What happened?
Description
webauthn-lib 4.5.x to 4.8.x has a moderate security advisory:
GHSA-875x-g8p7-5w27
Craft 5.2.8 has web-auth/webauthn-lib ~4.8.0 as a dependency
Having roave/security-advisories with Roave/SecurityAdvisories@5f55b08 or newer now prevents updating Craft.
I've removed roave/security-advisories temporarily to complete my update locally.
Can you update webauthn-lib to 4.9.x?
Steps to reproduce
- Have
roave/security-advisories with dev-latest in require-dev in composer.json.
- Using
craft update or composer to update from 5.2.5 (or any previous 5.x version?) to 5.2.8
Expected behavior
Update completes without conflict.
Actual behavior
Error Output:
================
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.
Problem 1
- craftcms/cms 5.2.8 requires web-auth/webauthn-lib ~4.8.0 -> satisfiable by web-auth/webauthn-lib[4.8.0, ..., 4.8.x-dev].
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.7.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.6.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.5.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.4.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.3.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.2.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.1.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.0.
- roave/security-advisories dev-latest conflicts with web-auth/webauthn-lib 4.8.x-dev.
Craft CMS version
5.2.8
PHP version
No response
Operating system and version
No response
Database type and version
No response
Image driver and version
No response
Installed plugins and versions
What happened?
Description
webauthn-lib4.5.x to 4.8.x has a moderate security advisory:GHSA-875x-g8p7-5w27
Craft 5.2.8 has
web-auth/webauthn-lib ~4.8.0as a dependencyHaving
roave/security-advisorieswith Roave/SecurityAdvisories@5f55b08 or newer now prevents updating Craft.I've removed
roave/security-advisoriestemporarily to complete my update locally.Can you update
webauthn-libto 4.9.x?Steps to reproduce
roave/security-advisorieswithdev-latestinrequire-devin composer.json.craft updateorcomposerto update from 5.2.5 (or any previous 5.x version?) to 5.2.8Expected behavior
Update completes without conflict.
Actual behavior
Craft CMS version
5.2.8
PHP version
No response
Operating system and version
No response
Database type and version
No response
Image driver and version
No response
Installed plugins and versions