fix(deps): symfony/http-foundation and symfony/yaml to 6.4.48, clearing two advisories

[rubenvdlinde]

What is wrong

quality / Security (composer) is red on development. composer audit --format=plain --abandoned=report, the exact call the shared workflow makes, exits 1 with two advisories, both in packages-dev:

package	locked	advisory	patched from
symfony/http-foundation	v6.4.43	CVE-2026-108082, ReDoS in HeaderUtils::split() reachable through the Cache-Control request header	6.4.46
symfony/yaml	v6.4.40	CVE-2026-109413, unbounded recursion in the YAML inline lexer lets one document crash the process	6.4.45

symfony/http-foundation is a direct require-dev (^6.4.41). symfony/yaml is transitive: consolidation/robo 4.0.6 requires symfony/yaml ^6.

What changes

Both move to v6.4.48, the newest 6.x release. Nothing crosses a major boundary.

composer.json does not change. The ^6.4.41 constraint already allowed a patched release and symfony/yaml has no constraint here at all, so the lock alone was behind. composer update symfony/http-foundation symfony/yaml is enough: --with-dependencies additionally pulls symfony/polyfill-mbstring and symfony/polyfill-php83 forward, which nothing needs, so the narrower call is the one taken. The lock's content-hash is unchanged and the diff is 12 lines, all of them these two packages.

Both packages are development-only. Nextcloud supplies symfony/http-foundation to the app at runtime, and symfony/yaml is used by one test (ZgwOpenApiConformanceTest) and by robo. So the exposure this clears is the local and CI toolchain, not a shipped install.

Verification

Commands and exit codes, run with an isolated HOME and TMPDIR so the shared ~/.pdepend cache cannot answer for another clone.

• composer audit before: exit 1, "Found 2 security vulnerability advisories affecting 2 packages".
• composer audit --format=plain --abandoned=report after: exit 0, "No security vulnerability advisories found". The feed was reachable on both runs, which the before-run's two findings prove.
• composer install after: exit 0, reproducible from the lock. composer validate: exit 0.
• vendor/bin/phpunit --no-coverage: exit 0, 8657 tests, 50850 assertions, 82 skipped, 1 warning. Same counts as before the bump.
• COMPOSER_PROCESS_TIMEOUT=0 composer check:strict: see the comment below for both runs, this branch against a clean origin/development in the same clone.

No test accompanies this change: a lock bump has no behaviour to pin, and composer audit is itself the check that was failing.

Inherited

development is red on phpmd, check:debt-ratchet and several Hydra gates; each is owned by another lane in the same sweep, and none is touched here.

Fleet

The constraint is copied across the fleet, and so is the problem. Locked versions in the local checkouts, read-only, not changed: symfony/yaml sits below the patched 6.4.45 in opencatalogi, thematiq, launchpad, stackiq, larpinq, pipelinq, learniq, portaliq, decidiq, buildiq, planninq, hermiq and dossiq, and symfony/http-foundation sits at v6.4.43 in pipelinq, shillinq, buildiq, hermiq and dossiq, with opencatalogi and integriq at v7.4.13 against a 7.4.19 fix. Those checkouts may trail their own development, so each app needs its own composer audit before anyone counts it affected.

[github-actions]

Quality Report — ConductionNL/dossiq @ 57e8dfa

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
check-debt-ratchet		❌
check-types-e2e		✅
composer			✅	✅ 109/109
npm			✅	✅ 659/659
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌ 8657/8657 · 3 skipped (no test failed, the job failed for another reason — see its log)
Newman					⏭️
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it locally with npx playwright test, or from the Actions tab on a branch with no open pull request into development.
Hydra gates					❌

---

Quality workflow — 2026-10-15 10:52 UTC

Download the full PDF report from the workflow artifacts.