How to handle security advisories by adriendupuis · Pull Request #3278 · ibexa/documentation-developer

adriendupuis · 2026-07-06T14:34:40Z

Question	Answer
JIRA Ticket
Versions	4.6 (TODO: something to reuse on 5.0??)
Edition

#3235 and #3246 show that maintaining an exhaustive list of Security Advisories (SA) for both update and install is fastidious.

This PR proposes to explain how to handle SA in general.

Also document how to suppress deprecation messages breaking ibexa:install on PHP 8.4

Move CI code_samples.yaml from deprecated config.audit.ignore to config.policy.advisories.ignore-id, update its SA list, and sort alphabetically.

Checklist

Text renders correctly
Text has been checked with vale
Description metadata is up to date
Redirects cover removed/moved pages
Code samples are working
PHP code samples have been fixed with PHP CS fixer
Added link to this PR in relevant JIRA ticket or code PR

github-actions · 2026-07-06T14:35:15Z

Preview of modified files

Preview of modified Markdown:

mnocon

Initial pass, like the direction a lot - seems much more maintanable than maintaing the list of advisories 💪

…t.md

Added by default since 4.6.8 https://github.com/ibexa/commerce-skeleton/blob/v4.6.8/composer.json#L70-L72

glye

Great improvement.

glye · 2026-07-07T14:34:34Z


 - Run servers on a recent operating system and install security patches for dependencies.
 - Configure servers to alert you about security updates from vendors. Pay special attention to dependencies used by your project directly, or by PHP. The provider of the operating system usually has a service for this.
+- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions.


Maybe also add a point about considering whether you should update to very freshly released packages. There is a potential security benefit to avoiding the newest packages, because of supply-chain attacks. Composer doesn't have a setting for this yet, but minimum-release-age is coming:
composer/composer#12633

@glye Some like this?:

Suggested change

- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions.

- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions. Delay the installation of recently released version that aren't fixes. Only install fixing versions and one-month-old versions.

Feels too definite and specific to me. "that aren't fixes" isn't very helpful since attacks will likely camouflage as fixes. I would only advise people to consider the risk of supply chain attacks, and whether they ought to have a policy for avoiding recent releases newer than X time.

@glye Thx for the vocabulary :)

What about this?:

Suggested change

- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions.

- Update your Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories) and update your dependencies so you can install the fixed versions. Also consider the risk of [supply chain attacks](https://en.wikipedia.org/wiki/Supply_chain_attack) which could be mitigated by adopting a policy of waiting a minimum amount of time before using new releases.

Yes, this looks good to me!

Co-authored-by: Gunnstein Lye <289744+glye@users.noreply.github.com>

mnocon · 2026-07-10T09:39:17Z

    <a id="authentication-token"></a>If you added credentials to the `COMPOSER_AUTH` variable, at this point add this variable to `auth.json` (for example, by running `echo $COMPOSER_AUTH > auth.json`).

-!!! tip
+!!! caution "Security advisories"


6 admonitions in the row, no need to change this now but at some point we'll have to rework this - for v6 most likely

mnocon · 2026-07-10T10:31:04Z

+Example of a Composer output about a package with security issues when trying to install:
+
+```text
+- Root composer.json requires twig/cssinliner-extra v3.11.0 (exact version match), found twig/cssinliner-extra[v3.11.0] but these were not loaded, because they are affected by security advisories ("PKSA-fs5b-x5k4-1h39").


Nitpick category: can you split this message into multiple lines, so that you can see the whole message on the screen? This will make things easier to read.

Applies to all Composer outputs in this article.

mnocon · 2026-07-10T10:33:34Z

+
+Composer's output isn't always this verbose about security advisories blocking installation or updates.
+
+For example, imagine this error appeared recently when trying to install [[= product_name =]] 4.6 on PHP 7.4:


Suggested change

For example, imagine this error appeared recently when trying to install [[= product_name =]] 4.6 on PHP 7.4:

For example, when trying to install [[= product_name =]] 4.6 on PHP 7.4 you might see an error like the following one:

mnocon · 2026-07-10T10:36:55Z

+
+It's highly recommended that you not install the affected package, and instead meet the requirements of the fixed version.
+
+You can use the https://packagist.org/security-advisories/ resource to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).


Suggested change

You can use the https://packagist.org/security-advisories/ resource to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).

You can use the [Packagist Security Advisories database](https://packagist.org/security-advisories/) to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).

mnocon · 2026-07-10T10:43:39Z

+It worked before. You can check packagist.org, or an already running instance of [[= product_name =]], to see which version of this package was previously accepted.
+
+In this example, [`twig/twig` v3.11.3](https://packagist.org/packages/twig/twig#v3.11.3) matches the constraints `^3.0` and PHP 7.4 `>=7.2.5`.


Suggested change

It worked before. You can check packagist.org, or an already running instance of [[= product_name =]], to see which version of this package was previously accepted.

In this example, [`twig/twig` v3.11.3](https://packagist.org/packages/twig/twig#v3.11.3) matches the constraints `^3.0` and PHP 7.4 `>=7.2.5`.

To gather more information, check package information on [Packagist](packagist.org) and try installing a specific version of the package blocking installation.

In this case, trying to install `twig/twig:3.11.3` shows explicitly that this version is blocked by a security advisory:

mnocon · 2026-07-10T10:52:12Z

+- Root composer.json requires twig/cssinliner-extra v3.11.0 (exact version match), found twig/cssinliner-extra[v3.11.0] but these were not loaded, because they are affected by security advisories ("PKSA-fs5b-x5k4-1h39").
+```
+
+Composer's output isn't always this verbose about security advisories blocking installation or updates.


Suggested change

Composer's output isn't always this verbose about security advisories blocking installation or updates.

Composer's output doesn't always mention that a security advisory is blocking installation or updates.

To avoid a vague "isn't verbose"

mnocon · 2026-07-10T10:54:24Z

+
+If updating the affected package isn't possible, carefully review the security issue and assess the risk.
+If you choose to implement countermeasures instead of upgrading, you can ignore the security advisory.
+We recommend using Composer's [`config.policy.advisories.ignore-id`](https://getcomposer.org/doc/06-config.md#ignore-id) setting, providing for each entry the reason why you consider it safe to ignore.


Suggested change

We recommend using Composer's [`config.policy.advisories.ignore-id`](https://getcomposer.org/doc/06-config.md#ignore-id) setting, providing for each entry the reason why you consider it safe to ignore.

Use Composer's [`config.policy.advisories.ignore-id`](https://getcomposer.org/doc/06-config.md#ignore-id) setting, providing for each entry the reason why you consider it safe to ignore.

adriendupuis added 2 commits July 6, 2026 16:31

Add security_advisories.md

70a24dd

Use security_advisories.md

0956f0a

mnocon reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/infrastructure_and_maintenance/security/security_advisories.md Outdated

Comment thread docs/infrastructure_and_maintenance/security/security_checklist.md Outdated

adriendupuis added 3 commits July 7, 2026 11:10

security_advisories.md: Rework English

188b48a

Update docs/infrastructure_and_maintenance/security/security_checklis…

388702e

…t.md

security_advisories.md: Rework English

7affb5d

adriendupuis commented Jul 7, 2026

View reviewed changes

Comment thread docs/getting_started/install_ibexa_dxp.md Outdated

adriendupuis added 4 commits July 7, 2026 13:44

install_ibexa_dxp.md: Rm Php82HideDeprecationsErrorHandler

382ae22

Added by default since 4.6.8 https://github.com/ibexa/commerce-skeleton/blob/v4.6.8/composer.json#L70-L72

install_ibexa_dxp.md: Why ~E_DEPRECATED

194b0e9

install_ibexa_dxp.md: Why ~E_DEPRECATED

cb2d037

install_ibexa_dxp.md: Few rewording from Claude

8ab2448

This was referenced Jul 7, 2026

Update 4.6 install #3235

Closed

More SA to ignore #3246

Closed

adriendupuis added 2 commits July 7, 2026 14:43

security_advisories.md: Description

3606f37

security_advisories.md: [Ibexa.VariablesGlobal]

6d61d8a

adriendupuis marked this pull request as ready for review July 7, 2026 12:48

adriendupuis requested review from glye and mnocon July 7, 2026 12:48

adriendupuis added 2 commits July 7, 2026 15:02

code_samples.yaml: mv to config.policy.advisories.ignore-id

447a9a8

code_samples.yaml: update SA list

1a23ac6

adriendupuis force-pushed the security-advisories branch from f758443 to 1a23ac6 Compare July 7, 2026 13:29

install_ibexa_dxp.md: About SA

c245949

glye approved these changes Jul 7, 2026

View reviewed changes

Apply suggestion from @glye

973cdbe

Co-authored-by: Gunnstein Lye <289744+glye@users.noreply.github.com>

adriendupuis commented Jul 10, 2026

View reviewed changes

Comment thread docs/infrastructure_and_maintenance/security/security_advisories.md Outdated

Apply suggestion from @adriendupuis

963fad2

mnocon reviewed Jul 10, 2026

View reviewed changes

	- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions.
	- Update Composer packages regularly. Don't underestimate [package security advisories](security_advisories.md#package-security-advisories). Update dependencies to be able to install fixed versions. Delay the installation of recently released version that aren't fixes. Only install fixing versions and one-month-old versions.


		Composer's output isn't always this verbose about security advisories blocking installation or updates.

		For example, imagine this error appeared recently when trying to install [[= product_name =]] 4.6 on PHP 7.4:

	For example, imagine this error appeared recently when trying to install [[= product_name =]] 4.6 on PHP 7.4:
	For example, when trying to install [[= product_name =]] 4.6 on PHP 7.4 you might see an error like the following one:


		It's highly recommended that you not install the affected package, and instead meet the requirements of the fixed version.

		You can use the https://packagist.org/security-advisories/ resource to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).

	You can use the https://packagist.org/security-advisories/ resource to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).
	You can use the [Packagist Security Advisories database](https://packagist.org/security-advisories/) to learn more about a security advisory, such as the affected packages and versions, a detailed description of the issue, and other possible reference IDs for the advisory: PKSA (Packagist Security Advisory), GHSA (GitHub Security Advisories), and CVE (Common Vulnerabilities and Exposures).

		It worked before. You can check packagist.org, or an already running instance of [[= product_name =]], to see which version of this package was previously accepted.

		In this example, [`twig/twig` v3.11.3](https://packagist.org/packages/twig/twig#v3.11.3) matches the constraints `^3.0` and PHP 7.4 `>=7.2.5`.

	Composer's output isn't always this verbose about security advisories blocking installation or updates.
	Composer's output doesn't always mention that a security advisory is blocking installation or updates.

	We recommend using Composer's [`config.policy.advisories.ignore-id`](https://getcomposer.org/doc/06-config.md#ignore-id) setting, providing for each entry the reason why you consider it safe to ignore.
	Use Composer's [`config.policy.advisories.ignore-id`](https://getcomposer.org/doc/06-config.md#ignore-id) setting, providing for each entry the reason why you consider it safe to ignore.

Uh oh!

Conversation

adriendupuis commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

github-actions Bot commented Jul 6, 2026

Preview of modified files

Uh oh!

mnocon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

glye left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

adriendupuis Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

adriendupuis commented Jul 6, 2026 •

edited

Loading

adriendupuis Jul 10, 2026 •

edited

Loading