🚨 [security] [php] Update symfony/mailer 7.3.0 → 7.4.12 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ symfony/mailer (indirect, 7.3.0 → 7.4.12) · Repo · Changelog

Security Advisories 🚨

🚨 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Description

Symfony Mailer selects a transport via the MAILER_DSN environment variable / configuration (e.g. smtp://..., sendmail://..., native://default). SendmailTransport invokes the local sendmail binary and supports two modes: -bs (speak SMTP over stdin: the default) and -t (read the message on stdin, pass recipients as command-line arguments).

In -t mode, recipient addresses are appended to the sendmail command line without a -- end-of-options separator. A recipient address beginning with - (which Symfony\Component\Mime\Address accepts as valid) is therefore interpreted by sendmail as a command-line option rather than an address.

Resolution

The SendmailTransport transport now ensure -- is set before the list of recipients.

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 66 commits:

• Merge branch '6.4' into 7.4
• Merge branch '5.4' into 6.4
• [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash
• [7.4] Remove usages of named arguments in tests
• Update XSD references in phpunit.xml.dist files
• Merge branch '6.4' into 7.4
• PHP CS Fixer: backports changes toward 6.4 branch
• Merge branch '6.4' into 7.4
• CS fixes - native_function_invocation & static_lambda
• [CS] Back config from 8.1 and apply heredoc_indentation rule
• Add deprecationTrigger ignoreUndefinedTriggers="true" in phpunit.xml.dist files
• Configure deprecation triggers
• Merge branch '6.4' into 7.4
• [Mailer] Clarify the purpose of SentMessage's "message id" concept
• use PHPUnit 13 on PHP 8.4+
• Merge branch '7.3' into 7.4
• do not use createMock() to create non-mock objects
• Merge branch '7.3' into 7.4
• Merge branch '6.4' into 7.3
• do not use PHPUnit mock objects without configured expectations
• [Security] Keep SymfonyCasts as backers of the Security components 🤗
• Merge branch '7.3' into 7.4
• Merge branch '6.4' into 7.3
• [Mailer] Relax regexp to parse message ids
• [Mailer] Fix parsing message ids in SMTP responses
• Merge branch '7.3' into 7.4
• Revert "[Mailer] Fix memory leak with `mailer.message_logger_listener`"
• Merge branch '7.3' into 7.4
• bug #60515 [Mailer] Fix memory leak with `mailer.message_logger_listener` (andrew-demb)
• [Mailer] Fix memory leak with `mailer.message_logger_listener`
• Merge branch '6.4' into 7.3
• Replace __sleep/wakeup() by __(un)serialize() for throwing and internal usages
• Add global lower bounds to deps on the CI
• Fix low-deps tests
• Replace __sleep/wakeup() by __(un)serialize() when BC isn't a concern
• minor #61372 chore: PHP CS Fixer - update heredoc handling (keradus)
• chore: PHP CS Fixer - update heredoc handling
• Merge branch '7.3' into 7.4
• Merge branch '6.4' into 7.3
• Remove deprecated calls to deprecated methods of SplObjectStorage
• chore: heredoc indentation as of PHP 7.3
• [Mailer] Add MicrosoftGraph API Transport
• Merge branch '7.3' into 7.4
• Merge branch '6.4' into 7.3
• Fix inline var annotations
• replace PHPUnit annotations with attributes
• run tests using PHPUnit 11.5
• [Form][PhpUnitBridge] Remove usage of noop `ReflectionProperty::setAccessible()`
• Merge branch '7.3' into 7.4
• Merge branch '7.2' into 7.3
• Merge branch '6.4' into 7.2
• Fix @var phpdoc
• CS fixes
• Various CS fixes
• feature #60110 [Mailer] [Transport] Allow exception logging for `RoundRobinTransport` mailer (jnoordsij)
• [Mailer] [Transport] Allow exception logging for `RoundRobinTransport` mailer
• Merge branch '7.3' into 7.4
• Merge branch '7.2' into 7.3
• Merge branch '6.4' into 7.2
• Fix command option mode (InputOption::VALUE_REQUIRED)
• Merge branch '7.3' into 7.4
• Merge branch '7.2' into 7.3
• Merge branch '6.4' into 7.2
• [Mailer] [Transport] Send clone of `RawMessage` instance in `RoundRobinTransport`
• Allow Symfony ^8.0
• Redundant assignment to promoted property

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)