Release/1.6.8

.docker/nginx.conf

@@ -1,13 +1,12 @@
 worker_processes  auto;
 
-error_log  /var/log/nginx/error.log notice;
+error_log  /dev/stderr notice;
 pid        /tmp/nginx.pid;
 
 events {
     worker_connections  1024;
 }
 
-
 http {
     proxy_temp_path /tmp/proxy_temp;
     client_body_temp_path /tmp/client_temp;
@@ -18,19 +17,17 @@ http {
     include       /etc/nginx/mime.types;
     default_type  application/octet-stream;
 
-    set_real_ip_from 172.16.0.0/8;
+    set_real_ip_from 172.16.0.0/16;
     real_ip_recursive on;
     real_ip_header X-Forwarded-For;
 
     log_format  main  '$http_x_real_ip - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';
 
-    access_log  /var/log/nginx/access.log main;
+    access_log  /dev/stdout main;
 
     sendfile        on;
-    #tcp_nopush     on;
-
     keepalive_timeout  65;
 
     gzip  on;

.docker/templates/default.conf.template

@@ -0,0 +1,47 @@
+server {
+    listen ${NGINX_PORT};
+    server_name localhost;
+
+    root ${NGINX_WEB_ROOT};
+
+    client_max_body_size ${NGINX_MAX_BODY_SIZE};
+
+    # This also needs to be set in the single server tag and not only in http.
+    set_real_ip_from 172.16.0.0/16;
+    real_ip_recursive on;
+    real_ip_header X-Forwarded-For;
+
+    location / {
+        # try to serve file directly, fallback to index.php
+        try_files $uri /index.php$is_args$args;
+    }
+
+    # Protect files and directories from prying eyes.
+    location ~* \.(engine|inc|install|make|module|profile|po|sh|.*sql|.tar|.gz|.bz2|theme|twig|tpl(\.php)?|xtmpl|yml)(~|\.sw[op]|\.bak|\.orig|\.save)?$|^(\.(?!well-known).*|Entries.*|Repository|Root|Tag|Template|composer\.(json|lock)|web\.config)$|^#.*#$|\.php(~|\.sw[op]|\.bak|\.orig|\.save)$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/index\.php(/|$) {
+        fastcgi_buffers 16 32k;
+        fastcgi_buffer_size 64k;
+        fastcgi_busy_buffers_size 64k;
+
+        fastcgi_pass ${NGINX_FPM_SERVICE};
+        fastcgi_split_path_info ^(.+\.php)(/.*)$;
+        include fastcgi_params;
+
+        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT $realpath_root;
+
+        internal;
+    }
+
+    location ~ \.php$ {
+        return 404;
+    }
+
+    # Send log message to files symlinked to stdout/stderr.
+    error_log /dev/stderr;
+    access_log /dev/stdout main;
+}

.github/workflows/pr.yaml

@@ -20,11 +20,11 @@ jobs:
 
     test-composer-files:
         name: Validate composer (PHP ${{ matrix.php }})
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-24.04
         strategy:
             fail-fast: false
             matrix:
-                php: ['8.2']
+                php: ['8.3']
         steps:
             - uses: actions/checkout@master
             - name: Setup PHP, with composer and extensions
@@ -46,11 +46,11 @@ jobs:
 
     phpcsfixer:
         name: PHP-CS-FIXER (PHP ${{ matrix.php }})
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-24.04
         strategy:
             fail-fast: false
             matrix:
-                php: ['8.2']
+                php: ['8.3']
         steps:
             - uses: actions/checkout@master
             - name: Setup PHP, with composer and extensions
@@ -74,11 +74,11 @@ jobs:
 
     twigcs:
         name: TwigCS (PHP ${{ matrix.php }})
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-24.04
         strategy:
             fail-fast: false
             matrix:
-                php: ['8.2']
+                php: ['8.3']
         steps:
             - uses: actions/checkout@master
             - name: Setup PHP, with composer and extensions
@@ -102,7 +102,7 @@ jobs:
 
     js-coding-standards:
         name: JS coding standards
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@master
             - uses: actions/setup-node@v3
@@ -115,7 +115,7 @@ jobs:
 
     test-yarn-build:
         name: Test yarn build assets
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-24.04
         steps:
             - uses: actions/checkout@master
 

CHANGELOG.md

@@ -8,6 +8,11 @@ Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.6.8] - 2024-05-13
+
+* [PR-83](https://github.com/itk-dev/kunstdatabasen/pull/83)
+  Security updates.
+
 ## [1.6.7] - 2023-12-11
 
 * [PR-81](https://github.com/itk-dev/kunstdatabasen/pull/81)
@@ -69,7 +74,8 @@ Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [1.0.0] - yyyy-mm-dd
 
-[Unreleased]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.7...HEAD
+[Unreleased]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.8...HEAD
+[1.6.8]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.7...1.6.8
 [1.6.7]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.6...1.6.7
 [1.6.6]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.5...1.6.6
 [1.6.5]: https://github.com/itk-dev/kunstdatabasen/compare/1.6.4...1.6.5

composer.json

@@ -19,31 +19,31 @@
         "phpoffice/phpspreadsheet": "^1.29",
         "phpstan/phpdoc-parser": "^1.23",
         "stof/doctrine-extensions-bundle": "^1.8",
-        "symfony/console": "6.3.*",
-        "symfony/dotenv": "6.3.*",
+        "symfony/console": "6.4.*",
+        "symfony/dotenv": "6.4.*",
         "symfony/flex": "^2",
-        "symfony/form": "6.3.*",
-        "symfony/framework-bundle": "6.3.*",
-        "symfony/property-access": "6.3.*",
-        "symfony/property-info": "6.3.*",
-        "symfony/runtime": "6.3.*",
-        "symfony/security-bundle": "6.3.*",
-        "symfony/serializer": "6.3.*",
-        "symfony/twig-bundle": "6.3.*",
-        "symfony/validator": "6.3.*",
+        "symfony/form": "6.4.*",
+        "symfony/framework-bundle": "6.4.*",
+        "symfony/property-access": "6.4.*",
+        "symfony/property-info": "6.4.*",
+        "symfony/runtime": "6.4.*",
+        "symfony/security-bundle": "6.4.*",
+        "symfony/serializer": "6.4.*",
+        "symfony/twig-bundle": "6.4.*",
+        "symfony/validator": "6.4.*",
         "symfony/webpack-encore-bundle": "^2.1",
-        "symfony/yaml": "6.3.*",
+        "symfony/yaml": "6.4.*",
         "twig/extra-bundle": "^2.12|^3.0",
         "twig/twig": "^2.12|^3.0",
         "vich/uploader-bundle": "^2.1"
     },
     "require-dev": {
         "friendsofphp/php-cs-fixer": "^3.22",
-        "friendsoftwig/twigcs": "^6.2",
+        "friendsoftwig/twigcs": "^6.4",
         "hautelook/alice-bundle": "^2.12",
         "rector/rector": "^0.18.12",
         "symfony/maker-bundle": "^1.51",
-        "symfony/web-profiler-bundle": "6.3.*"
+        "symfony/web-profiler-bundle": "6.4.*"
     },
     "config": {
         "allow-plugins": {
@@ -113,7 +113,7 @@
     "extra": {
         "symfony": {
             "allow-contrib": true,
-            "require": "6.3.*"
+            "require": "6.4.*"
         }
     }
 }