From a983be8627749debe41958f72e109ce6c86a7331 Mon Sep 17 00:00:00 2001 From: Watheq Alshowaiter Date: Thu, 20 Aug 2026 21:39:13 +0300 Subject: [PATCH 1/3] security: pin GitHub Actions to commit SHAs, add Dependabot cooldown Mitigates supply-chain risk from mutable tag references and merges dependency updates without a delay window, both flagged by package scoring tools as security concerns. --- .github/dependabot.yml | 4 ++++ .github/workflows/dependabot-auto-merge.yml | 2 +- .github/workflows/fix-php-code-style-issues.yml | 6 +++--- .github/workflows/test-matrix.yml | 4 ++-- .github/workflows/update-changelog.yml | 6 +++--- 5 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 39b1580..fa36e71 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,6 +10,8 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 - package-ecosystem: "composer" directory: "/" @@ -17,3 +19,5 @@ updates: interval: "weekly" labels: - "dependencies" + cooldown: + default-days: 7 diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 0631c23..48100de 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -14,7 +14,7 @@ jobs: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v3.1.0 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" diff --git a/.github/workflows/fix-php-code-style-issues.yml b/.github/workflows/fix-php-code-style-issues.yml index 2773652..646c659 100644 --- a/.github/workflows/fix-php-code-style-issues.yml +++ b/.github/workflows/fix-php-code-style-issues.yml @@ -17,14 +17,14 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: ${{ github.head_ref }} - name: Fix PHP code style issues - uses: aglipanci/laravel-pint-action@2.6 + uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # 2.6 - name: Commit changes - uses: stefanzweifel/git-auto-commit-action@v5 + uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5 with: commit_message: Fix styling diff --git a/.github/workflows/test-matrix.yml b/.github/workflows/test-matrix.yml index ee244e7..28b7723 100644 --- a/.github/workflows/test-matrix.yml +++ b/.github/workflows/test-matrix.yml @@ -102,10 +102,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Setup PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45 # v2 with: php-version: ${{ matrix.php }} coverage: none diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml index 556d379..2c9a95c 100644 --- a/.github/workflows/update-changelog.yml +++ b/.github/workflows/update-changelog.yml @@ -14,18 +14,18 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: ref: main - name: Update Changelog - uses: stefanzweifel/changelog-updater-action@v1 + uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1 with: latest-version: ${{ github.event.release.name }} release-notes: ${{ github.event.release.body }} - name: Commit updated CHANGELOG - uses: stefanzweifel/git-auto-commit-action@v5 + uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5 with: branch: main commit_message: Update CHANGELOG From 152b4e7616c36c3f3bcad7cf35674593d7d85e1e Mon Sep 17 00:00:00 2001 From: WatheqAlshowaiter <24838274+WatheqAlshowaiter@users.noreply.github.com> Date: Thu, 20 Aug 2026 18:42:09 +0000 Subject: [PATCH 2/3] Fix styling --- src/FieldsService.php | 1 + src/Support/Helpers.php | 2 ++ 2 files changed, 3 insertions(+) diff --git a/src/FieldsService.php b/src/FieldsService.php index 259c537..05aff75 100644 --- a/src/FieldsService.php +++ b/src/FieldsService.php @@ -87,6 +87,7 @@ public function requiredFields() $primaryIndex = $this->primaryField(); $table = Helpers::getTableFromThisModel($this->modelClass); + return collect(Schema::getColumns($table)) ->map(function ($column) { // specific to mariadb if ($column['default'] == 'NULL') { diff --git a/src/Support/Helpers.php b/src/Support/Helpers.php index 25a8632..75db5c4 100644 --- a/src/Support/Helpers.php +++ b/src/Support/Helpers.php @@ -38,6 +38,7 @@ public static function getTableFromThisModel($model) /** * @return array + * * @throws ReflectionException */ public static function getModelAttributes($model) @@ -79,6 +80,7 @@ public static function getObserverFilledFields($modelOrClass) * Get a model for passive metadata inspection without starting its boot cycle. * * @return object + * * @throws ReflectionException */ protected static function getModelWithoutBooting($modelOrClass) From c009ed25991a474db23f7216de01203508f0f416 Mon Sep 17 00:00:00 2001 From: Watheq Alshowaiter Date: Thu, 20 Aug 2026 22:06:06 +0300 Subject: [PATCH 3/3] Fix email format for vulnerability reporting --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index a0b3ece..ca9d5cf 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -10,6 +10,6 @@ These package versions are security-supported. ## Reporting a Vulnerability -You can report a vulnerability by sending an email to [watheq[dot]alshowaiter[at]gmail[dot]com](mailto:watheq[dot]alshowaiter[at]gmail[dot]com). +You can report a vulnerability by sending an email to [watheq[dot]alshowaiter[at]gmail[dot]com](mailto:watheq.alshowaiter@gmail.com). Thank you for helping to keep this package secure.