muuucho's avatar
Level 11

composer warns about spatie/browsershot 4.0

When I run composer show --tree I see that it is spatie/laravel-pdf 1.5.2 that calls spatie/browsershot ^4.0. Composer suggests to upgrade browsershot to v5 to avoid the high severity vulnerability found in v4. However, my spatie/laravel-pdf 1.5.2 still does not pull in the v5, not even after a composer update. So, should I do anything (in such case what?), or can I just wait for an updated spatie/laravel-pdf that pulls in the v5 of Browsershot?

0 likes
2 replies
LaryAI's avatar
Level 58

To address the issue with spatie/browsershot being stuck at version 4.0 due to spatie/laravel-pdf requiring it, you have a couple of options:

  1. Wait for an Update: The simplest approach is to wait for the maintainers of spatie/laravel-pdf to release a new version that requires spatie/browsershot version 5.0 or higher. This is the safest option as it ensures compatibility and stability.

  2. Override the Dependency: If you need to address the vulnerability immediately and cannot wait for an update, you can override the dependency in your composer.json file. However, this approach should be used with caution as it might introduce compatibility issues.

    You can override the dependency by specifying the desired version in the composer.json file under the require section and using the replace or conflict key to manage the version constraint. Here's an example of how you might do this:

    {
        "require": {
            "spatie/laravel-pdf": "1.5.2",
            "spatie/browsershot": "^5.0"
        },
        "replace": {
            "spatie/browsershot": "^4.0"
        }
    }
    

    After making these changes, run composer update to apply them.

  3. Contact the Maintainers: If neither of the above solutions is feasible, consider reaching out to the maintainers of spatie/laravel-pdf to inquire about their plans for updating the dependency. They might provide a timeline or a workaround.

Remember to thoroughly test your application after making any changes to dependencies to ensure that everything works as expected.

muuucho's avatar
Level 11

I see now in https://github.com/spatie/laravel-pdf/blob/main/composer.json that it requires "spatie/browsershot": "^4.0|^5.0" So, hopefully there will be a new release soon.

Please or to participate in this conversation.