Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104034
To: internals@lists.php.net
References: <CAF+90c-B=xU9phGNxcRvZE+2c1RkKvsiDXU0qzWJdU_U3Tskag@mail.gmail.com>
 <7a909cd3-5d0f-8f2e-fba8-009778311bf0@php.net>
 <CAOwTYAspymG1HVBWSNGeuSK+gHcnBoxG599wqyD2-NDbOPeCfg@mail.gmail.com>
 <CAAfnsFUiV25V=BO3+iU63FM3U0jKbnL5AOTL0=+x1tt6v3Agow@mail.gmail.com>
 <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
Message-ID: <1cabe7e6-8e7d-fdc9-a2b6-2aa4ddf911da@gmail.com>
Date: Sat, 2 Feb 2019 17:59:57 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.5.0
MIME-Version: 1.0
In-Reply-To: <db1bacc7-e64d-e2bf-5c41-81521359e29a@librelamp.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-GB
Subject: Re: [PHP-DEV] Disable PEAR by default
From: rowan.collins@gmail.com (Rowan Collins)

On 02/02/2019 01:08, Alice Wonder wrote:
> That version has vulnerability, developer fixed it in newer release, 
> but composer keeps pulling in the older version because that is what 
> composer provides.


Have you seen 
https://packagist.phpcomposer.com/packages/roave/security-advisories ?

It's a very simple composer package which lists packages with known 
vulnerabilities as incompatible, so that composer will skip them even if 
it means downgrading to meet the constraints of other packages you've 
requested.

I'm not sure what other solution any package manager could provide, 
other than allowing you to install any version you liked, even if the 
authors stated that they were incompatible.

Regards,

-- 
Rowan Collins
[IMSoP]