{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony-standard/issues/760","labels_url":"https://api.github.com/repos/symfony/symfony-standard/issues/760/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony-standard/issues/760/comments","events_url":"https://api.github.com/repos/symfony/symfony-standard/issues/760/events","html_url":"https://github.com/symfony/symfony-standard/pull/760","id":52118208,"number":760,"title":"Adding security advisories pre-update check via `roave/security-advisories` meta-package","user":{"login":"Ocramius","id":154256,"avatar_url":"https://avatars.githubusercontent.com/u/154256?v=3","gravatar_id":"","url":"https://api.github.com/users/Ocramius","html_url":"https://github.com/Ocramius","followers_url":"https://api.github.com/users/Ocramius/followers","following_url":"https://api.github.com/users/Ocramius/following{/other_user}","gists_url":"https://api.github.com/users/Ocramius/gists{/gist_id}","starred_url":"https://api.github.com/users/Ocramius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ocramius/subscriptions","organizations_url":"https://api.github.com/users/Ocramius/orgs","repos_url":"https://api.github.com/users/Ocramius/repos","events_url":"https://api.github.com/users/Ocramius/events{/privacy}","received_events_url":"https://api.github.com/users/Ocramius/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2014-12-16T14:25:38Z","updated_at":"2015-04-13T01:29:35Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/symfony/symfony-standard/pulls/760","html_url":"https://github.com/symfony/symfony-standard/pull/760","diff_url":"https://github.com/symfony/symfony-standard/pull/760.diff","patch_url":"https://github.com/symfony/symfony-standard/pull/760.patch"},"body":"This additional package behaves like https://github.com/FriendsOfPHP/security-advisories, but before actually running the installation during any `require` or `update` composer command executions.\r\n\r\nThis effectively prevents installation of any security-issue affected code when changing dependencies.\r\n\r\nThe package itself does not bring in any dependencies or any additional code.\r\n\r\n*must* be referencing `dev-master`.\r\n\r\nMore on it:\r\n\r\n * https://github.com/Roave/SecurityAdvisories\r\n * [Roave/SecurityAdvisories release blogpost](http://ocramius.github.io/blog/roave-security-advisories-protect-against-composer-packages-with-security-issues/)\r\n\r\nI didn't update the `composer.lock` since I'd first need some feedback on whether this change is actually welcome."},"comment":{"url":"https://api.github.com/repos/symfony/symfony-standard/issues/comments/92161406","html_url":"https://github.com/symfony/symfony-standard/pull/760#issuecomment-92161406","issue_url":"https://api.github.com/repos/symfony/symfony-standard/issues/760","id":92161406,"user":{"login":"cordoval","id":328359,"avatar_url":"https://avatars.githubusercontent.com/u/328359?v=3","gravatar_id":"","url":"https://api.github.com/users/cordoval","html_url":"https://github.com/cordoval","followers_url":"https://api.github.com/users/cordoval/followers","following_url":"https://api.github.com/users/cordoval/following{/other_user}","gists_url":"https://api.github.com/users/cordoval/gists{/gist_id}","starred_url":"https://api.github.com/users/cordoval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cordoval/subscriptions","organizations_url":"https://api.github.com/users/cordoval/orgs","repos_url":"https://api.github.com/users/cordoval/repos","events_url":"https://api.github.com/users/cordoval/events{/privacy}","received_events_url":"https://api.github.com/users/cordoval/received_events","type":"User","site_admin":false},"created_at":"2015-04-13T01:29:35Z","updated_at":"2015-04-13T01:29:35Z","body":"I think this makes a lot of sense :+1: \r\nSince the error on composer exposes the conflict between roave package of advisories and the version of symfony that in this case is vulnerable then I think it is understandable and there shouldn't be any confusion. I doubt people would try to make any other conclusion if the conflict is specifically to the roave package.\r\n\r\n```bash\r\n~ composer install                                        Luiss-iMac [20:24:01]\r\nLoading composer repositories with package information\r\nInstalling dependencies (including require-dev)\r\nYour requirements could not be resolved to an installable set of packages.\r\n\r\n  Problem 1\r\n    - Installation request for symfony/symfony 2.5.2 -> satisfiable by symfony/symfony[v2.5.2].\r\n    - roave/security-advisories dev-master conflicts with symfony/symfony[v2.5.2].\r\n    - Installation request for roave/security-advisories dev-master -> satisfiable by roave/security-advisories[dev-master].\r\n```\r\n\r\nThanks for sharing @Ocramius! :older_man: "}}