From b7767bc921fbcdca55cdbe0777ebe78c423b9469 Mon Sep 17 00:00:00 2001 From: Jared Hendrickson Date: Mon, 8 Jun 2026 21:52:09 -0600 Subject: [PATCH 1/7] fix(WireGuardTunnel): adjust 'addresses' validation pre-condition timing #902 The previous fix did not address the outer nested model field validation, only the inner validation which rendered the fix unusable for many use cases. This commits introduces a new injection point to update() that allows us to apply pre-conditions before model validation, thefor allow us to negate addresses before validation if an iface assignment exists. --- .../usr/local/pkg/RESTAPI/Core/Model.inc | 10 ++++ .../pkg/RESTAPI/Models/WireGuardTunnel.inc | 24 ++++----- .../APIModelsWireGuardTunnelTestCase.inc | 54 +++++++++++++++++++ 3 files changed, 76 insertions(+), 12 deletions(-) diff --git a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc index 320ca623..7a1d8e69 100644 --- a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc +++ b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc @@ -1829,6 +1829,13 @@ class Model { $this->apply(); } + /** + * Initializes the 'pre_validate_update()' method. This method is intended to be overridden by a child model class + * and is called immediately before validating update actions. This is useful for conditions that need to be + * considered before validation occurs, such as scrubbing certain fields. + */ + protected function pre_validate_update(): void {} + /** * Initializes the default 'pre_apply_update' method. This method is intended to be overridden by a child model class and * is called immediately before the 'apply' method for update actions only. This method runs regardless of whether @@ -2352,6 +2359,9 @@ class Model { $this->remove_array_changes(); } + # Run the pre-validate method to allow for any adjustments to the object before validation occurs + $this->pre_validate_update(); + # Ensure all object Fields and validations succeed for proceeding. if ($this->validate(requires_id: true)) { # When dry_run is enabled, skip the actual write/apply phase but still report the would-be result diff --git a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/WireGuardTunnel.inc b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/WireGuardTunnel.inc index 63a3b53b..76d67700 100644 --- a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/WireGuardTunnel.inc +++ b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/WireGuardTunnel.inc @@ -145,18 +145,6 @@ class WireGuardTunnel extends Model { return wg_is_key_clamped($privatekey) ? $privatekey : wg_clamp_key($privatekey); } - /** - * Extends the default _update method to ensure addresses are removed if the tunnel has an interface assignment - */ - public function _update(): void { - # Remove any existing addresses if this tunnel has an existing interface assignment - if (NetworkInterface::query(if: $this->name->value)->exists()) { - $this->addresses->value = []; - } - - parent::_update(); - } - /** * Obtains the next available WireGuard tunnel interface name. * @return string The next available WireGuard tunnel interface name (i.e. tun_wg0) @@ -165,6 +153,18 @@ class WireGuardTunnel extends Model { return next_wg_if(); } + /** + * Adds pre-validation logic to scrub addresses from this WireGuardTunnel if it has an existing interface + * assignment. + */ + protected function pre_validate_update(): void { + # If this tunnel is assigned to an existing pfSense interface, scrub any addresses from the `addresses` field + # since the addresses for this tunnel will be derived from the assigned interface's configured IPs instead. + if (NetworkInterface::query(if: $this->name->value)->exists()) { + $this->addresses->value = []; + } + } + /** * Serializes changes to this tunnel before applying. */ diff --git a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Tests/APIModelsWireGuardTunnelTestCase.inc b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Tests/APIModelsWireGuardTunnelTestCase.inc index 3a2f5cb4..2d6ab873 100644 --- a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Tests/APIModelsWireGuardTunnelTestCase.inc +++ b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Tests/APIModelsWireGuardTunnelTestCase.inc @@ -116,6 +116,60 @@ class APIModelsWireGuardTunnelTestCase extends TestCase { $tun_wg0->delete(apply: true); } + /** + * Checks that the `addresses` field is removed before an update when the tunnel has an existing interface + * assignment, since addresses are derived from the assigned interface's configured IPs instead. + */ + public function test_addresses_removed_before_update_when_interface_is_assigned(): void { + # Create a WireGuardTunnel to test with + $tunnel = new WireGuardTunnel(privatekey: 'KG0BA4UyPilHH5qnXCfr6Lw8ynecOPor88tljLy3AHk=', async: false); + $tunnel->create(apply: true); + + # Assign a NetworkInterface for this tunnel + $if = new NetworkInterface( + if: $tunnel->name->value, + descr: 'WGTEST', + enable: true, + typev4: 'none', + typev6: 'none', + async: false, + ); + $if->create(); + + # Update the tunnel with addresses while it has an interface assignment + # pre_validate_update() should scrub the addresses before validation runs + $tunnel->from_representation(addresses: [['address' => '172.20.99.1', 'mask' => 30]]); + $tunnel->update(apply: false); + + # Ensure the addresses were removed before the update was processed + $this->assert_is_empty($tunnel->addresses->value); + + # Delete the interface and the tunnel + $if->delete(apply: true); + $tunnel->delete(apply: true); + } + + /** + * Checks that the `addresses` field is left intact before an update when the tunnel has no existing + * interface assignment. + */ + public function test_addresses_retained_on_update_when_no_interface_assigned(): void { + # Create a WireGuardTunnel to test with + $tunnel = new WireGuardTunnel(privatekey: 'KG0BA4UyPilHH5qnXCfr6Lw8ynecOPor88tljLy3AHk=', async: false); + $tunnel->create(apply: true); + + # Update the tunnel with addresses without an interface assignment + # pre_validate_update() should leave the addresses intact + $tunnel->from_representation(addresses: [['address' => '172.20.99.1', 'mask' => 30]]); + $tunnel->update(apply: true); + + # Ensure the addresses were retained during the update + $this->assert_is_not_empty($tunnel->addresses->value); + + # Delete the tunnel + $tunnel->delete(apply: true); + } + /** * Checks that the tunnel is properly configured on the backend after creating, updating and deleting */ From fbb44e8e0089b6e89dd61491fba910d7338924dd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 04:07:56 +0000 Subject: [PATCH 2/7] chore: bump the github-actions group with 4 updates Bumps the github-actions group with 4 updates: [actions/checkout](https://github.com/actions/checkout), [shivammathur/setup-php](https://github.com/shivammathur/setup-php), [actions/setup-python](https://github.com/actions/setup-python) and [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `actions/checkout` from 6.0.2 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `shivammathur/setup-php` from 2.37.1 to 2.37.2 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](https://github.com/shivammathur/setup-php/compare/7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc...f3e473d116dcccaddc5834248c87452386958240) Updates `actions/setup-python` from 6.2.0 to 6.3.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...ece7cb06caefa5fff74198d8649806c4678c61a1) Updates `softprops/action-gh-release` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: shivammathur/setup-php dependency-version: 2.37.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: actions/setup-python dependency-version: 6.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: softprops/action-gh-release dependency-version: 3.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/build.yml | 8 ++++---- .github/workflows/quality.yml | 14 +++++++------- .github/workflows/release.yml | 12 ++++++------ 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0ba335f3..7fe6bb7a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -27,7 +27,7 @@ jobs: FREEBSD_ID: freebsd16 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup FreeBSD build VM run: | /usr/local/bin/VBoxManage controlvm ${{ matrix.FREEBSD_VERSION }} poweroff || true @@ -62,7 +62,7 @@ jobs: - PFSENSE_VERSION: pfSense-2.8.1-RELEASE FREEBSD_ID: freebsd15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: pfSense-pkg-RESTAPI-${{ env.BUILD_VERSION }}-${{ matrix.FREEBSD_ID }}.pkg @@ -112,7 +112,7 @@ jobs: - PFSENSE_VERSION: pfSense-2.8.1-RELEASE FREEBSD_ID: freebsd15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: openapi-${{ matrix.PFSENSE_VERSION }}.json @@ -142,7 +142,7 @@ jobs: FREEBSD_ID: freebsd15 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index f0a19bab..a899f781 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -5,7 +5,7 @@ jobs: check_prettier: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 26 @@ -17,7 +17,7 @@ jobs: check_black: runs-on: ubuntu-latest steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: psf/black@87928e6d6761a4a6d22250e1fee5601b3998086e # 26.5.1 lint_php: @@ -27,9 +27,9 @@ jobs: matrix: PHP_VERSION: ["8.2"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: "Setup PHP ${{ matrix.PHP_VERSION }}" - uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2 with: php-version: "${{ matrix.PHP_VERSION }}" coverage: "none" @@ -46,9 +46,9 @@ jobs: matrix: PYTHON_VERSION: ["3.10", "3.11"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Set up Python ${{ matrix.PYTHON_VERSION }} - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ matrix.PYTHON_VERSION }} - name: Install dependencies @@ -62,7 +62,7 @@ jobs: runs-on: ubuntu-latest needs: ["lint_php"] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Check phpdoc build run: | wget https://phpdoc.org/phpDocumentor.phar -O phpdoc diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 19098db9..cead9bc6 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,7 +36,7 @@ jobs: PFSENSE_VERSION: "26.03.1" steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup FreeBSD build VM run: | @@ -62,7 +62,7 @@ jobs: path: pfSense-${{ matrix.PFSENSE_VERSION }}-pkg-RESTAPI.pkg - name: Release - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 with: files: pfSense-${{ matrix.PFSENSE_VERSION }}-pkg-RESTAPI.pkg @@ -70,7 +70,7 @@ jobs: runs-on: self-hosted needs: [release_pkg] steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: @@ -127,7 +127,7 @@ jobs: path: schema.graphql - name: Release schemas - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0 + uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1 with: files: | native.json @@ -164,7 +164,7 @@ jobs: name: github-pages url: ${{ steps.deployment.outputs.page_url }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Setup Pages uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 @@ -173,7 +173,7 @@ jobs: run: mkdir ./www - name: Setup python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 with: python-version: ${{ env.PYTHON_VERSION }} From 30852e3f55cf4cd9c205332f16d2d200465200be Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Jul 2026 08:56:40 -0600 Subject: [PATCH 3/7] chore: bump the npm group with 2 updates (#913) --- package-lock.json | 25 +++++++++++++++++-------- package.json | 4 ++-- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2b7ac456..a75e7c3b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6,8 +6,8 @@ "": { "devDependencies": { "@prettier/plugin-php": "^0.25.0", - "@stoplight/spectral-cli": "^6.16.0", - "prettier": "^3.8.3" + "@stoplight/spectral-cli": "^6.16.1", + "prettier": "^3.9.4" } }, "node_modules/@asyncapi/specs": { @@ -149,6 +149,14 @@ "integrity": "sha512-1fMXF3YP4pZZVozF8j/ZLfvnR8NSIljt56UhbZ5PeeDmmGHpgpdwQt7ITlGvYaQukCvuBRMLEiKiYC+oeIg4cg==", "dev": true }, + "node_modules/@scarf/scarf": { + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/@scarf/scarf/-/scarf-1.4.0.tgz", + "integrity": "sha512-xxeapPiUXdZAE3che6f3xogoJPeZgig6omHEy1rIY5WVsB3H2BHNnZH+gHG6x91SCWyQCzWGsuL2Hh3ClO5/qQ==", + "dev": true, + "hasInstallScript": true, + "license": "Apache-2.0" + }, "node_modules/@stoplight/better-ajv-errors": { "version": "1.0.3", "resolved": "https://registry.npmjs.org/@stoplight/better-ajv-errors/-/better-ajv-errors-1.0.3.tgz", @@ -241,12 +249,13 @@ } }, "node_modules/@stoplight/spectral-cli": { - "version": "6.16.0", - "resolved": "https://registry.npmjs.org/@stoplight/spectral-cli/-/spectral-cli-6.16.0.tgz", - "integrity": "sha512-P1acHIV/hDiO3w0YNUc3pD7/0q68SMAMyWVxAPUGzsAeq50lLpl0obN5j3QITMgJPhPByvBIjBV4ftkBd8nwMg==", + "version": "6.16.1", + "resolved": "https://registry.npmjs.org/@stoplight/spectral-cli/-/spectral-cli-6.16.1.tgz", + "integrity": "sha512-6DdYx94d+BNVTdgJRkb1KJIcqYQsOxstAZtH7Kh63SDUsXFRkdfsBKsL7l6csxLRYYh5Qm6CSBF7AUFYBFJ23w==", "dev": true, "license": "Apache-2.0", "dependencies": { + "@scarf/scarf": "^1.4.0", "@stoplight/json": "~3.21.0", "@stoplight/path": "1.3.2", "@stoplight/spectral-core": "^1.19.5", @@ -2188,9 +2197,9 @@ } }, "node_modules/prettier": { - "version": "3.8.3", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.3.tgz", - "integrity": "sha512-7igPTM53cGHMW8xWuVTydi2KO233VFiTNyF5hLJqpilHfmn8C8gPf+PS7dUT64YcXFbiMGZxS9pCSxL/Dxm/Jw==", + "version": "3.9.4", + "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz", + "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==", "dev": true, "license": "MIT", "bin": { diff --git a/package.json b/package.json index 8eb7545f..514d0bf0 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "devDependencies": { - "prettier": "^3.8.3", + "prettier": "^3.9.4", "@prettier/plugin-php": "^0.25.0", - "@stoplight/spectral-cli": "^6.16.0" + "@stoplight/spectral-cli": "^6.16.1" } } From 85c0fb9d4882d329961c11ab5157b04e50cd5259 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Jul 2026 04:04:24 +0000 Subject: [PATCH 4/7] chore: update pylint requirement in the pip group Updates the requirements on [pylint](https://github.com/pylint-dev/pylint) to permit the latest version. Updates `pylint` to 4.0.6 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](https://github.com/pylint-dev/pylint/compare/v4.0.5...v4.0.6) --- updated-dependencies: - dependency-name: pylint dependency-version: 4.0.6 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 96ee0a89..5977e85d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,4 +1,4 @@ jinja2~=3.1.6 -pylint~=4.0.5 +pylint~=4.0.6 black~=26.5.1 mkdocs~=1.6.1 From c9904b76d9e9b350e9d907c0df31bca03119e63b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 12 Jul 2026 14:48:31 -0600 Subject: [PATCH 5/7] chore: bump the composer group with 2 updates (#911) Bumps the composer group with 2 updates: [firebase/php-jwt](https://github.com/googleapis/php-jwt) and [webonyx/graphql-php](https://github.com/webonyx/graphql-php). Updates `firebase/php-jwt` from 7.0.5 to 7.1.0 - [Release notes](https://github.com/googleapis/php-jwt/releases) - [Changelog](https://github.com/googleapis/php-jwt/blob/main/CHANGELOG.md) - [Commits](https://github.com/googleapis/php-jwt/compare/v7.0.5...v7.1.0) Updates `webonyx/graphql-php` from 15.32.3 to 15.33.1 - [Release notes](https://github.com/webonyx/graphql-php/releases) - [Changelog](https://github.com/webonyx/graphql-php/blob/master/CHANGELOG.md) - [Commits](https://github.com/webonyx/graphql-php/compare/v15.32.3...v15.33.1) --- updated-dependencies: - dependency-name: firebase/php-jwt dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: composer - dependency-name: webonyx/graphql-php dependency-version: 15.33.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: composer ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- composer.json | 2 +- composer.lock | 38 ++++++++++++++++++++------------------ 2 files changed, 21 insertions(+), 19 deletions(-) diff --git a/composer.json b/composer.json index 5d620843..78239343 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { "require": { - "firebase/php-jwt": "v7.0.*", + "firebase/php-jwt": "v7.1.*", "webonyx/graphql-php": "^15.13" } } diff --git a/composer.lock b/composer.lock index 322cb115..01084168 100644 --- a/composer.lock +++ b/composer.lock @@ -4,20 +4,20 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "c5ee15cb98a3d7b53a5298a4a0692672", + "content-hash": "7f768d738be2a05be74983a3d6e3461a", "packages": [ { "name": "firebase/php-jwt", - "version": "v7.0.5", + "version": "v7.1.0", "source": { "type": "git", "url": "https://github.com/googleapis/php-jwt.git", - "reference": "47ad26bab5e7c70ae8a6f08ed25ff83631121380" + "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/47ad26bab5e7c70ae8a6f08ed25ff83631121380", - "reference": "47ad26bab5e7c70ae8a6f08ed25ff83631121380", + "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/b374a5d1a4f1f67fadc2165cdb284645945e2fc0", + "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0", "shasum": "" }, "require": { @@ -26,6 +26,7 @@ "require-dev": { "guzzlehttp/guzzle": "^7.4", "phpfastcache/phpfastcache": "^9.2", + "phpseclib/phpseclib": "~3.0", "phpspec/prophecy-phpunit": "^2.0", "phpunit/phpunit": "^9.5", "psr/cache": "^2.0||^3.0", @@ -34,7 +35,8 @@ }, "suggest": { "ext-sodium": "Support EdDSA (Ed25519) signatures", - "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present" + "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present", + "phpseclib/phpseclib": "Support PS256 (RSASSA-PSS) signatures" }, "type": "library", "autoload": { @@ -59,29 +61,29 @@ } ], "description": "A simple library to encode and decode JSON Web Tokens (JWT) in PHP. Should conform to the current spec.", - "homepage": "https://github.com/firebase/php-jwt", + "homepage": "https://github.com/googleapis/php-jwt", "keywords": [ "jwt", "php" ], "support": { "issues": "https://github.com/googleapis/php-jwt/issues", - "source": "https://github.com/googleapis/php-jwt/tree/v7.0.5" + "source": "https://github.com/googleapis/php-jwt/tree/v7.1.0" }, - "time": "2026-04-01T20:38:03+00:00" + "time": "2026-06-11T17:54:14+00:00" }, { "name": "webonyx/graphql-php", - "version": "v15.32.3", + "version": "v15.33.1", "source": { "type": "git", "url": "https://github.com/webonyx/graphql-php.git", - "reference": "993bf0bea17f870412ad8a90f60c41cb8d5f1145" + "reference": "e0f40ce40a527ee27413cceced4825aacbc7de5b" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/webonyx/graphql-php/zipball/993bf0bea17f870412ad8a90f60c41cb8d5f1145", - "reference": "993bf0bea17f870412ad8a90f60c41cb8d5f1145", + "url": "https://api.github.com/repos/webonyx/graphql-php/zipball/e0f40ce40a527ee27413cceced4825aacbc7de5b", + "reference": "e0f40ce40a527ee27413cceced4825aacbc7de5b", "shasum": "" }, "require": { @@ -94,14 +96,14 @@ "amphp/http-server": "^2.1 || ^3", "dms/phpunit-arraysubset-asserts": "dev-master", "ergebnis/composer-normalize": "^2.28", - "friendsofphp/php-cs-fixer": "3.95.1", + "friendsofphp/php-cs-fixer": "3.95.8", "mll-lab/php-cs-fixer-config": "5.13.0", "nyholm/psr7": "^1.5", "phpbench/phpbench": "^1.2", "phpstan/extension-installer": "^1.1", - "phpstan/phpstan": "2.1.51", + "phpstan/phpstan": "2.2.2", "phpstan/phpstan-phpunit": "2.0.16", - "phpstan/phpstan-strict-rules": "2.0.10", + "phpstan/phpstan-strict-rules": "2.0.11", "phpunit/phpunit": "^9.5 || ^10.5.21 || ^11", "psr/http-message": "^1 || ^2", "react/http": "^1.6", @@ -136,7 +138,7 @@ ], "support": { "issues": "https://github.com/webonyx/graphql-php/issues", - "source": "https://github.com/webonyx/graphql-php/tree/v15.32.3" + "source": "https://github.com/webonyx/graphql-php/tree/v15.33.1" }, "funding": [ { @@ -148,7 +150,7 @@ "type": "open_collective" } ], - "time": "2026-04-24T13:49:35+00:00" + "time": "2026-06-17T06:05:59+00:00" } ], "packages-dev": [], From c7c8eac0e635b5fdc697d252856fffb0692fa823 Mon Sep 17 00:00:00 2001 From: Jared Hendrickson Date: Sun, 12 Jul 2026 14:53:12 -0600 Subject: [PATCH 6/7] fix(FreeRADIUSUser): increase maximum length for motp_pin to 8 #915 --- .../files/usr/local/pkg/RESTAPI/Models/FreeRADIUSUser.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FreeRADIUSUser.inc b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FreeRADIUSUser.inc index 1efd59e7..6b91606f 100644 --- a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FreeRADIUSUser.inc +++ b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Models/FreeRADIUSUser.inc @@ -94,7 +94,7 @@ class FreeRADIUSUser extends Model { allow_null: false, sensitive: true, minimum_length: 4, - maximum_length: 4, + maximum_length: 8, verbose_name: 'MOTP PIN', internal_name: 'varusersmotppin', conditions: ['motp_enable' => true], From ff4e44abf2062d25014edd8c62fffcb1046acefd Mon Sep 17 00:00:00 2001 From: Jared Hendrickson Date: Sun, 12 Jul 2026 15:00:47 -0600 Subject: [PATCH 7/7] fix(Model): ensure model cache is updated intermittently during replace_all --- .../files/usr/local/pkg/RESTAPI/Core/Model.inc | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc index 7a1d8e69..80be5bda 100644 --- a/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc +++ b/pfSense-pkg-RESTAPI/files/usr/local/pkg/RESTAPI/Core/Model.inc @@ -2463,6 +2463,10 @@ class Model { $model_object->id = count($new_objects->model_objects); $model_object->validate(modelset: $new_objects); $new_objects->model_objects[] = $model_object; + + # In the event that the model can reference itself (e.g. FirewallAlias), ensure the model cache is + # updated so ForeignModelField can accurately find referenced objects. + self::get_model_cache()::cache_modelset($new_objects); } self::clear_model_cache();