[3.x]: All Craft 3 CMS versions still (again?) marked as unsave by composer with roave/security advisories
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 3.6k
- Forks
- 705
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 134
Description
What happened?
Description
Still unable to install & update projects on Craft 3, or possibly again. According to the maintainer there might be unaddressed vulnerabilities. I can see no commits adding Craft 3 versions back in, so while a previous bug report (#13336) about this was closed, I don't think it was ever truly solved.
This is turning into a major blocker for us as we've many sites still on Craft 3.
Craft CMS version
3.7.43
PHP version
No response
Operating system and version
No response
Database type and version
No response
Image driver and version
No response
Installed plugins and versions
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the linked Roave/SecurityAdvisories issue and the previous Craft CMS issue #13336, then reproduce installation or update behavior for Craft CMS 3.7.43. Determine whether Craft 3 versions are incorrectly flagged or have unresolved advisories; done means the dependency status and supported resolution are clearly established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100