From e26ee5b542677b11dac1ee8b3f19fb7bfbb518e6 Mon Sep 17 00:00:00 2001 From: jcchavezs Date: Tue, 9 Jun 2026 17:38:46 +0200 Subject: [PATCH 1/5] chore(security): uses pinned versions of actions --- .github/workflows/release.yml | 2 +- .github/workflows/rl-scanner.yml | 2 +- .github/workflows/snyk.yml | 4 ++-- .github/workflows/tests.yml | 18 +++++++++--------- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cbbfeed..e7591cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -34,7 +34,7 @@ jobs: steps: # Checkout the code - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: fetch-depth: 0 diff --git a/.github/workflows/rl-scanner.yml b/.github/workflows/rl-scanner.yml index 03773f3..0e33256 100644 --- a/.github/workflows/rl-scanner.yml +++ b/.github/workflows/rl-scanner.yml @@ -32,7 +32,7 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml index 2b2cd9b..c492f37 100644 --- a/.github/workflows/snyk.yml +++ b/.github/workflows/snyk.yml @@ -34,7 +34,7 @@ jobs: matrix: ${{ steps.set-matrix.outputs.matrix }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }} @@ -51,7 +51,7 @@ jobs: - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group' run: exit 0 - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.merge_commit_sha || github.ref }} diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 094507a..0bde3e3 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -25,7 +25,7 @@ jobs: matrix: ${{ steps.set-matrix.outputs.matrix }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -42,7 +42,7 @@ jobs: matrix: ${{ fromJson(needs.configure.outputs.matrix) }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -60,7 +60,7 @@ jobs: matrix: ${{ fromJson(needs.configure.outputs.matrix) }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -88,7 +88,7 @@ jobs: matrix: ${{ fromJson(needs.configure.outputs.matrix) }} steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -104,7 +104,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -120,7 +120,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -136,7 +136,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -152,7 +152,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} @@ -168,7 +168,7 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} From fdd20effbea88f13a0bf6132c86ed8825d9007e8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Jun 2026 01:52:40 +0000 Subject: [PATCH 2/5] Bump shivammathur/setup-php from 2.32.0 to 2.37.2 Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) from 2.32.0 to 2.37.2. - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/9e72090525849c5e82e596468b86eb55e9cc5401...f3e473d116dcccaddc5834248c87452386958240) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/rl-scanner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/rl-scanner.yml b/.github/workflows/rl-scanner.yml index 0e33256..f6648d8 100644 --- a/.github/workflows/rl-scanner.yml +++ b/.github/workflows/rl-scanner.yml @@ -37,7 +37,7 @@ jobs: ref: ${{ github.event.pull_request.head.sha || github.sha || github.ref }} - name: Setup PHP - uses: shivammathur/setup-php@9e72090525849c5e82e596468b86eb55e9cc5401 # pin@2.32.0 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # pin@2.37.2 with: php-version: ${{ inputs.php-version }} From d54d32e5b19410a782ba8781754751ff076fe4c0 Mon Sep 17 00:00:00 2001 From: Snehil Kishore Date: Wed, 10 Jun 2026 11:06:02 +0530 Subject: [PATCH 3/5] fix: resolve PHPStan and Psalm errors from updated dependencies - SessionStore::delete() now captures the session once so the non-null calls don't use redundant nullsafe operators (PHPStan nullsafe.neverNull) - Auth0Bundle::loadExtension() param names match the parent AbstractBundle/ConfigurableExtensionInterface signature (Psalm ParamNameMismatch) --- src/Auth0Bundle.php | 24 ++++++++++++------------ src/Stores/SessionStore.php | 7 ++++--- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/src/Auth0Bundle.php b/src/Auth0Bundle.php index 25a6c89..4f6bd69 100644 --- a/src/Auth0Bundle.php +++ b/src/Auth0Bundle.php @@ -29,11 +29,11 @@ public function configure(DefinitionConfigurator $definition): void } /** - * @param array $config The configuration array. - * @param ContainerConfigurator $container The container configurator. - * @param ContainerBuilder $builder The container builder. + * @param array $config The configuration array. + * @param ContainerConfigurator $configurator The container configurator. + * @param ContainerBuilder $container The container builder. */ - public function loadExtension(array $config, ContainerConfigurator $container, ContainerBuilder $builder): void + public function loadExtension(array $config, ContainerConfigurator $configurator, ContainerBuilder $container): void { $sdkConfig = $config['sdk'] ?? []; @@ -119,7 +119,7 @@ public function loadExtension(array $config, ContainerConfigurator $container, C $scopes = null; } - $container->services() + $configurator->services() ->set('auth0.configuration', SdkConfiguration::class) ->arg('$configuration', null) ->arg('$strategy', $sdkConfig['strategy']) @@ -167,14 +167,14 @@ public function loadExtension(array $config, ContainerConfigurator $container, C ->arg('$backchannelLogoutCache', $backchannelLogoutCache) ->arg('$backchannelLogoutExpires', $sdkConfig['backchannel_logout_expires']); - $container->services() + $configurator->services() ->set('auth0', Service::class) ->arg('$configuration', new Reference('auth0.configuration')) ->arg('$requestStack', new Reference('request_stack')) ->arg('$logger', new Reference('logger')) ->tag('routing.condition_service'); - $container->services() + $configurator->services() ->set('auth0.authenticator', Authenticator::class) ->arg('$configuration', $config['authenticator'] ?? []) ->arg('$service', new Reference('auth0')) @@ -182,32 +182,32 @@ public function loadExtension(array $config, ContainerConfigurator $container, C ->arg('$logger', new Reference('logger')) ->tag('security.authenticator'); - $container->services() + $configurator->services() ->set('auth0.store_session', SessionStore::class) ->arg('$namespace', $sessionStoragePrefix) ->arg('$requestStack', new Reference('request_stack')) ->arg('$logger', new Reference('logger')); - $container->services() + $configurator->services() ->set('auth0.store_transient', SessionStore::class) ->arg('$namespace', $transientStoragePrefix) ->arg('$requestStack', new Reference('request_stack')) ->arg('$logger', new Reference('logger')); - $container->services() + $configurator->services() ->set('auth0.authorizer', Authorizer::class) ->arg('$configuration', $config['authorizer'] ?? []) ->arg('$service', new Reference('auth0')) ->arg('$logger', new Reference('logger')); - $container->services() + $configurator->services() ->set(AuthenticationController::class) ->arg('$authenticator', new Reference('auth0.authenticator')) ->arg('$router', new Reference('router')) ->call('setContainer', [new Reference('service_container')]) ->tag('controller.service_arguments'); - $container->services() + $configurator->services() ->set(UserProvider::class) ->arg('$service', new Reference('auth0')); } diff --git a/src/Stores/SessionStore.php b/src/Stores/SessionStore.php index 467f3bb..203169a 100644 --- a/src/Stores/SessionStore.php +++ b/src/Stores/SessionStore.php @@ -58,7 +58,8 @@ public function defer( public function delete( string $key, ): void { - $manifest = $this->session()?->get($this->namespace, []); + $session = $this->session(); + $manifest = $session?->get($this->namespace, []); if (! is_array($manifest) || [] === $manifest) { return; @@ -68,12 +69,12 @@ public function delete( unset($manifest[$key]); if ([] === $manifest) { - $this->session()?->remove($this->namespace); + $session->remove($this->namespace); return; } - $this->session()?->set($this->namespace, $manifest); + $session->set($this->namespace, $manifest); } } From 2a9582943d5849d55acda8e641a585c452f999d6 Mon Sep 17 00:00:00 2001 From: Snehil Kishore Date: Wed, 10 Jun 2026 11:17:23 +0530 Subject: [PATCH 4/5] chore(security): ignore false-positive Snyk license flag for auth0-php Snyk reports auth0/auth0-php@8.19.0 as "Unknown license" though the package is MIT-licensed. Add a .snyk policy to ignore the license issue so the vulnerability check passes. --- .snyk | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000..dcc0c0f --- /dev/null +++ b/.snyk @@ -0,0 +1,7 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.5.0 +ignore: + snyk:lic:composer:auth0:auth0-php:Unknown: + - '*': + reason: auth0/auth0-php is MIT-licensed; Snyk lacks license metadata for 8.19.0 + expires: 2027-06-10T00:00:00.000Z From e9d8d47e517eaca27304a87a3b50d58e9ef3a290 Mon Sep 17 00:00:00 2001 From: Snehil Kishore Date: Wed, 10 Jun 2026 11:37:09 +0530 Subject: [PATCH 5/5] chore(security): align .snyk policy format with Snyk v1.12.0 schema Quote the license issue key and bump the policy version so Snyk correctly parses and honors the auth0-php license ignore. --- .snyk | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/.snyk b/.snyk index dcc0c0f..71dd378 100644 --- a/.snyk +++ b/.snyk @@ -1,7 +1,9 @@ # Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. -version: v1.5.0 +version: v1.12.0 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date ignore: - snyk:lic:composer:auth0:auth0-php:Unknown: + "snyk:lic:composer:auth0:auth0-php:Unknown": - '*': - reason: auth0/auth0-php is MIT-licensed; Snyk lacks license metadata for 8.19.0 - expires: 2027-06-10T00:00:00.000Z + reason: "auth0/auth0-php is MIT-licensed; Snyk lacks license metadata for 8.19.0" + expires: "2027-06-10T00:00:00.000Z" +patch: {}