|
| 1 | +# Saloon |
| 2 | + |
| 3 | +Endless Lifecycle Support (ELS) for Saloon from TuxCare provides security fixes for Saloon library versions that have reached their end-of-life. This allows you to continue running your applications without vulnerability concerns, even after official support has ended. |
| 4 | + |
| 5 | +## Supported Versions |
| 6 | + |
| 7 | +* **Saloon** 3.15.0 |
| 8 | + |
| 9 | +Other versions upon request. |
| 10 | + |
| 11 | +## Connection to ELS for Saloon Repository |
| 12 | + |
| 13 | +This guide outlines the steps needed to integrate the TuxCare ELS for Saloon repository into your application. The repository provides trusted Saloon library versions that can be easily integrated into your **Composer** projects. |
| 14 | + |
| 15 | +### Step 1: Get user credentials |
| 16 | + |
| 17 | +You need a username and password in order to use TuxCare ELS for Saloon repository. Anonymous access is disabled. To receive the credentials, please contact [[email protected]](mailto:[email protected]). |
| 18 | + |
| 19 | +### Step 2: Configure Composer authentication |
| 20 | + |
| 21 | +1. Create or edit the `auth.json` file for the user running Composer: |
| 22 | + |
| 23 | + * **Linux/macOS**: |
| 24 | + |
| 25 | + ```text |
| 26 | + ~/.composer/auth.json |
| 27 | + ``` |
| 28 | +
|
| 29 | + * **Windows**: |
| 30 | +
|
| 31 | + ```text |
| 32 | + %APPDATA%\Composer\auth.json |
| 33 | + ``` |
| 34 | +
|
| 35 | +2. Use either the Composer CLI or edit `auth.json` directly to add your credentials for `nexus.repo.tuxcare.com`. |
| 36 | +
|
| 37 | + <CodeTabs :tabs="[ |
| 38 | + { title: 'Composer CLI', content: `composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD` }, |
| 39 | + { title: 'auth.json', content: authjson } |
| 40 | + ]" /> |
| 41 | +
|
| 42 | + Replace `USERNAME` and `PASSWORD` with the credentials you received in [Step 1](#step-1-get-user-credentials). |
| 43 | +
|
| 44 | +### Step 3: Register the TuxCare repository |
| 45 | +
|
| 46 | +Add the `els_php` Composer repository either via CLI or by editing `composer.json`: |
| 47 | +
|
| 48 | + <CodeTabs :tabs="[ |
| 49 | + { title: 'Composer CLI', content: cli }, |
| 50 | + { title: 'composer.json', content: composerjson } |
| 51 | + ]" /> |
| 52 | +
|
| 53 | +### Step 4: Install Saloon |
| 54 | +
|
| 55 | +Install the TuxCare-maintained Saloon release that matches your project: |
| 56 | +
|
| 57 | +<CodeTabs :tabs="[ |
| 58 | + { title: 'Composer CLI', content: `composer require saloonphp/saloon:3.15.0-p1+tuxcare` }, |
| 59 | + { title: 'composer.json', content: pkgjson } |
| 60 | +]" /> |
| 61 | +
|
| 62 | +**Check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** |
| 63 | +
|
| 64 | +If you edited `composer.json` manually, run `composer update` to install the package: |
| 65 | +
|
| 66 | +```text |
| 67 | +composer update |
| 68 | +``` |
| 69 | + |
| 70 | +Composer will resolve dependencies against the TuxCare repository and install the patched releases. |
| 71 | + |
| 72 | +### Composer Repository Configuration |
| 73 | + |
| 74 | +If you encounter dependency resolution errors like: |
| 75 | + |
| 76 | +`packages from higher priority repository do not match your constraint` |
| 77 | + |
| 78 | +it usually means your project requires a package version that is not yet available in the TuxCare repository. |
| 79 | + |
| 80 | +**Solution**: Update your `composer.json` to set the TuxCare repository as non-canonical: |
| 81 | + |
| 82 | +``` |
| 83 | +{ |
| 84 | + "repositories": [ |
| 85 | + { |
| 86 | + "type": "composer", |
| 87 | + "url": "https://nexus.repo.tuxcare.com/repository/els_php/", |
| 88 | + "canonical": false |
| 89 | + } |
| 90 | + ] |
| 91 | +} |
| 92 | +``` |
| 93 | + |
| 94 | +This allows Composer to fall back to Packagist for packages not available in the TuxCare repository, while still preferring TuxCare patches when available. |
| 95 | + |
| 96 | +## Vulnerability Exploitability eXchange (VEX) |
| 97 | + |
| 98 | +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks. |
| 99 | + |
| 100 | +TuxCare provides VEX for Saloon ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_php/saloon/](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/saloon/). |
| 101 | + |
| 102 | +## How to Upgrade to a Newer Version |
| 103 | + |
| 104 | +If you have already installed a TuxCare Saloon package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version: |
| 105 | + |
| 106 | +```text |
| 107 | +composer require saloonphp/saloon:VERSION-pN+tuxcare |
| 108 | +``` |
| 109 | + |
| 110 | +Then run `composer update` to apply the changes: |
| 111 | + |
| 112 | +```text |
| 113 | +composer update |
| 114 | +``` |
| 115 | + |
| 116 | +## Resolved CVEs in Saloon |
| 117 | + |
| 118 | +Fixes for the following vulnerabilities are available in ELS for Saloon from TuxCare: |
| 119 | + |
| 120 | +<TableTabs label="Choose a version: " > |
| 121 | + |
| 122 | +<template #Saloon_3.15.0> |
| 123 | + |
| 124 | +| CVE ID | Severity | Vulnerable versions | Fixed in version | |
| 125 | +|----------------|----------|---------------------|--------------------| |
| 126 | +| CVE-2026-33942 | Critical | < 4.0.0 | 3.15.0-p1+tuxcare | |
| 127 | +| CVE-2026-33183 | Critical | < 4.0.0 | 3.15.0-p1+tuxcare | |
| 128 | +| CVE-2026-33182 | High | < 4.0.0 | 3.15.0-p1+tuxcare | |
| 129 | + |
| 130 | +</template> |
| 131 | + |
| 132 | +</TableTabs> |
| 133 | + |
| 134 | +If you are interested in the TuxCare Endless Lifecycle Support, contact [[email protected]](mailto:[email protected]). |
| 135 | + |
| 136 | +<script setup> |
| 137 | + |
| 138 | +const authjson = |
| 139 | +`{ |
| 140 | + "http-basic": { |
| 141 | + "nexus.repo.tuxcare.com": { |
| 142 | + "username": "USERNAME", |
| 143 | + "password": "PASSWORD" |
| 144 | + } |
| 145 | + } |
| 146 | +}` |
| 147 | + |
| 148 | +const composerjson = |
| 149 | +`{ |
| 150 | + "repositories": [ |
| 151 | + { |
| 152 | + "type": "composer", |
| 153 | + "url": "https://nexus.repo.tuxcare.com/repository/els_php/", |
| 154 | + "options": { |
| 155 | + "http": { |
| 156 | + "verify": true |
| 157 | + } |
| 158 | + } |
| 159 | + } |
| 160 | + ] |
| 161 | +}` |
| 162 | + |
| 163 | +const cli = |
| 164 | +`composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php/","options":{"http":{"verify":true}}}' --json` |
| 165 | + |
| 166 | +const pkgjson = |
| 167 | +`{ |
| 168 | + "require": { |
| 169 | + "saloonphp/saloon": "3.15.0-p1+tuxcare" |
| 170 | + } |
| 171 | +}` |
| 172 | + |
| 173 | +</script> |
0 commit comments