[AdilAzhariOmsan]

This updates dependencies to clear the five advisories that composer audit reports. The CI audit step was failing on main, so pint, phpstan and the tests never ran. This is a targeted dependency security update, not a comprehensive security audit of the application.

Summary

The change is lock-only, made with:

composer update laravel/framework league/commonmark symfony/http-foundation symfony/mime \
  --with-dependencies --minimal-changes

 composer.lock
-laravel/framework          v13.29.0
+laravel/framework          v13.39.0
-laravel/prompts            v0.3.24     (pulled in by laravel/framework)
+laravel/prompts            v0.3.26
-league/commonmark          2.10.0
+league/commonmark          2.10.7
-symfony/http-foundation    v8.1.6
+symfony/http-foundation    v8.1.10
-symfony/mime               v8.1.6
+symfony/mime               v8.1.10

Advisory	Severity	Package	Issue	Fixed in
CVE-2026-108082 (GHSA-r925-mgvr-h9cc)	High	symfony/http-foundation	ReDoS in HeaderUtils::split() via the Cache-Control request header	8.1.7
GHSA-3q6v-r5mr-hxv8	High	league/commonmark	Quadratic-time DoS in the GFM Table extension	2.10.2
GHSA-97jj-33gv-5xf9	Medium	league/commonmark	DisallowedRawHtml bypass	2.10.2
CVE-2026-45070 (GHSA-vqc8-7275-q272)	Medium	symfony/mime	Email header injection via MIME parameter names	8.1.10
CVE-2026-102279 (GHSA-jh5r-qr3c-85q8)	Low	laravel/framework	XSS on the debug exception page	13.30.0

Why it was needed: main's lock file was flagged by advisories published after its last green run on 2026-09-23. CI's composer audit step fails before any later step runs.

• laravel/framework is a direct dependency.
• The other three packages are transitive, through the framework.

Scope:

• composer.json is unchanged. The only changed file is composer.lock: 42 lines added, 39 removed.
• The lock's content-hash is unchanged.
• There are 130 packages before and after.
• Every new version stays inside its existing constraint and its current minor or patch line.
• No assets were published, and no other files changed.

Evidence

Before (CI on main): composer audit reports Found 5 security vulnerability advisories affecting 4 packages and exits 1.

After: run locally on PHP 8.5.8 / Composer 2.10.2, in CI order, with APP_CONFIG_CACHE pointed at a path that doesn't exist:

#	Check	Exit	Result
1	composer validate --strict	0	./composer.json is valid
2	composer audit	0	No security vulnerability advisories found.
3	vendor/bin/pint --test	0	passed
4	vendor/bin/phpstan analyse --no-progress	0	passed, 0 errors
5	php artisan test	0	6 passed, 6 assertions
6	php artisan about	0	Laravel 13.39.0, PHP 8.5.8

For the boot check I ran php artisan serve:

• GET / returned 200.
• GET /up (the health route) returned 200.
• Nothing was written to the Laravel log.

Limitation: the existing suite has only 6 tests, and they run on SQLite in memory. A green run shows that the app boots, the wiring works and the architecture rules hold. It does not show framework behaviour across 13.30 → 13.39, which is mostly bug fixes, with no breaking changes listed in the release notes.

Merge Danger

Door: two-way

Reverting this commit restores the previous lock file. No data or schema changes are involved.

Blast Radius: framework

The framework moves 10 minor releases within Laravel 13. Symfony and commonmark get patch releases only. The app currently has 3 PHP files and does not use Markdown, Mail or custom header parsing, so the practical surface is boot and routing, and both are verified above.