Search code examples
phplaravellaravel-5composer-phpdependabot

How to find which version of Laravel no longer has security vulnerability


I have a Laravel project on Github, and the dependabot email is warning me of a security vulnerability in Laravel's symfony/http-foundation dependancy (the vulnerability is in version >= 3.0.0 and < 3.4.26.

Is there a way to determine what is the lowest version of Laravel that is using a version of this dependancy >= 3.4.26.

I don't have time to migrate to the latest versions, so I'm looking to migrate to the lowest version of Laravel that doesn't have this issue.

Thank you


Solution

  • Laravel 5.4 and later use symfony/http-foundation >= 3.4.26

    It in fact uses ~3.2 which means 3.2 <= version < 4

    Laravel 5.3 uses 3.1.*