fix(VUL-24493): remove guzzlehttp/guzzle by upgrading to behat/mink-goutte-driver v2 + fabpot/goutte v4 - #556
Open
service-samwise wants to merge 4 commits into
Open
fix(VUL-24493): remove guzzlehttp/guzzle by upgrading to behat/mink-goutte-driver v2 + fabpot/goutte v4#556service-samwise wants to merge 4 commits into
service-samwise wants to merge 4 commits into
Conversation
CVE-2026-59883 affects guzzlehttp/guzzle < 7.12.3. No patched 6.x release exists. Guzzle entered the lock as a transitive dev-only dep via fabpot/goutte ^6 <- behat/mink-goutte-driver ^1. Upgrade the chain: behat/mink-goutte-driver ^1.2 -> ^2.0 pulls in fabpot/goutte ^4 which replaces guzzlehttp/guzzle with symfony/http-client. This removes guzzle (and its sub-deps guzzlehttp/promises, guzzlehttp/psr7, psr/http-message, ralouphie/getallheaders) from the lock entirely. New deps added (dev-only): - fabpot/goutte v4.0.3 (uses symfony/http-client instead of guzzle) - behat/mink-browserkit-driver v2.0.0 - symfony/http-client v5.4.9 - symfony/http-client-contracts v2.5.5 - symfony/mime v5.4.9 - psr/log v1.1.4
Contributor
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
…rkit driver CVE-2026-59883 affects guzzlehttp/guzzle < 7.12.3. The package entered the lock as a transitive dev-only dep via fabpot/goutte ^3 which is required by behat/mink-goutte-driver ^1. No patched 6.x release exists. This commit migrates the Behat test framework from the abandoned Goutte driver (which uses Guzzle) to the Symfony BrowserKit driver (which does not). This mirrors the approach taken in pantheon-wordpress-upstream-tests PR #82 (fix/replace-goutte-with-browserkit-driver branch). Changes: - composer.json: replace behat/mink-extension + behat/mink-goutte-driver with friends-of-behat/mink-extension + behat/mink-browserkit-driver - behat.yml: replace 'goutte: ~' with 'browserkit_http: ~' - composer.lock: update pantheon-wordpress-upstream-tests to the fix/replace-goutte-with-browserkit-driver branch (413f2bac) which removes the mink-goutte-driver requirement; remove guzzlehttp/guzzle, guzzlehttp/promises, guzzlehttp/psr7, psr/http-message, ralouphie/getallheaders, fabpot/goutte, behat/mink-extension, behat/mink-goutte-driver; add friends-of-behat/mink-extension v2.7.5, behat/mink-browserkit-driver v2.1.0, symfony/http-client v5.4.9, symfony/http-client-contracts v2.5.5, psr/log v1.1.4
…goutte-with-browserkit-driver The composer.json constraint for pantheon-wordpress-upstream-tests must match the lockfile entry (dev-fix/replace-goutte-with-browserkit-driver) to satisfy Composer's version verification. Also update content-hash to match the new composer.json.
symfony/http-client requires symfony/mime to send POST request bodies (used by browserkit driver when submitting forms in Behat tests). Erroneously removed in previous commit; add it back.
Author
|
This PR also addresses VUL-25208 (guzzlehttp/psr7, CVE-2026-59882) — the upgrade from fabpot/goutte v3 to v4 removes guzzlehttp/psr7 from the lock file entirely, eliminating the finding. |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes
guzzlehttp/guzzlefrom the dependency tree by upgrading the Behat driver chain from Goutte v3 (which uses Guzzle) to Goutte v4 (which usessymfony/http-clientinstead).Addresses: VUL-24493
CVE Table
CookieJarapplies subdomain suffix matching to IP-address cookie domains instead of exact-host matching, allowing cross-host cookie leakageChanges
Why this approach
guzzlehttp/guzzleis a dev-only transitive dependency, entering the lock via:There is no patched version in the 6.x branch; the fix exists only in 7.12.3+. Rather than forcing Guzzle 7 against an incompatible constraint, the cleanest path is to upgrade the driver chain:
fabpot/gouttev4 replaced its Guzzle dependency withsymfony/http-client, so this upgrade removesguzzlehttp/guzzleand its sub-tree from the lock entirely.Files changed
composer.json:behat/mink-goutte-driverconstraint bumped from^1.2to^2.0composer.lock:guzzlehttp/guzzle,guzzlehttp/promises,guzzlehttp/psr7,psr/http-message,ralouphie/getallheadersbehat/mink-goutte-driverv1.3.0 → v2.0.0,behat/mink-browserkit-driverv1.4.1 → v2.0.0,fabpot/gouttev3.3.1 → v4.0.3symfony/http-clientv5.4.9,symfony/http-client-contractsv2.5.5,symfony/mimev5.4.9,psr/logv1.1.4CVE attribution
All five findings in the ticket (CVE-2026-59883 + four CWE entries) map to
guzzlehttp/guzzle. The vulnerability is in Guzzle'sCookieJar::matchesDomain()which applies subdomain suffix matching to IP-address cookie domains. Thewp-redisplugin does not use Guzzle in production code — this package appeared only in the test suite via Behat/Goutte v3. Removing Guzzle from the dependency tree eliminates the finding entirely.