Repository navigation
Update symfony/mime for corrected CVE-2026-45070 fixed version #845
Description
The upstream CVE-2026-45070 advisory correction now marks Symfony Mime 7.4 versions below 7.4.22 affected by email-header injection through parameter names. The pre-correction Server main locked 7.4.13. Fresh Composer audit therefore refuses the existing lock; earlier successful checks used the prior advisory range.
General owns the narrow PHP dependency correction. Update only symfony/mime to the fixed 7.4.22 release using normal Composer resolution, preserving every other package version/reference. Verify the lock audit, install the resulting lock normally, check header-name validation and run required hosted qualification before merging. Preserve the audit and existing required checks. Published-image follow-through remains explicit; a source lock update does not replace an installed image.
Source correction merged at cd2e37dd5250b0225806212afb34b3e5c7e55fd2: PR #846, exact 5a3790dca65b7a56578217a09e31da40becadaf5, changes only the lockfile and one runtime package to 7.4.22 / 94a4c017435bc515f5ac80421a2c555fb9ca3676. Separate pinned Composer audit and normal install/platform checks pass. All 24 installed header-validation cases pass; downstream PHP qualification passes 175 tests / 2,449 assertions, with isolated release guards nine / 27. Exact Security clearance is recorded. All exact-head hosted checks passed: 16 successes and seven conditional skips. Full PHP qualification passes 3,436 tests / 74,864 assertions, with 51 skips and six pre-existing deprecations. Required merge-group PHP, shared fixtures and Sonar App checks also passed before merge. The merged remote branch is deleted and verified absent. Full main PHP qualification and main Sonar analysis completed successfully at the merged cd2e37dd5250b0225806212afb34b3e5c7e55fd2 source. The source correction is qualified; exact published-image follow-through remains open.
The previous Server main at 9fc29d43 failed its aggregate qualification strictly on the newly corrected dependency audit; its PHP feature/readiness/TLS job passes. That refusal is preserved, and the correction is now merged. Keep this issue open until the fixed dependency is verified in an exact published Server image. Existing source merges do not provide installed acceptance.
Completed installed delivery: Server 2.11.6 / chart 0.3.6 passed every normal publication gate in 40885194236. Both architecture artifacts retain the intended Mime 7.4.22/source-dist94a lock and qualified Server/Core bytes; all 24 amd64 installed header cases pass. Actual anonymous pulls of both architecture children from Docker Hub and GHCR pass. Final immutable tuple and evidence. The fixed dependency is now verified in the published image; this issue is complete.
Activity
rmcdaniel commentedon Oct 28, 2026
Security published-image gap verification — 2026-10-28 21:20 UTC.
Public registry metadata confirms the source fix is not published yet. Docker Hub tags
latest,2,2.11, and2.11.5all still resolve to indexsha256:f4f2ec64…last updated October 27. Public GHCRlatestand2.11.5resolve to the same amd64/arm64 children (sha256:bcc67285…/sha256:3160f4f5…). Both child configs identify release2.11.5and source revision721b2831975cc898cc39d7528c5ba7e8441fe744; that exact revision lockssymfony/mime v7.4.13ata8457227…, below the corrected 7.4.22 floor.Therefore #845 remains open. Fixed source
cd2e37dd…and its green main qualification do not replace a published artifact. General remains the owner of the qualified publication under the existing Cloud #450 boundary. Acceptance requires a newly published exact multi-architecture image whose config binds the intended fixed source and whose installed lock resolves Mime 7.4.22 /94a4c017…; do not move rolling tags onto the old digest. No registry write, image pull, layer download, credential use, or operator action occurred.rmcdaniel commentedon Oct 29, 2026
Uploaded candidate2.11.6 image content is independently verified; release acceptance remains pending.
Exact source/tag is
d13ebdb5eccc3d33b9d3c0e1ebc9ab0cb116e121, shared registry indexsha256:28e1ddeea655760e99748c48f2fa9bbecda37d3924864f6ee9011764144f2c2b. The selected amd64 manifest issha256:c20c901eaa8dedfa04e5b89280f93b23a5e84e143410e3ceb63ff0881d701641; arm64 issha256:f799cf5ca1b4276a1ac9293dd66e85c624cf91289a1b1b8086eeb10c3082a98a. Anonymous manifest reads from both registries agree, and both DockerHub architecture downloads succeeded.For each architecture, stopped-container inspection compares all 363 Server app/config/database files against exactd13 and 1,006 Core runtime/resource/composer files against published2.15.7/3aa98b8473b130dbc141457f76ccc32e4aa58062: zero differences. All three package-provenance files agree on the Core source/version/commit. The source manifest identifies2.11.6/chart0.3.6. Both installed metadata and lock install Mime7.4.22 with source/dist
94a4c017435bc515f5ac80421a2c555fb9ca3676. Core's generated Composer path reference is recorded separately from that Git source authority.The actual amd64 PHP runtime passes all24 installed Mime parameter-name controls (constructor, single setter and map setter; legal names retained and six invalid forms rejected). This is not an arm64 application-execution claim. Static inspection containers and the one-off PHP probe have been removed; exact task-label inventory is zero.
The original release stopped on the arm64 registry-pull HTTP500 before trust execution. PR859 is qualifying the normal digest-bound continuation; trust/first-run/Compose/TLS/protocol/chart and affected installed-consumer acceptance remain mandatory. General's isolated unchanged-limit maximum-close candidate test is now running; no outcome is claimed yet. Keep#845/#958 open through final accepted-image delivery.