mirror of
https://github.com/karatektus/pl_mail.git
synced 2026-10-25 01:54:10 +00:00
Paul LütznerandClaude Opus 5
ddccc8fa2e
55k lines of PHP with no static analysis, and a dependency tree holding four OAuth clients, a JWT library and an IMAP parser with nothing watching it for advisories. PHPStan at level 5 with a baseline. Level 5 is where the class of defect this codebase actually has starts showing up — nullable entity getters flowing into non-nullable parameters — without a fortnight of triage first. 208 findings are baselined as a debt ledger, not a licence; the level goes up when the ledger is small enough that raising it is a day's work. Two of the 217 were real bugs, both fixed here rather than baselined: "Test connection" in account settings constructed ConnectionTestResult with four arguments where six are required, and passed null for a string parameter. Both call sites are the early returns for an incomplete form and a blank password — that is, the two cases the button exists to report, each of which raised an ArgumentCountError instead. GraphCategorySyncer caught App\Service\Mail\GraphApiException, which does not exist; the client throws App\Domain\Exception\GraphApiException. The catch never matched, so the 403 that means "this account needs reconnecting with MailboxSettings.ReadWrite" propagated as an unhandled error instead of degrading quietly, which is what the comment inside it says it is there to do. One more it found is left alone deliberately, because it needs a decision rather than a fix: Controller/Admin/User/DefaultController references App\Form\Admin\UserFormType and User::setName(), neither of which exists, so that admin page fatals on load. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
version: 2
|
|
|
|
# A mail client's dependency tree is its attack surface: four OAuth clients, a
|
|
# JWT library, an IMAP parser and an HTML sanitiser, all handling bytes that
|
|
# arrive from outside. Nothing was watching them.
|
|
#
|
|
# Grouped and weekly rather than per-package and daily. plMail pins Symfony to
|
|
# a single minor (8.1.*), so its packages move together and one PR per package
|
|
# would be a dozen PRs that only make sense merged at once.
|
|
updates:
|
|
- package-ecosystem: composer
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
symfony:
|
|
patterns:
|
|
- 'symfony/*'
|
|
- 'symfonycasts/*'
|
|
doctrine:
|
|
patterns:
|
|
- 'doctrine/*'
|
|
# Everything else together: these are the ones worth reading
|
|
# individually, and there are few enough of them to do that.
|
|
minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
|
|
- package-ecosystem: npm
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
playwright:
|
|
patterns:
|
|
- '@playwright/*'
|
|
- 'playwright'
|
|
|
|
# The build publishes the image users actually run, so a stale or
|
|
# vulnerable action here reaches further than a stale library.
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- '*'
|