Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters (including or comment text). Applications depending on strict environment values may expose logic errors, insecure defaults, or failed authentication. Patches Fixed in v1.0.11. Users should upgrade to the latest patched version. Workarounds As a temporary workaround, avoid using inline comments in .env files, or sanitize loaded values manually.
Recommended action: Upgrade to 1.0.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently ignores missing configuration, potentially causing insecure defaults or deployment misconfigurations. Affected versions: - 1.0.1 → 1.0.2 - 1.0.9 → 1.0.10 Patches The issue has been fixed in version 1.0.11. All users should upgrade to 1.0.11 or later. Workarounds As a workaround, users can manually verify the existence of the .env file before initializing TinyEnv, for example: php if (!fileexists(DIR . '/.env')) { throw new RuntimeException('.env file is missing!'); }
Recommended action: Upgrade to 1.0.11 or 1.0.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.