[elcreator]

Problem

composer audit --locked --no-dev, the "Dependency audit" job of CI, fails on 3.6.x since 2026-11-04. It reports seven advisories in four Symfony packages:

Package	Advisory
symfony/filesystem	Path treats any prefix before :// as a root, so paths can escape their base directory
symfony/http-foundation	CVE-2026-118514: HEAD requests bypass the methods option of security.access_control rules and firewalls
symfony/http-foundation	Path rules enforced in front of PHP can be bypassed by appending the path to the script name
symfony/http-foundation	The private_ranges trusted proxies shortcut trusts clients presenting an IPv4-mapped, 6to4, Teredo or NAT64 address
symfony/http-foundation	Generated URLs can point to a host chosen by the client
symfony/http-kernel	Inline fragments let untrusted forwarded headers set the host, scheme and port of URLs generated for the main request
symfony/routing	CVE-2026-118516: host placeholders can match the start of the path in compiled URL matchers

The job reads the current advisory database, so it fails on any PR, whatever it changes. I did not work out which of these can be reached in Evolution CMS. The core does not call setTrustedProxies(), but a site or package may.

Change

symfony/filesystem, http-foundation, http-kernel and routing go to 8.1.11. No other package moves. Only core/composer.lock changes: core/vendor is not tracked here.

The lock was resolved on PHP 8.4.27 with Composer 2.11.1, the version that wrote the current lock.

Verification

• composer audit --locked --no-dev and composer audit --locked: no advisories.
• composer test -- --compact --fail-on-warning --fail-on-risky --fail-on-deprecation in evo-ci-php:8.4: 2435 passed, 9 skipped, 0 failed.
• PHPStan: no errors.
• Request::prepareBaseUrl() is rewritten in this release, so a site in a subfolder was compared before and after on real Apache (PHP 8.4, SQLite, /evo123/). The same requests gave the same result: front page, 404, manager, login, six manager pages, a Laravel route (base URL, path, generated URL) and forwarded headers. The responses to //host/... URLs did not reach PHP there, so that part of the fix was not exercised. nginx and FrankenPHP were not tried.

Notes

• roave/security-advisories in require-dev now refuses PHP below 8.4.27 / 8.5.12, so composer update needs a current PHP.
• The "Dependency audit" job of fix(installer): make "remove the install folder" work (3.6) #2552 fails for this reason only. It should pass on its next run after this is merged.

🤖 Generated with Claude Code