Repository navigation
Fix the PMMP and shopsys integration tests on 2.3.x - #15484
Merged
ondrejmirtes merged 2 commits intoOct 17, 2026
Merged
Conversation
…ow check phpstan/phpstan-src#6647 made an open positive-int << 12 return int, since it can overflow. RegionLoader passes getSectorCount() << 12 to fread(), and getSectorCount() is only positive-int, so the length is no longer int<1, max>. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The shopsys/shopsys setup runs `composer security-check` after install and aborts on symfony/expression-language, symfony/http-foundation and symfony/yaml (CVE-2026-109449, CVE-2026-108082, CVE-2026-109413). Only those three packages are updated, to 7.4.21, in both shopsys locks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pawell67
force-pushed
the
pocketmine-shift-overflow-baseline
branch
from
October 15, 2026 19:13
329ecf1 to
b6e6c06
Compare
Member
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes two integration jobs that fail on every phpstan-src PR changing the PHAR (e.g. phpstan/phpstan-src#6695). The two fixes are in one PR because every PR touching
e2e/**runs all integration jobs, so neither can be green on its own.1. Baseline the PocketMine-MP
fread()length (PMMP Tests)Since phpstan/phpstan-src#6647 (Check open integer-range bounds for shift-left overflow):
getSectorCount()is onlypositive-int, so<< 12can overflow and the result isint. As @JanTvrdik noted in #6647, the new error is correct and he left the baseline unchanged. This adds the entry topocketmine-ng-baseline.neon, sorted by path. PocketMine-MP's config setsreportUnmatchedIgnoredErrors: false, so older PHARs are not affected.2. Update the vulnerable Symfony packages in the shopsys locks (
Integration - shopsys/shopsys)Both jobs abort in their setup step, before PHPStan runs: shopsys'
composer security-checkfails onsymfony/expression-language(CVE-2026-109449),symfony/http-foundation(CVE-2026-108082) andsymfony/yaml(CVE-2026-109413). Same situation as #14849. Only those three packages are updated to 7.4.21 inshopsys-composer.lockandshopsys-project-base-composer.lock(composer update ... --with 'symfony/expression-language:7.4.*' --no-installon shopsysv19.0.0);expression-languageis held at 7.4.* so it does not jump to 8.x. 18 lines per lock.composer audit --lockedstill listscomposer/composerandleague/flysystem(GitHub advisories only). shopsys'security-checkdid not flag them, so they are left alone.I could not run the shopsys setup scripts locally (missing PHP extensions in the container), so the shopsys result is confirmed by CI only: on the earlier PR it passed with this lock change.
🤖 Generated with Claude Code