|
| 1 | +# Laravel |
| 2 | + |
| 3 | +Endless Lifecycle Support (ELS) for Laravel from TuxCare provides security fixes for Laravel framework versions that have reached their end-of-life. This allows you to continue running your Laravel applications without vulnerability concerns, even after official support has ended. |
| 4 | + |
| 5 | +## Supported Versions |
| 6 | + |
| 7 | +* **Laravel** 8, 10, 11 |
| 8 | + |
| 9 | +Other versions upon request. |
| 10 | + |
| 11 | +## Connection to ELS for PHP Libraries Repository |
| 12 | + |
| 13 | +This guide outlines the steps needed to integrate the TuxCare ELS for PHP Libraries repository into your Laravel application. The repository provides trusted PHP libraries that can be easily integrated into your **Composer** projects. |
| 14 | + |
| 15 | +### Step 1: Get user credentials |
| 16 | + |
| 17 | +You need a username and password in order to use TuxCare ELS for PHP Libraries repository. Anonymous access is disabled. To receive the credentials, please contact [[email protected]](mailto:[email protected]). |
| 18 | + |
| 19 | +### Step 2: Configure Composer authentication |
| 20 | + |
| 21 | +1. Create or edit the `auth.json` file for the user running Composer: |
| 22 | + |
| 23 | + * **Linux/macOS**: |
| 24 | + |
| 25 | + <CodeWithCopy> |
| 26 | + |
| 27 | + ```text |
| 28 | + ~/.composer/auth.json |
| 29 | + ``` |
| 30 | +
|
| 31 | + </CodeWithCopy> |
| 32 | +
|
| 33 | + * **Windows**: |
| 34 | +
|
| 35 | + <CodeWithCopy> |
| 36 | +
|
| 37 | + ```text |
| 38 | + %APPDATA%\Composer\auth.json |
| 39 | + ``` |
| 40 | +
|
| 41 | + </CodeWithCopy> |
| 42 | +
|
| 43 | +2. Use either the Composer CLI or edit `auth.json` directly add your credentials for `nexus.repo.tuxcare.com`. |
| 44 | +
|
| 45 | + <CodeTabs :tabs="[ |
| 46 | + { title: 'Composer CLI', content: `composer config --global --auth http-basic.nexus.repo.tuxcare.com USERNAME PASSWORD` }, |
| 47 | + { title: 'auth.json', content: authjson } |
| 48 | + ]" /> |
| 49 | +
|
| 50 | + Replace `USERNAME` and `PASSWORD` with the credentials you received in [Step 1](#step-1-get-user-credentials). |
| 51 | +
|
| 52 | +### Step 3: Register the TuxCare repository |
| 53 | +
|
| 54 | +Add the `els_php_custom1` Composer repository either via CLI or by editing `composer.json`: |
| 55 | +
|
| 56 | + <CodeTabs :tabs="[ |
| 57 | + { title: 'Composer CLI', content: cli }, |
| 58 | + { title: 'composer.json', content: composerjson } |
| 59 | + ]" /> |
| 60 | +
|
| 61 | +### Step 4: Install Laravel |
| 62 | +
|
| 63 | +Install the TuxCare-maintained Laravel release that matches your project: |
| 64 | +
|
| 65 | +<CodeTabs :tabs="[ |
| 66 | + { title: 'Composer CLI', content: `composer require laravel/framework:10.48.28-p1+tuxcare` }, |
| 67 | + { title: 'composer.json', content: laraveljson } |
| 68 | +]" /> |
| 69 | +
|
| 70 | +**Please check the exact version listed in your TuxCare Nexus account to ensure you receive the most recent patched release.** |
| 71 | +
|
| 72 | +If you edited `composer.json` manually, run `composer update` to install the package: |
| 73 | +
|
| 74 | +<CodeWithCopy> |
| 75 | +
|
| 76 | +```text |
| 77 | +composer update |
| 78 | +``` |
| 79 | + |
| 80 | +</CodeWithCopy> |
| 81 | + |
| 82 | +Composer will resolve dependencies against the TuxCare repository and install the patched releases. |
| 83 | + |
| 84 | +## Vulnerability Exploitability eXchange (VEX) |
| 85 | + |
| 86 | +VEX is a machine-readable format that tells you if a known vulnerability is actually exploitable in your product. It reduces false positives and helps prioritize real risks. |
| 87 | + |
| 88 | +TuxCare provides VEX for PHP Libraries ELS versions: [security.tuxcare.com/vex/cyclonedx/els_lang_php/](https://security.tuxcare.com/vex/cyclonedx/els_lang_php/). |
| 89 | + |
| 90 | +## How to Upgrade to a Newer Version |
| 91 | + |
| 92 | +If you have already installed a TuxCare Laravel package and want to upgrade to a newer release, update the version string in your `composer.json` file or run the `composer require` command with the new version: |
| 93 | + |
| 94 | +<CodeWithCopy> |
| 95 | + |
| 96 | +```text |
| 97 | +composer require laravel/framework:VERSION-pN+tuxcare |
| 98 | +``` |
| 99 | + |
| 100 | +</CodeWithCopy> |
| 101 | + |
| 102 | +Then run `composer update` to apply the changes: |
| 103 | + |
| 104 | +<CodeWithCopy> |
| 105 | + |
| 106 | +```text |
| 107 | +composer update |
| 108 | +``` |
| 109 | + |
| 110 | +</CodeWithCopy> |
| 111 | + |
| 112 | +## Resolved CVEs in Laravel |
| 113 | + |
| 114 | +Fixes for the following vulnerabilities are available in ELS for Laravel from TuxCare: |
| 115 | + |
| 116 | +| CVE ID | Severity | Vulnerable versions | Fixed in version | |
| 117 | +|----------------|----------|----------------------|---------------------| |
| 118 | +| CVE-2025-27515 | Medium | >= 11.0.0, < 11.44.1 | 11.44.0-p1+tuxcare | |
| 119 | +| CVE-2025-27515 | Medium | < 10.48.29 | 10.48.28-p1+tuxcare | |
| 120 | +| CVE-2025-27515 | Medium | <= 8.83.29 | 8.83.29-p1+tuxcare | |
| 121 | + |
| 122 | +If you are interested in the TuxCare Endless Lifecycle Support, contact [[email protected]](mailto:[email protected]). |
| 123 | + |
| 124 | +<script setup> |
| 125 | + |
| 126 | +const authjson = |
| 127 | +`{ |
| 128 | + "http-basic": { |
| 129 | + "nexus.repo.tuxcare.com": { |
| 130 | + "username": "USERNAME", |
| 131 | + "password": "PASSWORD" |
| 132 | + } |
| 133 | + } |
| 134 | +}` |
| 135 | + |
| 136 | +const composerjson = |
| 137 | +`{ |
| 138 | + "repositories": [ |
| 139 | + { |
| 140 | + "type": "composer", |
| 141 | + "url": "https://nexus.repo.tuxcare.com/repository/els_php_custom1/", |
| 142 | + "options": { |
| 143 | + "http": { |
| 144 | + "verify": true |
| 145 | + } |
| 146 | + } |
| 147 | + } |
| 148 | + ] |
| 149 | +}` |
| 150 | + |
| 151 | +const cli = |
| 152 | +`composer config repositories.tuxcare '{"type":"composer","url":"https://nexus.repo.tuxcare.com/repository/els_php_custom1/","options":{"http":{"verify":true}}}' --json` |
| 153 | + |
| 154 | +const laraveljson = |
| 155 | +`{ |
| 156 | + "require": { |
| 157 | + "laravel/framework": "10.48.28-p1+tuxcare" |
| 158 | + } |
| 159 | +}` |
| 160 | + |
| 161 | +</script> |
0 commit comments