[elcreator]

Problem

composer audit --locked --no-dev, the "Dependency audit" job of CI, fails on 3.5.x since 2026-11-04. It reports seven advisories in four Symfony packages:

Package	Advisory
symfony/filesystem	Path treats any prefix before :// as a root, so paths can escape their base directory
symfony/http-foundation	CVE-2026-118514: HEAD requests bypass the methods option of security.access_control rules and firewalls
symfony/http-foundation	Path rules enforced in front of PHP can be bypassed by appending the path to the script name
symfony/http-foundation	The private_ranges trusted proxies shortcut trusts clients presenting an IPv4-mapped, 6to4, Teredo or NAT64 address
symfony/http-foundation	Generated URLs can point to a host chosen by the client
symfony/http-kernel	Inline fragments let untrusted forwarded headers set the host, scheme and port of URLs generated for the main request
symfony/routing	CVE-2026-118516: host placeholders can match the start of the path in compiled URL matchers

The job reads the current advisory database, so it fails on any PR, whatever it changes. I did not work out which of these can be reached in Evolution CMS. The core does not call setTrustedProxies(), but a site or package may.

Change

symfony/filesystem, http-foundation, http-kernel and routing go to 7.4.23. No other package moves. core/composer.lock and the tracked core/vendor change, 19 files in all.

The lock was resolved on PHP 8.3.36. Ignoring the platform here moves symfony/filesystem to 8.1, which needs PHP 8.4, and this line supports 8.3.

Verification

• composer audit --locked --no-dev and composer audit --locked: no advisories.
• composer test -- --compact --fail-on-warning --fail-on-risky --fail-on-deprecation in evo-ci-php:8.4: 2249 passed, 9 skipped, 0 failed.
• PHPStan: no errors.
• Request::prepareBaseUrl() is rewritten in this release, so a site in a subfolder was compared before and after on real Apache (PHP 8.4, SQLite, /evo123/). The same requests gave the same result: front page, 404, manager, login, six manager pages, a Laravel route (base URL, path, generated URL) and forwarded headers. The responses to //host/... URLs did not reach PHP there, so that part of the fix was not exercised. nginx and FrankenPHP were not tried.

Notes

• roave/security-advisories in require-dev now refuses PHP below 8.3.36 / 8.4.27 / 8.5.12, so composer update needs a current PHP.
• The "Dependency audit" job of fix(installer): make "remove the install folder" work #2551 fails for this reason only. It should pass on its next run after this is merged.

🤖 Generated with Claude Code