mxr576

Symfony security advisories — May 20, 2026

All CVEs shipped in the coordinated release of v5.4.x / v6.4.40 / v7.4.12 / v8.0.12 on May 20, 2026. CVE numbers and descriptions are sourced from the v8.0.12 release notes. SA links are sourced from the Symfony security advisories blog.

CVE	Component	Impact	SA report	Fix commit	Branches
CVE-2026-46626	[Runtime]	CVE-2024-50340 patch bypass: web requests can still set APP_ENV/APP_DEBUG via parse_str/SAPI argv mismatch	SA	3228c3806e	5.4+
CVE-2026-47212	[Notifier/Twilio]	Twilio webhook parser never verifies the X-Twilio-Signature HMAC: unauthentica

mxr576

{
    "name": "mxr576/drupal-ai-providers",
    "description": "Downloads a collection of Drupal AI provider modules. Intended for exploring provider implementations or refactoring the AI core module. WARNING: This setup creates a non-functioning project.",
    "type": "metapackage",
    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        }
    ],

mxr576

Your role is to help create clear, well-structured issue descriptions for Drupal.org that follow community standards for both Drupal core and contributed projects.

Instructions

1. Template usage

• If no issue title is provided, suggest one or up to three alternatives.
• If the user provides an HTML template, use it exactly as provided, with no structural, markup, or attribute changes (including id, class, and data-* attributes).
• Do not change heading levels or strip/add attributes on user-provided headings.
• If no template is provided, apply the default Drupal issue summary template shown here:

mxr576

<h3 id="summary-problem-motivation">Problem/Motivation</h3>
(Why the issue was filed, steps to reproduce the problem, etc.)

<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
(Detailed instructions on how to reproduce the issue, including exact versions used, specific paths to visit, what actions to take, etc.)

<h3 id="summary-proposed-resolution">Proposed resolution</h3>
(Description of the proposed solution, the rationale behind it, and workarounds for people who cannot use the patch.)

<h3 id="summary-remaining-tasks">Remaining tasks</h3>

mxr576

You are an expert bash script developer. Create cross-platform bash scripts that work reliably on WSL, Ubuntu Linux, and macOS while following Google's Shell Style Guide (https://google.github.io/styleguide/shellguide.html).

Core requirements

Essential script structure:

#!/usr/bin/env bash
set -eou pipefail
if [[ -n "${DEBUG:-}" ]]; then
 set -x

mxr576

Composer project template that speeds up contribution to Apigee Edge Drupal module and Apigee API client PHP library.

Steps

1. Pick composer.json
2. Fork these components on Github.
3. Change CHANGE_ME strings in repository urls to your Github user name.
4. Run composer install

You get these components installed from version control. After that you can follow the regular GitHub PR workflow.

mxr576

################################################################################
# DDQG Composer Audit Docker image with Composer Audit Changes plugin.
#
# Usage:
# - docker buildx build --tag mxr576/ddqg_composer_audit:latest .
# - docker run --rm -ti -v [PATH_TO_COMPOSER_PROJECT_ROOT]:/app -v ${COMPOSER_HOME:-$HOME/.composer}/cache:/tmp/composer/cache mxr576/ddqg_composer_audit:latest audit -d /app 2>/dev/null # Ignore STDERR that contains the #StandWithUkraine message and leads to malformed JSON output
#
# See further ideas at https://hub.docker.com/r/composer/composer
#
# Simplified and customized version of https://github.com/composer/docker/blob/fd5f23e4881cad1f4a3f4249dd2120a8788fb2d9/latest/Dockerfile

mxr576

<?php

/**
 * @file
 * Dumping ground for stubs, until a pattern emerges.
 */

declare(strict_types=1);

namespace Drupal\datetime\Plugin\Field\FieldType {

mxr576

Change Symfony requirements in composer.json

This took me two hours on stackoverflow.com, so I'm going to document it to future me:

In the composer.json require section, for all packages starting with symfony/, but not for symfony/monolog-bundle, change the required version to the value of the $VERSION environment variable.

Write out the updated composer.json file in a way that works _without sponge`, which is not installed on GitHub Action runners by default.

mxr576

Content of the .htpasswd file

user:$apr1$TCSj3uFG$x3fNG4H6gvuxvNu5UMo3i/

(username: "user", password: "user")

@see https://www.digitalocean.com/community/tutorials/how-to-set-up-password-authentication-with-nginx-on-ubuntu-22-04

Only relevant changes in the drupal9-custom.conf.tmpl file