[AdilAzhariOmsan]

Lock-only security update for six Symfony advisories published on 2026-11-04. Until it merges, the next CI run on main (or any PR) fails at composer audit, and Pint, PHPStan and Pest never run. This is a targeted dependency update, not a security audit of the application.

Summary

composer update symfony/http-foundation symfony/http-kernel symfony/routing

-symfony/http-foundation  v8.1.10
+symfony/http-foundation  v8.1.11
-symfony/http-kernel      v8.1.6
+symfony/http-kernel      v8.1.11
-symfony/routing          v8.1.6
+symfony/routing          v8.1.11

Advisory	Package	Issue
CVE-2026-118514	http-foundation	HEAD requests bypass methods in access_control rules and firewalls (incomplete fix for CVE-2026-45075)
GHSA-3h27-hjv7-fqjx	http-foundation	Path rules enforced in front of PHP bypassable by appending the path to the script name
GHSA-xg2q-4rrq-657q	http-foundation	private_ranges trusted-proxy shortcut trusts IPv4-mapped / 6to4 / Teredo / NAT64 clients
GHSA-5mx8-mwrp-5693	http-foundation	Generated URLs can point to a client-chosen host
GHSA-wg5q-m2ww-f3c9	http-kernel	Inline fragments let untrusted forwarded headers set host/scheme/port of the main request's URLs
CVE-2026-118516	routing	Host placeholders can match the start of the path in compiled URL matchers

All six are fixed in 8.1.11.

Scope:

• Only composer.lock changes: 18 lines added, 18 removed.
• composer.json and the lock's content-hash are unchanged.
• No other package moves; all three stay inside their existing constraint and the 8.1 patch line.

Type of Change

• Infrastructure

Requirement

N/A (dependency security chore)

Testing

Test Evidence

Run locally on the branch, with APP_CONFIG_CACHE pointed at a path that doesn't exist:

Check	Result
composer audit before (on 31ead5b)	6 advisories, 3 packages, exit 1
composer validate --strict	valid
composer audit	No security vulnerability advisories found
pint --test	passed
phpstan analyse	0 errors
php artisan test	6 passed

Security / Data Isolation

• Not applicable (no application code changed)

Database / Migration

• No database changes

Documentation

• No documentation changes required

Reviewer Notes

The change was originally committed as the base of the local M1 branch (feat/frontend-shell). It is split out here so it can be reviewed on its own. M1 will be rebased onto main after this merges.

Definition of Done

• Acceptance criteria are satisfied
• composer check passes locally (validate, audit, Pint, PHPStan, Pest)
• No unrelated changes
• No secrets committed
• Self-review completed
• Reviewer feedback addressed