[GHSA-qrr6-mg7r-m243] PHPUnit has Argument injection via newline in PHP INI values that are forwarded to child processes

[sanmai]

Updates

• Affected products

Comments
only 12.5.21 and 13.1.5 are affected so <12 are not affected
https://phpc.social/@sebastian/116424686237276260

[github]

Hi there @sebastianbergmann! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[sanmai]

Duplicate of #7430

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the GHSA advisory metadata for the PHPUnit argument-injection vulnerability, adjusting the affected version range and modification timestamp.

Changes:

• Updated the advisory modified timestamp.
• Narrowed the affected version range by changing the introduced version from 0 to 12.0.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The PR description notes that “only 12.5.21 and 13.1.5 are affected”, but setting "introduced": "12.0.0" marks all versions from 12.0.0 up to 12.5.21 as affected. If the intent is to reflect the upstream statement precisely, set introduced to 12.5.21 (or model the affected versions as discrete ranges, e.g., one range for 12.5.21->12.5.22 and another for 13.1.5->(its fixed version), if applicable in the remainder of the file).