Repository navigation
[12.x] Prevent escaping from bypassing protection - #62027
Merged
Merged
Conversation
PaladinKnightMaster
added a commit
to PaladinKnightMaster/laravel-elitelima_basic
that referenced
this pull request
Oct 21, 2026
Dependabot's own PR for this (#40, 12.69.2 to 12.69.3) closed itself as "no longer updatable". The target had moved on to 12.70.1, and the composer-patches group only admitted patch bumps, which excludes 12.70.x. This takes the current release directly. The two releases between here and there carry hardening: - 12.70.1 (laravel/framework#62027, a backport of #61755): the mail Markdown escaper did not escape backslash or "]" in user input, so a crafted value could undo the escaping applied to the rest of it. - 12.70.0 (#61838): whereRowValues() now validates its operator, which was previously passed through unchecked, and cursor pagination no longer wraps a column in a raw expression when it is not an alias. Neither is reachable from this app. It has no calls to whereRowValues or cursor pagination, and its only Markdown mail is the admin password reset, which is static text plus a route URL, with secured encoding off. composer audit reports no advisories either way. It is still worth taking: these are fixes upstream considered security-relevant, and sitting on 12.69.2 only widens the gap to the next one. composer.json is unchanged, since ^12.0 already admits 12.70.1, and laravel/framework is the only package the lock moves. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backporting security fix in #61755 to v12 from v13.