#vary

catch → closed merge request !11689

Committed/pushed to 10.5.x, thanks!

@smustgrave we can update dependencies in patch releases, but we don't tend to do it routinely. Partly because it would be endless work, partly because patch releases of dependencies have caused regressions multiple times in the past so it's better to find this out in a minor release.

RTBC as 10.5 looks good.

Know this is a bug but do we push version updates to releases?

Back to NR for !11689 (10.5.x) - I'm out of time to open other PR's, we've decided to patch this in as needed.

luke.leber → changed the visibility of the branch 3471642-upgrade-asm89stack-cors-to to hidden.

Committed/pushed to 11.x, thanks!

We definitely need to backport this to 10.5.x.

11.1 and 10.4 are possible, but this will need a backport MR for each branch.

Seems like a good upgrade

Add backport plea.

I couldn't actually find any instructions on how to upgrade composer dependencies in core issues, so I just took a wild guess. I'm guessing the automation will bark if it's way off-base.

Cleaned up the IS.

There is now a version of the upstream library that fixes this, so core should be adjusted to rely on that

https://github.com/asm89/stack-cors/releases/tag/v2.3.0