Changeset 59740 for trunk/.github/dependabot.yml

Timestamp:

01/30/2025 06:51:17 PM (3 months ago)

Author:

desrosj

Message:

Security: Introduce Grunt task for updating Root Certificates.

The Root Certificate bundle maintained by Mozilla ships in WordPress to allow SSL certificates to be verified on hosts with incomplete, outdated, or invalid local SSL configurations. To date, updates have only been merged into Core when problems arise using a highly manual process.

This introduces the certificates:upgrade Grunt task to automate the process of updating the included bundle with upstream changes using Composer to manage versioning.

The legacy 1024bit certificates included for backwards compatibility are now maintained in a separate file that is prepended to the built version of the bundle during the relevant Grunt tasks. Some expired certificates from this list have been removed:

• Cybertrust Global Root (expired 2021-12-15)
• Thawte Server CA (expired 2020-12-31)
• Thawte Premium Server CA (expired 2020-12-31)

The Dependabot configuration has also been updated to open pull requests when new releases occur upstream. Going forward, the recommendation is to create a task ticket for updating these certificates with each release when an update is published. See #62811 for an example of this.

Props johnbillion, desrosj, whyisjake, ayeshrajans, SergeyBiryukov, swissspidy, skithund, barry.
Fixes #62812. See #62811, 50828.

File:

• trunk/.github/dependabot.yml (modified) (1 diff)

trunk/.github/dependabot.yml

@@ -13 +13 @@
         patterns:
           - "*"
+
+  # Check for updates to Composer packages.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    ignore:
+      # These dependencies do not currently need to be managed with Dependabot.
+      - dependency-name: "squizlabs/php_codesniffer"
+      - dependency-name: "wp-coding-standards/wpcs"
+      - dependency-name: "phpcompatibility/php-compatibility"
+      - dependency-name: "yoast/phpunit-polyfills"
+    groups:
+      composer-packages:
+        patterns:
+          - "composer/ca-bundle"