From 9bbe04f6892a4258f01d837bc96f2e5bf512794e Mon Sep 17 00:00:00 2001 From: Maciej Lew Date: Tue, 20 Oct 2026 12:56:42 +0200 Subject: [PATCH 1/5] Add some symfony/yaml CVEs to Composer audit ignore list Make GitHub Action test workflow pass --- build/docker-compose.yml | 2 -- build/php-7.0/Dockerfile | 2 +- build/php-7.1/Dockerfile | 2 +- build/php-7.2/Dockerfile | 2 +- build/php-7.3/Dockerfile | 2 +- build/php-7.4/Dockerfile | 2 +- build/php-8.0/Dockerfile | 2 +- build/php-8.1/Dockerfile | 2 +- build/php-8.2/Dockerfile | 2 +- build/php-8.3/Dockerfile | 2 +- composer.json | 12 ++++++++++++ 11 files changed, 21 insertions(+), 11 deletions(-) diff --git a/build/docker-compose.yml b/build/docker-compose.yml index dcbfba0..73a3cf9 100644 --- a/build/docker-compose.yml +++ b/build/docker-compose.yml @@ -1,5 +1,3 @@ -version: '3.5' - services: php-7.0: diff --git a/build/php-7.0/Dockerfile b/build/php-7.0/Dockerfile index ed516f7..959cb0c 100644 --- a/build/php-7.0/Dockerfile +++ b/build/php-7.0/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:2.2 as composer +FROM composer:2.2 AS composer FROM php:7.0-cli-alpine RUN apk update && \ diff --git a/build/php-7.1/Dockerfile b/build/php-7.1/Dockerfile index 2a0487e..92aeb2e 100644 --- a/build/php-7.1/Dockerfile +++ b/build/php-7.1/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:2.2 as composer +FROM composer:2.2 AS composer FROM php:7.1-cli-alpine RUN apk update && \ diff --git a/build/php-7.2/Dockerfile b/build/php-7.2/Dockerfile index bd7b230..0419aa0 100644 --- a/build/php-7.2/Dockerfile +++ b/build/php-7.2/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:2.2 as composer +FROM composer:latest AS composer FROM php:7.2-cli-alpine RUN apk update && \ diff --git a/build/php-7.3/Dockerfile b/build/php-7.3/Dockerfile index 28ef4fc..1e92d66 100644 --- a/build/php-7.3/Dockerfile +++ b/build/php-7.3/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:2.2 as composer +FROM composer:latest AS composer FROM php:7.3-cli-alpine RUN apk update && \ diff --git a/build/php-7.4/Dockerfile b/build/php-7.4/Dockerfile index d810922..9e931b2 100644 --- a/build/php-7.4/Dockerfile +++ b/build/php-7.4/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:2.2 as composer +FROM composer:latest AS composer FROM php:7.4-cli-alpine RUN apk update && \ diff --git a/build/php-8.0/Dockerfile b/build/php-8.0/Dockerfile index 04a6435..bf12589 100644 --- a/build/php-8.0/Dockerfile +++ b/build/php-8.0/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:latest as composer +FROM composer:latest AS composer FROM php:8.0-cli-alpine RUN apk update && \ diff --git a/build/php-8.1/Dockerfile b/build/php-8.1/Dockerfile index 70aea88..0d94ffc 100644 --- a/build/php-8.1/Dockerfile +++ b/build/php-8.1/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:latest as composer +FROM composer:latest AS composer FROM php:8.1-cli-alpine RUN apk update && \ diff --git a/build/php-8.2/Dockerfile b/build/php-8.2/Dockerfile index 677d0ad..d514158 100644 --- a/build/php-8.2/Dockerfile +++ b/build/php-8.2/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:latest as composer +FROM composer:latest AS composer FROM php:8.2-cli-alpine RUN apk update && \ diff --git a/build/php-8.3/Dockerfile b/build/php-8.3/Dockerfile index 94ac096..c8d87f7 100644 --- a/build/php-8.3/Dockerfile +++ b/build/php-8.3/Dockerfile @@ -1,4 +1,4 @@ -FROM composer:latest as composer +FROM composer:latest AS composer FROM php:8.3-cli-alpine RUN apk update && \ diff --git a/composer.json b/composer.json index 8c5dad5..7a33bc2 100644 --- a/composer.json +++ b/composer.json @@ -37,5 +37,17 @@ "suggest": { "ext-curl": "To use Curl HttpClient", "guzzlehttp/psr7": "To use Curl HttpClient and HTTP message factories" + }, + "config": { + "policy": { + "advisories": { + "ignore-id": { + "PKSA-xz3r-9gp4-4m1z": "CVE-2026-109413: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process - require-dev dependency, not applicable", + "PKSA-v5yj-8nmz-sk2q": "CVE-2026-45304: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion - require-dev dependency, not applicable", + "PKSA-ft77-7h5f-p3r6": "CVE-2026-45305: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex - require-dev dependency, not applicable", + "PKSA-b14r-zh1d-vdrc": "CVE-2026-45133: YAML Parser Stack Exhaustion via Unbounded Recursion in Nested Blocks, Sequences, and Mappings - require-dev dependency, not applicable" + } + } + } } } From f38f599ec0294db4abb74843d71dcc06cfede58a Mon Sep 17 00:00:00 2001 From: Maciej Lew Date: Tue, 20 Oct 2026 13:06:30 +0200 Subject: [PATCH 2/5] Close cURL handle based on its type instead of PHP version Call curl_close() only when the handle is a resource (PHP < 8.0); since PHP 8.0 it is a CurlHandle object freed automatically, and curl_close() is deprecated in PHP 8.5. --- src/Curl/HttpClient.php | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/Curl/HttpClient.php b/src/Curl/HttpClient.php index 2c03b3c..d8c7ebb 100644 --- a/src/Curl/HttpClient.php +++ b/src/Curl/HttpClient.php @@ -103,8 +103,7 @@ private function execute(RequestInterface $request, $httpClient): ResponseInterf private function closeHttpClient($httpClient) { - // curl_close() has no effect since PHP 8.0 and is deprecated since PHP 8.5 - if (PHP_VERSION_ID < 80000) { + if (is_resource($httpClient)) { curl_close($httpClient); } } From 492cf07df210c05dd25583fed3984e6dece0fa92 Mon Sep 17 00:00:00 2001 From: Maciej Lew Date: Tue, 20 Oct 2026 13:08:19 +0200 Subject: [PATCH 3/5] Always close cURL handle, even when request fails Wrap execute() in try/finally so closeHttpClient() also runs when RequestException is thrown, preventing the handle from being left open on PHP < 8.0. --- src/Curl/HttpClient.php | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/Curl/HttpClient.php b/src/Curl/HttpClient.php index d8c7ebb..6eda01c 100644 --- a/src/Curl/HttpClient.php +++ b/src/Curl/HttpClient.php @@ -25,9 +25,11 @@ public function sendRequest(RequestInterface $request): ResponseInterface $this->prepareRequestHeaders($request, $httpClient); $this->prepareResponseOptions($httpClient); - $response = $this->execute($request, $httpClient); - - $this->closeHttpClient($httpClient); + try { + $response = $this->execute($request, $httpClient); + } finally { + $this->closeHttpClient($httpClient); + } return $response; } From 38374cfeed13d875a9483cd129cc9b5d8ef65271 Mon Sep 17 00:00:00 2001 From: Maciej Lew Date: Tue, 20 Oct 2026 13:26:13 +0200 Subject: [PATCH 4/5] Add PHP 8.5 tests to Make targets --- build/Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/build/Makefile b/build/Makefile index 5d807b1..c1266e3 100644 --- a/build/Makefile +++ b/build/Makefile @@ -10,6 +10,7 @@ include $(CURDIR)/php-8.1/Makefile include $(CURDIR)/php-8.2/Makefile include $(CURDIR)/php-8.3/Makefile include $(CURDIR)/php-8.4/Makefile +include $(CURDIR)/php-8.5/Makefile help: @grep -hE '^[a-zA-Z0-9_.-]+:.*?## .*$$' $(MAKEFILE_LIST) \ @@ -30,6 +31,7 @@ test: ## test all against all php images $(MAKE) test-php-8.2 $(MAKE) test-php-8.3 $(MAKE) test-php-8.4 + $(MAKE) test-php-8.5 test-unit: ## test unit suite against all php images $(MAKE) test-suite-php-7.0 SUITE=unit @@ -42,5 +44,6 @@ test-unit: ## test unit suite against all php images $(MAKE) test-suite-php-8.2 SUITE=unit $(MAKE) test-suite-php-8.3 SUITE=unit $(MAKE) test-suite-php-8.4 SUITE=unit + $(MAKE) test-suite-php-8.5 SUITE=unit .DEFAULT_GOAL := help From 281f354146e704368dd044da496330000ccbb599 Mon Sep 17 00:00:00 2001 From: Maciej Lew Date: Tue, 20 Oct 2026 13:29:49 +0200 Subject: [PATCH 5/5] Release version 4.0.1 --- CHANGELOG.md | 8 +++++++- src/SmsapiClient.php | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ced20b..f8d7f0a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html). +## [4.0.1] - 2026-10-20 +### Fixed +- `curl_close()` deprecation on PHP-8.5 +- `TypeError` thrown instead of `NetworkException` when cURL handle cannot be initialized +- cURL handle not closed on failed request on PHP-7, `HttpClient` issue + ## [4.0.0] - 2026-04-09 ### Removed - deprecated `\Smsapi\Client\Feature\Contacts\Bag\CreateContactBag::withPhone` @@ -13,7 +19,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a - deprecated `\Smsapi\Client\Curl\Exception\NetworkException` - deprecated `\Smsapi\Client\Curl\Exception\ClientException` -## Changed +### Changed - method signature `\Smsapi\Client\Feature\Contacts\ContactsFeature::findContacts` - method signature `\Smsapi\Client\Feature\Sms\Bag\ScheduleSmsBag::setExternalId` - method signature `\Smsapi\Client\Feature\Sms\Bag\ScheduleSmssBag::setExternalId` diff --git a/src/SmsapiClient.php b/src/SmsapiClient.php index 8ef1412..0cab7cf 100644 --- a/src/SmsapiClient.php +++ b/src/SmsapiClient.php @@ -12,7 +12,7 @@ */ interface SmsapiClient extends LoggerAwareInterface { - const VERSION = '4.0.0'; + const VERSION = '4.0.1'; public function smsapiPlService(string $apiToken): SmsapiPlService;