diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a8d923710..845ff1463 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -34,13 +34,14 @@ This makes it easier to see exactly what is being tested when reviewing the PR. ## How to release -1. Complete CHANGELOG.md and commit -2. Create an annotated tag +1. On the master branch only, run `composer sbom`, and, if needed, update release numbers on SECURITY.md. +2. Complete CHANGELOG.md and commit +3. Create an annotated tag 1. `git tag -a 1.2.3` 2. Tag subject must be the version number, eg: `1.2.3` 3. Tag body must be a copy-paste of the changelog entries. -3. Push the tag with `git push --tags`, GitHub Actions will create a GitHub release automatically, and the release details will automatically be sent to packagist. -4. By default, Github removes markdown headings in the Release Notes. You can either edit to restore these, or, probably preferably, change the default comment character on your system - `git config core.commentChar ";"`. +4. Push the tag with `git push --tags`, GitHub Actions will create a GitHub release automatically, and the release details will automatically be sent to packagist. +5. By default, Github removes markdown headings in the Release Notes. You can either edit to restore these, or, probably preferably, change the default comment character on your system - `git config core.commentChar ";"`. > **Note:** Tagged releases are made from the `master` branch. Only in an emergency should a tagged release be made from the `release` branch. (i.e. cherry-picked hot-fixes.) However, there are 4 branches which have been updated to apply security patches, and those may be tagged if future security updates are needed. - 1.30.x (no further updates aside from security patches, including code changes needed for Php 8.5 compatibility) diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..a624a6d5a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,32 @@ +# Security Policy + +## Reporting a Vulnerability + +If you discover a security vulnerability within this project, please report it via [Private Vulnerability Reporting](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/new). + +Please do not report security vulnerabilities through public GitHub issues. + +### What to Include +* Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting). +* Full paths of source file(s) related to the manifestation of the issue. +* The location of the affected source code within those paths. +* Proof of concept (step-by-step instructions to reproduce the issue). +* Suggested remediation. + +## Supported Versions + +| Version | Supported | +| -------------------- | --------- | +| >= 5.10.0 | ✅ | +| >= 4.0.0, < 5.10.0 | ❌ | +| >= 3.10.8, < 4.0.0 | ✅ | +| >= 3.0.0, < 3.10.8 | ❌ | +| >= 2.4.8, < 3.0.0 | ✅ | +| >= 2.2.0, < 2.4.8 | ❌ | +| >= 2.1.19, < 2.2.0 | ✅ | +| >= 2.0.0, < 2.1.19 | ❌ | +| >= 1.30.6, < 2.0.0 | ✅ | +| < 1.30.6 | ❌ | + +## Disclosure Policy +We follow a coordinated vulnerability disclosure approach. We ask that you give us reasonable time to address the issue before making any public disclosures. diff --git a/composer.json b/composer.json index 19cbcc0bb..df5511983 100644 --- a/composer.json +++ b/composer.json @@ -18,6 +18,7 @@ "process-timeout": 600, "sort-packages": true, "allow-plugins": { + "cyclonedx/cyclonedx-php-composer": true, "dealerdirect/phpcodesniffer-composer-installer": true } }, @@ -64,6 +65,9 @@ "phpcbf samples/ src/ tests/ --report=checkstyle", "php-cs-fixer fix" ], + "sbom": [ + "composer CycloneDX:make-sbom --omit=dev --output-file=./sbom.xml" + ], "versions": [ "phpcs samples/ src/ tests/ --standard=PHPCompatibility --runtime-set testVersion 8.0- --exclude=PHPCompatibility.Variables.ForbiddenThisUseContexts -n" ] @@ -93,6 +97,7 @@ "require-dev": { "ext-intl": "*", "ext-openssl": "*", + "cyclonedx/cyclonedx-php-composer": "^6.2", "dealerdirect/phpcodesniffer-composer-installer": "dev-main", "dompdf/dompdf": "^2.0 || ^3.0", "friendsofphp/php-cs-fixer": "^3.2", diff --git a/composer.lock b/composer.lock index cec347275..ff13f7453 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "60d332b917eb81ff1fac85d62cecffcd", + "content-hash": "856c467bd80051944d384538ca6fda5f", "packages": [ { "name": "composer/pcre", @@ -461,6 +461,82 @@ ], "time": "2025-08-20T19:15:30+00:00" }, + { + "name": "composer/spdx-licenses", + "version": "1.6.0", + "source": { + "type": "git", + "url": "https://github.com/composer/spdx-licenses.git", + "reference": "5ecd0cb4177696f9fd48f1605dda81db3dee7889" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/composer/spdx-licenses/zipball/5ecd0cb4177696f9fd48f1605dda81db3dee7889", + "reference": "5ecd0cb4177696f9fd48f1605dda81db3dee7889", + "shasum": "" + }, + "require": { + "php": "^7.2 || ^8.0" + }, + "require-dev": { + "phpstan/phpstan": "^1.11", + "symfony/phpunit-bridge": "^6.4.25 || ^7.3.3 || ^8.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-main": "1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Composer\\Spdx\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Nils Adermann", + "email": "naderman@naderman.de", + "homepage": "http://www.naderman.de" + }, + { + "name": "Jordi Boggiano", + "email": "j.boggiano@seld.be", + "homepage": "http://seld.be" + }, + { + "name": "Rob Bast", + "email": "rob.bast@gmail.com", + "homepage": "http://robbast.nl" + } + ], + "description": "SPDX licenses list and validation library.", + "keywords": [ + "license", + "spdx", + "validator" + ], + "support": { + "irc": "ircs://irc.libera.chat:6697/composer", + "issues": "https://github.com/composer/spdx-licenses/issues", + "source": "https://github.com/composer/spdx-licenses/tree/1.6.0" + }, + "funding": [ + { + "url": "https://packagist.com", + "type": "custom" + }, + { + "url": "https://github.com/composer", + "type": "github" + } + ], + "time": "2026-04-08T20:18:39+00:00" + }, { "name": "composer/xdebug-handler", "version": "3.0.5", @@ -527,6 +603,179 @@ ], "time": "2024-05-06T16:37:16+00:00" }, + { + "name": "cyclonedx/cyclonedx-library", + "version": "v4.2.0", + "source": { + "type": "git", + "url": "https://github.com/CycloneDX/cyclonedx-php-library.git", + "reference": "a99d940fad1b091fe48f41b6ef1b5960bbb0fbd4" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/CycloneDX/cyclonedx-php-library/zipball/a99d940fad1b091fe48f41b6ef1b5960bbb0fbd4", + "reference": "a99d940fad1b091fe48f41b6ef1b5960bbb0fbd4", + "shasum": "" + }, + "require": { + "ext-dom": "*", + "ext-json": "*", + "ext-libxml": "*", + "opis/json-schema": "^2.0", + "php": "^8.1" + }, + "conflict": { + "composer/spdx-licenses": "<1.5" + }, + "require-dev": { + "composer/spdx-licenses": "^1.5", + "ext-simplexml": "*", + "roave/security-advisories": "dev-latest" + }, + "suggest": { + "composer/spdx-licenses": "used in license factory", + "package-url/packageurl-php": "for parsing and crafting PackageURL strings" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "4.x-dev" + }, + "composer-normalize": { + "indent-size": 4, + "indent-style": "space" + } + }, + "autoload": { + "psr-4": { + "CycloneDX\\Core\\": "src/Core/", + "CycloneDX\\Contrib\\": "src/Contrib/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Jan Kowalleck", + "email": "jan.kowalleck@gmail.com", + "homepage": "https://github.com/jkowalleck" + } + ], + "description": "Work with CycloneDX documents.", + "homepage": "https://github.com/CycloneDX/cyclonedx-php-library/#readme", + "keywords": [ + "CycloneDX", + "HBOM", + "OBOM", + "SBOM", + "SaaSBOM", + "bill-of-materials", + "bom", + "models", + "normalizer", + "owasp", + "package-url", + "purl", + "serializer", + "software-bill-of-materials", + "spdx", + "validator", + "vdr", + "vex" + ], + "support": { + "docs": "https://cyclonedx-php-library.readthedocs.io", + "issues": "https://github.com/CycloneDX/cyclonedx-php-library/issues", + "source": "https://github.com/CycloneDX/cyclonedx-php-library/" + }, + "funding": [ + { + "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX", + "type": "other" + } + ], + "time": "2026-09-17T17:38:29+00:00" + }, + { + "name": "cyclonedx/cyclonedx-php-composer", + "version": "v6.2.0", + "source": { + "type": "git", + "url": "https://github.com/CycloneDX/cyclonedx-php-composer.git", + "reference": "934440a5ef7c3c3cdb58c3c3d389d412630ccbf6" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/CycloneDX/cyclonedx-php-composer/zipball/934440a5ef7c3c3cdb58c3c3d389d412630ccbf6", + "reference": "934440a5ef7c3c3cdb58c3c3d389d412630ccbf6", + "shasum": "" + }, + "require": { + "composer-plugin-api": "^2.3", + "composer/spdx-licenses": "^1.5.7", + "cyclonedx/cyclonedx-library": "^4.0", + "package-url/packageurl-php": "^1.0", + "php": "^8.1" + }, + "require-dev": { + "composer/composer": "^2.3.0", + "marc-mabe/php-enum": "^4.6", + "roave/security-advisories": "dev-latest" + }, + "type": "composer-plugin", + "extra": { + "class": "CycloneDX\\Composer\\Plugin", + "branch-alias": { + "dev-master": "6.x-dev" + }, + "composer-normalize": { + "indent-size": 4, + "indent-style": "space" + } + }, + "autoload": { + "psr-4": { + "CycloneDX\\Composer\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Jan Kowalleck", + "email": "jan.kowalleck@gmail.com", + "homepage": "https://github.com/jkowalleck" + } + ], + "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from PHP Composer projects", + "homepage": "https://github.com/CycloneDX/cyclonedx-php-composer/#readme", + "keywords": [ + "CycloneDX", + "SBOM", + "bill-of-materials", + "bom", + "composer", + "package-url", + "purl", + "software-bill-of-materials", + "spdx" + ], + "support": { + "issues": "https://github.com/CycloneDX/cyclonedx-php-composer/issues", + "source": "https://github.com/CycloneDX/cyclonedx-php-composer/" + }, + "funding": [ + { + "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX", + "type": "other" + } + ], + "time": "2026-02-17T13:23:10+00:00" + }, { "name": "dealerdirect/phpcodesniffer-composer-installer", "version": "dev-main", @@ -1474,6 +1723,262 @@ }, "time": "2025-12-06T11:56:16+00:00" }, + { + "name": "opis/json-schema", + "version": "2.6.0", + "source": { + "type": "git", + "url": "https://github.com/opis/json-schema.git", + "reference": "8458763e0dd0b6baa310e04f1829fc73da4e8c8a" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/opis/json-schema/zipball/8458763e0dd0b6baa310e04f1829fc73da4e8c8a", + "reference": "8458763e0dd0b6baa310e04f1829fc73da4e8c8a", + "shasum": "" + }, + "require": { + "ext-json": "*", + "opis/string": "^2.1", + "opis/uri": "^1.0", + "php": "^7.4 || ^8.0" + }, + "require-dev": { + "ext-bcmath": "*", + "ext-intl": "*", + "phpunit/phpunit": "^9.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "2.x-dev" + } + }, + "autoload": { + "psr-4": { + "Opis\\JsonSchema\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Sorin Sarca", + "email": "sarca_sorin@hotmail.com" + }, + { + "name": "Marius Sarca", + "email": "marius.sarca@gmail.com" + } + ], + "description": "Json Schema Validator for PHP", + "homepage": "https://opis.io/json-schema", + "keywords": [ + "json", + "json-schema", + "schema", + "validation", + "validator" + ], + "support": { + "issues": "https://github.com/opis/json-schema/issues", + "source": "https://github.com/opis/json-schema/tree/2.6.0" + }, + "time": "2025-10-17T12:46:48+00:00" + }, + { + "name": "opis/string", + "version": "2.1.0", + "source": { + "type": "git", + "url": "https://github.com/opis/string.git", + "reference": "3e4d2aaff518ac518530b89bb26ed40f4503635e" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/opis/string/zipball/3e4d2aaff518ac518530b89bb26ed40f4503635e", + "reference": "3e4d2aaff518ac518530b89bb26ed40f4503635e", + "shasum": "" + }, + "require": { + "ext-iconv": "*", + "ext-json": "*", + "php": "^7.4 || ^8.0" + }, + "require-dev": { + "phpunit/phpunit": "^9.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "2.x-dev" + } + }, + "autoload": { + "psr-4": { + "Opis\\String\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Marius Sarca", + "email": "marius.sarca@gmail.com" + }, + { + "name": "Sorin Sarca", + "email": "sarca_sorin@hotmail.com" + } + ], + "description": "Multibyte strings as objects", + "homepage": "https://opis.io/string", + "keywords": [ + "multi-byte", + "opis", + "string", + "string manipulation", + "utf-8" + ], + "support": { + "issues": "https://github.com/opis/string/issues", + "source": "https://github.com/opis/string/tree/2.1.0" + }, + "time": "2025-10-17T12:38:41+00:00" + }, + { + "name": "opis/uri", + "version": "1.1.0", + "source": { + "type": "git", + "url": "https://github.com/opis/uri.git", + "reference": "0f3ca49ab1a5e4a6681c286e0b2cc081b93a7d5a" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/opis/uri/zipball/0f3ca49ab1a5e4a6681c286e0b2cc081b93a7d5a", + "reference": "0f3ca49ab1a5e4a6681c286e0b2cc081b93a7d5a", + "shasum": "" + }, + "require": { + "opis/string": "^2.0", + "php": "^7.4 || ^8.0" + }, + "require-dev": { + "phpunit/phpunit": "^9" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-master": "1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Opis\\Uri\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "Apache-2.0" + ], + "authors": [ + { + "name": "Marius Sarca", + "email": "marius.sarca@gmail.com" + }, + { + "name": "Sorin Sarca", + "email": "sarca_sorin@hotmail.com" + } + ], + "description": "Build, parse and validate URIs and URI-templates", + "homepage": "https://opis.io", + "keywords": [ + "URI Template", + "parse url", + "punycode", + "uri", + "uri components", + "url", + "validate uri" + ], + "support": { + "issues": "https://github.com/opis/uri/issues", + "source": "https://github.com/opis/uri/tree/1.1.0" + }, + "time": "2021-05-22T15:57:08+00:00" + }, + { + "name": "package-url/packageurl-php", + "version": "1.1.2", + "source": { + "type": "git", + "url": "https://github.com/package-url/packageurl-php.git", + "reference": "32058ad61f0d8b457fa26e7860bbd8b903196d3f" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/package-url/packageurl-php/zipball/32058ad61f0d8b457fa26e7860bbd8b903196d3f", + "reference": "32058ad61f0d8b457fa26e7860bbd8b903196d3f", + "shasum": "" + }, + "require": { + "php": "^7.3 || ^8.0" + }, + "require-dev": { + "ext-json": "*", + "phpunit/phpunit": "9.6.16", + "roave/security-advisories": "dev-latest" + }, + "type": "library", + "extra": { + "composer-normalize": { + "indent-size": 4, + "indent-style": "space" + } + }, + "autoload": { + "psr-4": { + "PackageUrl\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Jan Kowalleck", + "email": "jan.kowalleck@gmail.com", + "homepage": "https://github.com/jkowalleck" + } + ], + "description": "Builder and parser based on the package URL (purl) specification.", + "homepage": "https://github.com/package-url/packageurl-php#readme", + "keywords": [ + "package", + "package-url", + "packageurl", + "purl", + "url" + ], + "support": { + "issues": "https://github.com/package-url/packageurl-php/issues", + "source": "https://github.com/package-url/packageurl-php/tree/1.1.2" + }, + "funding": [ + { + "url": "https://github.com/sponsors/jkowalleck", + "type": "github" + } + ], + "time": "2024-02-05T11:20:07+00:00" + }, { "name": "paragonie/random_compat", "version": "v9.99.100", diff --git a/sbom.xml b/sbom.xml new file mode 100644 index 000000000..8614975c0 --- /dev/null +++ b/sbom.xml @@ -0,0 +1,294 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +