Hi, we are using actively AWS Security Inspector that looks into the vendors for usages of unsecure vendors. For month it's complaining about a CVE-2024-51736 - symfony/process Package Vulnerability because of an old locked version of symfony/process v4.3.4 in your composer.lock.
My idea would be to remove the composer.lock completely from this library and only rely on composer.json. This is a common pattern across most composer libraries and would of course calm down such false security alarms.
Thanks in advance & Kind Rergards
Thomas
Hi, we are using actively AWS Security Inspector that looks into the vendors for usages of unsecure vendors. For month it's complaining about a
CVE-2024-51736 - symfony/processPackage Vulnerability because of an old locked version ofsymfony/processv4.3.4 in your composer.lock.My idea would be to remove the composer.lock completely from this library and only rely on composer.json. This is a common pattern across most composer libraries and would of course calm down such false security alarms.
Thanks in advance & Kind Rergards
Thomas