https://github.com/advisories/GHSA-f7pm-6hr8-7ggm
02:26:09 Problem 1
02:26:09 - Root composer.json requires web-auth/webauthn-lib 5.2.3 (exact version match: 5.2.3 or 5.2.3.0), found web-auth/webauthn-lib[5.2.3] but these were not loaded, because they are affected by security advisories. To ignore the advisories, add ("PKSA-n72g-8zd8-6dm2") to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | Release | brennen | T413810 1.46.0-wmf.19 deployment blockers | ||
| Resolved | Zabe | T419497 Insecure web-auth/webauthn-lib version blocks CI |
Change #1249430 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/vendor@master] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
Change #1249483 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/extensions/OATHAuth@master] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249430 merged by jenkins-bot:
[mediawiki/vendor@master] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
Change #1249483 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249922 had a related patch set uploaded (by Mszwarc; author: Zabe):
[mediawiki/vendor@wmf/1.46.0-wmf.19] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
Change #1249923 had a related patch set uploaded (by Mszwarc; author: Zabe):
[mediawiki/extensions/OATHAuth@wmf/1.46.0-wmf.19] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249925 had a related patch set uploaded (by Mszwarc; author: Zabe):
[mediawiki/extensions/OATHAuth@wmf/1.46.0-wmf.18] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249925 abandoned by Mszwarc:
[mediawiki/extensions/OATHAuth@wmf/1.46.0-wmf.18] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249934 had a related patch set uploaded (by Zabe; author: Zabe):
[mediawiki/vendor@wmf/1.46.0-wmf.18] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
Since this is marked as a train blocker, can someone clarify the patch situation for me? I see @mszwarc has two related patches scheduled for a Wednesday backport. Any reason these shouldn't/can't be deployed now?
I marked this as a blocker since it blocks merging the branching patch (https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1249511). There is no reason to not backport the above patches now.
Change #1249922 merged by jenkins-bot:
[mediawiki/vendor@wmf/1.46.0-wmf.19] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
Change #1249923 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@wmf/1.46.0-wmf.19] Bump required web-auth/webauthn-lib to at least 5.2.4
Change #1249934 merged by jenkins-bot:
[mediawiki/vendor@wmf/1.46.0-wmf.18] Upgrading web-auth/webauthn-lib (5.2.3 => 5.2.4)
wmf.19 patches backported, train currently rolling to testwiki. Removed those backports from the deployment calendar for Weds 2026-03-11.