{
    "name": "ruler/ruler",
    "description": "A simple stateless production rules engine for PHP 5.3.",
    "keywords": ["rules", "engine"],
    "homepage": "https://github.com/bobthecow/Ruler",
    "license": "MIT",
    "require": {
        "php": ">=5.3.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^4.8 | ^5.5 | ^6.5"
    },
    "autoload": {
        "psr-4": {
            "Ruler\\": "src/Ruler"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Ruler\\Test\\": "tests/Ruler/Test"
        }
    },
    "authors": [
        {
            "name": "Justin Hileman",
            "email": "justin@justinhileman.info",
            "homepage": "http://justinhileman.com/"
        }
    ]
}

{
    "name": "ruler/ruler",
    "description": "A simple stateless production rules engine for PHP 5.3.",
    "keywords": ["rules", "engine"],
    "homepage": "https://github.com/bobthecow/Ruler",
    "license": "MIT",
    "require": {
        "php": ">=5.3.0"
    },
    "require-dev": {
        "phpunit/phpunit": "4.8.35 | ^5.6.3 | ^6.5"
    },
    "autoload": {
        "psr-4": {
            "Ruler\\": "src/Ruler"
        }
    },
    "autoload-dev": {
        "psr-4": {
            "Ruler\\Test\\": "tests/Ruler/Test"
        }
    },
    "authors": [
        {
            "name": "Justin Hileman",
            "email": "justin@justinhileman.info",
            "homepage": "http://justinhileman.com/"
        }
    ]
}

Install patcheds version of PHPUnit
Install patcheds version of PHPUnit

Enforce the use of secure phpunit versions. According to github security alert:

| Package         | Affected versions | Patched version |
|-----------------|-------------------|-----------------|
| phpunit/phpunit | >= 5.0.0, < 5.6.3 | 5.6.3           |

Description:

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a <?php substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.

Weaknesses: CWE-94
CVE ID: CVE-2017-9841
GHSA ID: GHSA-r7c9-c69m-rph8
