Description
Details
Related Objects
Event Timeline
Change #1240093 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/vendor@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240094 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240096 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240097 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240093 merged by jenkins-bot:
[mediawiki/vendor@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240094 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240100 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/vendor@REL1_45] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240101 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/vendor@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240100 merged by Reedy:
[mediawiki/vendor@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240101 merged by Reedy:
[mediawiki/vendor@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240102 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240103 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240104 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240103 merged by jenkins-bot:
[mediawiki/extensions/OAuth@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240104 merged by jenkins-bot:
[mediawiki/extensions/OAuth@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240102 merged by jenkins-bot:
[mediawiki/extensions/OAuth@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240096 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240109 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240110 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240112 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@REL1_43] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240097 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@master] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240115 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240116 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240117 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240116 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@REL1_44] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240115 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240112 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_43] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240117 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@REL1_43] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Purely out of interest, did this trigger Composer's automatic-security-blocking in CI at any point? (I had a quick look to try and find a failed build from it, but I couldn't immediately see one.)
Also, this might be a stupid question… but as a side note: from the CVE record, it seems like this CVE was published in July 2025 — how come we (IIUC) only seem to be finding out about it now?
(To - potentially - answer my own question, maybe it might be because it seems like it may have only been published as a GitHub security advisory within the last day? I can't say I'm certain on that, though.)
(Also, just FWIW & so that we have a downstream note of it, the CVE record is marked as being disputed "on the basis that key lengths are expected to be set by an application, not by this library".)
Answering my own question -- yes, it has (e.g. https://integration.wikimedia.org/ci/job/quibble-composer-mysql-php83/14643/console for https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/1240272)
13:03:25 INFO:quibble.commands:>>> Start: composer test in /workspace/src/extensions/CheckUser
13:03:26 ./composer.json is valid, but with a few warnings
13:03:26 See https://getcomposer.org/doc/04-schema.md for details on the schema
13:03:26 # General warnings
13:03:26 - No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
13:03:26 [12.5MiB/0.10s] No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
13:03:26 [12.6MiB/0.10s] Loading composer repositories with package information
13:03:26 [16.6MiB/0.61s] Updating dependencies
13:03:26 [17.8MiB/0.62s] Dependency resolution completed in 0.002 seconds
13:03:26 [17.8MiB/0.62s] Your requirements could not be resolved to an installable set of packages.
13:03:26 [17.8MiB/0.62s]
13:03:26 Problem 1
13:03:26 - Root composer.json requires firebase/php-jwt ^6.10.0, found firebase/php-jwt[v6.10.0, v6.10.1, v6.10.2, v6.11.0, v6.11.1] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-y2cr-5h3j-g3ys") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.Change #1240110 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_44] Upgrading firebase/php-jwt (v6.10.0 => v7.0.2)
Change #1240109 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@REL1_45] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240340 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/vendor@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240343 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/vendor@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240340 merged by jenkins-bot:
[mediawiki/vendor@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240345 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240346 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240347 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240348 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240349 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240350 had a related patch set uploaded (by Reedy; author: Reedy):
[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240343 merged by jenkins-bot:
[mediawiki/vendor@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240345 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240346 merged by jenkins-bot:
[mediawiki/extensions/CheckUser@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240347 merged by jenkins-bot:
[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240348 merged by jenkins-bot:
[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240349 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.16] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Change #1240350 merged by jenkins-bot:
[mediawiki/extensions/ContentTranslation@wmf/1.46.0-wmf.15] Upgrading firebase/php-jwt (v6.11.1 => v7.0.2)
Mentioned in SAL (#wikimedia-operations) [2026-02-18T17:58:00Z] <reedy@deploy2002> Started scap sync-world: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 => v
Mentioned in SAL (#wikimedia-operations) [2026-02-18T18:00:22Z] <reedy@deploy2002> reedy: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]]
Mentioned in SAL (#wikimedia-operations) [2026-02-18T18:04:59Z] <reedy@deploy2002> Finished scap sync-world: Backport for [[gerrit:1240340|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240343|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240345|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240346|Upgrading firebase/php-jwt (v6.11.1 => v7.0.2) (T417722)]], [[gerrit:1240347|Upgrading firebase/php-jwt (v6.11.1 =>