From 440bb9e01f6ab4da114068f44fe41101afa7eebf Mon Sep 17 00:00:00 2001 From: Deepak Kumar Mishra Date: Mon, 20 Jul 2026 11:33:41 +0530 Subject: [PATCH 1/2] fix(CLI-1839): guard against missing 'type' key in oneOf loop castParamType accessed $type['type'] unconditionally inside the oneOf loop. A $ref entry (or any entry without an inline type) caused an "Undefined array key type" PHP Warning. Skip entries that lack the key. Co-Authored-By: Claude Sonnet 4.6 --- src/Command/Api/ApiBaseCommand.php | 3 +++ .../src/Commands/Api/ApiCommandTest.php | 18 ++++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/src/Command/Api/ApiBaseCommand.php b/src/Command/Api/ApiBaseCommand.php index 4a3eb4a67..5c048b55a 100644 --- a/src/Command/Api/ApiBaseCommand.php +++ b/src/Command/Api/ApiBaseCommand.php @@ -237,6 +237,9 @@ private function castParamType(array $paramSpec, array|string|bool|int $value): if (isset($oneOf)) { $types = []; foreach ($oneOf as $type) { + if (!array_key_exists('type', $type)) { + continue; + } if ($type['type'] === 'array' && str_contains($value, ',')) { return $this->castParamToArray($type, $value); } diff --git a/tests/phpunit/src/Commands/Api/ApiCommandTest.php b/tests/phpunit/src/Commands/Api/ApiCommandTest.php index 57c362a3e..216f4b661 100644 --- a/tests/phpunit/src/Commands/Api/ApiCommandTest.php +++ b/tests/phpunit/src/Commands/Api/ApiCommandTest.php @@ -59,6 +59,24 @@ public function testTrustedProxiesCommandExecutesHttpGet(): void $this->assertEquals(0, $this->getStatusCode()); } + /** + * oneOf entries that lack a 'type' key (e.g. unresolved $ref) must be + * skipped silently rather than throwing an "Undefined array key" warning. + */ + public function testCastParamTypeSkipsOneOfEntriesWithoutTypeKey(): void + { + $command = $this->getApiCommandByName('api:environments:code-switch'); + $ref = new \ReflectionMethod($command, 'castParamType'); + $paramSpec = [ + 'oneOf' => [ + ['$ref' => '#/components/schemas/SomeRef'], + ['type' => 'integer'], + ], + ]; + $result = $ref->invoke($command, $paramSpec, '42'); + $this->assertSame(42, $result); + } + public function testTaskWait(): void { $environmentId = '24-a47ac10b-58cc-4372-a567-0e02b2c3d470'; From b44aff8276dfa2f5c3019c3902fcb33e17802fc3 Mon Sep 17 00:00:00 2001 From: Deepak Kumar Mishra Date: Tue, 21 Jul 2026 14:45:21 +0530 Subject: [PATCH 2/2] Bump guzzlehttp/guzzle from 7.14.1 to 7.15.1 to fix security advisories Addresses 4 medium severity advisories reported 2026-07-20: - GHSA-h95v-h523-3mw8: URI fragments disclosed in redirect Referer headers - GHSA-wm3w-8rrp-j577: Host-only cookie scope is not preserved - GHSA-f283-ghqc-fg79: Unbounded response cookies risk denial of service - GHSA-94pj-82f3-465w: Proxy-Authorization headers can be sent to origin servers Co-Authored-By: Claude Sonnet 4.6 --- composer.lock | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/composer.lock b/composer.lock index 701c5c2da..26ba68757 100644 --- a/composer.lock +++ b/composer.lock @@ -696,22 +696,22 @@ }, { "name": "guzzlehttp/guzzle", - "version": "7.14.1", + "version": "7.15.1", "source": { "type": "git", "url": "https://github.com/guzzle/guzzle.git", - "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0" + "reference": "61443dfb33c62f308ee8add20f45b4d6e4bf8d2f" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/guzzle/zipball/6b1d2429a2c312474c523aa9017fba0c07b5f4a0", - "reference": "6b1d2429a2c312474c523aa9017fba0c07b5f4a0", + "url": "https://api.github.com/repos/guzzle/guzzle/zipball/61443dfb33c62f308ee8add20f45b4d6e4bf8d2f", + "reference": "61443dfb33c62f308ee8add20f45b4d6e4bf8d2f", "shasum": "" }, "require": { "ext-json": "*", "guzzlehttp/promises": "^2.5.1", - "guzzlehttp/psr7": "^2.12.5", + "guzzlehttp/psr7": "^2.13", "php": "^7.2.5 || ^8.0", "psr/http-client": "^1.0", "symfony/deprecation-contracts": "^2.5 || ^3.0", @@ -724,7 +724,7 @@ "bamarni/composer-bin-plugin": "^1.8.2", "ext-curl": "*", "guzzle/client-integration-tests": "3.0.3", - "guzzlehttp/test-server": "^0.6", + "guzzlehttp/test-server": "^0.7", "php-http/message-factory": "^1.1", "phpunit/phpunit": "^8.5.52 || ^9.6.34", "psr/log": "^1.1 || ^2.0 || ^3.0" @@ -804,7 +804,7 @@ ], "support": { "issues": "https://github.com/guzzle/guzzle/issues", - "source": "https://github.com/guzzle/guzzle/tree/7.14.1" + "source": "https://github.com/guzzle/guzzle/tree/7.15.1" }, "funding": [ { @@ -820,7 +820,7 @@ "type": "tidelift" } ], - "time": "2026-07-13T01:32:54+00:00" + "time": "2026-07-18T11:23:11+00:00" }, { "name": "guzzlehttp/promises", @@ -908,16 +908,16 @@ }, { "name": "guzzlehttp/psr7", - "version": "2.12.5", + "version": "2.13.0", "source": { "type": "git", "url": "https://github.com/guzzle/psr7.git", - "reference": "9365d578a9fd1552ad6ca9c3cb530708526feb09" + "reference": "dad89620b7a6edb60c15858442eb2e408b45d8f4" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/guzzle/psr7/zipball/9365d578a9fd1552ad6ca9c3cb530708526feb09", - "reference": "9365d578a9fd1552ad6ca9c3cb530708526feb09", + "url": "https://api.github.com/repos/guzzle/psr7/zipball/dad89620b7a6edb60c15858442eb2e408b45d8f4", + "reference": "dad89620b7a6edb60c15858442eb2e408b45d8f4", "shasum": "" }, "require": { @@ -1007,7 +1007,7 @@ ], "support": { "issues": "https://github.com/guzzle/psr7/issues", - "source": "https://github.com/guzzle/psr7/tree/2.12.5" + "source": "https://github.com/guzzle/psr7/tree/2.13.0" }, "funding": [ { @@ -1023,7 +1023,7 @@ "type": "tidelift" } ], - "time": "2026-07-13T01:27:20+00:00" + "time": "2026-07-16T22:23:49+00:00" }, { "name": "http-interop/http-factory-guzzle", @@ -14056,5 +14056,5 @@ "platform-overrides": { "php": "8.2.29" }, - "plugin-api-version": "2.9.0" + "plugin-api-version": "2.6.0" }