vulnerabilities in composer dependencies

ugh, composer.

There are 7 composer security advisories affecting our repositories.

twig/twig (CVE-2022-39261)

Possibility to load a template outside a configured directory when using the filesystem loader

Affected repositories (1)

• mediawiki/extensions/FundraisingEmailUnsubscribe

twig/twig (CVE-2024-45411)

Possible sandbox bypass

Affected repositories (1)

• mediawiki/extensions/FundraisingEmailUnsubscribe

twig/twig (CVE-2024-51754)

Unguarded calls to __toString() when nesting an object into an array

Affected repositories (1)

• mediawiki/extensions/FundraisingEmailUnsubscribe

twig/twig (CVE-2024-51755)

Unguarded calls to __isset() and to array-accesses when the sandbox is enabled

Affected repositories (1)

• mediawiki/extensions/FundraisingEmailUnsubscribe

firebase/php-jwt (CVE-2021-46743)

Key/algorithm type confusion

Affected repositories (3)

• 🗄mediawiki/extensions/CheckUser
• 🗄mediawiki/extensions/ContentTranslation
• 🗄mediawiki/extensions/OAuth

swiftmailer/swiftmailer (CVE-2024-28859)

Deserialization Gadget chain in Swift Mailer

Affected repositories (1)

• mediawiki/extensions/SwiftMailer

symfony/http-foundation (CVE-2024-50345)

CVE-2024-50345: Open redirect via browser-sanitized URLs

Affected repositories (1)

• 🗄mediawiki/extensions/DonationInterface

Source code is licensed under the AGPL.