-
Notifications
You must be signed in to change notification settings - Fork 3
chore: use framework 0.34 #57
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
WalkthroughThe pull request updates composer.json to bump the utopia-php/framework dependency from 0.33.* to 0.34.*. It also adjusts PHP imports in two source files: src/Queue/Job.php switches its Hook import from Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 1
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
composer.lockis excluded by!**/*.lock
📒 Files selected for processing (1)
composer.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Adapter Tests (Swoole)
- GitHub Check: Adapter Tests (Workerman)
- GitHub Check: Adapter Tests (SwooleRedisCluster)
| "php-amqplib/php-amqplib": "^3.7", | ||
| "utopia-php/console": "0.0.*", | ||
| "utopia-php/framework": "0.33.*", | ||
| "utopia-php/framework": "0.34.*", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Update version constraint to exclude vulnerable versions.
Version 0.34.* is available on Packagist, but there is a critical security concern: a high-severity vulnerability exists in versions 0.20.0 - 0.34.6 and is fixed in 0.34.7. The current constraint allows installing vulnerable versions. Update to "0.34.7.*" or higher to ensure the security fix is included.
🤖 Prompt for AI Agents
In composer.json around line 30, the dependency constraint
"utopia-php/framework": "0.34.*" allows installing vulnerable releases (0.20.0 -
0.34.6); update the constraint to require the patched series by changing it to
"0.34.7.*" or a safer range like ">=0.34.7 <0.35" (or bump to a later fixed
major/minor) so Composer will not install the vulnerable versions.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
link me to the security concern details
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
utopia-php/framework security vulnerability 0.34.6 0.34.7
💡 Result:
Short answer: Aikido's advisory reports a Remote Code Execution vulnerability affecting utopia-php/framework versions 0.20.0 through 0.34.6 and states it was fixed in 0.34.7. Upgrade to >= 0.34.7 (or apply the vendor patch) as soon as possible. [1][2]
Sources:
- Aikido advisory (AIKIDO-2025-10433) — RCE in 0.20.0–0.34.6, fixed in 0.34.7. [1]
- utopia-php/framework package page (maintainer/vendor contact & package info). [2]
🌐 Web query:
AIKIDO-2025-10433 utopia-php framework advisory
💡 Result:
Summary advisory — AIKIDO-2025-10433 (utopia-php/framework)
- Issue: Remote Code Execution (RCE) in utopia-php/framework. [1]
- Affected versions: 0.20.0 through 0.34.6. [1]
- Fixed in: 0.34.7 — upgrade immediately to 0.34.7 or later. [1][2]
- Mitigation steps:
- Pin/update composer to utopia-php/framework >=0.34.7 and deploy. Example: composer update utopia-php/framework. [2]
- If you cannot upgrade immediately, isolate/disable services using the vulnerable package and apply compensating network controls (WAF, restrict incoming requests) until patched.
- Audit logs and systems for suspicious activity if running affected versions. Treat as high-severity RCE. [1]
- Vendor / repo references: Packagist / project pages for utopia-php/framework and Utopia PHP ecosystem. Use vendor security channel if needed (see package docs). [2][3]
Sources:
[1] Aikido intel — AIKIDO-2025-10433 (utopia-php/framework vulnerability, fixed in 0.34.7).
[2] Packagist — utopia-php/framework package information.
[3] Libraries.io / Utopia package pages (project docs and security contact).
🌐 Web query:
site:aikido.dev AIKIDO-2025-10433
💡 Result:
I found an Aikido Intel entry for AIKIDO-2025-10433:
- Title / summary: utopia-php/framework — Remote Code Execution (RCE). [High severity]. [1]
- Affected versions: 0.20.0 — 0.34.6. [1]
- Fixed in: 0.34.7. [1]
- CVE: none assigned (no CVE available). [1]
- Aikido Intel / Aikido Fix listings show the vulnerability entry in their public vulnerability database. [2]
Sources: [1] Aikido Intel CVE page for AIKIDO-2025-10433; [2] Aikido Intel / Fix vulnerability database.
@ChiragAgg5k, here are the security concern details:
Advisory: AIKIDO-2025-10433 - Remote Code Execution (RCE) vulnerability in utopia-php/framework
Link: https://www.aikido.dev/intel/AIKIDO-2025-10433
Key Details:
- Vulnerability Type: Remote Code Execution (High severity)
- Affected Versions: 0.20.0 through 0.34.6
- Fixed in: 0.34.7
- No CVE assigned yet
Recommendation:
Update your composer.json constraint to "0.34.7.*" or "^0.34.7" to ensure only patched versions can be installed. The current constraint "0.34.*" would allow Composer to install vulnerable versions 0.34.0 through 0.34.6.
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.