I have CiviCRM 5.63.1 installed with the latest Drupal 9 (9.5.10) - when running composer update I get a message about a vulnerability with firebase/php-jwt with versions less than 6. Looking in the composer.lock file in the root of my site, civicrm/civicrm-core is expecting a version less than 6. I have tried altering the composer.json file in the vendor/civicrm/civicrm-core location to bring in version 6 but each time this lock file reverts to downloading v5.5.1 instead. How can I get version 6 installed so the vulnerability alert will disappear?

Extract of the composer.lock file below (see last line).

        "name": "civicrm/civicrm-core",
        "version": "5.63.1",
        "source": {
            "type": "git",
            "url": "https://github.com/civicrm/civicrm-core.git",
            "reference": "27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58"
        "dist": {
            "type": "zip",
            "url": "https://api.github.com/repos/civicrm/civicrm-core/zipball/27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58",
            "reference": "27dd9bcab5d0ece3f73e0c6d2a1c7d3966d03c58",
            "shasum": ""
        "require": {
            "adrienrn/php-mimetyper": "0.2.2",
            "brick/money": "~0.5",
            "civicrm/civicrm-cxn-rpc": "~ || ~",
            "civicrm/composer-compile-lib": "~0.6 || ~1.0",
            "civicrm/composer-downloads-plugin": "^3.0",
            "composer-runtime-api": "~2.0",
            "cweagans/composer-patches": "~1.0",
            "dompdf/dompdf": "~2.0.2",
            "ext-fileinfo": "*",
            "ext-intl": "*",
            "ext-json": "*",
            "ezyang/htmlpurifier": "^4.13",
            "firebase/php-jwt": ">=3 <6",

Many thanks for your help in advance.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.