.4.8Compare Source
v7.4.6Compare Source
v7.4.1Compare Source
Changelog (symfony/yaml@v7.4.0...v7.4.1)
v7.4.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.