LoginSign Up
← Back to all sparks
S

SimpleSAMLphp

DEVOPS
Velocity0.0

SAML identity and service provider implementation in PHP

simplesamlphp.org ↗

Two maintained branches, and most of the shipping cadence is CVE response.

samlauthenticationidentitysecurity-patchesphpdual-branch
◆Current state
SimpleSAMLphp is running 2.4.x and 2.5.x in parallel, patching both from the same fix sets. Of the eight most recent releases, four are security releases and the rest are unlabelled bugfix drops. Release notes carry no feature detail at all — each is a short boilerplate paragraph plus SHA-256 checksums for the slim and full tarballs, with the actual content deferred to a separate changelog and upgrade notes.
◆Where it's heading
This is maintenance-mode infrastructure, and the release rhythm is set by vulnerability disclosure rather than a roadmap. The dual-branch discipline — shipping 2.4.6 and 2.5.1 within a minute of each other for the same three advisories — indicates a deployed base that cannot all move to the newer minor. The vulnerability classes are notable in themselves: HTTP-Artifact resolution and SP-Proxy deployments bridging identity providers of different trust levels.
◆Prediction
Expect the 2.4 and 2.5 branches to keep receiving paired patches, with 2.4 continuing until an announced end-of-life. The entries give no indication of what is planned beyond the 2.5 line.

◆Recent moves

  1. 1mo ago

    SimpleSAMLphp v2.4.8

    A bugfix release on the 2.4 maintenance branch. The notes carry no detail beyond checksums, continuing the project's practice of deferring all substance to the external changelog.

    View source ↗
  2. 2mo ago

    SimpleSAMLphp v2.5.2

    A bugfix release on the 2.5 branch, shipped a day after the equivalent 2.4 drop. The paired cadence across both branches is the consistent pattern in this feed.

    View source ↗
  3. 2mo ago

    SimpleSAMLphp v2.4.7

    Routine bugfix release on the 2.4 branch with no disclosed content. One of several unlabelled patches between the larger security drops.

    View source ↗
  4. 2mo ago

    Three advisories patched in HTTP-Artifact and SP-Proxy paths

    A security release covering three advisories affecting HTTP-Artifact resolution and SP-Proxy deployments that federate identity providers of differing trust levels. Shipped simultaneously with the 2.5.1 twin, it is the clearest example of the project's dual-branch patch discipline.

    View source ↗
  5. 2mo ago

    Same three advisories patched on the 2.5 branch

    The 2.5-branch counterpart to 2.4.6, carrying the identical three advisories and released within a minute of it. It contains no fixes beyond its twin.

    View source ↗
  6. 4mo ago

    SimpleSAMLphp 2.5.0

    The 2.5.0 stable minor that opened the current dual-branch arrangement. The release notes disclose nothing about what the minor version contains, so its significance has to be inferred from the fact that 2.4 continued receiving patches alongside it.

    View source ↗