Bump plank/laravel-mediable from 6.5.0 to 7.0.0

[dependabot]

Bumps plank/laravel-mediable from 6.5.0 to 7.0.0.

Release notes

Sourced from plank/laravel-mediable's releases.

7.0.0

What's Changed

This is a security release, upgrading is strongly recommended

• Added mediable.allowed_remote_hosts configuration which allows restricting remote URL source adapters to a whitelist. Wildcard subdomains may be specified with *.example.com syntax. By default, all hosts are allowed.
• If no mediable.allowed_remote_hosts allow list is provided, the RemoteUrlAdapter will reject private IP addresses and localhost by default, to prevent Server-Side Request Forgery (SSRF) attacks. [CVE-2026-49969]
• Added mediable.allowed_remote_schemes configuration which allows restricting remote URL source adapters to a whitelist of allowed URL schemes (e.g. http, https, ftp, etc.). By default, only https is allowed. When modifying this configuration, it may also be necessary to modify the source_adapters pattern matching.
• Directory validation will now strip . characters from path segments. This prevents attackers from using directory traversal patterns like ../ as well as preventing potential issues with certain filesystems where . characters in directory names may cause unexpected behaviour. [CVE-2026-49970]
• Added mediable.file_sanitizers configuration which allows specifying custom sanitizers for rewriting file contents to strip out security risks before they are uploaded. A sanitizer must implements the Plank\Mediable\Sanitizers\SanitizerInterface interface.
• Added SvgSanitizer which will strip executable javascript and other untrusted content from image/svg+xml files, which can result in stored XSS if rendered directly to a webpage. By default, this sanitizer is applied to all uploaded SVG files. It can be disabled by removing it from the mediable.sanitizers config array. [CVE-2026-49971]
• Added mediable.forbidden_file_extensions configuration and MediaUploader::setForbiddenExtensions() which allows specifying a blacklist of file extensions that are forbidden to be uploaded. Any file extension which is considered executable by your Apache or Nginx configuration should be included in this list. A number of common executable file extensions are included in this list by default to prevent remote code execution exploits.
• In addition, forbidden file extensions are now sanitized if they are nested within destination filenames (e.g. script.php.jpg becomes script-php.jpg). This prevents remote code execution from double extension bypass due to common Apache and Nginx misconfigurations
• Added mediable.forbidden_mime_types configuration and MediaUploader::setForbiddenMimeTypes() which allows specifying a blacklist of MIME types that are forbidden to be uploaded.
• MediaUploader::ON_DUPLICATE_* constants have been moved to an Plank\Mediable\Enum\OnDuplicateBehaviour enum.
• Added MediaUploaderConfiguration class. Most MediaUploader instance properties are moved to this class. The MediaUploader class now accepts this as a constructor argument instead of an array of configs.
• MediaUploader::beforeSave() now accepts a \Closure instead of a callable for better static analysis and type safety.

Full Changelog: plank/laravel-mediable@6.5.0...7.0.0

Changelog

Sourced from plank/laravel-mediable's changelog.

7.0.0

This is a security release, upgrading is strongly recommended

• Added mediable.allowed_remote_hosts configuration which allows restricting remote URL source adapters to a whitelist. Wildcard subdomains may be specified with *.example.com syntax. By default, all hosts are allowed.
• If no mediable.allowed_remote_hosts allow list is provided, the RemoteUrlAdapter will reject private IP addresses and localhost by default, to prevent Server-Side Request Forgery (SSRF) attacks. [CVE-2026-49969]
• Added mediable.allowed_remote_schemes configuration which allows restricting remote URL source adapters to a whitelist of allowed URL schemes (e.g. http, https, ftp, etc.). By default, only https is allowed. When modifying this configuration, it may also be necessary to modify the source_adapters pattern matching.
• Directory validation will now strip . characters from path segments. This prevents attackers from using directory traversal patterns like ../ as well as preventing potential issues with certain filesystems where . characters in directory names may cause unexpected behaviour. [CVE-2026-49970]
• Added mediable.file_sanitizers configuration which allows specifying custom sanitizers for rewriting file contents to strip out security risks before they are uploaded. A sanitizer must implements the Plank\Mediable\Sanitizers\SanitizerInterface interface.
• Added SvgSanitizer which will strip executable javascript and other untrusted content from image/svg+xml files, which can result in stored XSS if rendered directly to a webpage. By default, this sanitizer is applied to all uploaded SVG files. It can be disabled by removing it from the mediable.sanitizers config array. [CVE-2026-49971]
• Added mediable.forbidden_file_extensions configuration and MediaUploader::setForbiddenExtensions() which allows specifying a blacklist of file extensions that are forbidden to be uploaded. Any file extension which is considered executable by your Apache or Nginx configuration should be included in this list. A number of common executable file extensions are included in this list by default to prevent remote code execution exploits.
• In addition, forbidden file extensions are now sanitized if they are nested within destination filenames (e.g. script.php.jpg becomes script-php.jpg). This prevents remote code execution from double extension bypass due to common Apache and Nginx misconfigurations
• Added mediable.forbidden_mime_types configuration and MediaUploader::setForbiddenMimeTypes() which allows specifying a blacklist of MIME types that are forbidden to be uploaded.
• MediaUploader::ON_DUPLICATE_* constants have been moved to an Plank\Mediable\Enum\OnDuplicateBehaviour enum.
• Added MediaUploaderConfiguration class. Most MediaUploader instance properties are moved to this class. The MediaUploader class now accepts this as a constructor argument instead of an array of configs.
• MediaUploader::beforeSave() now accepts a \Closure instead of a callable for better static analysis and type safety.

6.1.0

• Attempt to automatically select an intervention/image driver based on the available extensions.
• Fix an error in package discovery if attempting to install both plank/laravel-mediable and intervention/image-laravel at the same time

6.0.5

• move ImageManipulator singleton to lazy instantiation

6.0.4

• Fix alt migration default value for the mysql dialect. Default value assigned from the Media model

6.0.3

• fix service provider database migration bindings by @​frasmage in #349

6.0.2

• Added intervention/image-laravel package to the composer suggests list
• Updated documentation with configuration instructions for intervention/image

6.0.1

• Fix readthedocs documentation build configuration

6.0.0

Compatibility

• Dropped support for PHP 7.4 and 8.0
• Dropped Support for Laravel 8 and 9
• Added Support for PHP 8.3
• Added Support for Laravel 11
• Added support for intervention/image 3.0
• Modernized the database migration files to use more recent Laravel conventions.

... (truncated)

Commits

• 5108415 Merge pull request #391 from plank/cve-mitigation
• 1f3b963 style fixes
• ebee6be add 7.x upgrade instructions
• faee68f misc fixes
• 0d5d12c Added MediaUploaderConfiguration class
• b9966e1 move on duplicate behaviour constants to enum
• 49e3583 CVE-2026-49972 Fix RCE via Double Extension Bypass in filename
• 25e3bb2 Add forbidden_file_extension and forbidden_mime_type configs
• 65046b2 CVE-2026-49971 Fix Stored XSS via Unsanitized SVG Upload
• 6d1e7fb CVE-2026-49970 Fix Path Traversal via Directory Separator Bypass in sanitizeP...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.