| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| grumphp.phar | 2026-10-03 | 9.0 MB | |
| grumphp.phar.asc | 2026-10-03 | 866 Bytes | |
| README.md | 2026-10-03 | 797 Bytes | |
| Version 2.25.0 source code.tar.gz | 2026-10-03 | 422.3 kB | |
| Version 2.25.0 source code.zip | 2026-10-03 | 603.4 kB | |
| Totals: 5 Items | 10.1 MB | 0 | |
Security
GrumPHP passed repository files to external tools as plain arguments, so a file whose name starts with - could be read as an option, such as --config, instead of a path. Paths starting with - are now prefixed with ./, and the git_blacklist task matches file names literally. See GHSA-fmpp-rfr9-jgpg for details.
Thanks to @jf0x3a for reporting this responsibly.
What's Changed
- Prevent file paths from being parsed as tool options by @veewee in https://github.com/phpro/grumphp/pull/1234
- Bump composer/composer from 2.10.2 to 2.10.3 by @dependabot[bot] in https://github.com/phpro/grumphp/pull/1230
Full Changelog: https://github.com/phpro/grumphp/compare/v2.24.0...v2.25.0
