Update the PHP the Windows image ships before testing

.github/workflows/tests.yml

@@ -173,6 +173,12 @@ jobs:
           extensions: dom, curl, libxml, mbstring, zip, fileinfo, pdo, sqlite3, pdo_sqlite
           coverage: none
           ini-values: error_reporting=E_ALL
+        env:
+          # The Windows and macOS images ship PHP, and setup-php reuses that copy unless `update`
+          # is set (an env var in setup-php 2.x, not an input). A security release then lags there,
+          # and roave/security-advisories refuses to install on the vulnerable patch (8.5.11 vs
+          # 8.5.12, 2026-10-26). Linux installs fresh, so it is left alone.
+          update: ${{ runner.os != 'Linux' }}
 
       - name: Install dependencies
         run: composer update --prefer-stable --no-interaction --no-progress

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Windows CI installs the current PHP patch.** setup-php reused the PHP the Windows image
+  ships (8.5.11) after 8.5.12 fixed a security issue, so `roave/security-advisories` refused
+  to install and the Windows leg failed on every pull request. The cross-platform job now
+  sets setup-php's `update` (an environment variable) off Linux, so it upgrades to the latest patch.
+
 ## [0.1.8] - 2026-10-20
 
 ### Changed