fixdossier / Docs / Sample records / PHPOffice/PhpSpreadsheet
Sample security record: PHPOffice/PhpSpreadsheet
| Repository | github.com/PHPOffice/PhpSpreadsheet |
|---|---|
| Generated | 2026-10-31T13:29:41.317Z |
| fixdossier | v0.1.2 (commit f5d6fc5), run locally with max_pages=10 |
| Files | SECURITY-RECORD.md · security-record.json |
PHPOffice/PhpSpreadsheet did not request, review or endorse this record, and no claim is made that the project uses fixdossier. It was generated from public GitHub data only (published security advisories, releases, tags, merged pull requests and commit messages).
Below is the generated SECURITY-RECORD.md, rendered as-is. Rows labelled date heuristic and all keyword commit rows are automatic guesses that the project’s maintainers would need to confirm. See what the record covers.
Security record — PHPOffice/PhpSpreadsheet
Generated 2026-10-31T13:29:41.317Z by fixdossier from GitHub data (releases, tags, security advisories, merged Dependabot/Renovate PRs, commit messages). Automatically compiled; review before relying on it. Not legal advice.
Summary
| Item | Count |
|---|---|
| Published GitHub security advisories | 32 |
| Commits that look like security fixes | 1 |
| Merged bot dependency updates (security-flagged) | 87 (9) |
| Releases | 145 |
| Fixes not yet in a release | 1 |
Security fixes (newest first)
| Date | Type | IDs | Fix | Shipped in | Release date | How mapped |
|---|---|---|---|---|---|---|
| 2026-10-12 | advisory (high) | GHSA-j2w7-387v-m2rq, CVE-2026-108359 | ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | 5.10.0, 3.10.8, 2.4.8, 2.1.19, 1.30.7 | 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17 | advisory patched_versions |
| 2026-10-12 | advisory (medium) | GHSA-2phh-27fw-q4gc, CVE-2026-108360 | SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | 5.10.0, 3.10.8, 2.4.8, 2.1.19, 1.30.7 | 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17 | advisory patched_versions |
| 2026-10-12 | advisory (high) | GHSA-rxj4-h86g-25gc, CVE-2026-108357 | XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service | 5.10.0, 3.10.8 | 2026-09-17, 2026-09-17 | advisory patched_versions |
| 2026-10-12 | advisory (high) | GHSA-3x94-m842-937c, CVE-2026-108358 | XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service | 5.10.0, 3.10.8, 2.4.8, 2.1.19, 1.30.7 | 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17, 2026-09-17 | advisory patched_versions |
| 2026-09-23 | commit | — | Security Policy Updates | unreleased | — | unreleased |
| 2026-07-19 | advisory (high) | GHSA-6hq5-7373-42rg, CVE-2026-59931 | SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist | 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6 | 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12 | advisory patched_versions |
| 2026-07-19 | advisory (high) | GHSA-2mrg-gjxq-2gvr, CVE-2026-59932 | Gnumeric reader unbounded gzip expansion causes memory exhaustion | 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6 | 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12 | advisory patched_versions |
| 2026-07-19 | advisory (high) | GHSA-xh5m-36r6-47m3, CVE-2026-59933 | XLS/OLE sector-chain self-loop causes memory exhaustion | 5.8.1, 3.10.7, 2.4.7, 2.1.18, 1.30.6 | 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12, 2026-07-12 | advisory patched_versions |
| 2026-06-07 | advisory (high) | GHSA-87m4-826x-3crx, CVE-2026-45034 | CVE-2026-34084 patch bypass | 1.30.5 | 2026-05-31 | advisory patched_versions |
| 2026-04-28 | advisory (high) | GHSA-84wq-86v6-x5j6, CVE-2026-40863 | CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader | 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.6 | 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20, 2026-07-12 | advisory patched_versions |
| 2026-04-28 | advisory (high) | GHSA-7c6m-4442-2x6m, CVE-2026-40902 | CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions | 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4 | 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20 | advisory patched_versions |
| 2026-04-28 | advisory (high) | GHSA-q4q6-r8wh-5cgh, CVE-2026-34084 | SSRF/RCE in IOFactory::load when $filename is user controlled | 5.6.0, 3.10.4, 2.4.4, 2.1.15, 1.30.3 | 2026-04-10, 2026-04-10, 2026-04-10, 2026-04-10, 2026-04-10 | advisory patched_versions |
| 2026-04-26 | advisory (medium) | GHSA-hrmw-qprp-wgmc, CVE-2026-40296 | XSS via number format code with @ text placeholder bypasses htmlspecialchars in HTML writer | 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4 | 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20 | advisory patched_versions |
| 2026-04-26 | advisory (medium) | GHSA-6wpp-88cp-7q68, CVE-2026-35453 | XSS via NumberFormat @ Text Substitution in HTML Writer | 5.7.0, 3.10.5, 2.4.5, 2.1.16, 1.30.4 | 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20, 2026-04-20 | advisory patched_versions |
| 2025-08-23 | advisory (high) | GHSA-rx7m-68vc-ppxh, CVE-2025-54370 | SSRF when reading and displaying a processed HTML document in the browser | 1.30.0, 2.1.12, 2.4.0, 3.10.0, 5.0.0 | 2025-08-10, 2025-08-10, 2025-08-10, 2025-08-10, 2025-08-10 | advisory patched_versions |
| 2025-02-01 | advisory (medium) | GHSA-r57h-547h-w24f, CVE-2025-23210 | Bypass XSS sanitizer using the javascript protocol and special characters | 3.9.0, 1.29.9, 2.3.7, 2.1.8 | 2025-01-26, 2025-01-26, 2025-01-26, 2025-01-26 | advisory patched_versions |
| 2025-01-18 | advisory (medium) | GHSA-79xx-vf93-p7cx, CVE-2025-22131 | Cross-Site Scripting (XSS) vulnerability in generateNavigation() function | 3.8.0, 1.29.8, 2.1.7, 2.3.6 | 2025-01-12, 2025-01-12, 2025-01-12, 2025-01-12 | advisory patched_versions |
| 2025-01-03 | advisory (medium) | GHSA-q9jv-mm3r-j47r, CVE-2024-56412 | Bypass XSS sanitizer using the javascript protocol and special characters | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (medium) | GHSA-hwcp-2h35-p66w, CVE-2024-56411 | Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (medium) | GHSA-wv23-996v-q229, CVE-2024-56410 | Cross-Site Scripting (XSS) vulnerability in custom properties | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (high) | GHSA-j2xg-cjcx-4677, CVE-2024-56409 | Unauthorized Reflected XSS in Currency.php file | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (high) | GHSA-c6fv-7vh8-2rhr, CVE-2024-56366 | Unauthorized Reflected XSS in the Accounting.php file | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (high) | GHSA-jmpx-686v-c3wx, CVE-2024-56365 | Unauthorized Reflected XSS in the constructor of the Downloader class | 3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2025-01-03 | advisory (high) | GHSA-x88g-h956-m5xg, CVE-2024-56408 | Unauthorized Reflected XSS in Convert-Online.php file |
3.7.0, 1.29.7, 2.1.6, 2.3.5 | 2024-12-27, 2024-12-27, 2024-12-27, 2024-12-27 | advisory patched_versions |
| 2024-11-16 | advisory (high) | GHSA-7cc9-j4mv-vcjp, CVE-2024-48917 | XXE in PHPSpreadsheet's XLSX reader | 1.29.4, 2.1.3, 2.3.2, 3.4.0 | 2024-11-10, 2024-11-10, 2024-11-10, 2024-11-10 | advisory patched_versions |
| 2024-11-16 | advisory (high) | GHSA-jw4x-v69f-hh5w, CVE-2024-47873 | XmlScanner bypass leads to XXE | 1.29.4, 2.1.3, 2.3.2, 3.4.0 | 2024-11-10, 2024-11-10, 2024-11-10, 2024-11-10 | advisory patched_versions |
| 2024-10-07 | advisory (medium) | GHSA-r8w8-74ww-j4wh, CVE-2024-45292 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks | 2.3.0, 1.29.2, 2.1.1 | 2024-09-29, 2024-09-29, 2024-09-29 | advisory patched_versions |
| 2024-10-07 | advisory (medium) | GHSA-w9xv-qf98-ccq4, CVE-2024-45291 | Absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled | 2.3.0, 1.29.2, 2.1.1 | 2024-09-29, 2024-09-29, 2024-09-29 | advisory patched_versions |
| 2024-10-07 | advisory (high) | GHSA-5gpr-w2p5-6m37, CVE-2024-45290 | Absolute path traversal and Server-Side Request Forgery when opening XLSX file | 2.3.0, 1.29.2, 2.1.1 | 2024-09-29, 2024-09-29, 2024-09-29 | advisory patched_versions |
| 2024-10-07 | advisory (high) | GHSA-6hwr-6v2f-3m88, CVE-2024-45293 | XXE in PHPSpreadsheet's XLSX reader | 2.3.0, 1.29.1, 2.1.1 | 2024-09-29, 2024-09-04, 2024-09-29 | advisory patched_versions |
| 2024-10-06 | advisory (high) | GHSA-v66g-p9x6-v98p, CVE-2024-45060 | Unauthenticated Cross-Site-Scripting (XSS) in sample file | 2.3.0, 1.29.2, 2.1.1 | 2024-09-29, 2024-09-29, 2024-09-29 | advisory patched_versions |
| 2024-08-28 | advisory (high) | GHSA-ghg6-32f9-2jp7, CVE-2024-45048 | XXE in PHPSpreadsheet encoding is returned | 2.2.1, 1.29.1, 2.1.1 | 2024-07-29, 2024-09-04, 2024-09-29 | advisory patched_versions |
| 2024-08-28 | advisory (medium) | GHSA-wgmf-q9vr-vww6, CVE-2024-45046 | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information | 2.1.0, 1.29.1 | 2024-05-11, 2024-09-04 | advisory patched_versions |
Dependency updates by bots (newest first)
| Merged | Bot | Update | Security? | Shipped in | How mapped |
|---|---|---|---|---|---|
| 2026-09-02 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.95.17 to 3.95.23 | 1.30.7 | date heuristic (first release on/after merge) | |
| 2026-08-08 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.13.5 to 3.13.6 | yes | 1.30.7 | date heuristic (first release on/after merge) |
| 2026-08-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.95.11 to 3.95.17 | 1.30.7 | date heuristic (first release on/after merge) | |
| 2026-07-26 | dependabot[bot] | Bump dompdf/dompdf from 3.1.5 to 3.1.6 | yes | 1.30.7 | date heuristic (first release on/after merge) |
| 2026-07-01 | dependabot[bot] | Bump composer/pcre from 3.3.2 to 3.4.0 | 2.1.18 | date heuristic (first release on/after merge) | |
| 2026-07-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.95.4 to 3.95.11 | 2.1.18 | date heuristic (first release on/after merge) | |
| 2026-06-24 | dependabot[bot] | Bump actions/cache from 5 to 6 | 2.1.18 | date heuristic (first release on/after merge) | |
| 2026-06-21 | dependabot[bot] | Bump actions/checkout from 6 to 7 | 2.1.18 | date heuristic (first release on/after merge) | |
| 2026-06-07 | dependabot[bot] | Bump peaceiris/actions-gh-pages from 3 to 4 | 5.8.0 | date heuristic (first release on/after merge) | |
| 2026-06-07 | dependabot[bot] | Bump actions/checkout from 4 to 6 | 5.8.0 | date heuristic (first release on/after merge) | |
| 2026-06-07 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.95.3 to 3.95.4 | 5.8.0 | date heuristic (first release on/after merge) | |
| 2026-05-19 | dependabot[bot] | Bump setasign/fpdi from 2.6.6 to 2.6.7 | 1.30.5 | date heuristic (first release on/after merge) | |
| 2026-04-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.11.0 to 6.11.2 | 2.1.15 | date heuristic (first release on/after merge) | |
| 2026-04-01 | dependabot[bot] | Bump dompdf/dompdf from 3.1.4 to 3.1.5 | 2.1.15 | date heuristic (first release on/after merge) | |
| 2026-04-01 | dependabot[bot] | Bump mpdf/mpdf from 8.2.7 to 8.3.1 | 2.1.15 | date heuristic (first release on/after merge) | |
| 2026-03-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.10.1 to 6.11.0 | 2.1.15 | date heuristic (first release on/after merge) | |
| 2026-02-01 | dependabot[bot] | Bump phpstan/phpstan-phpunit from 2.0.11 to 2.0.12 | 5.5.0 | date heuristic (first release on/after merge) | |
| 2026-02-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.92.3 to 3.93.1 | 5.5.0 | date heuristic (first release on/after merge) | |
| 2026-02-01 | dependabot[bot] | Bump phpstan/phpstan from 2.1.33 to 2.1.38 | 5.5.0 | date heuristic (first release on/after merge) | |
| 2026-01-28 | dependabot[bot] | Bump symfony/process from 6.4.26 to 6.4.33 | yes | 5.5.0 | date heuristic (first release on/after merge) |
| 2026-01-28 | dependabot[bot] | Bump phpunit/phpunit from 10.5.60 to 10.5.62 | 5.5.0 | date heuristic (first release on/after merge) | |
| 2025-11-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.88.2 to 3.89.1 | 2.4.2 | date heuristic (first release on/after merge) | |
| 2025-11-01 | dependabot[bot] | Bump dompdf/dompdf from 3.1.2 to 3.1.4 | 2.4.2 | date heuristic (first release on/after merge) | |
| 2025-10-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.85.1 to 3.88.2 | 1.30.1 | date heuristic (first release on/after merge) | |
| 2025-10-01 | dependabot[bot] | Bump dompdf/dompdf from 3.1.1 to 3.1.2 | 1.30.1 | date heuristic (first release on/after merge) | |
| 2025-08-05 | dependabot[bot] | Bump setasign/fpdi from 2.6.3 to 2.6.4 | yes | 1.30.0 | date heuristic (first release on/after merge) |
| 2025-07-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.75.0 to 3.76.0 | 1.29.12 | date heuristic (first release on/after merge) | |
| 2025-07-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.13.0 to 3.13.2 | 1.29.12 | date heuristic (first release on/after merge) | |
| 2025-06-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.9.3 to 6.10.0 | 1.29.11 | date heuristic (first release on/after merge) | |
| 2025-06-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.12.2 to 3.13.0 | 1.29.11 | date heuristic (first release on/after merge) | |
| 2025-05-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.12.0 to 3.12.2 | 4.3.0 | date heuristic (first release on/after merge) | |
| 2025-05-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.9.0 to 6.9.3 | 4.3.0 | date heuristic (first release on/after merge) | |
| 2025-04-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.70.0 to 3.75.0 | 4.2.0 | date heuristic (first release on/after merge) | |
| 2025-04-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.11.3 to 3.12.0 | 4.2.0 | date heuristic (first release on/after merge) | |
| 2025-04-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.8.2 to 6.9.0 | 4.2.0 | date heuristic (first release on/after merge) | |
| 2025-03-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.68.5 to 3.70.0 | 4.1.0 | date heuristic (first release on/after merge) | |
| 2025-02-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.66.0 to 3.68.5 | 1.29.10 | date heuristic (first release on/after merge) | |
| 2025-02-01 | dependabot[bot] | Bump dompdf/dompdf from 3.0.2 to 3.1.0 | 1.29.10 | date heuristic (first release on/after merge) | |
| 2025-02-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.8.0 to 6.8.2 | 1.29.10 | date heuristic (first release on/after merge) | |
| 2025-02-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.11.2 to 3.11.3 | 1.29.10 | date heuristic (first release on/after merge) | |
| 2025-01-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.11.1 to 3.11.2 | 1.29.8 | date heuristic (first release on/after merge) | |
| 2025-01-01 | dependabot[bot] | Bump dompdf/dompdf from 3.0.1 to 3.0.2 | 1.29.8 | date heuristic (first release on/after merge) | |
| 2024-12-28 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.7.7 to 6.8.0 | 1.29.8 | date heuristic (first release on/after merge) | |
| 2024-12-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.10.3 to 3.11.1 | 2.1.5 | date heuristic (first release on/after merge) | |
| 2024-12-01 | dependabot[bot] | Bump mitoteam/jpgraph from 10.4.1 to 10.4.3 | 2.1.5 | date heuristic (first release on/after merge) | |
| 2024-12-01 | dependabot[bot] | Bump mpdf/mpdf from 8.2.4 to 8.2.5 | 2.1.5 | date heuristic (first release on/after merge) | |
| 2024-11-06 | dependabot[bot] | Bump symfony/process from 6.4.8 to 6.4.14 | yes | 3.4.0 | date heuristic (first release on/after merge) |
| 2024-11-01 | dependabot[bot] | Bump maennchen/zipstream-php from 3.1.0 to 3.1.1 | 3.4.0 | date heuristic (first release on/after merge) | |
| 2024-11-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.7.5 to 6.7.7 | yes | 3.4.0 | date heuristic (first release on/after merge) |
| 2024-10-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.10.2 to 3.10.3 | 3.4.0 | date heuristic (first release on/after merge) | |
| 2024-09-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.61.1 to 3.64.0 | 1.29.1 | date heuristic (first release on/after merge) | |
| 2024-07-01 | dependabot[bot] | Bump phpstan/phpstan from 1.11.3 to 1.11.5 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-07-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.58.1 to 3.59.3 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-07-01 | dependabot[bot] | Bump mpdf/mpdf from 8.2.3 to 8.2.4 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-07-01 | dependabot[bot] | Bump phpunit/phpunit from 10.5.20 to 10.5.24 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-06-01 | dependabot[bot] | Bump dompdf/dompdf from 2.0.8 to 3.0.0 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-06-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.9.2 to 3.10.1 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-06-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.56.1 to 3.58.1 | 2.2.0 | date heuristic (first release on/after merge) | |
| 2024-05-01 | dependabot[bot] | Bump phpstan/phpstan from 1.10.66 to 1.10.67 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-05-01 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.7.4 to 6.7.5 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-05-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.53.0 to 3.54.0 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-05-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.9.1 to 3.9.2 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-05-01 | dependabot[bot] | Bump dompdf/dompdf from 2.0.4 to 2.0.8 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-15 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.51.0 to 3.53.0 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-15 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.9.0 to 3.9.1 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-15 | dependabot[bot] | Bump mpdf/mpdf from 8.2.2 to 8.2.3 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-15 | dependabot[bot] | Bump phpunit/phpunit from 9.6.17 to 9.6.19 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-15 | dependabot[bot] | Bump phpstan/phpstan from 1.10.59 to 1.10.66 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-04-14 | dependabot[bot] | Bump tecnickcom/tcpdf from 6.6.5 to 6.7.4 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-03-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.8.1 to 3.9.0 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-03-01 | dependabot[bot] | Bump phpstan/phpstan-phpunit from 1.3.15 to 1.3.16 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-03-01 | dependabot[bot] | Bump phpstan/phpstan from 1.10.57 to 1.10.59 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-03-01 | dependabot[bot] | Bump phpunit/phpunit from 9.6.16 to 9.6.17 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-03-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.48.0 to 3.51.0 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-02-21 | dependabot[bot] | Bump phenx/php-svg-lib from 0.5.1 to 0.5.2 | yes | 2.1.0 | date heuristic (first release on/after merge) |
| 2024-02-01 | dependabot[bot] | Bump phpstan/phpstan from 1.10.50 to 1.10.57 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-02-01 | dependabot[bot] | Bump phpunit/phpunit from 9.6.15 to 9.6.16 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-02-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.8.0 to 3.8.1 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-02-01 | dependabot[bot] | Bump mitoteam/jpgraph from 10.3.2 to 10.4.1 | 2.1.0 | date heuristic (first release on/after merge) | |
| 2024-01-01 | dependabot[bot] | Bump phpunit/phpunit from 9.6.14 to 9.6.15 | 2.0.0 | date heuristic (first release on/after merge) | |
| 2024-01-01 | dependabot[bot] | Bump squizlabs/php_codesniffer from 3.7.2 to 3.8.0 | 2.0.0 | date heuristic (first release on/after merge) | |
| 2024-01-01 | dependabot[bot] | Bump phpstan/phpstan from 1.10.46 to 1.10.50 | 2.0.0 | date heuristic (first release on/after merge) | |
| 2023-12-14 | dependabot[bot] | Bump dompdf/dompdf from 2.0.3 to 2.0.4 | yes | 2.0.0 | date heuristic (first release on/after merge) |
| 2023-12-13 | dependabot[bot] | Bump phenx/php-svg-lib from 0.5.0 to 0.5.1 | yes | 2.0.0 | date heuristic (first release on/after merge) |
| 2023-12-01 | dependabot[bot] | Bump phpunit/phpunit from 9.6.13 to 9.6.14 | 2.0.0 | date heuristic (first release on/after merge) | |
| 2023-09-01 | dependabot[bot] | Bump phpstan/phpstan from 1.10.26 to 1.10.32 | 2.0.0 | date heuristic (first release on/after merge) | |
| 2023-01-01 | dependabot[bot] | Bump friendsofphp/php-cs-fixer from 3.13.0 to 3.13.1 | 1.27.0 | date heuristic (first release on/after merge) |
Releases
| Release | Date | Pre-release |
|---|---|---|
| 5.10.0 | 2026-09-17 | |
| 3.10.8 | 2026-09-17 | |
| 2.4.8 | 2026-09-17 | |
| 2.1.19 | 2026-09-17 | |
| 1.30.7 | 2026-09-17 | |
| 5.9.0 | 2026-07-12 | |
| 5.8.1 | 2026-07-12 | |
| 1.30.6 | 2026-07-12 | |
| 3.10.7 | 2026-07-12 | |
| 2.4.7 | 2026-07-12 | |
| 2.1.18 | 2026-07-12 | |
| 5.8.0 | 2026-06-07 | |
| 3.10.6 | 2026-06-07 | |
| 2.4.6 | 2026-06-07 | |
| 2.1.17 | 2026-06-07 | |
| 1.30.5 | 2026-05-31 | |
| 5.7.0 | 2026-04-20 | |
| 1.30.4 | 2026-04-20 | |
| 3.10.5 | 2026-04-20 | |
| 2.4.5 | 2026-04-20 | |
| 2.1.16 | 2026-04-20 | |
| 5.6.0 | 2026-04-10 | |
| 1.30.3 | 2026-04-10 | |
| 3.10.4 | 2026-04-10 | |
| 2.4.4 | 2026-04-10 | |
| 2.1.15 | 2026-04-10 | |
| 5.5.0 | 2026-03-01 | |
| 5.4.0 | 2026-01-11 | |
| 3.10.3 | 2026-01-11 | |
| 2.4.3 | 2026-01-11 | |
| 2.1.14 | 2026-01-11 | |
| 1.30.2 | 2026-01-11 | |
| 5.3.0 | 2025-11-24 | |
| 3.10.2 | 2025-11-24 | |
| 2.4.2 | 2025-11-24 | |
| 5.2.0 | 2025-10-26 | |
| 2.1.13 | 2025-10-26 | |
| 1.30.1 | 2025-10-26 | |
| 5.1.0 | 2025-09-04 | |
| 3.10.1 | 2025-09-04 | |
| 2.4.1 | 2025-09-04 | |
| 5.0.0 | 2025-08-10 | |
| 3.10.0 | 2025-08-10 | |
| 2.4.0 | 2025-08-10 | |
| 2.1.12 | 2025-08-10 | |
| 1.30.0 | 2025-08-10 | |
| 4.5.0 | 2025-07-24 | |
| 3.9.3 | 2025-07-24 | |
| 2.3.10 | 2025-07-24 | |
| 2.1.11 | 2025-07-24 |
Gaps in this record
- pull requests: stopped after 10 pages (raise max_pages for full history)
- commits: stopped after 10 pages (raise max_pages for full history)
Mapping notes: advisory patched_versions means each advisory patched range was parsed and matched to the earliest fetched release tag that satisfies it; every matched release is listed. tag commit match means the commit SHA or bot PR merge SHA equals the commit a release tag points at (annotated tags use the peeled commit, not the tag object; a short SHA counts only when it is a unique prefix of one tag commit). date heuristic (first release on/after publish), date heuristic (first release on/after commit), and date heuristic (first release on/after merge) are the first stable release published on or after that date, used only when the methods above do not match. That heuristic can be wrong for backports and multi-branch repos. Commit detection uses message keywords (CVE-, GHSA-, security, vuln…) and will miss silent fixes and include some false positives. A docs conventional commit (any scope, with or without a colon) is not a fix candidate unless the message cites a CVE or GHSA.
Not legal advice. fixdossier is an engineering tool for evidence collection and review support. It is not legal advice and not a compliance certificate. It does not make a product compliant with the PLD, the CRA or anything else, and its output can be incomplete or wrong. Review it, and ask a lawyer about your situation.