Skip to content

chore: use framework 0.34 #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChiragAgg5k merged 2 commits into from
Dec 17, 2025
Merged

chore: use framework 0.34 #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5659783
chore: use framework 0.34
ChiragAgg5k Dec 17, 2025
5b85860
fix namespace
ChiragAgg5k Dec 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion composer.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"php": ">=8.3",
"php-amqplib/php-amqplib": "^3.7",
"utopia-php/console": "0.0.*",
"utopia-php/framework": "0.33.*",
"utopia-php/framework": "0.34.*",
Copy link

@coderabbitai coderabbitai bot Dec 17, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Update version constraint to exclude vulnerable versions.

Version 0.34.* is available on Packagist, but there is a critical security concern: a high-severity vulnerability exists in versions 0.20.0 - 0.34.6 and is fixed in 0.34.7. The current constraint allows installing vulnerable versions. Update to "0.34.7.*" or higher to ensure the security fix is included.

🤖 Prompt for AI Agents 
In composer.json around line 30, the dependency constraint
"utopia-php/framework": "0.34.*" allows installing vulnerable releases (0.20.0 -
0.34.6); update the constraint to require the patched series by changing it to
"0.34.7.*" or a safer range like ">=0.34.7 <0.35" (or bump to a later fixed
major/minor) so Composer will not install the vulnerable versions.

Copy link
Member Author

@ChiragAgg5k ChiragAgg5k Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

link me to the security concern details

Copy link

@coderabbitai coderabbitai bot Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🌐 Web query:

utopia-php/framework security vulnerability 0.34.6 0.34.7

💡 Result:

Short answer: Aikido's advisory reports a Remote Code Execution vulnerability affecting utopia-php/framework versions 0.20.0 through 0.34.6 and states it was fixed in 0.34.7. Upgrade to >= 0.34.7 (or apply the vendor patch) as soon as possible. [1][2]

Sources:

  • Aikido advisory (AIKIDO-2025-10433) — RCE in 0.20.0–0.34.6, fixed in 0.34.7. [1]
  • utopia-php/framework package page (maintainer/vendor contact & package info). [2]

🌐 Web query:

AIKIDO-2025-10433 utopia-php framework advisory

💡 Result:

Summary advisory — AIKIDO-2025-10433 (utopia-php/framework)

  • Issue: Remote Code Execution (RCE) in utopia-php/framework. [1]
  • Affected versions: 0.20.0 through 0.34.6. [1]
  • Fixed in: 0.34.7 — upgrade immediately to 0.34.7 or later. [1][2]
  • Mitigation steps:
    1. Pin/update composer to utopia-php/framework >=0.34.7 and deploy. Example: composer update utopia-php/framework. [2]
    2. If you cannot upgrade immediately, isolate/disable services using the vulnerable package and apply compensating network controls (WAF, restrict incoming requests) until patched.
    3. Audit logs and systems for suspicious activity if running affected versions. Treat as high-severity RCE. [1]
  • Vendor / repo references: Packagist / project pages for utopia-php/framework and Utopia PHP ecosystem. Use vendor security channel if needed (see package docs). [2][3]

Sources:
[1] Aikido intel — AIKIDO-2025-10433 (utopia-php/framework vulnerability, fixed in 0.34.7).
[2] Packagist — utopia-php/framework package information.
[3] Libraries.io / Utopia package pages (project docs and security contact).

🌐 Web query:

site:aikido.dev AIKIDO-2025-10433

💡 Result:

I found an Aikido Intel entry for AIKIDO-2025-10433:

  • Title / summary: utopia-php/framework — Remote Code Execution (RCE). [High severity]. [1]
  • Affected versions: 0.20.0 — 0.34.6. [1]
  • Fixed in: 0.34.7. [1]
  • CVE: none assigned (no CVE available). [1]
  • Aikido Intel / Aikido Fix listings show the vulnerability entry in their public vulnerability database. [2]

Sources: [1] Aikido Intel CVE page for AIKIDO-2025-10433; [2] Aikido Intel / Fix vulnerability database.

@ChiragAgg5k, here are the security concern details:

Advisory: AIKIDO-2025-10433 - Remote Code Execution (RCE) vulnerability in utopia-php/framework

Link: https://www.aikido.dev/intel/AIKIDO-2025-10433

Key Details:

  • Vulnerability Type: Remote Code Execution (High severity)
  • Affected Versions: 0.20.0 through 0.34.6
  • Fixed in: 0.34.7
  • No CVE assigned yet

Recommendation:
Update your composer.json constraint to "0.34.7.*" or "^0.34.7" to ensure only patched versions can be installed. The current constraint "0.34.*" would allow Composer to install vulnerable versions 0.34.0 through 0.34.6.

"utopia-php/telemetry": "*",
"utopia-php/pools": "0.8.*",
"utopia-php/fetch": "0.4.*"
Expand Down
173 changes: 44 additions & 129 deletions composer.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion src/Queue/Job.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

namespace Utopia\Queue;

use Utopia\Hook;
use Utopia\Http\Hook;

class Job extends Hook
{
Expand Down
4 changes: 2 additions & 2 deletions src/Queue/Server.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
use Exception;
use Throwable;
use Utopia\Console;
use Utopia\Hook;
use Utopia\Http\Hook;
use Utopia\Telemetry\Adapter as Telemetry;
use Utopia\Telemetry\Adapter\None as NoTelemetry;
use Utopia\Telemetry\Histogram;
use Utopia\Validator;
use Utopia\Http\Validator;

class Server
{
Expand Down