diff --git a/docs/changelog.270.txt b/docs/changelog.270.txt
index 6589cef3b..136fa6c17 100644
--- a/docs/changelog.270.txt
+++ b/docs/changelog.270.txt
@@ -42,6 +42,9 @@ Core:
 Database:
 - XoopsMySQLDatabase::isResultSet() tells PHPStan and Psalm that a passing result is a mysqli_result, so a one-part isResultSet() guard narrows the result for the fetch methods; the deprecated XoopsTree also checks for a mysqli_result and treats anything else as a failed query (#249)
 
+Libraries and assets:
+- HTML Purifier 4.19.1, firebase/php-jwt 7.2.1, Monolog 3.12.1, Punic 3.8.2, Smarty 4.5.8, symfony/polyfill-mbstring 1.43.0, symfony/var-dumper 7.4.18, symfony/yaml 7.4.20, TCPDF 6.11.4, webmozart/assert 2.5.0 (xoops_lib/composer.dist.lock, xoops_lib/vendor)
+
 ===================================
 2.7.4 RC 1                    2026-09
 ===================================
diff --git a/htdocs/xoops_lib/composer.dist.lock b/htdocs/xoops_lib/composer.dist.lock
index b2ff72df3..af9e42a69 100644
--- a/htdocs/xoops_lib/composer.dist.lock
+++ b/htdocs/xoops_lib/composer.dist.lock
@@ -339,16 +339,16 @@
         },
         {
             "name": "ezyang/htmlpurifier",
-            "version": "v4.19.0",
+            "version": "v4.19.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ezyang/htmlpurifier.git",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf"
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/b287d2a16aceffbf6e0295559b39662612b77fcf",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf",
+                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/5e0539132d934f936fbae2c88b55d58f9438623f",
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f",
                 "shasum": ""
             },
             "require": {
@@ -394,32 +394,32 @@
             ],
             "support": {
                 "issues": "https://github.com/ezyang/htmlpurifier/issues",
-                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.0"
+                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.1"
             },
-            "time": "2025-10-17T16:34:55+00:00"
+            "time": "2026-09-15T15:42:51+00:00"
         },
         {
             "name": "firebase/php-jwt",
-            "version": "v7.1.0",
+            "version": "v7.2.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/googleapis/php-jwt.git",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0"
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
+                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/0501f5729b9e2448516674aff07c7d1727869b8e",
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.0"
             },
             "require-dev": {
-                "guzzlehttp/guzzle": "^7.4",
+                "guzzlehttp/guzzle": "^7.4||^8.0",
                 "phpfastcache/phpfastcache": "^9.2",
                 "phpseclib/phpseclib": "~3.0",
-                "phpspec/prophecy-phpunit": "^2.0",
+                "phpspec/prophecy-phpunit": "^2.2",
                 "phpunit/phpunit": "^9.5",
                 "psr/cache": "^2.0||^3.0",
                 "psr/http-client": "^1.0",
@@ -431,6 +431,14 @@
                 "phpseclib/phpseclib": "Support PS256 (RSASSA-PSS) signatures"
             },
             "type": "library",
+            "extra": {
+                "component": {
+                    "id": "jwt",
+                    "path": "Jwt",
+                    "entry": "README.md",
+                    "target": "googleapis/php-jwt.git"
+                }
+            },
             "autoload": {
                 "psr-4": {
                     "Firebase\\JWT\\": "src"
@@ -460,9 +468,9 @@
             ],
             "support": {
                 "issues": "https://github.com/googleapis/php-jwt/issues",
-                "source": "https://github.com/googleapis/php-jwt/tree/v7.1.0"
+                "source": "https://github.com/googleapis/php-jwt/tree/v7.2.1"
             },
-            "time": "2026-06-11T17:54:14+00:00"
+            "time": "2026-09-28T17:51:46+00:00"
         },
         {
             "name": "kint-php/kint",
@@ -529,16 +537,16 @@
         },
         {
             "name": "monolog/monolog",
-            "version": "3.10.0",
+            "version": "3.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Seldaek/monolog.git",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0"
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/b321dd6749f0bf7189444158a3ce785cc16d69b0",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/d7059e4c691d05ea1222b5124bed0f961be46e15",
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15",
                 "shasum": ""
             },
             "require": {
@@ -564,6 +572,7 @@
                 "phpstan/phpstan-strict-rules": "^2",
                 "phpunit/phpunit": "^10.5.17 || ^11.0.7",
                 "predis/predis": "^1.1 || ^2",
+                "psr/clock": "^1.0",
                 "rollbar/rollbar": "^4.0",
                 "ruflin/elastica": "^7 || ^8",
                 "symfony/mailer": "^5.4 || ^6",
@@ -582,6 +591,7 @@
                 "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server",
                 "mongodb/mongodb": "Allow sending log messages to a MongoDB server (via library)",
                 "php-amqplib/php-amqplib": "Allow sending log messages to an AMQP server using php-amqplib",
+                "psr/clock": "Required to pass a clock to the Logger and control the timestamp of log records",
                 "rollbar/rollbar": "Allow sending log messages to Rollbar",
                 "ruflin/elastica": "Allow sending log messages to an Elastic Search server"
             },
@@ -616,7 +626,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Seldaek/monolog/issues",
-                "source": "https://github.com/Seldaek/monolog/tree/3.10.0"
+                "source": "https://github.com/Seldaek/monolog/tree/3.12.1"
             },
             "funding": [
                 {
@@ -628,7 +638,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-01-02T08:56:05+00:00"
+            "time": "2026-09-29T19:21:12+00:00"
         },
         {
             "name": "php-debugbar/php-debugbar",
@@ -865,16 +875,16 @@
         },
         {
             "name": "punic/punic",
-            "version": "3.8.1",
+            "version": "3.8.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/punic/punic.git",
-                "reference": "142707201a246a9c2ea909605cd56177af87f961"
+                "reference": "523858c590fc9c02607c8138241c464e1fdb36a5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/punic/punic/zipball/142707201a246a9c2ea909605cd56177af87f961",
-                "reference": "142707201a246a9c2ea909605cd56177af87f961",
+                "url": "https://api.github.com/repos/punic/punic/zipball/523858c590fc9c02607c8138241c464e1fdb36a5",
+                "reference": "523858c590fc9c02607c8138241c464e1fdb36a5",
                 "shasum": ""
             },
             "require": {
@@ -936,7 +946,7 @@
             ],
             "support": {
                 "issues": "https://github.com/punic/punic/issues",
-                "source": "https://github.com/punic/punic/tree/3.8.1"
+                "source": "https://github.com/punic/punic/tree/3.8.2"
             },
             "funding": [
                 {
@@ -948,20 +958,20 @@
                     "type": "github"
                 }
             ],
-            "time": "2023-03-29T06:56:57+00:00"
+            "time": "2026-09-10T07:35:23+00:00"
         },
         {
             "name": "smarty/smarty",
-            "version": "v4.5.7",
+            "version": "v4.5.8",
             "source": {
                 "type": "git",
                 "url": "https://github.com/smarty-php/smarty.git",
-                "reference": "838d6ad1c635f8a6bafc08d791b8af18d8304b3a"
+                "reference": "042d310bdfbc67aa9138418d838d689b34f4c87e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/smarty-php/smarty/zipball/838d6ad1c635f8a6bafc08d791b8af18d8304b3a",
-                "reference": "838d6ad1c635f8a6bafc08d791b8af18d8304b3a",
+                "url": "https://api.github.com/repos/smarty-php/smarty/zipball/042d310bdfbc67aa9138418d838d689b34f4c87e",
+                "reference": "042d310bdfbc67aa9138418d838d689b34f4c87e",
                 "shasum": ""
             },
             "require": {
@@ -1012,7 +1022,7 @@
             "support": {
                 "forum": "https://github.com/smarty-php/smarty/discussions",
                 "issues": "https://github.com/smarty-php/smarty/issues",
-                "source": "https://github.com/smarty-php/smarty/tree/v4.5.7"
+                "source": "https://github.com/smarty-php/smarty/tree/v4.5.8"
             },
             "funding": [
                 {
@@ -1020,7 +1030,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-06-29T08:48:56+00:00"
+            "time": "2026-10-04T21:31:15+00:00"
         },
         {
             "name": "smottt/wideimage",
@@ -1217,16 +1227,16 @@
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.38.2",
+            "version": "v1.43.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
                 "shasum": ""
             },
             "require": {
@@ -1278,7 +1288,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -1298,20 +1308,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-27T06:59:30+00:00"
+            "time": "2026-09-24T15:19:04+00:00"
         },
         {
             "name": "symfony/var-dumper",
-            "version": "v7.4.14",
+            "version": "v7.4.18",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/var-dumper.git",
-                "reference": "9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358"
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358",
-                "reference": "9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358",
+                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/e088da50b813f32473a76871616cbb8fa54653a8",
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8",
                 "shasum": ""
             },
             "require": {
@@ -1327,7 +1337,7 @@
                 "symfony/http-kernel": "^6.4|^7.0|^8.0",
                 "symfony/process": "^6.4|^7.0|^8.0",
                 "symfony/uid": "^6.4|^7.0|^8.0",
-                "twig/twig": "^3.12"
+                "twig/twig": "^3.12|^4.0"
             },
             "bin": [
                 "Resources/bin/var-dump-server"
@@ -1365,7 +1375,7 @@
                 "dump"
             ],
             "support": {
-                "source": "https://github.com/symfony/var-dumper/tree/v7.4.14"
+                "source": "https://github.com/symfony/var-dumper/tree/v7.4.18"
             },
             "funding": [
                 {
@@ -1385,20 +1395,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-08T20:24:16+00:00"
+            "time": "2026-08-30T20:10:52+00:00"
         },
         {
             "name": "symfony/yaml",
-            "version": "v7.4.14",
+            "version": "v7.4.20",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/yaml.git",
-                "reference": "f8f328665ace2370d1e10645b807ba1646dc7dcc"
+                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/f8f328665ace2370d1e10645b807ba1646dc7dcc",
-                "reference": "f8f328665ace2370d1e10645b807ba1646dc7dcc",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
+                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
                 "shasum": ""
             },
             "require": {
@@ -1441,7 +1451,7 @@
             "description": "Loads and dumps YAML files",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/yaml/tree/v7.4.14"
+                "source": "https://github.com/symfony/yaml/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -1461,20 +1471,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-06-08T20:24:16+00:00"
+            "time": "2026-09-26T06:31:10+00:00"
         },
         {
             "name": "tecnickcom/tcpdf",
-            "version": "6.11.3",
+            "version": "6.11.4",
             "source": {
                 "type": "git",
                 "url": "https://github.com/tecnickcom/TCPDF.git",
-                "reference": "b18f6119161019916c5bb07cb8da5205ae5c1b63"
+                "reference": "fbbaf14cfae8fe646f154f7c530d15ec25764040"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/tecnickcom/TCPDF/zipball/b18f6119161019916c5bb07cb8da5205ae5c1b63",
-                "reference": "b18f6119161019916c5bb07cb8da5205ae5c1b63",
+                "url": "https://api.github.com/repos/tecnickcom/TCPDF/zipball/fbbaf14cfae8fe646f154f7c530d15ec25764040",
+                "reference": "fbbaf14cfae8fe646f154f7c530d15ec25764040",
                 "shasum": ""
             },
             "require": {
@@ -1485,7 +1495,7 @@
                 "ext-gd": "Enables additional image handling in some workflows.",
                 "ext-imagick": "Enables additional image format support when available.",
                 "ext-zlib": "Recommended for compressed streams and related features.",
-                "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF for new projects."
+                "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF."
             },
             "type": "library",
             "autoload": {
@@ -1517,7 +1527,7 @@
                     "role": "lead"
                 }
             ],
-            "description": "Deprecated legacy PDF engine for PHP. For new projects use tecnickcom/tc-lib-pdf.",
+            "description": "Deprecated legacy PDF engine for PHP. Migrate to tecnickcom/tc-lib-pdf.",
             "homepage": "https://tcpdf.org",
             "keywords": [
                 "PDFD32000-2008",
@@ -1534,24 +1544,24 @@
             },
             "funding": [
                 {
-                    "url": "https://www.paypal.com/donate/?hosted_button_id=NZUEC5XS8MFBJ",
-                    "type": "paypal"
+                    "url": "https://github.com/sponsors/tecnickcom",
+                    "type": "github"
                 }
             ],
-            "time": "2026-04-21T17:00:18+00:00"
+            "time": "2026-08-28T11:28:19+00:00"
         },
         {
             "name": "webmozart/assert",
-            "version": "2.4.1",
+            "version": "2.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/webmozarts/assert.git",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70"
+                "reference": "8a163706bbcac613733dba03f51e13b5eb1bb819"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/2ccb7c2e821038c03a3e6e1700c570c158c55f70",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/8a163706bbcac613733dba03f51e13b5eb1bb819",
+                "reference": "8a163706bbcac613733dba03f51e13b5eb1bb819",
                 "shasum": ""
             },
             "require": {
@@ -1602,9 +1612,9 @@
             ],
             "support": {
                 "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.4.1"
+                "source": "https://github.com/webmozarts/assert/tree/2.5.0"
             },
-            "time": "2026-06-15T15:31:57+00:00"
+            "time": "2026-10-05T23:14:19+00:00"
         },
         {
             "name": "xoops/helpers",
diff --git a/htdocs/xoops_lib/vendor/composer/autoload_classmap.php b/htdocs/xoops_lib/vendor/composer/autoload_classmap.php
index 6d31e8da5..c6e7ebedc 100644
--- a/htdocs/xoops_lib/vendor/composer/autoload_classmap.php
+++ b/htdocs/xoops_lib/vendor/composer/autoload_classmap.php
@@ -452,9 +452,11 @@
     'Monolog\\Formatter\\LogstashFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/LogstashFormatter.php',
     'Monolog\\Formatter\\MongoDBFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/MongoDBFormatter.php',
     'Monolog\\Formatter\\NormalizerFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php',
+    'Monolog\\Formatter\\RedactingFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/RedactingFormatter.php',
     'Monolog\\Formatter\\ScalarFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/ScalarFormatter.php',
     'Monolog\\Formatter\\SyslogFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/SyslogFormatter.php',
     'Monolog\\Formatter\\WildfireFormatter' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/WildfireFormatter.php',
+    'Monolog\\Formatter\\WrappingFormatterInterface' => $vendorDir . '/monolog/monolog/src/Monolog/Formatter/WrappingFormatterInterface.php',
     'Monolog\\Handler\\AbstractHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/AbstractHandler.php',
     'Monolog\\Handler\\AbstractProcessingHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php',
     'Monolog\\Handler\\AbstractSyslogHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/AbstractSyslogHandler.php',
@@ -482,6 +484,7 @@
     'Monolog\\Handler\\FlowdockHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php',
     'Monolog\\Handler\\FormattableHandlerInterface' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/FormattableHandlerInterface.php',
     'Monolog\\Handler\\FormattableHandlerTrait' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/FormattableHandlerTrait.php',
+    'Monolog\\Handler\\FrankenPhpHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/FrankenPhpHandler.php',
     'Monolog\\Handler\\GelfHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/GelfHandler.php',
     'Monolog\\Handler\\GroupHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/GroupHandler.php',
     'Monolog\\Handler\\Handler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/Handler.php',
@@ -490,6 +493,7 @@
     'Monolog\\Handler\\IFTTTHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/IFTTTHandler.php',
     'Monolog\\Handler\\InsightOpsHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/InsightOpsHandler.php',
     'Monolog\\Handler\\LogEntriesHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/LogEntriesHandler.php',
+    'Monolog\\Handler\\LogMonsterHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/LogMonsterHandler.php',
     'Monolog\\Handler\\LogglyHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/LogglyHandler.php',
     'Monolog\\Handler\\LogmaticHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/LogmaticHandler.php',
     'Monolog\\Handler\\MailHandler' => $vendorDir . '/monolog/monolog/src/Monolog/Handler/MailHandler.php',
diff --git a/htdocs/xoops_lib/vendor/composer/autoload_static.php b/htdocs/xoops_lib/vendor/composer/autoload_static.php
index 67127d45b..d035abe18 100644
--- a/htdocs/xoops_lib/vendor/composer/autoload_static.php
+++ b/htdocs/xoops_lib/vendor/composer/autoload_static.php
@@ -617,9 +617,11 @@ class ComposerStaticInitdcd8bb0b135e004111c0e95f5addbb05
         'Monolog\\Formatter\\LogstashFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/LogstashFormatter.php',
         'Monolog\\Formatter\\MongoDBFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/MongoDBFormatter.php',
         'Monolog\\Formatter\\NormalizerFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php',
+        'Monolog\\Formatter\\RedactingFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/RedactingFormatter.php',
         'Monolog\\Formatter\\ScalarFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/ScalarFormatter.php',
         'Monolog\\Formatter\\SyslogFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/SyslogFormatter.php',
         'Monolog\\Formatter\\WildfireFormatter' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/WildfireFormatter.php',
+        'Monolog\\Formatter\\WrappingFormatterInterface' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Formatter/WrappingFormatterInterface.php',
         'Monolog\\Handler\\AbstractHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/AbstractHandler.php',
         'Monolog\\Handler\\AbstractProcessingHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php',
         'Monolog\\Handler\\AbstractSyslogHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/AbstractSyslogHandler.php',
@@ -647,6 +649,7 @@ class ComposerStaticInitdcd8bb0b135e004111c0e95f5addbb05
         'Monolog\\Handler\\FlowdockHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php',
         'Monolog\\Handler\\FormattableHandlerInterface' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/FormattableHandlerInterface.php',
         'Monolog\\Handler\\FormattableHandlerTrait' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/FormattableHandlerTrait.php',
+        'Monolog\\Handler\\FrankenPhpHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/FrankenPhpHandler.php',
         'Monolog\\Handler\\GelfHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/GelfHandler.php',
         'Monolog\\Handler\\GroupHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/GroupHandler.php',
         'Monolog\\Handler\\Handler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/Handler.php',
@@ -655,6 +658,7 @@ class ComposerStaticInitdcd8bb0b135e004111c0e95f5addbb05
         'Monolog\\Handler\\IFTTTHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/IFTTTHandler.php',
         'Monolog\\Handler\\InsightOpsHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/InsightOpsHandler.php',
         'Monolog\\Handler\\LogEntriesHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/LogEntriesHandler.php',
+        'Monolog\\Handler\\LogMonsterHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/LogMonsterHandler.php',
         'Monolog\\Handler\\LogglyHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/LogglyHandler.php',
         'Monolog\\Handler\\LogmaticHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/LogmaticHandler.php',
         'Monolog\\Handler\\MailHandler' => __DIR__ . '/..' . '/monolog/monolog/src/Monolog/Handler/MailHandler.php',
diff --git a/htdocs/xoops_lib/vendor/composer/installed.json b/htdocs/xoops_lib/vendor/composer/installed.json
index 5778ce85c..0f19bb5a8 100644
--- a/htdocs/xoops_lib/vendor/composer/installed.json
+++ b/htdocs/xoops_lib/vendor/composer/installed.json
@@ -348,17 +348,17 @@
         },
         {
             "name": "ezyang/htmlpurifier",
-            "version": "v4.19.0",
-            "version_normalized": "4.19.0.0",
+            "version": "v4.19.1",
+            "version_normalized": "4.19.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ezyang/htmlpurifier.git",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf"
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/b287d2a16aceffbf6e0295559b39662612b77fcf",
-                "reference": "b287d2a16aceffbf6e0295559b39662612b77fcf",
+                "url": "https://api.github.com/repos/ezyang/htmlpurifier/zipball/5e0539132d934f936fbae2c88b55d58f9438623f",
+                "reference": "5e0539132d934f936fbae2c88b55d58f9438623f",
                 "shasum": ""
             },
             "require": {
@@ -374,7 +374,7 @@
                 "ext-iconv": "Converts text to and from non-UTF-8 encodings",
                 "ext-tidy": "Used for pretty-printing HTML"
             },
-            "time": "2025-10-17T16:34:55+00:00",
+            "time": "2026-09-15T15:42:51+00:00",
             "type": "library",
             "installation-source": "dist",
             "autoload": {
@@ -406,33 +406,33 @@
             ],
             "support": {
                 "issues": "https://github.com/ezyang/htmlpurifier/issues",
-                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.0"
+                "source": "https://github.com/ezyang/htmlpurifier/tree/v4.19.1"
             },
             "install-path": "../ezyang/htmlpurifier"
         },
         {
             "name": "firebase/php-jwt",
-            "version": "v7.1.0",
-            "version_normalized": "7.1.0.0",
+            "version": "v7.2.1",
+            "version_normalized": "7.2.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/googleapis/php-jwt.git",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0"
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
-                "reference": "b374a5d1a4f1f67fadc2165cdb284645945e2fc0",
+                "url": "https://api.github.com/repos/googleapis/php-jwt/zipball/0501f5729b9e2448516674aff07c7d1727869b8e",
+                "reference": "0501f5729b9e2448516674aff07c7d1727869b8e",
                 "shasum": ""
             },
             "require": {
                 "php": "^8.0"
             },
             "require-dev": {
-                "guzzlehttp/guzzle": "^7.4",
+                "guzzlehttp/guzzle": "^7.4||^8.0",
                 "phpfastcache/phpfastcache": "^9.2",
                 "phpseclib/phpseclib": "~3.0",
-                "phpspec/prophecy-phpunit": "^2.0",
+                "phpspec/prophecy-phpunit": "^2.2",
                 "phpunit/phpunit": "^9.5",
                 "psr/cache": "^2.0||^3.0",
                 "psr/http-client": "^1.0",
@@ -443,8 +443,16 @@
                 "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present",
                 "phpseclib/phpseclib": "Support PS256 (RSASSA-PSS) signatures"
             },
-            "time": "2026-06-11T17:54:14+00:00",
+            "time": "2026-09-28T17:51:46+00:00",
             "type": "library",
+            "extra": {
+                "component": {
+                    "id": "jwt",
+                    "path": "Jwt",
+                    "entry": "README.md",
+                    "target": "googleapis/php-jwt.git"
+                }
+            },
             "installation-source": "dist",
             "autoload": {
                 "psr-4": {
@@ -475,7 +483,7 @@
             ],
             "support": {
                 "issues": "https://github.com/googleapis/php-jwt/issues",
-                "source": "https://github.com/googleapis/php-jwt/tree/v7.1.0"
+                "source": "https://github.com/googleapis/php-jwt/tree/v7.2.1"
             },
             "install-path": "../firebase/php-jwt"
         },
@@ -547,17 +555,17 @@
         },
         {
             "name": "monolog/monolog",
-            "version": "3.10.0",
-            "version_normalized": "3.10.0.0",
+            "version": "3.12.1",
+            "version_normalized": "3.12.1.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/Seldaek/monolog.git",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0"
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/b321dd6749f0bf7189444158a3ce785cc16d69b0",
-                "reference": "b321dd6749f0bf7189444158a3ce785cc16d69b0",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/d7059e4c691d05ea1222b5124bed0f961be46e15",
+                "reference": "d7059e4c691d05ea1222b5124bed0f961be46e15",
                 "shasum": ""
             },
             "require": {
@@ -583,6 +591,7 @@
                 "phpstan/phpstan-strict-rules": "^2",
                 "phpunit/phpunit": "^10.5.17 || ^11.0.7",
                 "predis/predis": "^1.1 || ^2",
+                "psr/clock": "^1.0",
                 "rollbar/rollbar": "^4.0",
                 "ruflin/elastica": "^7 || ^8",
                 "symfony/mailer": "^5.4 || ^6",
@@ -601,10 +610,11 @@
                 "graylog2/gelf-php": "Allow sending log messages to a GrayLog2 server",
                 "mongodb/mongodb": "Allow sending log messages to a MongoDB server (via library)",
                 "php-amqplib/php-amqplib": "Allow sending log messages to an AMQP server using php-amqplib",
+                "psr/clock": "Required to pass a clock to the Logger and control the timestamp of log records",
                 "rollbar/rollbar": "Allow sending log messages to Rollbar",
                 "ruflin/elastica": "Allow sending log messages to an Elastic Search server"
             },
-            "time": "2026-01-02T08:56:05+00:00",
+            "time": "2026-09-29T19:21:12+00:00",
             "type": "library",
             "extra": {
                 "branch-alias": {
@@ -637,7 +647,7 @@
             ],
             "support": {
                 "issues": "https://github.com/Seldaek/monolog/issues",
-                "source": "https://github.com/Seldaek/monolog/tree/3.10.0"
+                "source": "https://github.com/Seldaek/monolog/tree/3.12.1"
             },
             "funding": [
                 {
@@ -895,17 +905,17 @@
         },
         {
             "name": "punic/punic",
-            "version": "3.8.1",
-            "version_normalized": "3.8.1.0",
+            "version": "3.8.2",
+            "version_normalized": "3.8.2.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/punic/punic.git",
-                "reference": "142707201a246a9c2ea909605cd56177af87f961"
+                "reference": "523858c590fc9c02607c8138241c464e1fdb36a5"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/punic/punic/zipball/142707201a246a9c2ea909605cd56177af87f961",
-                "reference": "142707201a246a9c2ea909605cd56177af87f961",
+                "url": "https://api.github.com/repos/punic/punic/zipball/523858c590fc9c02607c8138241c464e1fdb36a5",
+                "reference": "523858c590fc9c02607c8138241c464e1fdb36a5",
                 "shasum": ""
             },
             "require": {
@@ -918,7 +928,7 @@
             "require-dev": {
                 "phpunit/phpunit": "^4.8 || ^5.7 || ^6.5 || ^7.4 || ^8.5 || ^9.5"
             },
-            "time": "2023-03-29T06:56:57+00:00",
+            "time": "2026-09-10T07:35:23+00:00",
             "bin": [
                 "bin/punic-data"
             ],
@@ -969,7 +979,7 @@
             ],
             "support": {
                 "issues": "https://github.com/punic/punic/issues",
-                "source": "https://github.com/punic/punic/tree/3.8.1"
+                "source": "https://github.com/punic/punic/tree/3.8.2"
             },
             "funding": [
                 {
@@ -985,17 +995,17 @@
         },
         {
             "name": "smarty/smarty",
-            "version": "v4.5.7",
-            "version_normalized": "4.5.7.0",
+            "version": "v4.5.8",
+            "version_normalized": "4.5.8.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/smarty-php/smarty.git",
-                "reference": "838d6ad1c635f8a6bafc08d791b8af18d8304b3a"
+                "reference": "042d310bdfbc67aa9138418d838d689b34f4c87e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/smarty-php/smarty/zipball/838d6ad1c635f8a6bafc08d791b8af18d8304b3a",
-                "reference": "838d6ad1c635f8a6bafc08d791b8af18d8304b3a",
+                "url": "https://api.github.com/repos/smarty-php/smarty/zipball/042d310bdfbc67aa9138418d838d689b34f4c87e",
+                "reference": "042d310bdfbc67aa9138418d838d689b34f4c87e",
                 "shasum": ""
             },
             "require": {
@@ -1005,7 +1015,7 @@
                 "phpunit/phpunit": "^8.5 || ^7.5",
                 "smarty/smarty-lexer": "^3.1"
             },
-            "time": "2026-06-29T08:48:56+00:00",
+            "time": "2026-10-04T21:31:15+00:00",
             "type": "library",
             "extra": {
                 "branch-alias": {
@@ -1048,7 +1058,7 @@
             "support": {
                 "forum": "https://github.com/smarty-php/smarty/discussions",
                 "issues": "https://github.com/smarty-php/smarty/issues",
-                "source": "https://github.com/smarty-php/smarty/tree/v4.5.7"
+                "source": "https://github.com/smarty-php/smarty/tree/v4.5.8"
             },
             "funding": [
                 {
@@ -1262,17 +1272,17 @@
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.38.2",
-            "version_normalized": "1.38.2.0",
+            "version": "v1.43.0",
+            "version_normalized": "1.43.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
-                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
+                "reference": "4d5d331bf731e0aedbc6b2f5e61135b7b7996a72",
                 "shasum": ""
             },
             "require": {
@@ -1285,7 +1295,7 @@
             "suggest": {
                 "ext-mbstring": "For best performance"
             },
-            "time": "2026-05-27T06:59:30+00:00",
+            "time": "2026-09-24T15:19:04+00:00",
             "type": "library",
             "extra": {
                 "thanks": {
@@ -1326,7 +1336,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.43.0"
             },
             "funding": [
                 {
@@ -1350,17 +1360,17 @@
         },
         {
             "name": "symfony/var-dumper",
-            "version": "v7.4.14",
-            "version_normalized": "7.4.14.0",
+            "version": "v7.4.18",
+            "version_normalized": "7.4.18.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/var-dumper.git",
-                "reference": "9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358"
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358",
-                "reference": "9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358",
+                "url": "https://api.github.com/repos/symfony/var-dumper/zipball/e088da50b813f32473a76871616cbb8fa54653a8",
+                "reference": "e088da50b813f32473a76871616cbb8fa54653a8",
                 "shasum": ""
             },
             "require": {
@@ -1376,9 +1386,9 @@
                 "symfony/http-kernel": "^6.4|^7.0|^8.0",
                 "symfony/process": "^6.4|^7.0|^8.0",
                 "symfony/uid": "^6.4|^7.0|^8.0",
-                "twig/twig": "^3.12"
+                "twig/twig": "^3.12|^4.0"
             },
-            "time": "2026-06-08T20:24:16+00:00",
+            "time": "2026-08-30T20:10:52+00:00",
             "bin": [
                 "Resources/bin/var-dump-server"
             ],
@@ -1416,7 +1426,7 @@
                 "dump"
             ],
             "support": {
-                "source": "https://github.com/symfony/var-dumper/tree/v7.4.14"
+                "source": "https://github.com/symfony/var-dumper/tree/v7.4.18"
             },
             "funding": [
                 {
@@ -1440,17 +1450,17 @@
         },
         {
             "name": "symfony/yaml",
-            "version": "v7.4.14",
-            "version_normalized": "7.4.14.0",
+            "version": "v7.4.20",
+            "version_normalized": "7.4.20.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/yaml.git",
-                "reference": "f8f328665ace2370d1e10645b807ba1646dc7dcc"
+                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/f8f328665ace2370d1e10645b807ba1646dc7dcc",
-                "reference": "f8f328665ace2370d1e10645b807ba1646dc7dcc",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
+                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
                 "shasum": ""
             },
             "require": {
@@ -1464,7 +1474,7 @@
             "require-dev": {
                 "symfony/console": "^6.4|^7.0|^8.0"
             },
-            "time": "2026-06-08T20:24:16+00:00",
+            "time": "2026-09-26T06:31:10+00:00",
             "bin": [
                 "Resources/bin/yaml-lint"
             ],
@@ -1495,7 +1505,7 @@
             "description": "Loads and dumps YAML files",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/yaml/tree/v7.4.14"
+                "source": "https://github.com/symfony/yaml/tree/v7.4.20"
             },
             "funding": [
                 {
@@ -1519,17 +1529,17 @@
         },
         {
             "name": "tecnickcom/tcpdf",
-            "version": "6.11.3",
-            "version_normalized": "6.11.3.0",
+            "version": "6.11.4",
+            "version_normalized": "6.11.4.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/tecnickcom/TCPDF.git",
-                "reference": "b18f6119161019916c5bb07cb8da5205ae5c1b63"
+                "reference": "fbbaf14cfae8fe646f154f7c530d15ec25764040"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/tecnickcom/TCPDF/zipball/b18f6119161019916c5bb07cb8da5205ae5c1b63",
-                "reference": "b18f6119161019916c5bb07cb8da5205ae5c1b63",
+                "url": "https://api.github.com/repos/tecnickcom/TCPDF/zipball/fbbaf14cfae8fe646f154f7c530d15ec25764040",
+                "reference": "fbbaf14cfae8fe646f154f7c530d15ec25764040",
                 "shasum": ""
             },
             "require": {
@@ -1540,9 +1550,9 @@
                 "ext-gd": "Enables additional image handling in some workflows.",
                 "ext-imagick": "Enables additional image format support when available.",
                 "ext-zlib": "Recommended for compressed streams and related features.",
-                "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF for new projects."
+                "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF."
             },
-            "time": "2026-04-21T17:00:18+00:00",
+            "time": "2026-08-28T11:28:19+00:00",
             "type": "library",
             "installation-source": "dist",
             "autoload": {
@@ -1574,7 +1584,7 @@
                     "role": "lead"
                 }
             ],
-            "description": "Deprecated legacy PDF engine for PHP. For new projects use tecnickcom/tc-lib-pdf.",
+            "description": "Deprecated legacy PDF engine for PHP. Migrate to tecnickcom/tc-lib-pdf.",
             "homepage": "https://tcpdf.org",
             "keywords": [
                 "PDFD32000-2008",
@@ -1591,25 +1601,25 @@
             },
             "funding": [
                 {
-                    "url": "https://www.paypal.com/donate/?hosted_button_id=NZUEC5XS8MFBJ",
-                    "type": "paypal"
+                    "url": "https://github.com/sponsors/tecnickcom",
+                    "type": "github"
                 }
             ],
             "install-path": "../tecnickcom/tcpdf"
         },
         {
             "name": "webmozart/assert",
-            "version": "2.4.1",
-            "version_normalized": "2.4.1.0",
+            "version": "2.5.0",
+            "version_normalized": "2.5.0.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/webmozarts/assert.git",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70"
+                "reference": "8a163706bbcac613733dba03f51e13b5eb1bb819"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/2ccb7c2e821038c03a3e6e1700c570c158c55f70",
-                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/8a163706bbcac613733dba03f51e13b5eb1bb819",
+                "reference": "8a163706bbcac613733dba03f51e13b5eb1bb819",
                 "shasum": ""
             },
             "require": {
@@ -1623,7 +1633,7 @@
                 "ext-simplexml": "",
                 "ext-spl": ""
             },
-            "time": "2026-06-15T15:31:57+00:00",
+            "time": "2026-10-05T23:14:19+00:00",
             "type": "library",
             "extra": {
                 "psalm": {
@@ -1662,7 +1672,7 @@
             ],
             "support": {
                 "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.4.1"
+                "source": "https://github.com/webmozarts/assert/tree/2.5.0"
             },
             "install-path": "../webmozart/assert"
         },
diff --git a/htdocs/xoops_lib/vendor/composer/installed.php b/htdocs/xoops_lib/vendor/composer/installed.php
index 4cce40a1b..ed127e47c 100644
--- a/htdocs/xoops_lib/vendor/composer/installed.php
+++ b/htdocs/xoops_lib/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'xoopscore27/libraries',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '974f618ee91046210372a32e3743e54db15d9e91',
+        'reference' => '97110d0d50fbcd040dd05fe597861967b54e061d',
         'type' => 'metapackage',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -56,18 +56,18 @@
             'dev_requirement' => false,
         ),
         'ezyang/htmlpurifier' => array(
-            'pretty_version' => 'v4.19.0',
-            'version' => '4.19.0.0',
-            'reference' => 'b287d2a16aceffbf6e0295559b39662612b77fcf',
+            'pretty_version' => 'v4.19.1',
+            'version' => '4.19.1.0',
+            'reference' => '5e0539132d934f936fbae2c88b55d58f9438623f',
             'type' => 'library',
             'install_path' => __DIR__ . '/../ezyang/htmlpurifier',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'firebase/php-jwt' => array(
-            'pretty_version' => 'v7.1.0',
-            'version' => '7.1.0.0',
-            'reference' => 'b374a5d1a4f1f67fadc2165cdb284645945e2fc0',
+            'pretty_version' => 'v7.2.1',
+            'version' => '7.2.1.0',
+            'reference' => '0501f5729b9e2448516674aff07c7d1727869b8e',
             'type' => 'library',
             'install_path' => __DIR__ . '/../firebase/php-jwt',
             'aliases' => array(),
@@ -89,9 +89,9 @@
             ),
         ),
         'monolog/monolog' => array(
-            'pretty_version' => '3.10.0',
-            'version' => '3.10.0.0',
-            'reference' => 'b321dd6749f0bf7189444158a3ce785cc16d69b0',
+            'pretty_version' => '3.12.1',
+            'version' => '3.12.1.0',
+            'reference' => 'd7059e4c691d05ea1222b5124bed0f961be46e15',
             'type' => 'library',
             'install_path' => __DIR__ . '/../monolog/monolog',
             'aliases' => array(),
@@ -143,18 +143,18 @@
             ),
         ),
         'punic/punic' => array(
-            'pretty_version' => '3.8.1',
-            'version' => '3.8.1.0',
-            'reference' => '142707201a246a9c2ea909605cd56177af87f961',
+            'pretty_version' => '3.8.2',
+            'version' => '3.8.2.0',
+            'reference' => '523858c590fc9c02607c8138241c464e1fdb36a5',
             'type' => 'library',
             'install_path' => __DIR__ . '/../punic/punic',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'smarty/smarty' => array(
-            'pretty_version' => 'v4.5.7',
-            'version' => '4.5.7.0',
-            'reference' => '838d6ad1c635f8a6bafc08d791b8af18d8304b3a',
+            'pretty_version' => 'v4.5.8',
+            'version' => '4.5.8.0',
+            'reference' => '042d310bdfbc67aa9138418d838d689b34f4c87e',
             'type' => 'library',
             'install_path' => __DIR__ . '/../smarty/smarty',
             'aliases' => array(),
@@ -188,45 +188,45 @@
             'dev_requirement' => false,
         ),
         'symfony/polyfill-mbstring' => array(
-            'pretty_version' => 'v1.38.2',
-            'version' => '1.38.2.0',
-            'reference' => 'd3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6',
+            'pretty_version' => 'v1.43.0',
+            'version' => '1.43.0.0',
+            'reference' => '4d5d331bf731e0aedbc6b2f5e61135b7b7996a72',
             'type' => 'library',
             'install_path' => __DIR__ . '/../symfony/polyfill-mbstring',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'symfony/var-dumper' => array(
-            'pretty_version' => 'v7.4.14',
-            'version' => '7.4.14.0',
-            'reference' => '9a3a56a4a1e65a5cb4f8d13801fe8ab0a170e358',
+            'pretty_version' => 'v7.4.18',
+            'version' => '7.4.18.0',
+            'reference' => 'e088da50b813f32473a76871616cbb8fa54653a8',
             'type' => 'library',
             'install_path' => __DIR__ . '/../symfony/var-dumper',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'symfony/yaml' => array(
-            'pretty_version' => 'v7.4.14',
-            'version' => '7.4.14.0',
-            'reference' => 'f8f328665ace2370d1e10645b807ba1646dc7dcc',
+            'pretty_version' => 'v7.4.20',
+            'version' => '7.4.20.0',
+            'reference' => '0222bf4dfaa1e3ceb8fff579635d655f2950d5a7',
             'type' => 'library',
             'install_path' => __DIR__ . '/../symfony/yaml',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'tecnickcom/tcpdf' => array(
-            'pretty_version' => '6.11.3',
-            'version' => '6.11.3.0',
-            'reference' => 'b18f6119161019916c5bb07cb8da5205ae5c1b63',
+            'pretty_version' => '6.11.4',
+            'version' => '6.11.4.0',
+            'reference' => 'fbbaf14cfae8fe646f154f7c530d15ec25764040',
             'type' => 'library',
             'install_path' => __DIR__ . '/../tecnickcom/tcpdf',
             'aliases' => array(),
             'dev_requirement' => false,
         ),
         'webmozart/assert' => array(
-            'pretty_version' => '2.4.1',
-            'version' => '2.4.1.0',
-            'reference' => '2ccb7c2e821038c03a3e6e1700c570c158c55f70',
+            'pretty_version' => '2.5.0',
+            'version' => '2.5.0.0',
+            'reference' => '8a163706bbcac613733dba03f51e13b5eb1bb819',
             'type' => 'library',
             'install_path' => __DIR__ . '/../webmozart/assert',
             'aliases' => array(),
@@ -271,7 +271,7 @@
         'xoopscore27/libraries' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '974f618ee91046210372a32e3743e54db15d9e91',
+            'reference' => '97110d0d50fbcd040dd05fe597861967b54e061d',
             'type' => 'metapackage',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/VERSION b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/VERSION
index 35e3d1bab..877958519 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/VERSION
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/VERSION
@@ -1 +1 @@
-4.19.0
\ No newline at end of file
+4.19.1
\ No newline at end of file
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.includes.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.includes.php
index 1f99a4aa2..18b1150ae 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.includes.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.includes.php
@@ -7,7 +7,7 @@
  * primary concern and you are using an opcode cache. PLEASE DO NOT EDIT THIS
  * FILE, changes will be overwritten the next time the script is run.
  *
- * @version 4.19.0
+ * @version 4.19.1
  *
  * @warning
  *      You must *not* include any other HTML Purifier files before this file,
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.php
index 31b5a0f79..9fbd33b68 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier.php
@@ -19,7 +19,7 @@
  */
 
 /*
-    HTML Purifier 4.19.0 - Standards Compliant HTML Filtering
+    HTML Purifier 4.19.1 - Standards Compliant HTML Filtering
     Copyright (C) 2006-2008 Edward Z. Yang
 
     This library is free software; you can redistribute it and/or
@@ -58,12 +58,12 @@ class HTMLPurifier
      * Version of HTML Purifier.
      * @type string
      */
-    public $version = '4.19.0';
+    public $version = '4.19.1';
 
     /**
      * Constant with version of HTML Purifier.
      */
-    const VERSION = '4.19.0';
+    const VERSION = '4.19.1';
 
     /**
      * Global configuration object.
@@ -174,6 +174,7 @@ public function purify($html, $config = null)
         $id_accumulator = HTMLPurifier_IDAccumulator::build($config, $context);
         $context->register('IDAccumulator', $id_accumulator);
 
+        $html = (string) $html;
         $html = HTMLPurifier_Encoder::convertToUTF8($html, $config, $context);
 
         // setup filters
@@ -199,7 +200,7 @@ public function purify($html, $config = null)
         // maybe prepare(), but later
 
         for ($i = 0, $filter_size = count($filters); $i < $filter_size; $i++) {
-            $html = $filters[$i]->preFilter($html, $config, $context);
+            $html = (string) $filters[$i]->preFilter($html, $config, $context);
         }
 
         // purified HTML
@@ -220,7 +221,7 @@ public function purify($html, $config = null)
             );
 
         for ($i = $filter_size - 1; $i >= 0; $i--) {
-            $html = $filters[$i]->postFilter($html, $config, $context);
+            $html = (string) $filters[$i]->postFilter($html, $config, $context);
         }
 
         $html = HTMLPurifier_Encoder::convertFromUTF8($html, $config, $context);
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php
index 256408e2f..a0069b0a9 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Config.php
@@ -21,7 +21,7 @@ class HTMLPurifier_Config
      * HTML Purifier's version
      * @type string
      */
-    public $version = '4.19.0';
+    public $version = '4.19.1';
 
     /**
      * Whether or not to automatically finalize
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php
index 6ba9ad2d9..7df36b411 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php
@@ -239,13 +239,18 @@ private function _prepareDir($config)
             } elseif (!$this->_testPermissions($base, $chmod)) {
                 return false;
             }
-            if (!@mkdir($directory, $chmod) && !is_dir($directory)) {
+            $created = @mkdir($directory, $chmod);
+            if (!$created && !is_dir($directory)) {
                 trigger_error(
                     'Could not create directory ' . $directory . '',
                     E_USER_WARNING
                 );
                 return false;
             }
+            if ($created) {
+                // Ensure the directory has the correct permissions, since mkdir() obeys the umask
+                @chmod($directory, $chmod);
+            }
             if (!$this->_testPermissions($directory, $chmod)) {
                 return false;
             }
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer/HTML/4.19.1,19080e8571546cc135ea74472a1cabdb683c94e5,1.ser b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer/HTML/4.19.1,19080e8571546cc135ea74472a1cabdb683c94e5,1.ser
new file mode 100644
index 000000000..881e96882
Binary files /dev/null and b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer/HTML/4.19.1,19080e8571546cc135ea74472a1cabdb683c94e5,1.ser differ
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php
index e7e3cac1a..d00372057 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Filter/ExtractStyleBlocks.php
@@ -110,6 +110,7 @@ public function preFilter($html, $config, $context)
         // NB: this must be NON-greedy because if we have
         // <style>foo</style>  <style>bar</style>
         // we must not grab foo</style>  <style>bar
+        $html = (string) $html;
         $html = preg_replace_callback('#<style(?:\s.*)?>(.*)<\/style>#isU', array($this, 'styleCallback'), $html);
         $style_blocks = $this->_styleMatches;
         $this->_styleMatches = array(); // reset
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
index 42d514447..822ba7bda 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Injector/RemoveSpansWithoutAttributes.php
@@ -74,7 +74,7 @@ public function handleElement(&$token)
 
         if ($current instanceof HTMLPurifier_Token_End && $current->name === 'span') {
             // Mark closing span tag for deletion
-            $this->markForDeletion->attach($current);
+            $this->markForDeletion->offsetSet($current);
             // Delete open span tag
             $token = false;
         }
@@ -85,8 +85,8 @@ public function handleElement(&$token)
      */
     public function handleEnd(&$token)
     {
-        if ($this->markForDeletion->contains($token)) {
-            $this->markForDeletion->detach($token);
+        if ($this->markForDeletion->offsetExists($token)) {
+            $this->markForDeletion->offsetUnset($token);
             $token = false;
         }
     }
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php
index 793edc89a..6b8e5ebb3 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/Lexer.php
@@ -295,10 +295,11 @@ protected static function CDATACallback($matches)
      */
     public function normalize($html, $config, $context)
     {
+        $html = (string) $html;
         // normalize newlines to \n
         if ($config->get('Core.NormalizeNewlines')) {
-            $html = str_replace("\r\n", "\n", (string)$html);
-            $html = str_replace("\r", "\n", (string)$html);
+            $html = str_replace("\r\n", "\n", $html);
+            $html = str_replace("\r", "\n", $html);
         }
 
         if ($config->get('HTML.Trusted')) {
diff --git a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URISchemeRegistry.php b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URISchemeRegistry.php
index 4ac8a0b76..7dcaf9ab6 100644
--- a/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URISchemeRegistry.php
+++ b/htdocs/xoops_lib/vendor/ezyang/htmlpurifier/library/HTMLPurifier/URISchemeRegistry.php
@@ -44,6 +44,10 @@ public function getScheme($scheme, $config, $context)
             $config = HTMLPurifier_Config::createDefault();
         }
 
+        if ($scheme === null) {
+            return;
+        }
+
         // important, otherwise attacker could include arbitrary file
         $allowed_schemes = $config->get('URI.AllowedSchemes');
         if (!$config->get('URI.OverrideAllowedSchemes') &&
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/CHANGELOG.md b/htdocs/xoops_lib/vendor/firebase/php-jwt/CHANGELOG.md
index 17d7a630b..8597266f5 100644
--- a/htdocs/xoops_lib/vendor/firebase/php-jwt/CHANGELOG.md
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## [7.1.1](https://github.com/googleapis/php-jwt/compare/v7.1.0...v7.1.1) (2026-09-02)
+
+
+### Bug Fixes
+
+* Limit the number of segments a JWT can be exploded into ([#639](https://github.com/googleapis/php-jwt/issues/639)) ([93d248c](https://github.com/googleapis/php-jwt/commit/93d248c650aea615d74a5ffa20c91c7a818e9b8d))
+
 ## [7.1.0](https://github.com/googleapis/php-jwt/compare/v7.0.5...v7.1.0) (2026-06-11)
 
 
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/VERSION b/htdocs/xoops_lib/vendor/firebase/php-jwt/VERSION
new file mode 100644
index 000000000..b26a34e47
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/VERSION
@@ -0,0 +1 @@
+7.2.1
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/composer.json b/htdocs/xoops_lib/vendor/firebase/php-jwt/composer.json
index 50d0ff91c..89c8c7019 100644
--- a/htdocs/xoops_lib/vendor/firebase/php-jwt/composer.json
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/composer.json
@@ -33,13 +33,21 @@
         }
     },
     "require-dev": {
-        "guzzlehttp/guzzle": "^7.4",
-        "phpspec/prophecy-phpunit": "^2.0",
+        "guzzlehttp/guzzle": "^7.4||^8.0",
+        "phpspec/prophecy-phpunit": "^2.2",
         "phpunit/phpunit": "^9.5",
         "psr/cache": "^2.0||^3.0",
         "psr/http-client": "^1.0",
         "psr/http-factory": "^1.0",
         "phpfastcache/phpfastcache": "^9.2",
         "phpseclib/phpseclib": "~3.0"
+    },
+    "extra": {
+        "component": {
+            "id": "jwt",
+            "target": "googleapis/php-jwt.git",
+            "path": "Jwt",
+            "entry": "README.md"
+        }
     }
 }
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWK.php b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWK.php
index 7a1f44883..1870c6fe0 100644
--- a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWK.php
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWK.php
@@ -293,7 +293,8 @@ private static function createPemFromModulusAndExponent(
      * DER-encode the length
      *
      * DER supports lengths up to (2**8)**127, however, we'll only support lengths up to (2**8)**4.  See
-     * {@link http://itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf#p=13 X.690 paragraph 8.1.3} for more information.
+     * {@link http://itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf#p=13 X.690 paragraph 8.1.3}
+     * for more information.
      *
      * @param int $length
      * @return string
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWT.php b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWT.php
index 1c71ab3d0..f9a21e207 100644
--- a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWT.php
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/JWT.php
@@ -90,7 +90,8 @@ class JWT
      * @throws UnexpectedValueException     Provided JWT was invalid
      * @throws SignatureInvalidException    Provided JWT was invalid because the signature verification failed
      * @throws BeforeValidException         Provided JWT is trying to be used before it's eligible as defined by 'nbf'
-     * @throws BeforeValidException         Provided JWT is trying to be used before it's been created as defined by 'iat'
+     * @throws BeforeValidException         Provided JWT is trying to be used before it's
+     *                                      been created as defined by 'iat'
      * @throws ExpiredException             Provided JWT has since expired, as defined by the 'exp' claim
      *
      * @uses jsonDecode
@@ -107,7 +108,7 @@ public static function decode(
         if (empty($keyOrKeyArray)) {
             throw new InvalidArgumentException('Key may not be empty');
         }
-        $tks = \explode('.', $jwt);
+        $tks = \explode('.', $jwt, 4);
         if (\count($tks) !== 3) {
             throw new UnexpectedValueException('Wrong number of segments');
         }
@@ -313,7 +314,8 @@ public static function sign(
      *
      * @param string $msg         The original message (header and body)
      * @param string $signature   The original signature
-     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For Ed*, ES*, HS*, a string key works. for RS*, must be an instance of OpenSSLAsymmetricKey
+     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For Ed*, ES*, HS*, a string key works.
+     *                                                        for RS*, must be an instance of OpenSSLAsymmetricKey
      * @param string $alg         The algorithm
      *
      * @return bool
diff --git a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/Key.php b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/Key.php
index 694d3b13b..39d7f432e 100644
--- a/htdocs/xoops_lib/vendor/firebase/php-jwt/src/Key.php
+++ b/htdocs/xoops_lib/vendor/firebase/php-jwt/src/Key.php
@@ -17,8 +17,7 @@ public function __construct(
         #[\SensitiveParameter] private $keyMaterial,
         private string $algorithm
     ) {
-        if (
-            !\is_string($keyMaterial)
+        if (!\is_string($keyMaterial)
             && !$keyMaterial instanceof OpenSSLAsymmetricKey
             && !$keyMaterial instanceof OpenSSLCertificate
         ) {
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/CHANGELOG.md b/htdocs/xoops_lib/vendor/monolog/monolog/CHANGELOG.md
index 2c89f9d18..15a35665c 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/CHANGELOG.md
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/CHANGELOG.md
@@ -1,3 +1,39 @@
+### 3.12.1 (2026-09-29)
+
+  * Fixed `Logger` silently dropping every record for the rest of the process once the infinite loop guard aborted a nested logging cycle, which could hit long-running workers (#2072)
+  * Fixed `RedactingFormatter` letting secrets containing `&`, `<` or `>` through when wrapping an `HtmlFormatter` (#2069)
+  * Fixed `SocketHandler` throwing the writing timeout immediately when the first write made no progress, instead of waiting for the configured timeout (#2071)
+  * Fixed `RotatingFileHandler` computing the first rotation in the default timezone instead of the `$timezone` passed to the constructor (#2070)
+
+### 3.12.0 (2026-09-09)
+
+  * Added support for reading the timestamp of new records from a PSR-20 clock, via a new `$clock` constructor param and `Logger::setClock()` (#2065)
+  * Added support for `#[WithMonologChannel]` on constructor/method parameters, so a channel can be bound to a single argument instead of the whole class (#2068)
+  * Fixed `TelegramBotHandler` breaking HTML markup when truncating or splitting long messages, open tags are now closed at the end of a chunk and reopened in the next one (#2066)
+  * Fixed `RedactingFormatter` not redacting secrets nested inside array values of sensitive keys (#2067)
+
+### 3.11.0 (2026-09-02)
+
+  * Security: Fixed potential XSS in `BrowserConsoleHandler` when logging user provided content
+  * Added `RedactingFormatter` to automatically redact sensitive data from records, based on key names, `#[SensitiveParameter]` constructor params and/or regex patterns (#2041)
+  * Added `FrankenPhpHandler` to log records via FrankenPHP's frankenphp_log() function (#2056)
+  * Added `LogMonsterHandler` which complains if the code did not log enough records before the process/request ends, like a dead man's switch for logs (#2039)
+  * Added `FILE_PER_HOUR` rotation mode to `RotatingFileHandler` (#2040)
+  * Added `ErrorHandler::captureStackTraces()` to attach the stack trace of PHP errors to the records it generates (#2060)
+  * Added `NormalizerFormatter::setMaxTraceLength()` to limit how many stack trace frames are included when normalizing exceptions (#2015)
+  * Added extension points to `TelegramBotHandler` to change the API URL (e.g. for a self-hosted Bot API server) and to send extra curl headers (#2029)
+  * Added ability to override `IntrospectionProcessor`'s `SKIP_FUNCTIONS` in subclasses (#2050)
+  * Added `$maxLength` param to `SyslogUdpHandler`/`UdpSocket` to keep datagrams below the path MTU, as fragmented UDP packets are often dropped (#2049)
+  * Fixed `StreamHandler` truncating writes on non-blocking streams, it now loops until the whole record is written (#2016)
+  * Fixed stack trace frames without file/line being skipped, they are now reported as `internal[function]` entries so traces are not truncated or empty (#2061)
+  * Fixed `RotatingFileHandler` cleanup not finding files behind stream wrappers (e.g. private://) as glob() cannot see through those (#2058)
+  * Fixed `RotatingFileHandler` not using the configured timezone when computing the next rotation time (#2022)
+  * Fixed scalars being replaced by the "Over N levels deep" message instead of being output when the max normalization depth is reached (#2042)
+  * Fixed `DeduplicationHandler` failing with an undefined array key error when the store file is written to concurrently (#2020)
+  * Fixed `TelegramBotHandler` swallowing errors when the API returns a non-JSON response (#2030)
+  * Fixed `AbstractProcessingHandler::handle()` reading `$bubble` directly instead of calling `getBubble()`, so overrides of it were ignored (#2031)
+  * Fixed warning on PHP 8.5 when `ErrorHandler` sets the HTTP response code and a status line was already registered (#2027)
+
 ### 3.10.0 (2026-01-02)
 
   * Added automatic directory cleanup in RotatingFileHandler (#2000)
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/README.md b/htdocs/xoops_lib/vendor/monolog/monolog/README.md
index 0564f96f0..52cf8c7c4 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/README.md
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/README.md
@@ -1,4 +1,4 @@
-<p align="center"><img src="logo.jpg" alt="Monolog" width="400"></p>
+<p align="center"><img src="logo.png" alt="Monolog" width="400"></p>
 
 # Monolog - Logging for PHP [![Continuous Integration](https://github.com/Seldaek/monolog/workflows/Continuous%20Integration/badge.svg?branch=main)](https://github.com/Seldaek/monolog/actions)
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/composer.json b/htdocs/xoops_lib/vendor/monolog/monolog/composer.json
index b0fb2d7a5..a547ea06c 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/composer.json
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/composer.json
@@ -32,6 +32,7 @@
         "phpstan/phpstan-strict-rules": "^2",
         "phpunit/phpunit": "^10.5.17 || ^11.0.7",
         "predis/predis": "^1.1 || ^2",
+        "psr/clock": "^1.0",
         "rollbar/rollbar": "^4.0",
         "ruflin/elastica": "^7 || ^8",
         "symfony/mailer": "^5.4 || ^6",
@@ -51,7 +52,8 @@
         "ext-mbstring": "Allow to work properly with unicode symbols",
         "ext-sockets": "Allow sending log messages to a Syslog server (via UDP driver)",
         "ext-curl": "Required to send log messages using the IFTTTHandler, the LogglyHandler, the SendGridHandler, the SlackWebhookHandler or the TelegramBotHandler",
-        "ext-openssl": "Required to send log messages using SSL"
+        "ext-openssl": "Required to send log messages using SSL",
+        "psr/clock": "Required to pass a clock to the Logger and control the timestamp of log records"
     },
     "autoload": {
         "psr-4": {"Monolog\\": "src/Monolog"}
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Attribute/WithMonologChannel.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Attribute/WithMonologChannel.php
index 862e05b33..0feb213eb 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Attribute/WithMonologChannel.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Attribute/WithMonologChannel.php
@@ -12,14 +12,15 @@
 namespace Monolog\Attribute;
 
 /**
- * A reusable attribute to help configure a class as expecting a given logger channel.
+ * A reusable attribute to help configure a class, or one of its constructor/method arguments,
+ * as expecting a given logger channel.
  *
  * Using it offers no guarantee: it needs to be leveraged by a Monolog third-party consumer.
  *
  * Using it with the Monolog library only has no effect at all: wiring the logger instance into
  * other classes is not managed by Monolog.
  */
-#[\Attribute(\Attribute::TARGET_CLASS)]
+#[\Attribute(\Attribute::TARGET_CLASS | \Attribute::TARGET_PARAMETER)]
 final class WithMonologChannel
 {
     public function __construct(
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/ErrorHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/ErrorHandler.php
index 805f2dfd9..c10f7be65 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/ErrorHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/ErrorHandler.php
@@ -41,6 +41,9 @@ class ErrorHandler
 
     private bool $hasFatalErrorHandler = false;
 
+    /** @var int bitmask of E_* constants to capture stack traces for, 0 to disable */
+    private int $captureStackTraceTypes = 0;
+
     private string $fatalLevel = LogLevel::ALERT;
 
     private string|null $reservedMemory = null;
@@ -139,6 +142,30 @@ public function registerFatalHandler($level = null, int $reservedMemorySize = 20
         return $this;
     }
 
+    /**
+     * Attaches an ErrorException carrying the stack trace of the error to the log record's context
+     *
+     * PHP does not report where a warning/notice/deprecation came from, so without this the records
+     * only point at the line which raised the error, and not at its caller. Formatters rendering
+     * stack traces (e.g. LineFormatter::includeStacktraces) then show the full call site.
+     *
+     * This is off by default because context.exception makes errors look like exceptions to the
+     * handlers which treat that key specially, e.g. NewRelicHandler reports them via
+     * newrelic_notice_error and RollbarHandler as exception occurrences, and because formatters
+     * extending NormalizerFormatter then include the whole trace in every record. Narrowing
+     * $errorTypes is wise if you log a lot of errors: E_DEPRECATED in particular can be very
+     * frequent in legacy code while rarely being worth a stack trace.
+     *
+     * @param  int   $errorTypes bitmask of E_* constants to capture stack traces for
+     * @return $this
+     */
+    public function captureStackTraces(bool $capture = true, int $errorTypes = E_ALL): self
+    {
+        $this->captureStackTraceTypes = $capture ? $errorTypes : 0;
+
+        return $this;
+    }
+
     /**
      * @return array<class-string, LogLevel::*>
      */
@@ -195,7 +222,8 @@ private function handleException(\Throwable $e): never
         }
 
         if (!headers_sent() && \in_array(strtolower((string) \ini_get('display_errors')), ['0', '', 'false', 'off', 'none', 'no'], true)) {
-            http_response_code(500);
+            // PHP 8.5+ warns if header('HTTP/...') already staged a status line, which is undetectable from userland
+            @http_response_code(500);
         }
 
         exit(255);
@@ -207,13 +235,23 @@ private function handleError(int $code, string $message, string $file = '', int
             return false;
         }
 
+        $isFatal = $this->hasFatalErrorHandler && \in_array($code, self::FATAL_ERRORS, true);
+
+        $trace = null;
+        if ($isFatal || 0 !== ($this->captureStackTraceTypes & $code)) {
+            $trace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);
+            array_shift($trace); // Exclude handleError from trace
+        }
+
         // fatal error codes are ignored if a fatal error handler is present as well to avoid duplicate log entries
-        if (!$this->hasFatalErrorHandler || !\in_array($code, self::FATAL_ERRORS, true)) {
+        if (!$isFatal) {
             $level = $this->errorLevelMap[$code] ?? LogLevel::CRITICAL;
-            $this->logger->log($level, self::codeToString($code).': '.$message, ['code' => $code, 'message' => $message, 'file' => $file, 'line' => $line]);
+            $context = ['code' => $code, 'message' => $message, 'file' => $file, 'line' => $line];
+            if (null !== $trace) {
+                $context['exception'] = self::createErrorException($code, $message, $file, $line, $trace);
+            }
+            $this->logger->log($level, self::codeToString($code).': '.$message, $context);
         } else {
-            $trace = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS);
-            array_shift($trace); // Exclude handleError from trace
             $this->lastFatalData = ['type' => $code, 'message' => $message, 'file' => $file, 'line' => $line, 'trace' => $trace];
         }
 
@@ -240,11 +278,17 @@ public function handleFatalError(): void
             $lastError = error_get_last();
         }
         if (\is_array($lastError) && \in_array($lastError['type'], self::FATAL_ERRORS, true)) {
+            // PHP 8.5+ reports a trace for fatal errors which never reach the error handler (OOM, timeouts)
             $trace = $lastError['trace'] ?? null;
+            $context = ['code' => $lastError['type'], 'message' => $lastError['message'], 'file' => $lastError['file'], 'line' => $lastError['line'], 'trace' => $trace];
+            if (\is_array($trace)) {
+                /** @var list<array<string, mixed>> $trace */
+                $context['exception'] = self::createErrorException($lastError['type'], $lastError['message'], $lastError['file'], $lastError['line'], $trace);
+            }
             $this->logger->log(
                 $this->fatalLevel,
                 'Fatal Error ('.self::codeToString($lastError['type']).'): '.$lastError['message'],
-                ['code' => $lastError['type'], 'message' => $lastError['message'], 'file' => $lastError['file'], 'line' => $lastError['line'], 'trace' => $trace]
+                $context
             );
 
             if ($this->logger instanceof Logger) {
@@ -255,6 +299,20 @@ public function handleFatalError(): void
         }
     }
 
+    /**
+     * @param list<array<string, mixed>> $trace
+     */
+    private static function createErrorException(int $code, string $message, string $file, int $line, array $trace): \ErrorException
+    {
+        $e = new \ErrorException($message, 0, $code, $file, $line);
+
+        // Exception::getTrace() is final, so overwriting the private property is the only way to
+        // report the real call site instead of ErrorHandler's own frame
+        (new \ReflectionProperty(\Exception::class, 'trace'))->setValue($e, $trace);
+
+        return $e;
+    }
+
     private static function codeToString(int $code): string
     {
         return match ($code) {
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/GelfMessageFormatter.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/GelfMessageFormatter.php
index bf8ed2411..4774bde00 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/GelfMessageFormatter.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/GelfMessageFormatter.php
@@ -87,11 +87,11 @@ public function __construct(?string $systemName = null, ?string $extraPrefix = n
     public function format(LogRecord $record): Message
     {
         $context = $extra = [];
-        if (isset($record->context)) {
+        if ($record->context !== []) {
             /** @var array<array<mixed>|bool|float|int|string|null> $context */
             $context = parent::normalize($record->context);
         }
-        if (isset($record->extra)) {
+        if ($record->extra !== []) {
             /** @var array<array<mixed>|bool|float|int|string|null> $extra */
             $extra = parent::normalize($record->extra);
         }
@@ -110,7 +110,7 @@ public function format(LogRecord $record): Message
             $message->setShortMessage(Utils::substr($record->message, 0, $this->maxLength));
         }
 
-        if (isset($record->channel)) {
+        if ($record->channel !== '') {
             $message->setAdditional('facility', $record->channel);
         }
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/JsonFormatter.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/JsonFormatter.php
index fa11d0ef0..c9281a427 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/JsonFormatter.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/JsonFormatter.php
@@ -160,6 +160,10 @@ protected function formatBatchNewlines(array $records): string
      */
     protected function normalize(mixed $data, int $depth = 0): mixed
     {
+        if (is_null($data) || is_scalar($data)) {
+            return $data;
+        }
+
         if ($depth > $this->maxNormalizeDepth) {
             return 'Over '.$this->maxNormalizeDepth.' levels deep, aborting normalization';
         }
@@ -209,11 +213,7 @@ protected function normalize(mixed $data, int $depth = 0): mixed
             return $data;
         }
 
-        if (\is_resource($data)) {
-            return parent::normalize($data);
-        }
-
-        return $data;
+        return parent::normalize($data);
     }
 
     /**
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php
index 60da29cf7..7fc6de460 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/NormalizerFormatter.php
@@ -28,6 +28,7 @@ class NormalizerFormatter implements FormatterInterface
     protected string $dateFormat;
     protected int $maxNormalizeDepth = 9;
     protected int $maxNormalizeItemCount = 1000;
+    protected ?int $maxTraceLength = null;
 
     private int $jsonEncodeOptions = Utils::DEFAULT_JSON_FLAGS;
 
@@ -122,6 +123,24 @@ public function setMaxNormalizeItemCount(int $maxNormalizeItemCount): self
         return $this;
     }
 
+    /**
+     * The maximum number of stack trace frames to include
+     */
+    public function getMaxTraceLength(): ?int
+    {
+        return $this->maxTraceLength;
+    }
+
+    /**
+     * @return $this
+     */
+    public function setMaxTraceLength(?int $maxTraceLength): self
+    {
+        $this->maxTraceLength = $maxTraceLength;
+
+        return $this;
+    }
+
     /**
      * Enables `json_encode` pretty print.
      *
@@ -174,10 +193,6 @@ protected function normalizeRecord(LogRecord $record): array
      */
     protected function normalize(mixed $data, int $depth = 0): mixed
     {
-        if ($depth > $this->maxNormalizeDepth) {
-            return 'Over ' . $this->maxNormalizeDepth . ' levels deep, aborting normalization';
-        }
-
         if (null === $data || \is_scalar($data)) {
             if (\is_float($data)) {
                 if (is_infinite($data)) {
@@ -191,6 +206,10 @@ protected function normalize(mixed $data, int $depth = 0): mixed
             return $data;
         }
 
+        if ($depth > $this->maxNormalizeDepth) {
+            return 'Over ' . $this->maxNormalizeDepth . ' levels deep, aborting normalization';
+        }
+
         if (\is_array($data)) {
             $normalized = [];
 
@@ -290,14 +309,36 @@ protected function normalizeException(Throwable $e, int $depth = 0)
             }
         }
 
-        $trace = $e->getTrace();
+        $trace = array_slice($e->getTrace(), 0, $this->maxTraceLength);
         foreach ($trace as $frame) {
-            if (isset($frame['file'], $frame['line'])) {
+            if (isset($frame['file'])) {
                 $file = $frame['file'];
                 if ($this->basePath !== '') {
-                    $file = preg_replace('{^'.preg_quote($this->basePath).'}', '', $file);
+                    $file = preg_replace('{^'.preg_quote($this->basePath).'}', '', $file) ?? $file;
+                }
+                $data['trace'][] = $file.':'.($frame['line'] ?? 0);
+            } else {
+                // Frames called by the engine itself have no file/line: shutdown functions,
+                // callbacks run by internal functions, destructors. Skipping them made traces
+                // look shorter than they were, and entirely empty for fatal errors caught in a
+                // shutdown function, so they are reported by name instead.
+                $call = $frame['function'];
+                // since PHP 8.4 a closure is named after its declaring scope, which already
+                // includes the class, so prefixing it again would just repeat it
+                if (isset($frame['class']) && !str_starts_with($call, '{closure:')) {
+                    // before 8.4 the name is <namespace>\{closure}, and the class has the namespace
+                    $call = str_ends_with($call, '\{closure}') ? '{closure}' : $call;
+                    $call = Utils::getClassName($frame['class']).($frame['type'] ?? '::').$call;
+                }
+                // anonymous classes carry their declaration site after a NUL byte, which truncates
+                // syslog lines and is not valid JSON; PHP 8.4 embeds it in closure names too
+                $call = preg_replace('{@anonymous\x00.*?\$[0-9a-f]++(?=::|$)}s', '@anonymous', $call) ?? $call;
+                if ($this->basePath !== '') {
+                    // closure names embed the file they were declared in since PHP 8.4, so the
+                    // pattern cannot be anchored; limit it or a recurring base path is stripped twice
+                    $call = preg_replace('{'.preg_quote($this->basePath).'}', '', $call, 1) ?? $call;
                 }
-                $data['trace'][] = $file.':'.$frame['line'];
+                $data['trace'][] = 'internal['.$call.']:0';
             }
         }
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/RedactingFormatter.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/RedactingFormatter.php
new file mode 100644
index 000000000..65a311ae4
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/RedactingFormatter.php
@@ -0,0 +1,374 @@
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of the Monolog package.
+ *
+ * (c) Jordi Boggiano <j.boggiano@seld.be>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Monolog\Formatter;
+
+use Monolog\LogRecord;
+use Monolog\Utils;
+
+/**
+ * Wraps another formatter to redact sensitive data from log records.
+ *
+ * It works in three passes so that it can mask secrets wherever they end up:
+ *
+ *  - Before delegating, it masks the value of any context/extra key whose name
+ *    matches one of the configured sensitive keys (case-insensitive, recursive).
+ *  - After delegating, it removes those same secret values from the wrapped
+ *    formatter's output, which catches the copies masking the record cannot
+ *    reach, e.g. a secret interpolated into the message by the
+ *    PsrLogMessageProcessor or embedded in an exception message.
+ *  - Last, it runs the configured regex patterns over the output, which catches
+ *    secrets that only became strings once the inner formatter normalized
+ *    objects (e.g. tokens buried in an exception stack trace). If a pattern
+ *    cannot be applied, the record is dropped instead of emitted unredacted.
+ *
+ * On top of the sensitive keys, secrets are also read from the properties of the
+ * objects in the record matching a constructor parameter marked
+ * #[SensitiveParameter]. Those can only be handled by the output pass, as the
+ * objects carrying them cannot be modified. This is the one part that reflects on
+ * every logged object, so it can be turned off with $redactSensitiveParameters.
+ *
+ * Only string and array output can be swept, so wrapping a formatter which returns
+ * objects (e.g. the ElasticaFormatter) leaves you with the key masking alone.
+ *
+ * Because it is a formatter rather than a processor, it is guaranteed to run
+ * after every processor (both Logger- and Handler-level), so it always sees the
+ * final record with all data at hand.
+ *
+ * @author Jordi Boggiano <j.boggiano@seld.be>
+ */
+final class RedactingFormatter implements WrappingFormatterInterface
+{
+    /**
+     * Matches long token-like words (30+ alphanumerics, optionally prefixed like api_key_),
+     * which are very likely to be secrets/tokens. Provided as an opt-in pattern as it may
+     * cause collateral damage on legitimate long strings (hashes, UUIDs, base64, ...).
+     */
+    public const TOKEN_PATTERN = '{\b(?:[a-z]+_)*[a-zA-Z0-9]{30,}\b}';
+
+    /**
+     * How deep to walk the record and the output, mirrors NormalizerFormatter's default
+     */
+    private const MAX_DEPTH = 9;
+
+    /** @var list<string> Lowercased sensitive keys */
+    private array $sensitiveKeys;
+
+    /** @var list<string> */
+    private array $patterns;
+
+    /** @var array<class-string, array<string, \ReflectionProperty>> */
+    private array $sensitiveProperties = [];
+
+    /**
+     * @param FormatterInterface $formatter                 The formatter to wrap and whose output gets redacted
+     * @param list<string>       $sensitiveKeys             Exact context/extra keys whose values to mask (case-insensitive)
+     * @param list<string>       $patterns                  PCRE patterns to mask in the formatted output (e.g. self::TOKEN_PATTERN)
+     * @param string             $mask                      Replacement token
+     * @param bool               $redactSensitiveParameters Whether to also read secrets off the properties matching a
+     *                                                      #[SensitiveParameter] constructor parameter, which requires
+     *                                                      walking and reflecting on every object in the record
+     * @param int                $minSecretLength           Minimum length a secret must have to be removed from the
+     *                                                      output, to avoid short values like "pass" redacting
+     *                                                      unrelated data
+     *
+     * @throws \InvalidArgumentException If a pattern is not a valid PCRE regex
+     */
+    public function __construct(
+        private readonly FormatterInterface $formatter,
+        array $sensitiveKeys = ['password', 'passwd', 'pwd', 'secret', 'token', 'api_key', 'apikey', 'authorization', 'auth', 'cookie'],
+        array $patterns = [],
+        private readonly string $mask = '[REDACTED]',
+        private readonly bool $redactSensitiveParameters = true,
+        private readonly int $minSecretLength = 5,
+    ) {
+        $this->sensitiveKeys = array_values(array_map('strtolower', $sensitiveKeys));
+
+        foreach ($patterns as $pattern) {
+            if (@preg_match($pattern, '') === false) {
+                throw new \InvalidArgumentException(sprintf('Invalid redaction pattern provided to RedactingFormatter: %s', var_export($pattern, true)));
+            }
+        }
+        $this->patterns = array_values($patterns);
+    }
+
+    public function getWrappedFormatter(): FormatterInterface
+    {
+        return $this->formatter;
+    }
+
+    public function format(LogRecord $record)
+    {
+        // secrets must be collected before the keys get masked, as masking loses the values
+        $secrets = $this->collectSecrets([$record]);
+
+        return $this->sweep($this->formatter->format($this->redactRecord($record)), $secrets);
+    }
+
+    public function formatBatch(array $records)
+    {
+        $secrets = $this->collectSecrets($records);
+
+        foreach ($records as $key => $record) {
+            $records[$key] = $this->redactRecord($record);
+        }
+
+        return $this->sweep($this->formatter->formatBatch($records), $secrets);
+    }
+
+    private function redactRecord(LogRecord $record): LogRecord
+    {
+        return $record->with(
+            context: $this->redactKeys($record->context),
+            extra: $this->redactKeys($record->extra),
+        );
+    }
+
+    /**
+     * @param  array<mixed> $data
+     * @return array<mixed>
+     */
+    private function redactKeys(array $data, int $depth = 0): array
+    {
+        // context comes from userland and can hold a self-referencing array
+        if ($depth > self::MAX_DEPTH) {
+            return $data;
+        }
+
+        foreach ($data as $key => $value) {
+            if (\is_string($key) && \in_array(strtolower($key), $this->sensitiveKeys, true)) {
+                $data[$key] = $this->mask;
+            } elseif (\is_array($value)) {
+                $data[$key] = $this->redactKeys($value, $depth + 1);
+            }
+        }
+
+        return $data;
+    }
+
+    /**
+     * Gathers the secret values present in the given records, longest first
+     *
+     * @param  iterable<LogRecord> $records
+     * @return list<string>
+     */
+    private function collectSecrets(iterable $records): array
+    {
+        $secrets = [];
+        $seen = [];
+        foreach ($records as $record) {
+            $this->collect($record->context, $secrets, $seen, 0);
+            $this->collect($record->extra, $secrets, $seen, 0);
+        }
+
+        if ([] === $secrets) {
+            return [];
+        }
+
+        // a secret shows up escaped in json output (quotes/backslashes/newlines) and in html output
+        // (& < >), so every spelling the wrapped formatter can produce has to be looked for
+        $escapedSecrets = [];
+        foreach ($secrets as $secret) {
+            foreach ([substr(Utils::jsonEncode($secret, null, true), 1, -1), htmlspecialchars($secret, ENT_NOQUOTES, 'UTF-8')] as $escaped) {
+                if ($escaped !== $secret && $escaped !== '') {
+                    $escapedSecrets[] = $escaped;
+                }
+            }
+        }
+
+        $secrets = array_values(array_unique(array_merge($secrets, $escapedSecrets)));
+        // longest first, so that overlapping secrets do not leave fragments behind
+        usort($secrets, static fn (string $a, string $b) => \strlen($b) <=> \strlen($a));
+
+        return $secrets;
+    }
+
+    /**
+     * @param list<string>      $secrets
+     * @param array<int, true>  $seen    Ids of the objects visited so far, to survive cyclic graphs
+     */
+    private function collect(mixed $data, array &$secrets, array &$seen, int $depth): void
+    {
+        if ($depth > self::MAX_DEPTH) {
+            return;
+        }
+
+        if (\is_array($data)) {
+            foreach ($data as $key => $value) {
+                if (\is_string($key) && \in_array(strtolower($key), $this->sensitiveKeys, true)) {
+                    // the value is masked in the record, but a nested array's leaves can still
+                    // leak elsewhere (e.g. json-encoded by PsrLogMessageProcessor)
+                    $this->collectSensitiveValue($value, $secrets, $depth + 1);
+
+                    continue;
+                }
+
+                $this->collect($value, $secrets, $seen, $depth + 1);
+            }
+
+            return;
+        }
+
+        // the array walk above is essentially free, reflecting on objects is not
+        if (!\is_object($data) || !$this->redactSensitiveParameters) {
+            return;
+        }
+
+        $id = spl_object_id($data);
+        if (isset($seen[$id])) {
+            return;
+        }
+        $seen[$id] = true;
+
+        foreach ($this->getSensitiveProperties($data) as $property) {
+            if ($property->isInitialized($data)) {
+                $this->addSecret($property->getValue($data), $secrets);
+            }
+        }
+
+        // public properties only, matching what formatters get to see, but enough to reach
+        // objects nested inside this one
+        foreach (get_object_vars($data) as $value) {
+            $this->collect($value, $secrets, $seen, $depth + 1);
+        }
+    }
+
+    /**
+     * Collects every string leaf nested inside a value under a sensitive key.
+     *
+     * @param list<string> $secrets
+     */
+    private function collectSensitiveValue(mixed $value, array &$secrets, int $depth): void
+    {
+        if ($depth > self::MAX_DEPTH) {
+            return;
+        }
+
+        if (\is_array($value)) {
+            foreach ($value as $item) {
+                $this->collectSensitiveValue($item, $secrets, $depth + 1);
+            }
+
+            return;
+        }
+
+        $this->addSecret($value, $secrets);
+    }
+
+    /**
+     * Reflects the properties of an object matching a #[SensitiveParameter] constructor parameter
+     *
+     * Non-public properties are included as they can still leak through __toString(), and the
+     * result is cached per class as reflecting on every logged object would be far too costly.
+     *
+     * @return array<string, \ReflectionProperty>
+     */
+    private function getSensitiveProperties(object $data): array
+    {
+        $class = $data::class;
+        if (isset($this->sensitiveProperties[$class])) {
+            return $this->sensitiveProperties[$class];
+        }
+
+        $names = Utils::getSensitiveParameterNames($class);
+
+        // PHP 8.2+ wraps the arguments it hides from stack traces in a SensitiveParameterValue,
+        // whose own constructor parameter is not marked. Matched by name and read as a property
+        // so that it does not matter whether symfony/polyfill-php82 is installed on PHP 8.1:
+        // naming the class makes PHPStan report either the @internal getValue() the polyfill
+        // inherits, or a missing class when it is absent.
+        if ('SensitiveParameterValue' === $class) {
+            $names['value'] = true;
+        }
+
+        $properties = [];
+        foreach ($names as $name => $_) {
+            // walking up is required as a private property of a parent class is not
+            // reachable through the child's ReflectionClass
+            for ($reflection = new \ReflectionClass($class); false !== $reflection; $reflection = $reflection->getParentClass()) {
+                if ($reflection->hasProperty($name)) {
+                    $properties[$name] = $reflection->getProperty($name);
+
+                    break;
+                }
+            }
+        }
+
+        return $this->sensitiveProperties[$class] = $properties;
+    }
+
+    /**
+     * @param list<string> $secrets
+     */
+    private function addSecret(mixed $value, array &$secrets): void
+    {
+        // a Stringable secret ends up in the output as its string form, so that is what
+        // has to be looked for
+        if ($value instanceof \Stringable) {
+            try {
+                $value = $value->__toString();
+            } catch (\Throwable) {
+                return;
+            }
+        }
+
+        // ints/floats are left out on purpose, sweeping a digit run out of the output
+        // would silently corrupt unrelated data
+        if (\is_string($value) && $value !== '' && \strlen($value) >= $this->minSecretLength) {
+            $secrets[] = $value;
+        }
+    }
+
+    /**
+     * Removes the collected secrets and applies the configured patterns to the formatter output,
+     * recursing into arrays to support formatters that do not return a string (e.g. MongoDBFormatter).
+     *
+     * @param list<string> $secrets
+     */
+    private function sweep(mixed $formatted, array $secrets, int $depth = 0): mixed
+    {
+        if ([] === $this->patterns && [] === $secrets) {
+            return $formatted;
+        }
+
+        // deeper than any formatter will render anyway, and a custom one may well
+        // hand back a self-referencing array
+        if ($depth > self::MAX_DEPTH) {
+            return $formatted;
+        }
+
+        if (\is_string($formatted)) {
+            if ([] !== $secrets) {
+                $formatted = str_replace($secrets, $this->mask, $formatted);
+            }
+            if ([] !== $this->patterns) {
+                $replaced = preg_replace($this->patterns, $this->mask, $formatted);
+                if (null === $replaced) {
+                    // the patterns could not be applied so the output cannot be trusted, drop it
+                    // entirely. Neither the patterns (which may embed a secret themselves) nor the
+                    // mask are reported, preg_last_error_msg() is one of a fixed set of PCRE strings
+                    return '[RedactingFormatter dropped this record, pattern redaction failed with "'.preg_last_error_msg().'"]';
+                }
+                $formatted = $replaced;
+            }
+
+            return $formatted;
+        }
+
+        if (\is_array($formatted)) {
+            foreach ($formatted as $key => $value) {
+                $formatted[$key] = $this->sweep($value, $secrets, $depth + 1);
+            }
+        }
+
+        return $formatted;
+    }
+}
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/WrappingFormatterInterface.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/WrappingFormatterInterface.php
new file mode 100644
index 000000000..02a6b8851
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Formatter/WrappingFormatterInterface.php
@@ -0,0 +1,28 @@
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of the Monolog package.
+ *
+ * (c) Jordi Boggiano <j.boggiano@seld.be>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Monolog\Formatter;
+
+/**
+ * Interface for formatters decorating another formatter
+ *
+ * Handlers which only accept one specific formatter can use Utils::unwrapFormatter()
+ * to see through the decoration and accept a wrapped instance of that formatter.
+ *
+ * @author Jordi Boggiano <j.boggiano@seld.be>
+ */
+interface WrappingFormatterInterface extends FormatterInterface
+{
+    /**
+     * Returns the formatter this one delegates the actual formatting to
+     */
+    public function getWrappedFormatter(): FormatterInterface;
+}
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php
index de13a76be..78bec3e6a 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/AbstractProcessingHandler.php
@@ -43,7 +43,7 @@ public function handle(LogRecord $record): bool
 
         $this->write($record);
 
-        return false === $this->bubble;
+        return !$this->getBubble();
     }
 
     /**
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/BrowserConsoleHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/BrowserConsoleHandler.php
index 788d7d068..6d8656b98 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/BrowserConsoleHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/BrowserConsoleHandler.php
@@ -262,10 +262,7 @@ private static function dump(string $title, array $dict): array
         }
         $script[] = self::call('log', self::quote('%c%s'), self::quote('font-weight: bold'), self::quote($title));
         foreach ($dict as $key => $value) {
-            $value = json_encode($value);
-            if (false === $value) {
-                $value = self::quote('');
-            }
+            $value = Utils::jsonEncode($value, Utils::DEFAULT_JSON_FLAGS | JSON_HEX_TAG);
             $script[] = self::call('log', self::quote('%s: %o'), self::quote((string) $key), $value);
         }
 
@@ -274,7 +271,10 @@ private static function dump(string $title, array $dict): array
 
     private static function quote(string $arg): string
     {
-        return '"' . addcslashes($arg, "\"\n\\") . '"';
+        // JSON_HEX_TAG keeps a literal < out of the output, so that a log message cannot break out
+        // of the surrounding <script> element via </script> or <!--<script>. json_encode also
+        // escapes \r and U+2028/U+2029, which would otherwise terminate the JS string literal.
+        return Utils::jsonEncode($arg, Utils::DEFAULT_JSON_FLAGS | JSON_HEX_TAG);
     }
 
     /**
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/DeduplicationHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/DeduplicationHandler.php
index 2b1d0b867..f843a4d58 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/DeduplicationHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/DeduplicationHandler.php
@@ -82,7 +82,7 @@ public function flush(): void
                 $passthru = $passthru === true || !\is_array($store) || !$this->isDuplicate($store, $record);
                 if ($passthru) {
                     $line = $this->buildDeduplicationStoreEntry($record);
-                    file_put_contents($this->deduplicationStore, $line . "\n", FILE_APPEND);
+                    file_put_contents($this->deduplicationStore, $line . "\n", FILE_APPEND | LOCK_EX);
                     if (!\is_array($store)) {
                         $store = [];
                     }
@@ -114,7 +114,14 @@ protected function isDuplicate(array $store, LogRecord $record): bool
         $yesterday = time() - 86400;
 
         for ($i = \count($store) - 1; $i >= 0; $i--) {
-            list($timestamp, $level, $message) = explode(':', $store[$i], 3);
+            $parts = explode(':', $store[$i], 3);
+
+            if (\count($parts) < 3) {
+                // Skip invalid/incomplete lines (e.g. partially written due to concurrent access)
+                continue;
+            }
+
+            [$timestamp, $level, $message] = $parts;
 
             if ($level === $record->level->getName() && $message === $expectedMessage && $timestamp > $timestampValidity) {
                 return true;
@@ -149,6 +156,7 @@ private function collectLogs(): void
         }
 
         if (false === flock($handle, LOCK_EX)) {
+            fclose($handle);
             return;
         }
         $validLogs = [];
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticaHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticaHandler.php
index 4a184b393..93cf4e0a2 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticaHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticaHandler.php
@@ -19,6 +19,7 @@
 use Elastica\Client;
 use Elastica\Exception\ExceptionInterface;
 use Monolog\LogRecord;
+use Monolog\Utils;
 
 /**
  * Elastic Search handler
@@ -89,7 +90,7 @@ protected function write(LogRecord $record): void
      */
     public function setFormatter(FormatterInterface $formatter): HandlerInterface
     {
-        if ($formatter instanceof ElasticaFormatter) {
+        if (Utils::unwrapFormatter($formatter) instanceof ElasticaFormatter) {
             return parent::setFormatter($formatter);
         }
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticsearchHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticsearchHandler.php
index 6fd705de4..b3128c469 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticsearchHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ElasticsearchHandler.php
@@ -21,6 +21,7 @@
 use Elasticsearch\Common\Exceptions\RuntimeException as ElasticsearchRuntimeException;
 use Elasticsearch\Client;
 use Monolog\LogRecord;
+use Monolog\Utils;
 use Elastic\Elasticsearch\Exception\InvalidArgumentException as ElasticInvalidArgumentException;
 use Elastic\Elasticsearch\Client as Client8;
 
@@ -114,7 +115,7 @@ protected function write(LogRecord $record): void
      */
     public function setFormatter(FormatterInterface $formatter): HandlerInterface
     {
-        if ($formatter instanceof ElasticsearchFormatter) {
+        if (Utils::unwrapFormatter($formatter) instanceof ElasticsearchFormatter) {
             return parent::setFormatter($formatter);
         }
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ErrorLogHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ErrorLogHandler.php
index cd28ff6ac..a7e71860d 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ErrorLogHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/ErrorLogHandler.php
@@ -14,7 +14,6 @@
 use Monolog\Formatter\LineFormatter;
 use Monolog\Formatter\FormatterInterface;
 use Monolog\Level;
-use Monolog\Utils;
 use Monolog\LogRecord;
 
 /**
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php
index 27c6c1533..60cd4e2ba 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FlowdockHandler.php
@@ -68,7 +68,7 @@ public function __construct(
      */
     public function setFormatter(FormatterInterface $formatter): HandlerInterface
     {
-        if (!$formatter instanceof FlowdockFormatter) {
+        if (!Utils::unwrapFormatter($formatter) instanceof FlowdockFormatter) {
             throw new \InvalidArgumentException('The FlowdockHandler requires an instance of Monolog\Formatter\FlowdockFormatter to function correctly');
         }
 
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FrankenPhpHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FrankenPhpHandler.php
new file mode 100644
index 000000000..621bae67c
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/FrankenPhpHandler.php
@@ -0,0 +1,100 @@
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of the Monolog package.
+ *
+ * (c) Jordi Boggiano <j.boggiano@seld.be>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Monolog\Handler;
+
+use Monolog\Formatter\FormatterInterface;
+use Monolog\Formatter\NormalizerFormatter;
+use Monolog\Level;
+use Monolog\LogRecord;
+
+/**
+ * Logs records using FrankenPHP's frankenphp_log() function.
+ *
+ * This handler requires a NormalizerFormatter to function and expects an array in $record->formatted
+ *
+ * @see https://frankenphp.dev/docs/logging/#frankenphp_log
+ *
+ * @author Kévin Dunglas <kevin@dunglas.dev>
+ */
+class FrankenPhpHandler extends AbstractProcessingHandler
+{
+    /**
+     * @throws MissingExtensionException If frankenphp_log() is not available
+     */
+    public function __construct(int|string|Level $level = Level::Debug, bool $bubble = true)
+    {
+        if (!\function_exists('frankenphp_log')) {
+            throw new MissingExtensionException(
+                'You must run this handler under FrankenPHP, the frankenphp_log() function is not available'
+            );
+        }
+
+        parent::__construct($level, $bubble);
+    }
+
+    /**
+     * Translates Monolog log levels to FrankenPHP's slog-based levels.
+     *
+     * slog's docs state its gap of 4 between named levels matches OpenTelemetry's SeverityNumber
+     * mapping, converted by subtracting 9. Applying that same subtraction to OpenTelemetry's own
+     * Syslog severity mapping for the 4 extra RFC 5424 levels slog has no constant for keeps this
+     * scale traceable to that spec instead of an arbitrary choice.
+     *
+     * FrankenPHP feeds these through zapslog, which buckets everything >= Error into "error", so
+     * above Error only the level_name context key tells the Monolog levels apart.
+     *
+     * @see https://pkg.go.dev/log/slog#hdr-Levels
+     * @see https://opentelemetry.io/docs/specs/otel/logs/data-model-appendix/
+     */
+    protected function toFrankenPhpLevel(Level $level): int
+    {
+        return match ($level) {
+            Level::Debug => \FRANKENPHP_LOG_LEVEL_DEBUG,
+            Level::Info => \FRANKENPHP_LOG_LEVEL_INFO,
+            Level::Notice => 1,
+            Level::Warning => \FRANKENPHP_LOG_LEVEL_WARN,
+            Level::Error => \FRANKENPHP_LOG_LEVEL_ERROR,
+            Level::Critical => 9,
+            Level::Alert => 10,
+            Level::Emergency => 12,
+        };
+    }
+
+    /**
+     * @inheritDoc
+     */
+    protected function write(LogRecord $record): void
+    {
+        $this->writeFrankenPhpLog($record->message, $this->toFrankenPhpLevel($record->level), $record->formatted);
+    }
+
+    /**
+     * @param array<mixed> $context Displayed as structured attributes alongside the message
+     */
+    protected function writeFrankenPhpLog(string $message, int $level, array $context): void
+    {
+        // frankenphp_log() merges $context into the same JSON object it already fills with "msg",
+        // "level" and "ts", so drop Monolog's duplicates of those three. level_name still carries
+        // the Monolog level name, which slog's own severity cannot express.
+        unset($context['message'], $context['level'], $context['datetime']);
+
+        \frankenphp_log($message, $level, $context);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getDefaultFormatter(): FormatterInterface
+    {
+        return new NormalizerFormatter();
+    }
+}
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/LogMonsterHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/LogMonsterHandler.php
new file mode 100644
index 000000000..0c78df47b
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/LogMonsterHandler.php
@@ -0,0 +1,192 @@
+<?php declare(strict_types=1);
+
+/*
+ * This file is part of the Monolog package.
+ *
+ * (c) Jordi Boggiano <j.boggiano@seld.be>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Monolog\Handler;
+
+use Closure;
+use Monolog\Level;
+use Monolog\Logger;
+use Monolog\ResettableInterface;
+use Monolog\Formatter\FormatterInterface;
+use Psr\Log\LogLevel;
+use Monolog\LogRecord;
+
+/**
+ * Watches log records go by and expects to be fed at least $hunger of them before
+ * the process ends. If it stays hungry until close() (and was not manually fed()),
+ * the monster gets angry and emits a complaint record at $angerLevel to the nested
+ * handler. Useful as a dead-man's switch for cron jobs / workers that should produce
+ * a known amount of log activity before they finish, or to make sure that every code
+ * path / request in the application at least logs some amount of records.
+ *
+ * Records carrying context are "cookies with chocolate chips" — when $wantsContextChips
+ * is true, only records with non-empty context count toward feeding the monster.
+ *
+ * Thanks to Jonathan Wage for the idea https://x.com/seldaek/status/1491110384023277569
+ *
+ * @author Jordi Boggiano <j.boggiano@seld.be>
+ */
+class LogMonsterHandler extends Handler implements ProcessableHandlerInterface, ResettableInterface, FormattableHandlerInterface
+{
+    use ProcessableHandlerTrait;
+
+    /**
+     * Handler or factory Closure($record, $this)
+     *
+     * @phpstan-var (Closure(LogRecord|null, HandlerInterface): HandlerInterface)|HandlerInterface
+     */
+    protected Closure|HandlerInterface $handler;
+
+    protected int $hunger;
+
+    protected Level $angerLevel;
+
+    protected string $channel;
+
+    protected bool $wantsContextChips;
+
+    /** Number of records the monster has eaten so far */
+    protected int $eaten = 0;
+
+    /** Whether the monster has been manually fed and should stay quiet on close */
+    protected bool $fed = false;
+
+    /**
+     * @phpstan-param (Closure(LogRecord|null, HandlerInterface): HandlerInterface)|HandlerInterface $handler
+     *
+     * @param Closure|HandlerInterface     $handler           Handler or factory Closure($record|null, $logMonsterHandler).
+     * @param int                          $hunger            Number of log records the monster must eat before close() to stay satisfied.
+     * @param int|string|Level|LogLevel::* $angerLevel        Level at which the monster logs its complaint when it goes hungry.
+     * @param string                       $channel           Channel name stamped on the synthetic complaint record, note the record only gets sent to the given $handler, and will for example not go to the handlers configured for $channel in Symfony.
+     * @param bool                         $wantsContextChips If true, only records carrying context count toward feeding the monster.
+     *
+     * @phpstan-param value-of<Level::VALUES>|value-of<Level::NAMES>|Level|LogLevel::* $angerLevel
+     */
+    public function __construct(Closure|HandlerInterface $handler, int $hunger, int|string|Level $angerLevel = Level::Error, string $channel = 'log-monster', bool $wantsContextChips = false)
+    {
+        $this->handler = $handler;
+        $this->hunger = $hunger;
+        $this->channel = $channel;
+        $this->wantsContextChips = $wantsContextChips;
+        $this->angerLevel = Logger::toMonologLevel($angerLevel);
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function isHandling(LogRecord $record): bool
+    {
+        return true;
+    }
+
+    /**
+     * Manually feed the log monster so it does not complain on close (until reset() is called)
+     */
+    public function feed(): void
+    {
+        $this->fed = true;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function handle(LogRecord $record): bool
+    {
+        if (!$this->wantsContextChips || \count($record->context) > 0) {
+            $this->eaten++;
+        }
+
+        // the monster only watches records go by, it never consumes them
+        return false;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function close(): void
+    {
+        if (!$this->fed && $this->eaten < $this->hunger) {
+            $record = new LogRecord(
+                datetime: new \DateTimeImmutable('now'),
+                channel: $this->channel,
+                level: $this->angerLevel,
+                message: 'Om nom nom... the log monster is hangry: it only ate '.$this->eaten.' of '.$this->hunger.' expected log records',
+                context: ['eaten' => $this->eaten, 'hunger' => $this->hunger],
+            );
+
+            if (\count($this->processors) > 0) {
+                $record = $this->processRecord($record);
+            }
+
+            $this->getHandler($record)->handle($record);
+        }
+
+        $this->getHandler()->close();
+    }
+
+    public function reset(): void
+    {
+        $this->fed = false;
+        $this->eaten = 0;
+
+        $this->resetProcessors();
+
+        if ($this->getHandler() instanceof ResettableInterface) {
+            $this->getHandler()->reset();
+        }
+    }
+
+    /**
+     * Return the nested handler
+     *
+     * If the handler was provided as a factory, this will trigger the handler's instantiation.
+     */
+    public function getHandler(?LogRecord $record = null): HandlerInterface
+    {
+        if (!$this->handler instanceof HandlerInterface) {
+            $handler = ($this->handler)($record, $this);
+            if (!$handler instanceof HandlerInterface) {
+                throw new \RuntimeException("The factory Closure should return a HandlerInterface");
+            }
+            $this->handler = $handler;
+        }
+
+        return $this->handler;
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function setFormatter(FormatterInterface $formatter): HandlerInterface
+    {
+        $handler = $this->getHandler();
+        if ($handler instanceof FormattableHandlerInterface) {
+            $handler->setFormatter($formatter);
+
+            return $this;
+        }
+
+        throw new \UnexpectedValueException('The nested handler of type '.\get_class($handler).' does not support formatters.');
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public function getFormatter(): FormatterInterface
+    {
+        $handler = $this->getHandler();
+        if ($handler instanceof FormattableHandlerInterface) {
+            return $handler->getFormatter();
+        }
+
+        throw new \UnexpectedValueException('The nested handler of type '.\get_class($handler).' does not support formatters.');
+    }
+}
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/RotatingFileHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/RotatingFileHandler.php
index 401c10895..ccdf21940 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/RotatingFileHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/RotatingFileHandler.php
@@ -28,6 +28,7 @@
  */
 class RotatingFileHandler extends StreamHandler
 {
+    public const FILE_PER_HOUR = 'Y-m-d-H';
     public const FILE_PER_DAY = 'Y-m-d';
     public const FILE_PER_MONTH = 'Y-m';
     public const FILE_PER_YEAR = 'Y';
@@ -49,9 +50,9 @@ public function __construct(string $filename, int $maxFiles = 0, int|string|Leve
     {
         $this->filename = Utils::canonicalizePath($filename);
         $this->maxFiles = $maxFiles;
+        $this->timezone = $timezone;
         $this->setFilenameFormat($filenameFormat, $dateFormat);
         $this->nextRotation = $this->getNextRotation();
-        $this->timezone = $timezone;
 
         parent::__construct($this->getTimedFilename(), $level, $bubble, $filePermission, $useLocking);
     }
@@ -133,11 +134,7 @@ protected function rotate(): void
             return;
         }
 
-        $logFiles = glob($this->getGlobPattern());
-        if (false === $logFiles) {
-            // failed to glob
-            return;
-        }
+        $logFiles = $this->findRotatedFiles();
 
         if ($this->maxFiles >= \count($logFiles)) {
             // no files to remove
@@ -149,7 +146,7 @@ protected function rotate(): void
             return strcmp($b, $a);
         });
 
-        $basePath = dirname($this->filename);
+        $basePath = self::normalizeDirectorySeparators(dirname($this->filename));
 
         foreach (\array_slice($logFiles, $this->maxFiles) as $file) {
             if (is_writable($file)) {
@@ -160,7 +157,7 @@ protected function rotate(): void
                 });
                 unlink($file);
 
-                $dir = dirname($file);
+                $dir = self::normalizeDirectorySeparators(dirname($file));
                 while ($dir !== $basePath) {
                     $entries = scandir($dir);
                     if ($entries === false || \count(array_diff($entries, ['.', '..'])) > 0) {
@@ -168,7 +165,7 @@ protected function rotate(): void
                     }
 
                     rmdir($dir);
-                    $dir = dirname($dir);
+                    $dir = self::normalizeDirectorySeparators(dirname($dir));
                 }
                 restore_error_handler();
             }
@@ -181,7 +178,7 @@ protected function getTimedFilename(): string
         $timedFilename = str_replace(
             ['{filename}', '{date}'],
             [$fileInfo['filename'], (new \DateTimeImmutable(timezone: $this->timezone))->format($this->dateFormat)],
-            ($fileInfo['dirname'] ?? '') . '/' . $this->filenameFormat
+            self::appendDirectorySeparator($fileInfo['dirname'] ?? '') . $this->filenameFormat
         );
 
         if (isset($fileInfo['extension'])) {
@@ -191,17 +188,152 @@ protected function getTimedFilename(): string
         return $timedFilename;
     }
 
+    /**
+     * Appends the trailing "/" to a pathinfo() dirname.
+     *
+     * pathinfo() reduces a wrapper URL with no subdirectory ("scheme://foo.log")
+     * to a bare "scheme:", and PHP does not route the single-slash "scheme:/"
+     * to the wrapper at all, so that case needs both slashes back. The pattern
+     * deliberately requires two characters before the colon so a Windows drive
+     * letter is left alone.
+     */
+    private static function appendDirectorySeparator(string $dirName): string
+    {
+        if (1 === preg_match('#^[a-zA-Z][a-zA-Z0-9+.-]+:$#', $dirName)) {
+            return $dirName.'//';
+        }
+
+        return $dirName.'/';
+    }
+
+    /**
+     * Rewrites Windows directory separators to "/".
+     *
+     * SPL joins directory entries with DIRECTORY_SEPARATOR, so on Windows the
+     * iterator yields "C:\\logs\\foo.rot" while the pattern is built from a
+     * pathinfo() dirname. Both sides have to be normalised, and only on Windows:
+     * on POSIX a backslash is a legal filename character.
+     */
+    private static function normalizeDirectorySeparators(string $path): string
+    {
+        if ('\\' !== \DIRECTORY_SEPARATOR) {
+            return $path;
+        }
+
+        return str_replace('\\', '/', $path);
+    }
+
+    /**
+     * Finds the log files that previous rotations left behind.
+     *
+     * glob() cannot see through stream wrappers (Drupal's private:// for one),
+     * so the pattern is translated to a regex and matched against a directory
+     * walk instead. It still comes from getGlobPattern(), so overriding that
+     * keeps changing which files the cleanup considers. Unlike glob(), symlinked
+     * directories are not followed, which also rules out symlink loops.
+     *
+     * @return string[]
+     */
+    protected function findRotatedFiles(): array
+    {
+        $pattern = self::normalizeDirectorySeparators($this->getGlobPattern());
+
+        // split off the literal directory prefix, so only the subtree the pattern
+        // can actually reach has to be walked
+        $slashPos = strrpos(substr($pattern, 0, strcspn($pattern, '*?[')), '/');
+        $baseDir = false === $slashPos ? './' : substr($pattern, 0, $slashPos + 1);
+        $relativePattern = false === $slashPos ? $pattern : substr($pattern, $slashPos + 1);
+
+        $regex = '#^'.preg_quote($baseDir, '#').self::globToRegex($relativePattern).'$#';
+
+        if (!is_dir($baseDir)) {
+            return [];
+        }
+
+        try {
+            // walking the subtree is only needed when the pattern itself nests
+            $iterator = str_contains($relativePattern, '/')
+                ? new \RecursiveIteratorIterator(
+                    new \RecursiveDirectoryIterator($baseDir, \FilesystemIterator::SKIP_DOTS),
+                    \RecursiveIteratorIterator::LEAVES_ONLY,
+                    // an unreadable subdirectory skips that subtree instead of throwing
+                    // all the way out of write()/close() and breaking logging
+                    \RecursiveIteratorIterator::CATCH_GET_CHILD
+                )
+                : new \FilesystemIterator($baseDir, \FilesystemIterator::SKIP_DOTS);
+        } catch (\UnexpectedValueException $e) {
+            // is_dir() above can pass on a directory we are still not allowed to open
+            return [];
+        }
+
+        $logFiles = [];
+        foreach ($iterator as $path => $file) {
+            if (!$file->isFile()) {
+                continue;
+            }
+
+            $path = self::normalizeDirectorySeparators((string) $path);
+            if (1 === preg_match($regex, $path)) {
+                $logFiles[] = $path;
+            }
+        }
+
+        return $logFiles;
+    }
+
+    /**
+     * Translates a glob pattern into a regex matching the same paths.
+     *
+     * Wildcards stop at "/" like glob's do, so a pattern for one directory
+     * cannot start matching nested files once the walk goes deeper.
+     */
+    private static function globToRegex(string $glob): string
+    {
+        $regex = '';
+
+        for ($i = 0, $length = \strlen($glob); $i < $length; $i++) {
+            $char = $glob[$i];
+
+            if ('*' === $char) {
+                $regex .= '[^/]*';
+                continue;
+            }
+
+            if ('?' === $char) {
+                $regex .= '[^/]';
+                continue;
+            }
+
+            // a "]" directly after the opening bracket is literal, hence $i + 2
+            if ('[' === $char && false !== ($end = strpos($glob, ']', $i + 2))) {
+                $class = substr($glob, $i + 1, $end - $i - 1);
+                $negate = '';
+                if (str_starts_with($class, '!')) {
+                    $negate = '^';
+                    $class = substr($class, 1);
+                }
+                $regex .= '['.$negate.str_replace(['\\', ']', '^'], ['\\\\', '\\]', '\\^'], $class).']';
+                $i = $end;
+                continue;
+            }
+
+            $regex .= preg_quote($char, '#');
+        }
+
+        return $regex;
+    }
+
     protected function getGlobPattern(): string
     {
         $fileInfo = pathinfo($this->filename);
         $glob = str_replace(
             ['{filename}', '{date}'],
             [$fileInfo['filename'], str_replace(
-                ['Y', 'y', 'm', 'd'],
-                ['[0-9][0-9][0-9][0-9]', '[0-9][0-9]', '[0-9][0-9]', '[0-9][0-9]'],
+                ['Y', 'y', 'm', 'd', 'H'],
+                ['[0-9][0-9][0-9][0-9]', '[0-9][0-9]', '[0-9][0-9]', '[0-9][0-9]', '[0-9][0-9]'],
                 $this->dateFormat
             )],
-            ($fileInfo['dirname'] ?? '') . '/' . $this->filenameFormat
+            self::appendDirectorySeparator($fileInfo['dirname'] ?? '') . $this->filenameFormat
         );
         if (isset($fileInfo['extension'])) {
             $glob .= '.'.$fileInfo['extension'];
@@ -212,23 +344,24 @@ protected function getGlobPattern(): string
 
     protected function setDateFormat(string $dateFormat): void
     {
-        if (0 === preg_match('{^[Yy](([/_.-]?m)([/_.-]?d)?)?$}', $dateFormat)) {
+        if (0 === preg_match('{^[Yy](([/_.-]?m)([/_.-]?d([/_.-]?H)?)?)?$}', $dateFormat)) {
             throw new InvalidArgumentException(
-                'Invalid date format - format must be one of '.
+                'Invalid date format - format must be one of RotatingFileHandler::FILE_PER_HOUR ("Y-m-d-H"), '.
                 'RotatingFileHandler::FILE_PER_DAY ("Y-m-d"), RotatingFileHandler::FILE_PER_MONTH ("Y-m") '.
                 'or RotatingFileHandler::FILE_PER_YEAR ("Y"), or you can set one of the '.
                 'date formats using slashes, underscores and/or dots instead of dashes.'
             );
         }
+
         $this->dateFormat = $dateFormat;
     }
 
     protected function getNextRotation(): \DateTimeImmutable
     {
         return match (str_replace(['/','_','.'], '-', $this->dateFormat)) {
-            self::FILE_PER_MONTH => (new \DateTimeImmutable('first day of next month'))->setTime(0, 0, 0),
-            self::FILE_PER_YEAR => (new \DateTimeImmutable('first day of January next year'))->setTime(0, 0, 0),
-            default => (new \DateTimeImmutable('tomorrow'))->setTime(0, 0, 0),
+            self::FILE_PER_MONTH => (new \DateTimeImmutable('first day of next month', $this->timezone))->setTime(0, 0, 0),
+            self::FILE_PER_YEAR => (new \DateTimeImmutable('first day of January next year', $this->timezone))->setTime(0, 0, 0),
+            default => (new \DateTimeImmutable('tomorrow', $this->timezone))->setTime(0, 0, 0),
         };
     }
 }
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SocketHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SocketHandler.php
index 36d46bf9d..4560d7637 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SocketHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SocketHandler.php
@@ -385,6 +385,7 @@ private function writeToSocket(string $data): void
         $length = \strlen($data);
         $sent = 0;
         $this->lastSentBytes = $sent;
+        $this->lastWritingAt = microtime(true);
         while ($this->isConnected() && $sent < $length) {
             if (0 === $sent) {
                 $chunk = $this->fwrite($data);
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/StreamHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/StreamHandler.php
index c8a648c43..2776cbf01 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/StreamHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/StreamHandler.php
@@ -148,7 +148,11 @@ protected function write(LogRecord $record): void
             }
             $this->createDir($url);
             $this->errorMessage = null;
-            set_error_handler($this->customErrorHandler(...));
+            // forwarding to $this->customErrorHandler using a closure to make the
+            // private method accessible, see https://github.com/Seldaek/monolog/issues/1866
+            set_error_handler(function (int $code, string $msg) {
+                return $this->customErrorHandler($code, $msg);
+            });
 
             try {
                 $stream = fopen($url, $this->fileOpenMode);
@@ -175,7 +179,11 @@ protected function write(LogRecord $record): void
         }
 
         $this->errorMessage = null;
-        set_error_handler($this->customErrorHandler(...));
+        // forwarding to $this->customErrorHandler using a closure to make the
+        // private method accessible, see https://github.com/Seldaek/monolog/issues/1866
+        set_error_handler(function (int $code, string $msg) {
+            return $this->customErrorHandler($code, $msg);
+        });
         try {
             $this->streamWrite($stream, $record);
         } finally {
@@ -207,7 +215,26 @@ protected function write(LogRecord $record): void
      */
     protected function streamWrite($stream, LogRecord $record): void
     {
-        fwrite($stream, (string) $record->formatted);
+        $data = (string) $record->formatted;
+        $length = \strlen($data);
+        $written = 0;
+
+        // fwrite() may write only part of the data on non-blocking streams, so loop until it is all written, see https://github.com/Seldaek/monolog/issues/2011
+        while ($written < $length) {
+            $result = fwrite($stream, substr($data, $written));
+            if ($result === false) {
+                // write failed, let the customErrorHandler/errorMessage logic in write() report and retry it
+                break;
+            }
+            if ($result === 0) {
+                // the non-blocking stream's buffer is full, wait until it can be written to again instead of busy-looping or dropping the rest of the record
+                $write = [$stream];
+                $read = $except = [];
+                stream_select($read, $write, $except, null);
+                continue;
+            }
+            $written += $result;
+        }
     }
 
     /**
@@ -244,8 +271,10 @@ private function createDir(string $url): void
         $dir = $this->getDirFromStream($url);
         if (null !== $dir && !is_dir($dir)) {
             $this->errorMessage = null;
-            set_error_handler(function (...$args) {
-                return $this->customErrorHandler(...$args);
+            // forwarding to $this->customErrorHandler using a closure to make the
+            // private method accessible, see https://github.com/Seldaek/monolog/issues/1866
+            set_error_handler(function (int $code, string $msg) {
+                return $this->customErrorHandler($code, $msg);
             });
             $status = mkdir($dir, 0777, true);
             restore_error_handler();
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdp/UdpSocket.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdp/UdpSocket.php
index 3ff0bce5f..92f836fe0 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdp/UdpSocket.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdp/UdpSocket.php
@@ -20,12 +20,22 @@ class UdpSocket
 
     protected string $ip;
     protected int $port;
+    protected int $maxLength;
     protected ?Socket $socket = null;
 
-    public function __construct(string $ip, int $port = 514)
+    /**
+     * @param ?int $maxLength Maximum size in bytes of a single UDP datagram sent to $ip:$port.
+     *                        Defaults to the largest a UDP payload can theoretically be, but
+     *                        messages that size get fragmented at the IP level, and many routers
+     *                        and firewalls drop fragmented UDP packets, which silently truncates
+     *                        or loses the log entry on the receiving end. Passing a value that
+     *                        fits within the path MTU (eg. 1024) avoids that.
+     */
+    public function __construct(string $ip, int $port = 514, ?int $maxLength = null)
     {
         $this->ip = $ip;
         $this->port = $port;
+        $this->maxLength = $maxLength ?? self::DATAGRAM_MAX_LENGTH;
     }
 
     public function write(string $line, string $header = ""): void
@@ -70,7 +80,7 @@ protected function send(string $chunk): void
 
     protected function assembleMessage(string $line, string $header): string
     {
-        $chunkSize = static::DATAGRAM_MAX_LENGTH - \strlen($header);
+        $chunkSize = $this->maxLength - \strlen($header);
 
         return $header . Utils::substr($line, 0, $chunkSize);
     }
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdpHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdpHandler.php
index b5e467417..0c11d5f10 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdpHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/SyslogUdpHandler.php
@@ -46,13 +46,18 @@ class SyslogUdpHandler extends AbstractSyslogHandler
      * @param  int                       $port     Port number, or 0 if $host is a unix socket
      * @param  string|int                $facility Either one of the names of the keys in $this->facilities, or a LOG_* facility constant
      * @param  bool                      $bubble   Whether the messages that are handled can bubble up the stack or not
-     * @param  string                    $ident    Program name or tag for each log message.
-     * @param  int                       $rfc      RFC to format the message for.
+     * @param  string                    $ident     Program name or tag for each log message.
+     * @param  int                       $rfc       RFC to format the message for.
+     * @param  ?int                      $maxLength Maximum size in bytes of a single UDP datagram. Defaults to the
+     *                                              largest a UDP payload can theoretically be, which risks getting
+     *                                              silently truncated or dropped by routers/firewalls that reject
+     *                                              fragmented UDP packets; pass a value that fits within the path
+     *                                              MTU (eg. 1024) to avoid that.
      * @throws MissingExtensionException when there is no socket extension
      *
      * @phpstan-param self::RFC* $rfc
      */
-    public function __construct(string $host, int $port = 514, string|int $facility = LOG_USER, int|string|Level $level = Level::Debug, bool $bubble = true, string $ident = 'php', int $rfc = self::RFC5424)
+    public function __construct(string $host, int $port = 514, string|int $facility = LOG_USER, int|string|Level $level = Level::Debug, bool $bubble = true, string $ident = 'php', int $rfc = self::RFC5424, ?int $maxLength = null)
     {
         if (!\extension_loaded('sockets')) {
             throw new MissingExtensionException('The sockets extension is required to use the SyslogUdpHandler');
@@ -63,7 +68,7 @@ public function __construct(string $host, int $port = 514, string|int $facility
         $this->ident = $ident;
         $this->rfc = $rfc;
 
-        $this->socket = new UdpSocket($host, $port);
+        $this->socket = new UdpSocket($host, $port, $maxLength);
     }
 
     protected function write(LogRecord $record): void
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/TelegramBotHandler.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/TelegramBotHandler.php
index e6b23bc48..1e7e6a4dd 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/TelegramBotHandler.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Handler/TelegramBotHandler.php
@@ -251,17 +251,41 @@ protected function send(string $message): void
         }
     }
 
+    /**
+     * Returns the Telegram Bot API base URL.
+     * Override in a subclass to point to a self-hosted Bot API server.
+     */
+    protected function getBotApiUrl(): string
+    {
+        return self::BOT_API;
+    }
+
+    /**
+     * Returns extra HTTP headers to send with every Telegram API request.
+     * Override in a subclass to inject custom headers (e.g. auth tokens, tracing).
+     *
+     * @return string[]
+     */
+    protected function getCurlHeaders(): array
+    {
+        return [];
+    }
+
     protected function sendCurl(string $message): void
     {
         if ('' === trim($message)) {
             return;
         }
-        
+
         $ch = curl_init();
-        $url = self::BOT_API . $this->apiKey . '/SendMessage';
+        $url = $this->getBotApiUrl() . $this->apiKey . '/SendMessage';
         curl_setopt($ch, CURLOPT_URL, $url);
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
+        $headers = $this->getCurlHeaders();
+        if ($headers !== []) {
+            curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
+        }
         $params = [
             'text' => $message,
             'chat_id' => $this->channel,
@@ -274,14 +298,26 @@ protected function sendCurl(string $message): void
         }
         curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
 
-        $result = Curl\Util::execute($ch);
-        if (!\is_string($result)) {
+        $this->validateApiResponse(Curl\Util::execute($ch));
+    }
+
+    /**
+     * @param  string|bool      $rawResult Raw response body from the Telegram API call
+     * @throws RuntimeException When the response is missing, non-JSON, or signals failure
+     */
+    protected function validateApiResponse(string|bool $rawResult): void
+    {
+        if (!\is_string($rawResult)) {
             throw new RuntimeException('Telegram API error. Description: No response');
         }
-        $result = json_decode($result, true);
 
-        if ($result['ok'] === false) {
-            throw new RuntimeException('Telegram API error. Description: ' . $result['description']);
+        $result = json_decode($rawResult, true);
+
+        if (!\is_array($result)) {
+            throw new RuntimeException('Telegram API error. Description: Unexpected non-JSON response');
+        }
+        if (($result['ok'] ?? null) !== true) {
+            throw new RuntimeException('Telegram API error. Description: ' . ($result['description'] ?? 'Unknown error'));
         }
     }
 
@@ -293,9 +329,139 @@ private function handleMessageLength(string $message): array
     {
         $truncatedMarker = ' (…truncated)';
         if (!$this->splitLongMessages && \strlen($message) > self::MAX_MESSAGE_LENGTH) {
-            return [Utils::substr($message, 0, self::MAX_MESSAGE_LENGTH - \strlen($truncatedMarker)) . $truncatedMarker];
+            $maxLength = self::MAX_MESSAGE_LENGTH - \strlen($truncatedMarker);
+            $truncated = Utils::substr($message, 0, $maxLength);
+
+            if ($this->parseMode === 'HTML') {
+                $truncated = $this->trimPartialHtmlTag($truncated);
+                $closing = $this->closingHtmlTagsFor($this->updateOpenHtmlTags($truncated, []));
+
+                while ($truncated !== '' && \strlen($truncated . $closing) > $maxLength) {
+                    $truncated = $this->trimPartialHtmlTag(Utils::substr($truncated, 0, -1));
+                    $closing = $this->closingHtmlTagsFor($this->updateOpenHtmlTags($truncated, []));
+                }
+
+                $truncated .= $closing;
+            }
+
+            return [$truncated . $truncatedMarker];
+        }
+
+        if ($this->parseMode === 'HTML' && \strlen($message) > self::MAX_MESSAGE_LENGTH) {
+            return $this->splitHtmlMessage($message, self::MAX_MESSAGE_LENGTH);
         }
 
         return str_split($message, self::MAX_MESSAGE_LENGTH);
     }
+
+    /**
+     * Splits an HTML $message into chunks of at most $maxLength characters, closing any
+     * tag left open at the end of a chunk and reopening it at the start of the next one,
+     * so that neither a tag nor a start/end tag pair is ever cut in half.
+     *
+     * @return string[]
+     */
+    private function splitHtmlMessage(string $message, int $maxLength): array
+    {
+        $chunks = [];
+        $openTags = [];
+        $remaining = $message;
+
+        while ($remaining !== '') {
+            $prefix = $this->openingHtmlTagsFor($openTags);
+            $slice = Utils::substr($remaining, 0, max(1, $maxLength - \strlen($prefix)));
+            $isLast = \strlen($slice) >= \strlen($remaining);
+
+            if (!$isLast) {
+                $slice = $this->trimPartialHtmlTag($slice);
+            }
+
+            $sliceOpenTags = $this->updateOpenHtmlTags($slice, $openTags);
+            $suffix = $isLast ? '' : $this->closingHtmlTagsFor($sliceOpenTags);
+
+            while (!$isLast && $slice !== '' && \strlen($prefix . $slice . $suffix) > $maxLength) {
+                $slice = $this->trimPartialHtmlTag(Utils::substr($slice, 0, -1));
+                $sliceOpenTags = $this->updateOpenHtmlTags($slice, $openTags);
+                $suffix = $this->closingHtmlTagsFor($sliceOpenTags);
+            }
+
+            $chunks[] = $prefix . $slice . $suffix;
+            $remaining = Utils::substr($remaining, \strlen($slice));
+            $openTags = $isLast ? [] : $sliceOpenTags;
+        }
+
+        return $chunks;
+    }
+
+    /**
+     * Backs off before a `<` that has no matching `>` yet, so $html never ends mid-tag.
+     */
+    private function trimPartialHtmlTag(string $html): string
+    {
+        $lastLt = strrpos($html, '<');
+        $lastGt = strrpos($html, '>');
+
+        if ($lastLt !== false && ($lastGt === false || $lastLt > $lastGt)) {
+            return Utils::substr($html, 0, $lastLt);
+        }
+
+        return $html;
+    }
+
+    /**
+     * Scans $html for tags, applying them onto $openTags, so the result is the set of
+     * tags still open after $html (tags opened before $html that $html did not close,
+     * plus any $html opened itself and did not close again).
+     *
+     * @param  array<array{name: string, raw: string}> $openTags
+     * @return array<array{name: string, raw: string}>
+     */
+    private function updateOpenHtmlTags(string $html, array $openTags): array
+    {
+        if (0 === preg_match_all('/<(\/?)([a-zA-Z][a-zA-Z0-9]*)\b[^>]*>/', $html, $matches, PREG_SET_ORDER)) {
+            return $openTags;
+        }
+
+        foreach ($matches as $match) {
+            $name = strtolower($match[2]);
+            if ($match[1] === '/') {
+                for ($i = \count($openTags) - 1; $i >= 0; $i--) {
+                    if ($openTags[$i]['name'] === $name) {
+                        array_splice($openTags, $i, 1);
+                        break;
+                    }
+                }
+            } else {
+                $openTags[] = ['name' => $name, 'raw' => $match[0]];
+            }
+        }
+
+        return $openTags;
+    }
+
+    /**
+     * @param  array<array{name: string, raw: string}> $openTags
+     */
+    private function closingHtmlTagsFor(array $openTags): string
+    {
+        $closing = '';
+        foreach (array_reverse($openTags) as $tag) {
+            $closing .= '</' . $tag['name'] . '>';
+        }
+
+        return $closing;
+    }
+
+    /**
+     * @param  array<array{name: string, raw: string}> $openTags
+     */
+    private function openingHtmlTagsFor(array $openTags): string
+    {
+        $opening = '';
+        foreach ($openTags as $tag) {
+            $opening .= $tag['raw'];
+        }
+
+        return $opening;
+    }
 }
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Logger.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Logger.php
index e545c4487..177e14557 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Logger.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Logger.php
@@ -16,6 +16,7 @@
 use Fiber;
 use Monolog\Handler\HandlerInterface;
 use Monolog\Processor\ProcessorInterface;
+use Psr\Clock\ClockInterface;
 use Psr\Log\LoggerInterface;
 use Psr\Log\InvalidArgumentException;
 use Psr\Log\LogLevel;
@@ -146,6 +147,11 @@ class Logger implements LoggerInterface, ResettableInterface
 
     protected DateTimeZone $timezone;
 
+    /**
+     * Clock used to timestamp new records, or null to read the current time from the engine
+     */
+    protected ClockInterface|null $clock = null;
+
     protected Closure|null $exceptionHandler = null;
 
     /**
@@ -169,15 +175,17 @@ class Logger implements LoggerInterface, ResettableInterface
      * @param list<HandlerInterface> $handlers   Optional stack of handlers, the first one in the array is called first, etc.
      * @param callable[]         $processors Optional array of processors
      * @param DateTimeZone|null  $timezone   Optional timezone, if not provided date_default_timezone_get() will be used
+     * @param ClockInterface|null $clock     Optional clock to read the current time from, if not provided the engine's current time is used
      *
      * @phpstan-param array<(callable(LogRecord): LogRecord)|ProcessorInterface> $processors
      */
-    public function __construct(string $name, array $handlers = [], array $processors = [], DateTimeZone|null $timezone = null)
+    public function __construct(string $name, array $handlers = [], array $processors = [], DateTimeZone|null $timezone = null, ClockInterface|null $clock = null)
     {
         $this->name = $name;
         $this->setHandlers($handlers);
         $this->processors = $processors;
         $this->timezone = $timezone ?? new DateTimeZone(date_default_timezone_get());
+        $this->clock = $clock;
         $this->fiberLogDepth = new \WeakMap();
     }
 
@@ -345,19 +353,19 @@ public function addRecord(int|Level $level, string $message, array $context = []
             $logDepth = 0;
         }
 
-        if ($logDepth === 3) {
-            $this->warning('A possible infinite logging loop was detected and aborted. It appears some of your handler code is triggering logging, see the previous log record for a hint as to what may be the cause.');
+        try {
+            if ($logDepth === 3) {
+                $this->warning('A possible infinite logging loop was detected and aborted. It appears some of your handler code is triggering logging, see the previous log record for a hint as to what may be the cause.');
 
-            return false;
-        } elseif ($logDepth >= 5) { // log depth 4 is let through, so we can log the warning above
-            return false;
-        }
+                return false;
+            } elseif ($logDepth >= 5) { // log depth 4 is let through, so we can log the warning above
+                return false;
+            }
 
-        try {
             $recordInitialized = \count($this->processors) === 0;
 
             $record = new LogRecord(
-                datetime: $datetime ?? new JsonSerializableDateTimeImmutable($this->microsecondTimestamps, $this->timezone),
+                datetime: $datetime ?? $this->createDateTime(),
                 channel: $this->name,
                 level: self::toMonologLevel($level),
                 message: $message,
@@ -519,7 +527,7 @@ public static function toMonologLevel(string|int|Level $level): Level
     public function isHandling(int|string|Level $level): bool
     {
         $record = new LogRecord(
-            datetime: new JsonSerializableDateTimeImmutable($this->microsecondTimestamps, $this->timezone),
+            datetime: $this->createDateTime(),
             channel: $this->name,
             message: '',
             level: self::toMonologLevel($level),
@@ -705,6 +713,66 @@ public function getTimezone(): DateTimeZone
         return $this->timezone;
     }
 
+    /**
+     * Sets the clock to read the current time from when timestamping log records.
+     *
+     * Pass null to go back to reading the engine's current time. The timezone
+     * configured on the logger still decides how the timestamp is rendered.
+     *
+     * @return $this
+     */
+    public function setClock(ClockInterface|null $clock): self
+    {
+        $this->clock = $clock;
+
+        return $this;
+    }
+
+    /**
+     * Returns the clock used to timestamp log records, or null if the engine's current time is used.
+     */
+    public function getClock(): ClockInterface|null
+    {
+        return $this->clock;
+    }
+
+    /**
+     * Builds the timestamp of a new record, reading the current time from the clock if one is set.
+     */
+    private function createDateTime(): JsonSerializableDateTimeImmutable
+    {
+        if (null === $this->clock) {
+            return new JsonSerializableDateTimeImmutable($this->microsecondTimestamps, $this->timezone);
+        }
+
+        $now = $this->clock->now();
+
+        if ($now instanceof JsonSerializableDateTimeImmutable) {
+            return $now;
+        }
+
+        $datetime = new JsonSerializableDateTimeImmutable($this->microsecondTimestamps, $this->timezone);
+
+        // The instant is applied without ever going through a local wall clock time, which
+        // is ambiguous across a DST transition, and without the "@U.u" notation, which is
+        // off by one second before 1970 and replaces the named timezone with an offset.
+        $datetime = $datetime->setTimestamp($now->getTimestamp());
+        if (\PHP_VERSION_ID >= 80400) {
+            return $datetime->setMicrosecond($now->getMicrosecond());
+        }
+
+        $microseconds = (int) $now->format('u');
+        if (0 !== $microseconds) {
+            // DateInterval has no notation for microseconds, they can only be set on the property
+            $interval = new \DateInterval('PT0S');
+            $interval->f = $microseconds / 1000000;
+
+            $datetime = $datetime->add($interval);
+        }
+
+        return $datetime;
+    }
+
     /**
      * Delegates exception management to the custom exception handler,
      * or throws the exception if no custom handler is set.
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Processor/IntrospectionProcessor.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Processor/IntrospectionProcessor.php
index b942dc055..3b6865240 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Processor/IntrospectionProcessor.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Processor/IntrospectionProcessor.php
@@ -86,7 +86,7 @@ public function __invoke(LogRecord $record): LogRecord
                         continue 2;
                     }
                 }
-            } elseif (\in_array($trace[$i]['function'], self::SKIP_FUNCTIONS, true)) {
+            } elseif (\in_array($trace[$i]['function'], static::SKIP_FUNCTIONS, true)) {
                 $i++;
 
                 continue;
@@ -121,6 +121,6 @@ private function isTraceClassOrSkippedFunction(array $trace, int $index): bool
             return false;
         }
 
-        return isset($trace[$index]['class']) || \in_array($trace[$index]['function'], self::SKIP_FUNCTIONS, true);
+        return isset($trace[$index]['class']) || \in_array($trace[$index]['function'], static::SKIP_FUNCTIONS, true);
     }
 }
diff --git a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Utils.php b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Utils.php
index 153801553..a425f34ce 100644
--- a/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Utils.php
+++ b/htdocs/xoops_lib/vendor/monolog/monolog/src/Monolog/Utils.php
@@ -11,14 +11,30 @@
 
 namespace Monolog;
 
+use Monolog\Formatter\FormatterInterface;
+use Monolog\Formatter\WrappingFormatterInterface;
+
 final class Utils
 {
     const DEFAULT_JSON_FLAGS = JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_PRESERVE_ZERO_FRACTION | JSON_INVALID_UTF8_SUBSTITUTE | JSON_PARTIAL_OUTPUT_ON_ERROR;
 
+    /** @var array<class-string, array<string, true>> */
+    private static array $sensitiveParameterNames = [];
+
     public static function getClass(object $object): string
     {
-        $class = \get_class($object);
+        return self::getClassName(\get_class($object));
+    }
 
+    /**
+     * Strips the declaration site PHP appends to anonymous class names after a NUL byte
+     *
+     * Takes the name rather than the object because stack trace frames only carry the string.
+     *
+     * @param class-string $class
+     */
+    public static function getClassName(string $class): string
+    {
         if (false === ($pos = strpos($class, "@anonymous\0"))) {
             return $class;
         }
@@ -30,6 +46,60 @@ public static function getClass(object $object): string
         return $parent . '@anonymous';
     }
 
+    /**
+     * Returns the names of the constructor parameters of a class which are marked #[SensitiveParameter]
+     *
+     * The attribute can only target parameters, and PHP does not copy it over to the promoted
+     * property, so the constructor signature is the only place it can be found. Non-promoted
+     * parameters are included too, to be matched by name against the object's properties, as
+     * assigning a sensitive parameter to a same-named property is just as common.
+     *
+     * Results are cached per class as the reflection cost is otherwise prohibitive.
+     *
+     * @param  class-string        $class
+     * @return array<string, true> Set of parameter names, to be used with isset()
+     */
+    public static function getSensitiveParameterNames(string $class): array
+    {
+        if (isset(self::$sensitiveParameterNames[$class])) {
+            return self::$sensitiveParameterNames[$class];
+        }
+
+        $names = [];
+        try {
+            $constructor = (new \ReflectionClass($class))->getConstructor();
+            if (null !== $constructor) {
+                foreach ($constructor->getParameters() as $parameter) {
+                    // filtering by name and not IS_INSTANCEOF on purpose, so this keeps working
+                    // on PHP < 8.2 where the attribute class does not exist yet
+                    if (\count($parameter->getAttributes(\SensitiveParameter::class)) > 0) {
+                        $names[$parameter->getName()] = true;
+                    }
+                }
+            }
+        } catch (\ReflectionException) {
+            // class is not loadable, nothing we can do
+        }
+
+        return self::$sensitiveParameterNames[$class] = $names;
+    }
+
+    /**
+     * Resolves a chain of formatter decorators down to the formatter doing the actual work
+     *
+     * Useful for handlers which only accept one specific formatter, to let them accept it
+     * wrapped in a decorator like the RedactingFormatter.
+     */
+    public static function unwrapFormatter(FormatterInterface $formatter): FormatterInterface
+    {
+        // bounded in case a decorator ends up wrapping itself
+        for ($i = 0; $i < 10 && $formatter instanceof WrappingFormatterInterface; $i++) {
+            $formatter = $formatter->getWrappedFormatter();
+        }
+
+        return $formatter;
+    }
+
     public static function substr(string $string, int $start, ?int $length = null): string
     {
         if (\extension_loaded('mbstring')) {
diff --git a/htdocs/xoops_lib/vendor/punic/punic/CHANGELOG.md b/htdocs/xoops_lib/vendor/punic/punic/CHANGELOG.md
index 9b46df8b3..f8216e204 100644
--- a/htdocs/xoops_lib/vendor/punic/punic/CHANGELOG.md
+++ b/htdocs/xoops_lib/vendor/punic/punic/CHANGELOG.md
@@ -1,5 +1,10 @@
 # CHANGELOG
 
+### 3.8.2 (2023-03-29)
+
+- Fix the PHPDoc type of the $onlyCodes parameter of Territory::getLanguages() (#425, @mlocati)
+
+
 ### 3.8.1 (2023-03-29)
 
 - Fix PHP 8.2 deprecation warning in bin/punic-data (#419, @ragulka)
diff --git a/htdocs/xoops_lib/vendor/punic/punic/src/Territory.php b/htdocs/xoops_lib/vendor/punic/punic/src/Territory.php
index 92a028438..fce1fd9cd 100644
--- a/htdocs/xoops_lib/vendor/punic/punic/src/Territory.php
+++ b/htdocs/xoops_lib/vendor/punic/punic/src/Territory.php
@@ -247,13 +247,13 @@ public static function getTerritoriesWithInfo()
      *                               <li>'m' to include official minority languages</li>
      *                               <li>'u' to include unofficial or unknown languages</li>
      *                               </ul>
-     * @param string $onlyCodes Set to true to retrieve only the language codes. If set to false (default) you'll receive a list of arrays with these keys:
-     *                          <ul>
-     *                          <li>string id: the language identifier</li>
-     *                          <li>string status: 'o' for official; 'r' for official regional; 'f' for de facto official; 'm' for official minority; 'u' for unofficial or unknown</li>
-     *                          <li>number population: the amount of people speaking the language (%)</li>
-     *                          <li>number|null writing: the amount of people able to write (%). May be null if no data is available</li>
-     *                          </ul>
+     * @param bool $onlyCodes Set to true to retrieve only the language codes. If set to false (default) you'll receive a list of arrays with these keys:
+     *                        <ul>
+     *                        <li>string id: the language identifier</li>
+     *                        <li>string status: 'o' for official; 'r' for official regional; 'f' for de facto official; 'm' for official minority; 'u' for unofficial or unknown</li>
+     *                        <li>number population: the amount of people speaking the language (%)</li>
+     *                        <li>number|null writing: the amount of people able to write (%). May be null if no data is available</li>
+     *                        </ul>
      *
      * @return array|null Return the languages spoken in the specified territory, as described by the $onlyCodes parameter (or null if $territoryCode is not valid or no data is available)
      */
diff --git a/htdocs/xoops_lib/vendor/punic/punic/src/Unit.php b/htdocs/xoops_lib/vendor/punic/punic/src/Unit.php
index f1c8817b5..2c236ab80 100644
--- a/htdocs/xoops_lib/vendor/punic/punic/src/Unit.php
+++ b/htdocs/xoops_lib/vendor/punic/punic/src/Unit.php
@@ -336,7 +336,7 @@ private static function getDataForUnit(array $data, $unit)
             || !isset($data[$unitCategory])
             || $unitID === null || $unitID[0] === '_'
             || !isset($data[$unitCategory][$unitID])
-            ) {
+        ) {
             $units = array();
             foreach ($data as $c => $us) {
                 if (strpos($c, '_') === false) {
diff --git a/htdocs/xoops_lib/vendor/smarty/smarty/CHANGELOG.md b/htdocs/xoops_lib/vendor/smarty/smarty/CHANGELOG.md
index 831088d77..a60094981 100644
--- a/htdocs/xoops_lib/vendor/smarty/smarty/CHANGELOG.md
+++ b/htdocs/xoops_lib/vendor/smarty/smarty/CHANGELOG.md
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.5.8] - 2026-10-04
+
+- Security: prevent attacker-controlled template output from forging a nocache marker that injects raw PHP into the generated cache file when a template is rendered through the `extends:`/inheritance path (CWE-94 code injection); the top-level unifunc's missing nocache hash no longer produces an empty alternative in the cache-split regex
+
 ## [4.5.7] - 2026-06-29
 - Security: prevent symlinks inside a trusted `secure_dir`/template directory from being used to read files outside of it (CWE-22 path traversal), affecting `{include}` and `{fetch}` of local files
 - Security: `{html_image}` now escapes the `file`, `path_prefix`, `href`/`link`, `width` and `height` attributes (it already escaped `alt` and pass-through attributes), and `{html_select_date}` casts `day_size`/`month_size`/`year_size` to int (matching `{html_select_time}`), preventing untrusted values passed into these attributes from breaking out of the generated HTML (CWE-79)
diff --git a/htdocs/xoops_lib/vendor/smarty/smarty/libs/Smarty.class.php b/htdocs/xoops_lib/vendor/smarty/smarty/libs/Smarty.class.php
index cab3edf08..ab0bbdc8e 100644
--- a/htdocs/xoops_lib/vendor/smarty/smarty/libs/Smarty.class.php
+++ b/htdocs/xoops_lib/vendor/smarty/smarty/libs/Smarty.class.php
@@ -107,7 +107,7 @@ class Smarty extends Smarty_Internal_TemplateBase
     /**
      * smarty version
      */
-    const SMARTY_VERSION = '4.5.7';
+    const SMARTY_VERSION = '4.5.8';
     /**
      * define variable scopes
      */
diff --git a/htdocs/xoops_lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_updatecache.php b/htdocs/xoops_lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_updatecache.php
index c1abbb321..00c075330 100644
--- a/htdocs/xoops_lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_updatecache.php
+++ b/htdocs/xoops_lib/vendor/smarty/smarty/libs/sysplugins/smarty_internal_runtime_updatecache.php
@@ -72,22 +72,42 @@ public function removeNoCacheHash(
         $php_pattern = '/(<%|%>|<\?php|<\?|\?>|<script\s+language\s*=\s*[\"\']?\s*php\s*[\"\']?\s*>)/';
         $content = ob_get_clean();
         $hash_array = $cached->hashes;
-        $hash_array[ $_template->compiled->nocache_hash ] = true;
-        $hash_array = array_keys($hash_array);
-        $nocache_hash = '(' . implode('|', $hash_array) . ')';
+        // Only fold in the top-level nocache hash when it is actually set. A template
+        // compiled through the inheritance/component path produces a top-level unifunc
+        // that never restores its nocache_hash, leaving it null here. Using that null as
+        // an array offset is deprecated (PHP 8.1+), and an empty hash would produce an
+        // empty alternative "(realhash|)" in the pattern below, letting attacker-controlled
+        // output forge a nocache marker whose raw content is copied verbatim into the cache
+        // file (skipping PHP-tag neutralization) and executed as PHP on the next include
+        // (CWE-94 code injection).
+        if ((string) $_template->compiled->nocache_hash !== '') {
+            $hash_array[ $_template->compiled->nocache_hash ] = true;
+        }
+        // Defensive: never allow an empty hash (hence an empty regex alternative).
+        $hash_array = array_filter(array_keys($hash_array), function ($hash) {
+            return (string) $hash !== '';
+        });
         $_template->cached->has_nocache_code = false;
-        // get text between non-cached items
-        $cache_split =
-            preg_split(
+        if ($hash_array === array()) {
+            // No known nocache hashes: there is no legitimate nocache content to extract,
+            // so treat the whole buffer as ordinary output (PHP tags are neutralized below).
+            $cache_split = array($content);
+            $cache_parts = array();
+        } else {
+            $nocache_hash = '(' . implode('|', $hash_array) . ')';
+            // get text between non-cached items
+            $cache_split =
+                preg_split(
+                    "!/\*%%SmartyNocache:{$nocache_hash}%%\*\/(.+?)/\*/%%SmartyNocache:{$nocache_hash}%%\*/!s",
+                    $content
+                );
+            // get non-cached items
+            preg_match_all(
                 "!/\*%%SmartyNocache:{$nocache_hash}%%\*\/(.+?)/\*/%%SmartyNocache:{$nocache_hash}%%\*/!s",
-                $content
+                $content,
+                $cache_parts
             );
-        // get non-cached items
-        preg_match_all(
-            "!/\*%%SmartyNocache:{$nocache_hash}%%\*\/(.+?)/\*/%%SmartyNocache:{$nocache_hash}%%\*/!s",
-            $content,
-            $cache_parts
-        );
+        }
         $content = '';
         // loop over items, stitch back together
         foreach ($cache_split as $curr_idx => $curr_split) {
diff --git a/htdocs/xoops_lib/vendor/symfony/polyfill-mbstring/Mbstring.php b/htdocs/xoops_lib/vendor/symfony/polyfill-mbstring/Mbstring.php
index e3d1f965f..bc9e6acfa 100644
--- a/htdocs/xoops_lib/vendor/symfony/polyfill-mbstring/Mbstring.php
+++ b/htdocs/xoops_lib/vendor/symfony/polyfill-mbstring/Mbstring.php
@@ -79,20 +79,58 @@ final class Mbstring
         ['μ', 's', 'ι',        'σ', 'β',        'θ',        'φ',        'π',        'κ',        'ρ',        'ε',        "\xE1\xB9\xA1", 'ι'],
     ];
 
+    // Encodings rejected by mb_ord() and mb_chr(), with their aliases
+    private const UNSUPPORTED_CODEPOINT_ENCODINGS = [
+        'BASE64' => 'BASE64',
+        'UUENCODE' => 'UUENCODE',
+        'X-UUENCODE' => 'UUENCODE',
+        'HTML-ENTITIES' => 'HTML-ENTITIES',
+        'HTML' => 'HTML-ENTITIES',
+        'QUOTED-PRINTABLE' => 'Quoted-Printable',
+        'QPRINT' => 'Quoted-Printable',
+        'UTF-7' => 'UTF-7',
+        'UTF7' => 'UTF-7',
+        'UTF7-IMAP' => 'UTF7-IMAP',
+        'MUTF-7' => 'UTF7-IMAP',
+        'JIS' => 'JIS',
+        'ISO-2022-JP' => 'ISO-2022-JP',
+        'ISO-2022-JP-2004' => 'ISO-2022-JP-2004',
+        'ISO-2022-JP-MOBILE#KDDI' => 'ISO-2022-JP-MOBILE#KDDI',
+        'ISO-2022-JP-KDDI' => 'ISO-2022-JP-MOBILE#KDDI',
+        'ISO-2022-JP-MS' => 'ISO-2022-JP-MS',
+        'ISO2022JPMS' => 'ISO-2022-JP-MS',
+        'CP50220' => 'CP50220',
+        'CP50220RAW' => 'CP50220',
+        'CP50220-RAW' => 'CP50220',
+        'JIS-MS' => 'CP50220',
+        'CP50221' => 'CP50221',
+        'CP50222' => 'CP50222',
+    ];
+
+    // Well-formed characters in group 1, then the maximal subparts of ill-formed sequences
+    private const UTF8_CHAR_REGEX = '/([\x00-\x7F]|[\xC2-\xDF][\x80-\xBF]|\xE0[\xA0-\xBF][\x80-\xBF]|[\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}|\xED[\x80-\x9F][\x80-\xBF]|\xF0[\x90-\xBF][\x80-\xBF]{2}|[\xF1-\xF3][\x80-\xBF]{3}|\xF4[\x80-\x8F][\x80-\xBF]{2})|\xE0[\xA0-\xBF]|[\xE1-\xEC\xEE\xEF][\x80-\xBF]|\xED[\x80-\x9F]|\xF0[\x90-\xBF][\x80-\xBF]?|[\xF1-\xF3][\x80-\xBF]{1,2}|\xF4[\x80-\x8F][\x80-\xBF]?|[\x80-\xFF]/';
+
     private static $encodingList = ['ASCII', 'UTF-8'];
     private static $language = 'neutral';
     private static $internalEncoding = 'UTF-8';
     private static $iconvSupportsIgnore;
+    private static $convertibleEncodings = ['UTF-8' => true];
 
     public static function mb_convert_encoding($s, $toEncoding, $fromEncoding = null)
     {
-        if (\is_array($s)) {
-            $r = [];
-            foreach ($s as $str) {
-                $r[] = self::mb_convert_encoding($str, $toEncoding, $fromEncoding);
-            }
+        if (\is_string($fromEncoding) && 2 < \strlen($fromEncoding) && '"' === $fromEncoding[0] && '"' === $fromEncoding[-1]) {
+            $fromEncoding = substr($fromEncoding, 1, -1);
+        }
 
-            return $r;
+        if (80000 <= \PHP_VERSION_ID
+            && (!isset(self::$convertibleEncodings[$toEncoding]) || (null !== $fromEncoding && !(\is_string($fromEncoding) && isset(self::$convertibleEncodings[$fromEncoding]))))
+            && null !== $error = self::getConversionError('mb_convert_encoding', 2, $toEncoding, $fromEncoding)
+        ) {
+            throw new \ValueError($error);
+        }
+
+        if (\is_array($s)) {
+            return self::convertArray($s, $toEncoding, $fromEncoding);
         }
 
         if (\is_array($fromEncoding) || (null !== $fromEncoding && false !== strpos($fromEncoding, ','))) {
@@ -118,6 +156,8 @@ public static function mb_convert_encoding($s, $toEncoding, $fromEncoding = null
             }
             if ('UTF-8' !== $fromEncoding) {
                 $s = self::iconv($fromEncoding, 'UTF-8', $s);
+            } elseif (!preg_match('//u', $s)) {
+                $s = self::scrubUtf8($s);
             }
 
             return preg_replace_callback('/[\x80-\xFF]+/', [__CLASS__, 'html_encoding_callback'], $s);
@@ -157,17 +197,42 @@ public static function mb_convert_encoding($s, $toEncoding, $fromEncoding = null
             $fromEncoding = 'UTF-8';
         }
 
+        if ('UTF-8' === $fromEncoding && !preg_match('//u', $s)) {
+            $s = self::scrubUtf8($s);
+        }
+
         return self::iconv($fromEncoding, $toEncoding, $s);
     }
 
     public static function mb_convert_variables($toEncoding, $fromEncoding, &...$vars)
     {
+        if (\is_string($fromEncoding) && 2 < \strlen($fromEncoding) && '"' === $fromEncoding[0] && '"' === $fromEncoding[-1]) {
+            $fromEncoding = substr($fromEncoding, 1, -1);
+        }
+
+        if (80000 <= \PHP_VERSION_ID && null !== $error = self::getConversionError('mb_convert_variables', 1, $toEncoding, $fromEncoding)) {
+            throw new \ValueError($error);
+        }
+
         $ok = true;
-        array_walk_recursive($vars, static function (&$v) use (&$ok, $toEncoding, $fromEncoding) {
-            if (false === $v = self::mb_convert_encoding($v, $toEncoding, $fromEncoding)) {
-                $ok = false;
+        foreach ($vars as $i => &$var) {
+            $convert = static function (&$v) use (&$ok, $toEncoding, $fromEncoding, $i) {
+                if (\is_string($v)) {
+                    if (false === $v = self::mb_convert_encoding($v, $toEncoding, $fromEncoding)) {
+                        $ok = false;
+                    }
+                } elseif (80600 <= \PHP_VERSION_ID && !\is_object($v)) {
+                    trigger_error(\sprintf('mb_convert_variables(): Argument #%d must be of type string|array|object or only contain entries of type string|array|object, %s given', 3 + $i, strtok(get_debug_type($v), ' ')), \E_USER_WARNING);
+                }
+            };
+
+            if (\is_array($var)) {
+                array_walk_recursive($var, $convert);
+            } else {
+                $convert($var);
             }
-        });
+        }
+        unset($var);
 
         return $ok ? $fromEncoding : false;
     }
@@ -210,7 +275,7 @@ public static function mb_decode_numericentity($s, $convmap, $encoding = null)
         if ('UTF-8' === $encoding) {
             $encoding = null;
             if (!preg_match('//u', $s)) {
-                $s = @self::iconv('UTF-8', 'UTF-8', $s);
+                $s = self::scrubUtf8($s);
             }
         } else {
             $s = self::iconv($encoding, 'UTF-8', $s);
@@ -276,7 +341,7 @@ public static function mb_encode_numericentity($s, $convmap, $encoding = null, $
         if ('UTF-8' === $encoding) {
             $encoding = null;
             if (!preg_match('//u', $s)) {
-                $s = @self::iconv('UTF-8', 'UTF-8', $s);
+                $s = self::scrubUtf8($s);
             }
         } else {
             $s = self::iconv($encoding, 'UTF-8', $s);
@@ -290,10 +355,15 @@ public static function mb_encode_numericentity($s, $convmap, $encoding = null, $
         $result = '';
 
         while ($i < $len) {
-            $ulen = $s[$i] < "\x80" ? 1 : $ulenMask[$s[$i] & "\xF0"];
+            $ulen = $s[$i] < "\x80" ? 1 : $ulenMask[$s[$i] & "\xF0"] ?? 1;
             $uchr = substr($s, $i, $ulen);
             $i += $ulen;
-            $c = self::mb_ord($uchr);
+
+            // code points above U+10FFFF are outside any convmap, but mb_ord() rejects them
+            if (false === $c = self::mb_ord($uchr)) {
+                $result .= $uchr;
+                continue;
+            }
 
             for ($j = 0; $j < $cnt; $j += 4) {
                 if ($c >= $convmap[$j] && $c <= $convmap[$j + 1]) {
@@ -324,7 +394,7 @@ public static function mb_convert_case($s, $mode, $encoding = null)
         if ('UTF-8' === $encoding) {
             $encoding = null;
             if (!preg_match('//u', $s)) {
-                $s = @self::iconv('UTF-8', 'UTF-8', $s);
+                $s = self::scrubUtf8($s);
             }
         } else {
             $s = self::iconv($encoding, 'UTF-8', $s);
@@ -365,7 +435,7 @@ public static function mb_convert_case($s, $mode, $encoding = null)
             $len = \strlen($s);
 
             while ($i < $len) {
-                $ulen = $s[$i] < "\x80" ? 1 : $ulenMask[$s[$i] & "\xF0"];
+                $ulen = $s[$i] < "\x80" ? 1 : $ulenMask[$s[$i] & "\xF0"] ?? 1;
                 $uchr = substr($s, $i, $ulen);
                 $i += $ulen;
 
@@ -462,6 +532,10 @@ public static function mb_check_encoding($var = null, $encoding = null)
         }
 
         if (!\is_array($var)) {
+            if ('UTF-8' === self::getEncoding($encoding)) {
+                return (bool) preg_match('//u', $var);
+            }
+
             return self::mb_detect_encoding($var, [$encoding]) || false !== @iconv($encoding, $encoding, $var);
         }
 
@@ -562,50 +636,16 @@ public static function mb_strlen($s, $encoding = null)
 
     public static function mb_strpos($haystack, $needle, $offset = 0, $encoding = null)
     {
-        $encoding = self::getEncoding($encoding);
-        if ('CP850' === $encoding || 'ASCII' === $encoding) {
-            return strpos($haystack, $needle, $offset);
-        }
-
-        $needle = (string) $needle;
-        if ('' === $needle) {
-            if (80000 > \PHP_VERSION_ID) {
-                trigger_error(__METHOD__.': Empty delimiter', \E_USER_WARNING);
-
-                return false;
-            }
-
-            return 0;
-        }
-
-        return iconv_strpos($haystack, $needle, $offset, $encoding);
+        return self::find(__FUNCTION__, $haystack, $needle, $offset, $encoding, false, false);
     }
 
     public static function mb_strrpos($haystack, $needle, $offset = 0, $encoding = null)
     {
-        $encoding = self::getEncoding($encoding);
-        if ('CP850' === $encoding || 'ASCII' === $encoding) {
-            return strrpos($haystack, $needle, $offset);
-        }
-
         if ($offset != (int) $offset) {
             $offset = 0;
-        } elseif ($offset = (int) $offset) {
-            if ($offset < 0) {
-                if (0 > $offset += self::mb_strlen($needle)) {
-                    $haystack = self::mb_substr($haystack, 0, $offset, $encoding);
-                }
-                $offset = 0;
-            } else {
-                $haystack = self::mb_substr($haystack, $offset, 2147483647, $encoding);
-            }
         }
 
-        $pos = '' !== $needle || 80000 > \PHP_VERSION_ID
-            ? iconv_strrpos($haystack, $needle, $encoding)
-            : self::mb_strlen($haystack, $encoding);
-
-        return false !== $pos ? $offset + $pos : false;
+        return self::find(__FUNCTION__, $haystack, $needle, $offset, $encoding, true, false);
     }
 
     public static function mb_str_split($string, $split_length = 1, $encoding = null)
@@ -626,17 +666,27 @@ public static function mb_str_split($string, $split_length = 1, $encoding = null
             throw new \ValueError('Argument #2 ($length) must be greater than 0');
         }
 
+        if (80300 <= \PHP_VERSION_ID && 0x3FFFFFFF < $split_length) {
+            throw new \ValueError('Argument #2 ($length) is too large');
+        }
+
         if (null === $encoding) {
             $encoding = mb_internal_encoding();
         }
 
         if ('UTF-8' === $encoding = self::getEncoding($encoding)) {
+            $string = (string) $string;
+
+            if (\strlen($string) <= $split_length) {
+                return '' === $string ? [] : [$string];
+            }
+
             $rx = '/(';
             while (65535 < $split_length) {
                 $rx .= '.{65535}';
                 $split_length -= 65535;
             }
-            $rx .= '.{'.$split_length.'})/us';
+            $rx .= '.{'.$split_length.'})/Aus';
 
             return preg_split($rx, $string, -1, \PREG_SPLIT_DELIM_CAPTURE | \PREG_SPLIT_NO_EMPTY);
         }
@@ -707,64 +757,32 @@ public static function mb_substr($s, $start, $length = null, $encoding = null)
 
     public static function mb_stripos($haystack, $needle, $offset = 0, $encoding = null)
     {
-        [$haystack, $needle] = str_replace(self::SIMPLE_CASE_FOLD[0], self::SIMPLE_CASE_FOLD[1], [
-            self::mb_convert_case($haystack, \MB_CASE_LOWER, $encoding),
-            self::mb_convert_case($needle, \MB_CASE_LOWER, $encoding),
-        ]);
-
-        return self::mb_strpos($haystack, $needle, $offset, $encoding);
+        return self::find(__FUNCTION__, $haystack, $needle, $offset, $encoding, false, true);
     }
 
     public static function mb_stristr($haystack, $needle, $part = false, $encoding = null)
     {
-        $pos = self::mb_stripos($haystack, $needle, 0, $encoding);
-
-        return self::getSubpart($pos, $part, $haystack, $encoding);
+        return self::findPart(__FUNCTION__, $haystack, $needle, $part, $encoding, false, true);
     }
 
     public static function mb_strrchr($haystack, $needle, $part = false, $encoding = null)
     {
-        $encoding = self::getEncoding($encoding);
-        if ('CP850' === $encoding || 'ASCII' === $encoding) {
-            $pos = strrpos($haystack, $needle);
-        } else {
-            $needle = self::mb_substr($needle, 0, 1, $encoding);
-            $pos = iconv_strrpos($haystack, $needle, $encoding);
-        }
-
-        return self::getSubpart($pos, $part, $haystack, $encoding);
+        return self::findPart(__FUNCTION__, $haystack, $needle, $part, $encoding, true, false);
     }
 
     public static function mb_strrichr($haystack, $needle, $part = false, $encoding = null)
     {
-        $needle = self::mb_substr($needle, 0, 1, $encoding);
-        $pos = self::mb_strripos($haystack, $needle, $encoding);
-
-        return self::getSubpart($pos, $part, $haystack, $encoding);
+        return self::findPart(__FUNCTION__, $haystack, $needle, $part, $encoding, true, true);
     }
 
     public static function mb_strripos($haystack, $needle, $offset = 0, $encoding = null)
     {
-        $haystack = self::mb_convert_case($haystack, \MB_CASE_LOWER, $encoding);
-        $needle = self::mb_convert_case($needle, \MB_CASE_LOWER, $encoding);
-
-        $haystack = str_replace(self::SIMPLE_CASE_FOLD[0], self::SIMPLE_CASE_FOLD[1], $haystack);
-        $needle = str_replace(self::SIMPLE_CASE_FOLD[0], self::SIMPLE_CASE_FOLD[1], $needle);
-
-        return self::mb_strrpos($haystack, $needle, $offset, $encoding);
+        return self::find(__FUNCTION__, $haystack, $needle, $offset, $encoding, true, true);
     }
 
     public static function mb_strstr($haystack, $needle, $part = false, $encoding = null)
     {
-        $pos = strpos($haystack, $needle);
-        if (false === $pos) {
-            return false;
-        }
-        if ($part) {
-            return substr($haystack, 0, $pos);
-        }
-
-        return substr($haystack, $pos);
+        return self::findPart(__FUNCTION__, $haystack, $needle, $part, $encoding, false, false);
     }
 
     public static function mb_get_info($type = 'all')
@@ -809,19 +827,37 @@ public static function mb_http_output($encoding = null)
     public static function mb_strwidth($s, $encoding = null)
     {
         $encoding = self::getEncoding($encoding);
+        $wideChars = '/[\x{1100}-\x{115F}\x{2329}\x{232A}\x{2E80}-\x{303E}\x{3040}-\x{A4CF}\x{AC00}-\x{D7A3}\x{F900}-\x{FAFF}\x{FE10}-\x{FE19}\x{FE30}-\x{FE6F}\x{FF00}-\x{FF60}\x{FFE0}-\x{FFE6}\x{20000}-\x{2FFFD}\x{30000}-\x{3FFFD}]/u';
 
         if ('UTF-8' !== $encoding) {
             $s = self::iconv($encoding, 'UTF-8', $s);
+        } elseif (!preg_match('//u', $s)) {
+            // Each maximal subpart of an ill-formed sequence is one column wide
+            return preg_match_all(self::UTF8_CHAR_REGEX, $s) + preg_match_all($wideChars, self::scrubUtf8($s));
         }
 
-        $s = preg_replace('/[\x{1100}-\x{115F}\x{2329}\x{232A}\x{2E80}-\x{303E}\x{3040}-\x{A4CF}\x{AC00}-\x{D7A3}\x{F900}-\x{FAFF}\x{FE10}-\x{FE19}\x{FE30}-\x{FE6F}\x{FF00}-\x{FF60}\x{FFE0}-\x{FFE6}\x{20000}-\x{2FFFD}\x{30000}-\x{3FFFD}]/u', '', $s, -1, $wide);
+        $s = preg_replace($wideChars, '', $s, -1, $wide);
 
         return ($wide << 1) + iconv_strlen($s, 'UTF-8');
     }
 
     public static function mb_substr_count($haystack, $needle, $encoding = null)
     {
-        return substr_count($haystack, $needle);
+        if ('' === $needle = (string) $needle) {
+            if (80000 > \PHP_VERSION_ID) {
+                trigger_error('mb_substr_count(): Empty substring', \E_USER_WARNING);
+
+                return false;
+            }
+
+            throw new \ValueError('mb_substr_count(): Argument #2 ($needle) must not be empty');
+        }
+
+        if (!$search = self::prepareSearch((string) $haystack, $needle, self::getEncoding($encoding), false, true)) {
+            return 0;
+        }
+
+        return substr_count($search[0], $search[1]);
     }
 
     public static function mb_output_handler($contents, $status)
@@ -831,6 +867,10 @@ public static function mb_output_handler($contents, $status)
 
     public static function mb_chr($code, $encoding = null)
     {
+        if (null !== $encoding && !self::assertCodepointEncoding($encoding, 'mb_chr')) {
+            return false;
+        }
+
         if (0x80 > $code %= 0x200000) {
             $s = \chr($code);
         } elseif (0x800 > $code) {
@@ -850,26 +890,64 @@ public static function mb_chr($code, $encoding = null)
 
     public static function mb_ord($s, $encoding = null)
     {
+        if ('' === (string) $s) {
+            if (80000 > \PHP_VERSION_ID) {
+                trigger_error('mb_ord(): Empty string', \E_USER_WARNING);
+
+                return false;
+            }
+
+            throw new \ValueError('mb_ord(): Argument #1 ($string) must not be empty');
+        }
+
+        if (null !== $encoding && !self::assertCodepointEncoding($encoding, 'mb_ord')) {
+            return false;
+        }
+
         if ('UTF-8' !== $encoding = self::getEncoding($encoding)) {
             $s = mb_convert_encoding($s, 'UTF-8', $encoding);
         }
 
-        if (1 === \strlen($s)) {
-            return \ord($s);
+        $s = unpack('C*', substr($s, 0, 4));
+        $code = $s[1] ?? 0;
+        if (0x80 > $code) {
+            return $code;
         }
 
-        $code = ($s = unpack('C*', substr($s, 0, 4))) ? $s[1] : 0;
-        if (0xF0 <= $code) {
-            return (($code - 0xF0) << 18) + (($s[2] - 0x80) << 12) + (($s[3] - 0x80) << 6) + $s[4] - 0x80;
+        if (0xC2 > $code || 0xF4 < $code) {
+            return false;
         }
-        if (0xE0 <= $code) {
-            return (($code - 0xE0) << 12) + (($s[2] - 0x80) << 6) + $s[3] - 0x80;
+
+        $c2 = $s[2] ?? 0;
+        if (0x80 !== ($c2 & 0xC0)) {
+            return false;
         }
-        if (0xC0 <= $code) {
-            return (($code - 0xC0) << 6) + $s[2] - 0x80;
+
+        if (0xE0 > $code) {
+            return (($code & 0x1F) << 6) | ($c2 & 0x3F);
         }
 
-        return $code;
+        $c3 = $s[3] ?? 0;
+        if (0x80 !== ($c3 & 0xC0)
+            || 0xE0 === $code && 0xA0 > $c2
+            || 0xED === $code && 0xA0 <= $c2
+        ) {
+            return false;
+        }
+
+        if (0xF0 > $code) {
+            return (($code & 0x0F) << 12) | (($c2 & 0x3F) << 6) | ($c3 & 0x3F);
+        }
+
+        $c4 = $s[4] ?? 0;
+        if (0x80 !== ($c4 & 0xC0)
+            || 0xF0 === $code && 0x90 > $c2
+            || 0xF4 === $code && 0x90 <= $c2
+        ) {
+            return false;
+        }
+
+        return (($code & 0x07) << 18) | (($c2 & 0x3F) << 12) | (($c3 & 0x3F) << 6) | ($c4 & 0x3F);
     }
 
     /** @return string|false */
@@ -893,7 +971,7 @@ public static function mb_str_pad(string $string, int $length, string $pad_strin
             return false;
         }
 
-        if (self::mb_strlen($pad_string, $encoding) <= 0) {
+        if (0 >= $padStringLength = self::mb_strlen($pad_string, $encoding)) {
             if (\PHP_VERSION_ID < 80000) {
                 trigger_error('mb_str_pad(): Argument #3 ($pad_string) must be a non-empty string', \E_USER_WARNING);
 
@@ -921,15 +999,20 @@ public static function mb_str_pad(string $string, int $length, string $pad_strin
 
         switch ($pad_type) {
             case \STR_PAD_LEFT:
-                return self::mb_substr(str_repeat($pad_string, $paddingRequired), 0, $paddingRequired, $encoding).$string;
+                $leftPaddingLength = $paddingRequired;
+                break;
             case \STR_PAD_RIGHT:
-                return $string.self::mb_substr(str_repeat($pad_string, $paddingRequired), 0, $paddingRequired, $encoding);
+                $leftPaddingLength = 0;
+                break;
             default:
-                $leftPaddingLength = floor($paddingRequired / 2);
-                $rightPaddingLength = $paddingRequired - $leftPaddingLength;
-
-                return self::mb_substr(str_repeat($pad_string, $leftPaddingLength), 0, $leftPaddingLength, $encoding).$string.self::mb_substr(str_repeat($pad_string, $rightPaddingLength), 0, $rightPaddingLength, $encoding);
+                $leftPaddingLength = intdiv($paddingRequired, 2);
         }
+
+        $rightPaddingLength = $paddingRequired - $leftPaddingLength;
+
+        return str_repeat($pad_string, intdiv($leftPaddingLength, $padStringLength)).self::mb_substr($pad_string, 0, $leftPaddingLength % $padStringLength, $encoding)
+            .$string
+            .str_repeat($pad_string, intdiv($rightPaddingLength, $padStringLength)).self::mb_substr($pad_string, 0, $rightPaddingLength % $padStringLength, $encoding);
     }
 
     /** @return string|false */
@@ -980,16 +1063,288 @@ public static function mb_rtrim(string $string, ?string $characters = null, ?str
         return self::mb_internal_trim('{[%s]+$}Du', $string, $characters, $encoding, __FUNCTION__);
     }
 
-    private static function getSubpart($pos, $part, $haystack, $encoding)
+    /**
+     * Finds the position of $needle in $haystack like native mbstring.
+     *
+     * @return int|false
+     */
+    private static function find(string $function, $haystack, $needle, $offset, $encoding, bool $reverse, bool $fold)
+    {
+        $needle = (string) $needle;
+
+        if (80000 > \PHP_VERSION_ID && '' === $needle && 'mb_stripos' === $function) {
+            trigger_error($function.'(): Empty delimiter', \E_USER_WARNING);
+
+            return false;
+        }
+
+        if (!$search = self::prepareSearch((string) $haystack, $needle, self::searchEncoding($encoding, $fold), $fold, $fold)) {
+            return false;
+        }
+
+        [$haystack, $needle, $bytes, $dropped] = $search;
+
+        if (80000 > \PHP_VERSION_ID && $fold && ('' === $haystack || '' === $needle)) {
+            return false;
+        }
+
+        if (false === $start = self::utf8Offset($haystack, $offset = (int) $offset, $bytes)) {
+            // Native mbstring counts the ill-formed sequences that iconv() dropped: the offset could be in range
+            if ($dropped && abs($offset) <= self::utf8Length($haystack) + $dropped) {
+                return false;
+            }
+
+            if (80000 > \PHP_VERSION_ID) {
+                trigger_error($function.'(): '.($reverse ? 'Offset is greater than the length of haystack string' : 'Offset not contained in string'), \E_USER_WARNING);
+
+                return false;
+            }
+
+            throw new \ValueError($function.'(): Argument #3 ($offset) must be contained in argument #1 ($haystack)');
+        }
+
+        if (80000 > \PHP_VERSION_ID && '' === $needle) {
+            if ('mb_strpos' === $function) {
+                trigger_error($function.'(): Empty delimiter', \E_USER_WARNING);
+            }
+
+            return false;
+        }
+
+        if (!$reverse) {
+            $pos = strpos($haystack, $needle, $start);
+        } else {
+            $pos = strrpos($haystack, $needle, 0 > $offset ? $start - \strlen($haystack) : $start);
+        }
+
+        return false === $pos || $bytes ? $pos : self::utf8Length(substr($haystack, 0, $pos));
+    }
+
+    /**
+     * Returns the part of $haystack before or from $needle like native mbstring.
+     *
+     * @return string|false
+     */
+    private static function findPart(string $function, $haystack, $needle, $part, $encoding, bool $reverse, bool $fold)
+    {
+        $needle = (string) $needle;
+
+        if (80000 > \PHP_VERSION_ID && '' === $needle) {
+            if (!$reverse) {
+                trigger_error($function.'(): Empty delimiter', \E_USER_WARNING);
+            }
+
+            return false;
+        }
+
+        $haystack = (string) $haystack;
+
+        if (!$search = self::prepareSearch($haystack, $needle, $encoding = self::searchEncoding($encoding, $fold), $fold, $fold)) {
+            return false;
+        }
+
+        [$h, $n, $bytes] = $search;
+
+        if (false === $pos = $reverse ? strrpos($h, $n) : strpos($h, $n)) {
+            return false;
+        }
+
+        if ($bytes) {
+            return (string) ($part ? substr($haystack, 0, $pos) : substr($haystack, $pos));
+        }
+
+        if ($fold || ('UTF-8' === $encoding && (!preg_match('//u', $haystack) || !preg_match('//u', $needle)))) {
+            // Cut after as many characters as native mbstring counts before the match
+            $pos = self::utf8Length(substr($h, 0, $pos));
+            $h = 'UTF-8' === $encoding ? self::markIllFormedUtf8($haystack) : self::utf8($haystack, $encoding);
+            $pos = self::utf8Offset($h, $pos, false);
+        }
+
+        $h = (string) ($part ? substr($h, 0, $pos) : substr($h, $pos));
+
+        if (false !== strpos($h, "\xFF")) {
+            $h = str_replace("\xFF", 'none' === mb_substitute_character() ? '' : '?', $h);
+        }
+
+        return 'UTF-8' === $encoding ? $h : (string) @self::iconv('UTF-8', $encoding, $h);
+    }
+
+    /**
+     * @return array{string, string, bool, int}|null The haystack and the needle to search, whether offsets in them count bytes rather than UTF-8 characters, and how many bytes of ill-formed sequences iconv() dropped from the haystack
+     */
+    private static function prepareSearch(string $haystack, string $needle, string $encoding, bool $fold, bool $markIllFormed)
+    {
+        if ('ASCII' === $encoding || ('CP850' === $encoding && !$fold)) {
+            if ('ASCII' === $encoding) {
+                // Native mbstring turns every byte above 0x7F into the same error marker
+                $haystack = preg_replace('/[\x80-\xFF]/', "\xFF", $haystack);
+                $needle = preg_replace('/[\x80-\xFF]/', "\xFF", $needle);
+            }
+
+            if ($fold) {
+                $haystack = strtr($haystack, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');
+                $needle = strtr($needle, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz');
+            }
+
+            return [$haystack, $needle, true, 0];
+        }
+
+        $dropped = 0;
+
+        if ('UTF-8' !== $encoding) {
+            if (false === ($haystack = self::utf8($haystack, $encoding, $dropped)) || false === $needle = self::utf8($needle, $encoding)) {
+                return null;
+            }
+        } elseif ($markIllFormed) {
+            $haystack = self::markIllFormedUtf8($haystack);
+            $needle = self::markIllFormedUtf8($needle);
+        }
+
+        return $fold ? [self::foldCase($haystack), self::foldCase($needle), false, $dropped] : [$haystack, $needle, false, $dropped];
+    }
+
+    private static function searchEncoding($encoding, bool $fold): string
+    {
+        $normalizedEncoding = self::getEncoding($encoding);
+
+        // Native mbstring folds the case of 8bit strings as Latin-1
+        return $fold && 'CP850' === $normalizedEncoding && null !== $encoding && 'CP850' !== strtoupper($encoding) ? 'ISO-8859-1' : $normalizedEncoding;
+    }
+
+    /**
+     * Converts $s to UTF-8 to search it, ending with "\xFF", a byte that is invalid in UTF-8, when its last sequence is truncated, like native mbstring.
+     *
+     * @param int $dropped Set to the number of bytes of the ill-formed sequences that iconv() dropped elsewhere
+     *
+     * @return string|false False when the encoding is unknown
+     */
+    private static function utf8(string $s, string $encoding, &$dropped = 0)
     {
-        if (false === $pos) {
+        if ('UTF-8' === $encoding || '' === $s) {
+            return $s;
+        }
+
+        if (false !== $u = @iconv($encoding, 'UTF-8', $s)) {
+            return $u;
+        }
+
+        // Let iconv() warn about an unknown encoding
+        if (false === iconv($encoding, 'UTF-8', '')) {
             return false;
         }
-        if ($part) {
-            return self::mb_substr($haystack, 0, $pos, $encoding);
+
+        // iconv() drops the ill-formed sequences, but fails on a truncated one at the end
+        for ($i = 0; $i < 4; ++$i) {
+            if (false !== $u = @self::iconv($encoding, 'UTF-8', $i ? substr($s, 0, -$i) : $s)) {
+                $dropped = \strlen($s) - $i - \strlen((string) @iconv('UTF-8', $encoding, $u));
+
+                return $i || '' === $u ? $u."\xFF" : $u;
+            }
+        }
+
+        $dropped = \strlen($s);
+
+        return "\xFF";
+    }
+
+    /**
+     * Replaces each maximal subpart of ill-formed UTF-8 sequences with "\xFF", like native mbstring before searching case-insensitively.
+     */
+    private static function markIllFormedUtf8(string $s): string
+    {
+        if (preg_match('//u', $s)) {
+            return $s;
+        }
+
+        return preg_replace('/\G(?:[\x00-\x7F]|[\xC2-\xDF][\x80-\xBF]|\xE0[\xA0-\xBF][\x80-\xBF]|[\xE1-\xEC\xEE\xEF][\x80-\xBF]{2}|\xED[\x80-\x9F][\x80-\xBF]|\xF0[\x90-\xBF][\x80-\xBF]{2}|[\xF1-\xF3][\x80-\xBF]{3}|\xF4[\x80-\x8F][\x80-\xBF]{2})*+\K(?:\xE0[\xA0-\xBF]|[\xE1-\xEC\xEE\xEF][\x80-\xBF]|\xED[\x80-\x9F]|\xF0[\x90-\xBF][\x80-\xBF]?|[\xF1-\xF3][\x80-\xBF]{1,2}|\xF4[\x80-\x8F][\x80-\xBF]?|[\x80-\xFF])/', "\xFF", $s);
+    }
+
+    /**
+     * Folds the case of UTF-8 $s like the simple case folding of native mbstring.
+     */
+    private static function foldCase(string $s): string
+    {
+        static $map = null;
+
+        if (null === $map) {
+            $map = array_combine(self::SIMPLE_CASE_FOLD[0], self::SIMPLE_CASE_FOLD[1]) + self::getData('lowerCase');
+            unset($map["\xC4\xB0"]); // U+0130 has no simple case folding
+        }
+
+        return strtr($s, $map);
+    }
+
+    /**
+     * Counts the characters of UTF-8 $s like native mbstring, even when ill-formed: one per byte that is not a continuation byte.
+     */
+    private static function utf8Length(string $s): int
+    {
+        return \strlen($s) - array_sum(\array_slice(count_chars($s), 0x80, 0x40));
+    }
+
+    /**
+     * @return int|false The offset in bytes of the character at $offset, false when it is out of range, like native mbstring
+     */
+    private static function utf8Offset(string $s, int $offset, bool $bytes)
+    {
+        if (0 === $offset) {
+            return 0;
+        }
+
+        if ($bytes || preg_match('//u', $u = str_replace("\xFF", '?', $s))) {
+            $length = $bytes ? \strlen($s) : self::utf8Length($s);
+
+            if (0 > $offset) {
+                $offset += $length;
+            }
+
+            if (0 > $offset || $offset > $length) {
+                return false;
+            }
+
+            if ($bytes) {
+                return $offset;
+            }
+
+            for ($rx = ''; 65535 < $offset; $offset -= 65535) {
+                $rx .= '.{65535}';
+            }
+            preg_match('/^'.$rx.'.{'.$offset.'}\K/su', $u, $m, \PREG_OFFSET_CAPTURE);
+
+            return $m[0][1];
         }
 
-        return self::mb_substr($haystack, $pos, null, $encoding);
+        // Walk ill-formed UTF-8 like native mbstring: backward over the bytes that are not continuation bytes, forward by the lengths that lead bytes announce
+        $length = \strlen($s);
+
+        if (0 > $offset) {
+            $i = $length;
+
+            while (0 > $offset) {
+                if (0 === $i) {
+                    return false;
+                }
+
+                if (0x80 !== (\ord($s[--$i]) & 0xC0)) {
+                    ++$offset;
+                }
+            }
+
+            return $i;
+        }
+
+        $i = 0;
+
+        while (0 < $offset--) {
+            if ($i >= $length) {
+                return false;
+            }
+
+            $c = \ord($s[$i]);
+            $i += $c < 0xC2 ? 1 : ($c < 0xE0 ? 2 : ($c < 0xF0 ? 3 : ($c < 0xF5 ? 4 : 1)));
+        }
+
+        return min($i, $length);
     }
 
     private static function html_encoding_callback(array $m)
@@ -1083,16 +1438,13 @@ private static function mb_internal_trim(string $regex, string $string, ?string
         }
 
         if ('' === $characters) {
-            return null === $encoding ? $string : self::mb_convert_encoding($string, $encoding);
+            return $string;
         }
 
-        if ('UTF-8' === $encoding) {
+        if ('UTF-8' === self::getEncoding($encoding)) {
             $encoding = null;
-            if (!preg_match('//u', $string)) {
-                $string = @self::iconv('UTF-8', 'UTF-8', $string);
-            }
-            if (null !== $characters && !preg_match('//u', $characters)) {
-                $characters = @self::iconv('UTF-8', 'UTF-8', $characters);
+            if (!preg_match('//u', $string) || (null !== $characters && !preg_match('//u', $characters))) {
+                return self::mb_trim_invalid_utf8($string, $characters, $function);
             }
         } else {
             $string = self::iconv($encoding, 'UTF-8', $string);
@@ -1117,6 +1469,139 @@ private static function mb_internal_trim(string $regex, string $string, ?string
         return self::iconv('UTF-8', $encoding, $string);
     }
 
+    /**
+     * Trims ill-formed UTF-8 like mbstring: each maximal subpart of an ill-formed
+     * sequence counts as one character, and the string is returned as is when
+     * nothing is trimmed, else re-encoded with the substitute character.
+     */
+    private static function mb_trim_invalid_utf8(string $string, ?string $characters, string $function): string
+    {
+        $regex = self::UTF8_CHAR_REGEX;
+
+        // Ill-formed sequences leave group 1 empty: they are trimmed when $characters has one too
+        preg_match_all($regex, $characters ?? "\0 \f\n\r\t\v\u{00A0}\u{1680}\u{2000}\u{2001}\u{2002}\u{2003}\u{2004}\u{2005}\u{2006}\u{2007}\u{2008}\u{2009}\u{200A}\u{2028}\u{2029}\u{202F}\u{205F}\u{3000}\u{0085}\u{180E}", $m);
+        $trimmed = array_flip($m[1]);
+
+        $start = 0;
+        $end = \strlen($string);
+
+        while ('mb_rtrim' !== $function && $start < $end && preg_match($regex, $string, $m, 0, $start) && isset($trimmed[$m[1] ?? ''])) {
+            $start += \strlen($m[0]);
+        }
+
+        while ('mb_ltrim' !== $function && $start < $end) {
+            // Characters are at most 4 bytes long, and only continuation bytes don't start one
+            for ($i = $end - 1; $i > $start && $i > $end - 4 && 0x80 === (\ord($string[$i]) & 0xC0); --$i) {
+            }
+
+            preg_match_all($regex, substr($string, $i, $end - $i), $m);
+
+            if (!isset($trimmed[end($m[1])])) {
+                break;
+            }
+
+            $end -= \strlen(end($m[0]));
+        }
+
+        if (0 === $start && \strlen($string) === $end) {
+            return $string;
+        }
+
+        $string = substr($string, $start, $end - $start);
+
+        return 'none' === mb_substitute_character() ? self::scrubUtf8($string) : mb_convert_encoding($string, 'UTF-8', 'UTF-8');
+    }
+
+    private static function scrubUtf8(string $s): string
+    {
+        return preg_replace(self::UTF8_CHAR_REGEX, '$1', $s);
+    }
+
+    /**
+     * @param true[] $referenceIds The ids of the references followed to reach $array
+     */
+    private static function convertArray(array $array, $toEncoding, $fromEncoding, array $referenceIds = []): array
+    {
+        $r = [];
+
+        foreach ($array as $key => $v) {
+            if (null !== $v && !\is_scalar($v) && !\is_array($v)) {
+                trigger_error('mb_convert_encoding(): Object is not supported', \E_USER_WARNING);
+                continue;
+            }
+
+            $k = \is_string($key) ? self::mb_convert_encoding($key, $toEncoding, $fromEncoding) : $key;
+
+            if (\is_string($v)) {
+                $v = self::mb_convert_encoding($v, $toEncoding, $fromEncoding);
+            } elseif (\is_array($v)) {
+                // Only a reference can close a cycle: following the same one twice means one was found
+                $id = 70400 <= \PHP_VERSION_ID && ($reference = \ReflectionReference::fromArrayElement($array, $key)) ? $reference->getId() : null;
+
+                if (null !== $id && isset($referenceIds[$id])) {
+                    trigger_error('mb_convert_encoding(): Cannot convert recursively referenced values', \E_USER_WARNING);
+                    $v = [];
+                } else {
+                    $v = self::convertArray($v, $toEncoding, $fromEncoding, null === $id ? $referenceIds : $referenceIds + [$id => true]);
+                }
+            }
+
+            // Keys that collide once converted keep their first value
+            $r += [$k => $v];
+        }
+
+        return $r;
+    }
+
+    /**
+     * Returns the error native mbstring throws for these encoding arguments, if any.
+     */
+    private static function getConversionError(string $function, int $argument, $toEncoding, $fromEncoding): ?string
+    {
+        if (!self::isConvertibleEncoding((string) $toEncoding)) {
+            return \sprintf('%s(): Argument #%d ($to_encoding) must be a valid encoding, "%s" given', $function, $argument, $toEncoding);
+        }
+
+        if (null === $fromEncoding) {
+            return null;
+        }
+
+        if (!$list = \is_array($fromEncoding) ? $fromEncoding : ('' === $fromEncoding ? [] : explode(',', $fromEncoding))) {
+            return \sprintf('%s(): Argument #%d ($from_encoding) must specify at least one encoding', $function, 1 + $argument);
+        }
+
+        foreach ($list as $encoding) {
+            $encoding = \is_array($fromEncoding) ? (string) $encoding : trim($encoding, " \t");
+
+            // PHP 8.4 takes an empty entry of a comma-separated list for "auto"
+            if ('' === $encoding && !\is_array($fromEncoding) && 80400 <= \PHP_VERSION_ID) {
+                continue;
+            }
+
+            if (0 !== strcasecmp($encoding, 'auto') && !self::isConvertibleEncoding($encoding)) {
+                return \sprintf('%s(): Argument #%d ($from_encoding) contains invalid encoding "%s"', $function, 1 + $argument, $encoding);
+            }
+        }
+
+        return null;
+    }
+
+    private static function isConvertibleEncoding(string $encoding): bool
+    {
+        if (isset(self::$convertibleEncodings[$encoding])) {
+            return true;
+        }
+
+        $normalizedEncoding = self::getEncoding($encoding);
+
+        // Native encoding names use no other characters, while iconv() also accepts suffixes like //TRANSLIT
+        if ('' === $normalizedEncoding || preg_match('/[^\w#\-.:]/', $encoding) || (null === (self::UNSUPPORTED_CODEPOINT_ENCODINGS[$normalizedEncoding] ?? null) && false === @iconv($normalizedEncoding, $normalizedEncoding, ''))) {
+            return false;
+        }
+
+        return self::$convertibleEncodings[$encoding] = true;
+    }
+
     private static function assertEncoding(string $encoding, string $errorFormat): bool
     {
         try {
@@ -1135,4 +1620,31 @@ private static function assertEncoding(string $encoding, string $errorFormat): b
 
         return $validEncoding;
     }
+
+    private static function assertCodepointEncoding(string $encoding, string $function): bool
+    {
+        if (null !== $name = self::UNSUPPORTED_CODEPOINT_ENCODINGS[strtoupper($encoding)] ?? null) {
+            if (80000 > \PHP_VERSION_ID) {
+                trigger_error(\sprintf('%s(): Unsupported encoding "%s"', $function, $name), \E_USER_WARNING);
+
+                return false;
+            }
+
+            throw new \ValueError(\sprintf('%s() does not support the "%s" encoding', $function, $name));
+        }
+
+        $normalizedEncoding = self::getEncoding($encoding);
+
+        if ('UTF-8' === $normalizedEncoding || false !== @iconv($normalizedEncoding, $normalizedEncoding, '')) {
+            return true;
+        }
+
+        if (80000 > \PHP_VERSION_ID) {
+            trigger_error(\sprintf('%s(): Unknown encoding "%s"', $function, $encoding), \E_USER_WARNING);
+
+            return false;
+        }
+
+        throw new \ValueError(\sprintf('%s(): Argument #2 ($encoding) must be a valid encoding, "%s" given', $function, $encoding));
+    }
 }
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/DateCaster.php b/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/DateCaster.php
index 453d0cb90..4dcdd07d9 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/DateCaster.php
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/DateCaster.php
@@ -94,11 +94,18 @@ public static function castPeriod(\DatePeriod $p, array $a, Stub $stub, bool $is
         $dates = [];
         foreach (clone $p as $i => $d) {
             if (self::PERIOD_LIMIT === $i) {
+                if (!$end = $p->getEndDate()) {
+                    $dates[] = \sprintf('%s more', $p->recurrences - $i);
+                    break;
+                }
+
                 $now = new \DateTimeImmutable('now', new \DateTimeZone('UTC'));
-                $dates[] = \sprintf('%s more', ($end = $p->getEndDate())
-                    ? ceil(($end->format('U.u') - $d->format('U.u')) / ((int) $now->add($p->getDateInterval())->format('U.u') - (int) $now->format('U.u')))
-                    : $p->recurrences - $i
-                );
+                $numberOfSeconds = (float) $now->add($p->getDateInterval())->format('U.u') - (float) $now->format('U.u');
+
+                if (0 < $numberOfSeconds) {
+                    $dates[] = \sprintf('%s more', ceil(($end->format('U.u') - $d->format('U.u')) / $numberOfSeconds));
+                }
+
                 break;
             }
             $dates[] = \sprintf('%s) %s', $i + 1, self::formatDateTime($d));
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/SplCaster.php b/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/SplCaster.php
index 31f4b11cc..26a58cb12 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/SplCaster.php
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/Caster/SplCaster.php
@@ -144,7 +144,6 @@ public static function castFileInfo(\SplFileInfo $c, array $a, Stub $stub, bool
     public static function castFileObject(\SplFileObject $c, array $a, Stub $stub, bool $isNested): array
     {
         static $map = [
-            'csvControl' => 'getCsvControl',
             'flags' => 'getFlags',
             'maxLineLen' => 'getMaxLineLen',
             'fstat' => 'fstat',
@@ -154,6 +153,16 @@ public static function castFileObject(\SplFileObject $c, array $a, Stub $stub, b
 
         $prefix = Caster::PREFIX_VIRTUAL;
 
+        if (\PHP_VERSION_ID < 90000) {
+            set_error_handler(static fn () => true, \E_DEPRECATED);
+            try {
+                $a[$prefix.'csvControl'] = $c->getCsvControl();
+            } catch (\Exception) {
+            } finally {
+                restore_error_handler();
+            }
+        }
+
         foreach ($map as $key => $accessor) {
             try {
                 $a[$prefix.$key] = $c->$accessor();
@@ -234,12 +243,23 @@ public static function castWeakMap(\WeakMap $c, array $a, Stub $stub, bool $isNe
     private static function castSplArray(\ArrayObject|\ArrayIterator $c, array $a, Stub $stub, bool $isNested): array
     {
         $prefix = Caster::PREFIX_VIRTUAL;
-        $flags = $c->getFlags();
+        $hasDebugInfo = method_exists($c, '__debugInfo');
 
-        if (!($flags & \ArrayObject::STD_PROP_LIST)) {
-            $c->setFlags(\ArrayObject::STD_PROP_LIST);
-            $a = Caster::castObject($c, $c::class, method_exists($c, '__debugInfo'), $stub->class);
-            $c->setFlags($flags);
+        if ($c instanceof \ArrayObject) {
+            $flags = $c->getFlags();
+
+            if (!($flags & \ArrayObject::STD_PROP_LIST)) {
+                $c->setFlags(\ArrayObject::STD_PROP_LIST);
+                $a = Caster::castObject($c, $c::class, $hasDebugInfo, $stub->class);
+                $c->setFlags($flags);
+            }
+        } else {
+            // ArrayIterator::getFlags() and ArrayIterator::setFlags() are deprecated as of PHP 8.6
+            [$flags, , $properties] = $c->__serialize();
+
+            if (!($flags & \ArrayObject::STD_PROP_LIST)) {
+                $a = $properties;
+            }
         }
 
         unset($a["\0ArrayObject\0storage"], $a["\0ArrayIterator\0storage"]);
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/CliDescriptor.php b/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/CliDescriptor.php
index 24590fc85..8ea85d588 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/CliDescriptor.php
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/CliDescriptor.php
@@ -11,6 +11,7 @@
 
 namespace Symfony\Component\VarDumper\Command\Descriptor;
 
+use Symfony\Component\Console\Formatter\OutputFormatter;
 use Symfony\Component\Console\Input\ArrayInput;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Style\SymfonyStyle;
@@ -46,13 +47,13 @@ public function describe(OutputInterface $output, Data $data, array $context, in
         if (isset($context['request'])) {
             $request = $context['request'];
             $this->lastIdentifier = $request['identifier'];
-            $section = \sprintf('%s %s', $request['method'], $request['uri']);
+            $section = \sprintf('%s %s', self::escape($request['method']), self::escape($request['uri']));
             if ($controller = $request['controller']) {
-                $rows[] = ['controller', rtrim($this->dumper->dump($controller, true), "\n")];
+                $rows[] = ['controller', OutputFormatter::escape(rtrim($this->dumper->dump($controller, true), "\n"))];
             }
         } elseif (isset($context['cli'])) {
             $this->lastIdentifier = $context['cli']['identifier'];
-            $section = '$ '.$context['cli']['command_line'];
+            $section = '$ '.self::escape($context['cli']['command_line']);
         }
 
         if ($this->lastIdentifier !== $lastIdentifier) {
@@ -61,13 +62,13 @@ public function describe(OutputInterface $output, Data $data, array $context, in
 
         if (isset($context['source'])) {
             $source = $context['source'];
-            $sourceInfo = \sprintf('%s on line %d', $source['name'], $source['line']);
+            $sourceInfo = \sprintf('%s on line %d', self::escape($source['name']), $source['line']);
             if ($fileLink = $source['file_link'] ?? null) {
-                $sourceInfo = \sprintf('<href=%s>%s</>', $fileLink, $sourceInfo);
+                $sourceInfo = \sprintf('<href=%s>%s</>', self::escape($fileLink), $sourceInfo);
             }
             $rows[] = ['source', $sourceInfo];
             $file = $source['file_relative'] ?? $source['file'];
-            $rows[] = ['file', $file];
+            $rows[] = ['file', self::escape($file)];
         }
 
         $io->table([], $rows);
@@ -75,4 +76,9 @@ public function describe(OutputInterface $output, Data $data, array $context, in
         $this->dumper->dump($data);
         $io->newLine();
     }
+
+    private static function escape(string $value): string
+    {
+        return OutputFormatter::escape(preg_replace('/[\x00-\x08\x0B-\x1F\x7F]|\xC2[\x80-\x9F]/', '', $value));
+    }
 }
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/HtmlDescriptor.php b/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/HtmlDescriptor.php
index 18f9f6565..e602b599e 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/HtmlDescriptor.php
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/Command/Descriptor/HtmlDescriptor.php
@@ -44,11 +44,11 @@ public function describe(OutputInterface $output, Data $data, array $context, in
         if (isset($context['request'])) {
             $request = $context['request'];
             $controller = "<span class='dumped-tag'>{$this->dumper->dump($request['controller'], true, ['maxDepth' => 0])}</span>";
-            $title = \sprintf('<code>%s</code> <a href="%s">%s</a>', $request['method'], $uri = $request['uri'], $uri);
-            $dedupIdentifier = $request['identifier'];
+            $title = \sprintf('<code>%s</code> <a href="%s">%s</a>', self::escape($request['method']), $uri = self::escape($request['uri']), $uri);
+            $dedupIdentifier = self::escape($request['identifier']);
         } elseif (isset($context['cli'])) {
-            $title = '<code>$ </code>'.$context['cli']['command_line'];
-            $dedupIdentifier = $context['cli']['identifier'];
+            $title = '<code>$ </code>'.self::escape($context['cli']['command_line']);
+            $dedupIdentifier = self::escape($context['cli']['identifier']);
         } else {
             $dedupIdentifier = bin2hex(random_bytes(4));
         }
@@ -56,10 +56,10 @@ public function describe(OutputInterface $output, Data $data, array $context, in
         $sourceDescription = '';
         if (isset($context['source'])) {
             $source = $context['source'];
-            $projectDir = $source['project_dir'] ?? null;
-            $sourceDescription = \sprintf('%s on line %d', $source['name'], $source['line']);
+            $projectDir = isset($source['project_dir']) ? self::escape($source['project_dir']) : null;
+            $sourceDescription = \sprintf('%s on line %d', self::escape($source['name']), $source['line']);
             if (isset($source['file_link'])) {
-                $sourceDescription = \sprintf('<a href="%s">%s</a>', $source['file_link'], $sourceDescription);
+                $sourceDescription = \sprintf('<a href="%s">%s</a>', self::escape($source['file_link']), $sourceDescription);
             }
         }
 
@@ -115,4 +115,9 @@ private function renderTags(array $tags): string
             </div>
             HTML;
     }
+
+    private static function escape(string $value): string
+    {
+        return htmlspecialchars($value, \ENT_QUOTES | \ENT_SUBSTITUTE, 'UTF-8');
+    }
 }
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/Dumper/CliDumper.php b/htdocs/xoops_lib/vendor/symfony/var-dumper/Dumper/CliDumper.php
index 451a861a0..3e65a24e9 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/Dumper/CliDumper.php
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/Dumper/CliDumper.php
@@ -54,7 +54,7 @@ class CliDumper extends AbstractDumper
         "\r" => '\r',
         "\033" => '\e',
     ];
-    protected static string $unicodeCharsRx = "/[\u{00A0}\u{00AD}\u{034F}\u{061C}\u{115F}\u{1160}\u{17B4}\u{17B5}\u{180E}\u{2000}-\u{200F}\u{202F}\u{205F}\u{2060}-\u{2064}\u{206A}-\u{206F}\u{3000}\u{2800}\u{3164}\u{FEFF}\u{FFA0}\u{1D159}\u{1D173}-\u{1D17A}]/u";
+    protected static string $unicodeCharsRx = "/[\u{0080}-\u{009F}\u{00A0}\u{00AD}\u{034F}\u{061C}\u{115F}\u{1160}\u{17B4}\u{17B5}\u{180E}\u{2000}-\u{200F}\u{202F}\u{205F}\u{2060}-\u{2064}\u{206A}-\u{206F}\u{3000}\u{2800}\u{3164}\u{FEFF}\u{FFA0}\u{1D159}\u{1D173}-\u{1D17A}]/u";
 
     protected bool $collapseNextHash = false;
     protected bool $expandNextHash = false;
@@ -520,7 +520,7 @@ protected function style(string $style, string $value, array $attr = []): string
     protected function supportsColors(): bool
     {
         if ($this->outputStream !== static::$defaultOutput) {
-            return $this->hasColorSupport($this->outputStream);
+            return $this->hasColorSupport($this->getColorSupportStream());
         }
         if (isset(static::$defaultColors)) {
             return static::$defaultColors;
@@ -550,10 +550,7 @@ protected function supportsColors(): bool
             }
         }
 
-        $h = stream_get_meta_data($this->outputStream) + ['wrapper_type' => null];
-        $h = 'Output' === $h['stream_type'] && 'PHP' === $h['wrapper_type'] ? fopen('php://stdout', 'w') : $this->outputStream;
-
-        return static::$defaultColors = $this->hasColorSupport($h);
+        return static::$defaultColors = $this->hasColorSupport($this->getColorSupportStream());
     }
 
     protected function dumpLine(int $depth, bool $endOfValue = false): void
@@ -581,6 +578,20 @@ protected function endValue(Cursor $cursor): void
         $this->dumpLine($cursor->depth, true);
     }
 
+    /**
+     * Returns the stream to probe for color support: on the CLI, php://output is backed by STDOUT.
+     */
+    private function getColorSupportStream(): mixed
+    {
+        if (!\defined('STDOUT') || !\is_resource($this->outputStream) || 'stream' !== get_resource_type($this->outputStream)) {
+            return $this->outputStream;
+        }
+
+        $h = stream_get_meta_data($this->outputStream) + ['wrapper_type' => null];
+
+        return 'Output' === $h['stream_type'] && 'PHP' === $h['wrapper_type'] ? \STDOUT : $this->outputStream;
+    }
+
     /**
      * Returns true if the stream supports colorization.
      *
diff --git a/htdocs/xoops_lib/vendor/symfony/var-dumper/composer.json b/htdocs/xoops_lib/vendor/symfony/var-dumper/composer.json
index bffa992ec..f71328427 100644
--- a/htdocs/xoops_lib/vendor/symfony/var-dumper/composer.json
+++ b/htdocs/xoops_lib/vendor/symfony/var-dumper/composer.json
@@ -25,7 +25,7 @@
         "symfony/http-kernel": "^6.4|^7.0|^8.0",
         "symfony/process": "^6.4|^7.0|^8.0",
         "symfony/uid": "^6.4|^7.0|^8.0",
-        "twig/twig": "^3.12"
+        "twig/twig": "^3.12|^4.0"
     },
     "conflict": {
         "symfony/console": "<6.4"
diff --git a/htdocs/xoops_lib/vendor/symfony/yaml/Inline.php b/htdocs/xoops_lib/vendor/symfony/yaml/Inline.php
index 8fa58d894..3c24c20f7 100644
--- a/htdocs/xoops_lib/vendor/symfony/yaml/Inline.php
+++ b/htdocs/xoops_lib/vendor/symfony/yaml/Inline.php
@@ -69,6 +69,16 @@ public static function parse(string $value, int $flags = 0, array &$references =
         $i = 0;
         $isQuoted = null;
         $tag = self::parseTag($value, $i, $flags);
+
+        // a tag without value, possibly followed by a comment
+        if (null !== $tag && '' !== $tag && (!isset($value[$i]) || '#' === $value[$i])) {
+            if (str_starts_with($tag, 'php/')) {
+                throw new ParseException(\sprintf('Missing value for tag "%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename);
+            }
+
+            return new TaggedValue($tag, '');
+        }
+
         switch ($value[$i]) {
             case '[':
                 $result = self::parseSequence($state, $value, $flags, $i, $references);
@@ -147,6 +157,8 @@ public static function dump(mixed $value, int $flags = 0, bool $rootLevel = fals
                 return 'false';
             case \is_int($value):
                 return $value;
+            case \is_float($value) && is_nan($value):
+                return '.NaN';
             case is_numeric($value) && false === strpbrk($value, "\f\n\r\t\v"):
                 $locale = setlocale(\LC_NUMERIC, 0);
                 if (false !== $locale) {
@@ -187,6 +199,7 @@ public static function dump(mixed $value, int $flags = 0, bool $rootLevel = fals
 
                 return \strlen($doubleQuoted) < \strlen($singleQuoted) ? $doubleQuoted : $singleQuoted;
             case Parser::preg_match('{^[0-9]+[_0-9]*$}', $value):
+            case Parser::preg_match('{^[+-]?0o[0-7_]++$}', $value):
             case Parser::preg_match(self::getHexRegex(), $value):
             case Parser::preg_match(self::getTimestampRegex(), $value):
                 return Escaper::escapeWithSingleQuotes($value);
@@ -399,6 +412,10 @@ private static function parseSequence(ParserState $state, string $sequence, int
                     continue;
                 }
 
+                if (!isset($sequence[$i])) {
+                    break;
+                }
+
                 switch ($sequence[$i]) {
                     case '[':
                         // nested sequence
@@ -519,7 +536,7 @@ private static function parseMapping(ParserState $state, string $mapping, int $f
                 if (!$isKeyQuoted) {
                     $evaluatedKey = self::evaluateScalar($state, $key, $flags, $references);
 
-                    if ('' !== $key && $evaluatedKey !== $key && !\is_string($evaluatedKey) && !\is_int($evaluatedKey)) {
+                    if ('' !== $key && $evaluatedKey !== $key && (!\is_string($evaluatedKey) || '!' === $key[0]) && !\is_int($evaluatedKey)) {
                         throw new ParseException('Implicit casting of incompatible mapping keys to strings is not supported. Quote your evaluable mapping keys instead.', self::$parsedLineNumber + 1, $mapping);
                     }
                 }
@@ -558,6 +575,10 @@ private static function parseMapping(ParserState $state, string $mapping, int $f
                         continue 2;
                     }
 
+                    if (!isset($mapping[$i])) {
+                        break;
+                    }
+
                     switch ($mapping[$i]) {
                         case '[':
                             // nested sequence
@@ -650,10 +671,11 @@ private static function evaluateScalar(ParserState $state, string $scalar, int $
         $scalar = trim($scalar);
 
         if (str_starts_with($scalar, '*')) {
-            if (false !== $pos = strpos($scalar, '#')) {
-                $value = substr($scalar, 1, $pos - 2);
-            } else {
-                $value = substr($scalar, 1);
+            $value = substr($scalar, 1);
+
+            // remove comments
+            if (Parser::preg_match('/[ \t]+#/', $value, $match, \PREG_OFFSET_CAPTURE)) {
+                $value = substr($value, 0, $match[0][1]);
             }
 
             // an unquoted *
@@ -683,6 +705,9 @@ private static function evaluateScalar(ParserState $state, string $scalar, int $
                 return false;
             case '!' === $scalar[0]:
                 switch (true) {
+                    case '!!str' === $scalar:
+                    case '!!binary' === $scalar:
+                        return '';
                     case str_starts_with($scalar, '!!str '):
                         $s = substr($scalar, 6);
 
@@ -785,6 +810,10 @@ private static function evaluateScalar(ParserState $state, string $scalar, int $
             case \in_array($scalar[0], ['+', '-', '.'], true) || is_numeric($scalar[0]):
                 if (Parser::preg_match('{^[+-]?[0-9][0-9_]*$}', $scalar)) {
                     $scalar = str_replace('_', '', $scalar);
+
+                    if ('+' === $scalar[0]) {
+                        $scalar = substr($scalar, 1);
+                    }
                 }
 
                 switch (true) {
@@ -803,8 +832,9 @@ private static function evaluateScalar(ParserState $state, string $scalar, int $
 
                         return '0x' === $scalar[0].$scalar[1] ? hexdec($scalar) : (float) $scalar;
                     case '.inf' === $scalarLower:
-                    case '.nan' === $scalarLower:
                         return -log(0);
+                    case '.nan' === $scalarLower:
+                        return \NAN;
                     case '-.inf' === $scalarLower:
                         return log(0);
                     case Parser::preg_match('/^(-|\+)?[0-9][0-9_]*(\.[0-9_]+)?$/', $scalar):
@@ -885,10 +915,6 @@ private static function parseTag(string $value, int &$i, int $flags): ?string
             throw new ParseException(\sprintf('The built-in tag "!%s" is not implemented.', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename);
         }
 
-        if ('' !== $tag && !isset($value[$i])) {
-            throw new ParseException(\sprintf('Missing value for tag "%s".', $tag), self::$parsedLineNumber + 1, $value, self::$parsedFilename);
-        }
-
         if ('' === $tag || Yaml::PARSE_CUSTOM_TAGS & $flags) {
             return $tag;
         }
@@ -898,7 +924,11 @@ private static function parseTag(string $value, int &$i, int $flags): ?string
 
     public static function evaluateBinaryScalar(string $scalar): string
     {
-        $parsedBinaryData = self::parseScalar(preg_replace('/\s/', '', $scalar));
+        $parsedBinaryData = preg_replace('/\s/', '', $scalar);
+
+        if ('' === $parsedBinaryData || '' === $parsedBinaryData = self::parseScalar($parsedBinaryData)) {
+            return '';
+        }
 
         if (!\is_scalar($parsedBinaryData ?? '') && !$parsedBinaryData instanceof \Stringable) {
             throw new ParseException(\sprintf('The "!!binary" tag only supports a base64 encoded string, got "%s".', get_debug_type($parsedBinaryData)), self::$parsedLineNumber + 1, $scalar, self::$parsedFilename);
@@ -950,6 +980,6 @@ private static function getTimestampRegex(): string
      */
     private static function getHexRegex(): string
     {
-        return '~^0x[0-9a-f_]++$~i';
+        return '~^0x[0-9a-fA-F_]++$~';
     }
 }
diff --git a/htdocs/xoops_lib/vendor/symfony/yaml/Parser.php b/htdocs/xoops_lib/vendor/symfony/yaml/Parser.php
index fdd3468a5..c35b18187 100644
--- a/htdocs/xoops_lib/vendor/symfony/yaml/Parser.php
+++ b/htdocs/xoops_lib/vendor/symfony/yaml/Parser.php
@@ -24,7 +24,7 @@
 class Parser
 {
     public const TAG_PATTERN = '(?P<tag>![\w!.\/:-]+)';
-    public const BLOCK_SCALAR_HEADER_PATTERN = '(?P<separator>\||>)(?P<modifiers>\+|\-|\d+|\+\d+|\-\d+|\d+\+|\d+\-)?(?P<comments> +#.*)?';
+    public const BLOCK_SCALAR_HEADER_PATTERN = '(?P<separator>\||>)(?P<modifiers>\+|\-|\d+|\+\d+|\-\d+|\d+\+|\d+\-)?(?P<comments>[ \t]+#.*)?';
     public const REFERENCE_PATTERN = '#^&(?P<ref>[^ ]++) *+(?P<value>.*)#u';
     public const DEFAULT_MAX_NESTING_LEVEL = 128;
     public const DEFAULT_MAX_ALIASES_FOR_COLLECTIONS = 128;
@@ -129,7 +129,7 @@ private function doParse(string $value, int $flags): mixed
     {
         $this->currentLineNb = -1;
         $this->currentLine = '';
-        $value = $this->cleanup($value);
+        $value = $this->cleanup($value, $hasContentOnStartMarkerLine);
         $this->lines = explode("\n", $value);
         $this->numberOfParsedLines = \count($this->lines);
         $this->locallySkippedLineNumbers = [];
@@ -150,8 +150,12 @@ private function doParse(string $value, int $flags): mixed
         }
 
         // Resolves the tag and returns if end of the document
-        if (null !== ($tag = $this->getLineTag($this->currentLine, $flags, false)) && !$this->moveToNextLine()) {
-            return new TaggedValue($tag, '');
+        if (null !== $tag = $this->getLineTag($this->currentLine, $flags, false)) {
+            do {
+                if (!$this->moveToNextLine()) {
+                    return new TaggedValue($tag, '');
+                }
+            } while ($this->isCurrentLineEmpty());
         }
 
         do {
@@ -173,6 +177,14 @@ private function doParse(string $value, int $flags): mixed
                 }
                 $context = 'sequence';
 
+                if ($hasContentOnStartMarkerLine && 0 === $this->currentLineNb) {
+                    throw new ParseException('A block collection cannot start on the line of the document start marker (---).', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename);
+                }
+
+                if (isset($values['value']) && '!' === $values['value'][0]) {
+                    $values['value'] = $this->moveAnchorBeforeTag($values['value']);
+                }
+
                 if (isset($values['value']) && '&' === $values['value'][0] && self::preg_match(self::REFERENCE_PATTERN, $values['value'], $matches)) {
                     $isRef = $matches['ref'];
                     $this->refsBeingParsed[] = $isRef;
@@ -190,9 +202,14 @@ private function doParse(string $value, int $flags): mixed
 
                     $sequenceIndentation = \strlen($values['leadspaces']) + 1;
                     $sequenceYaml = substr($this->currentLine, $sequenceIndentation);
-                    $sequenceYaml .= "\n".$this->getNextEmbedBlock($sequenceIndentation, true);
+                    $embedBlock = $this->getNextEmbedBlock($sequenceIndentation, true);
 
-                    $data[] = $this->parseBlock($currentLineNumber, rtrim($sequenceYaml), $flags);
+                    // keep trailing empty lines, they can be part of a block scalar
+                    if ($currentLineNumber !== $this->getRealCurrentLineNb()) {
+                        $sequenceYaml .= "\n".$embedBlock;
+                    }
+
+                    $data[] = $this->parseBlock($currentLineNumber, $sequenceYaml, $flags);
                 } elseif (!isset($values['value']) || '' == trim($values['value'], ' ') || str_starts_with(ltrim($values['value'], ' '), '#')) {
                     $data[] = $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true) ?? '', $flags);
                 } elseif (null !== $subTag = $this->getLineTag(ltrim($values['value'], ' '), $flags)) {
@@ -200,6 +217,8 @@ private function doParse(string $value, int $flags): mixed
                         $subTag,
                         $this->parseBlock($this->getRealCurrentLineNb() + 1, $this->getNextEmbedBlock(null, true), $flags)
                     );
+                } elseif (self::preg_match('/^'.self::TAG_PATTERN.'[ \t]+'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $values['value'])) {
+                    $data[] = $this->parseValue($values['value'], $flags, $context);
                 } else {
                     if (
                         isset($values['leadspaces'])
@@ -208,12 +227,14 @@ private function doParse(string $value, int $flags): mixed
                             || self::preg_match('#^(?P<key>'.Inline::REGEX_QUOTED_STRING.'|[^ \'"\{\[].*?) *\:(\s+(?P<value>.+?))?\s*$#u', $this->trimTag($values['value']), $matches)
                         )
                     ) {
+                        $currentLineNumber = $this->getRealCurrentLineNb();
+
                         $block = $values['value'];
-                        if ($this->isNextLineIndented() || isset($matches['value']) && '>-' === $matches['value']) {
+                        if ($this->isNextLineIndented() || $this->isNextLineInBlockScalar($block)) {
                             $block .= "\n".$this->getNextEmbedBlock($this->getCurrentLineIndentation() + \strlen($values['leadspaces']) + 1);
                         }
 
-                        $data[] = $this->parseBlock($this->getRealCurrentLineNb(), $block, $flags);
+                        $data[] = $this->parseBlock($currentLineNumber, $block, $flags);
                     } else {
                         $data[] = $this->parseValue($values['value'], $flags, $context);
                     }
@@ -223,7 +244,7 @@ private function doParse(string $value, int $flags): mixed
                     array_pop($this->refsBeingParsed);
                 }
             } elseif (
-                self::preg_match('#^(?P<key>(?:![^\s]++\s++)?(?:'.Inline::REGEX_QUOTED_STRING.'|[^ \'"\[\{!].*?)) *\:(( |\t)++(?P<value>.+))?$#u', rtrim($this->currentLine), $values)
+                self::preg_match('#^(?P<key>(?:![^\s]++\s++)?(?:'.Inline::REGEX_QUOTED_STRING.'|[^ \'"\[\{!].*?)|![^\s]++(?= +\:)) *\:(( |\t)++(?P<value>.+))?$#u', rtrim($this->currentLine), $values)
                 && (!str_contains($values['key'], ' #') || \in_array($values['key'][0], ['"', "'"], true))
             ) {
                 if ($context && 'sequence' == $context) {
@@ -231,6 +252,14 @@ private function doParse(string $value, int $flags): mixed
                 }
                 $context = 'mapping';
 
+                if ($hasContentOnStartMarkerLine && 0 === $this->currentLineNb) {
+                    throw new ParseException('A block collection cannot start on the line of the document start marker (---).', $this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename);
+                }
+
+                if (isset($values['value'][0]) && '!' === $values['value'][0]) {
+                    $values['value'] = $this->moveAnchorBeforeTag($values['value']);
+                }
+
                 try {
                     $key = Inline::parseScalar($values['key']);
                 } catch (ParseException $e) {
@@ -254,6 +283,12 @@ private function doParse(string $value, int $flags): mixed
                     $allowOverwrite = true;
                     if (isset($values['value'][0]) && '*' === $values['value'][0]) {
                         $refName = substr(rtrim($values['value']), 1);
+
+                        // remove comments
+                        if (self::preg_match('/[ \t]+#/', $refName, $match, \PREG_OFFSET_CAPTURE)) {
+                            $refName = substr($refName, 0, $match[0][1]);
+                        }
+
                         if (!\array_key_exists($refName, $this->refs)) {
                             if (false !== $pos = array_search($refName, $this->refsBeingParsed, true)) {
                                 throw new ParseException(\sprintf('Circular reference [%s] detected for reference "%s".', implode(', ', array_merge(\array_slice($this->refsBeingParsed, $pos), [$refName])), $refName), $this->currentLineNb + 1, $this->currentLine, $this->filename);
@@ -276,12 +311,14 @@ private function doParse(string $value, int $flags): mixed
 
                         $data += $refValue; // array union
                     } else {
+                        $currentLineNumber = $this->getRealCurrentLineNb();
+
                         if (isset($values['value']) && '' !== $values['value']) {
                             $value = $values['value'];
                         } else {
                             $value = $this->getNextEmbedBlock();
                         }
-                        $parsed = $this->parseBlock($this->getRealCurrentLineNb() + 1, $value, $flags);
+                        $parsed = $this->parseBlock($currentLineNumber + 1, $value, $flags);
 
                         if (Yaml::PARSE_OBJECT_FOR_MAP & $flags && $parsed instanceof \stdClass) {
                             $parsed = (array) $parsed;
@@ -442,11 +479,6 @@ private function doParse(string $value, int $flags): mixed
                     throw $e;
                 }
             } else {
-                // multiple documents are not supported
-                if ('---' === $this->currentLine) {
-                    throw new ParseException('Multiple documents are not supported.', $this->currentLineNb + 1, $this->currentLine, $this->filename);
-                }
-
                 if (isset($this->currentLine[1]) && '?' === $this->currentLine[0] && ' ' === $this->currentLine[1]) {
                     throw new ParseException('Complex mappings are not supported.', $this->getRealCurrentLineNb() + 1, $this->currentLine);
                 }
@@ -745,10 +777,11 @@ private function moveToPreviousLine(): bool
     private function parseValue(string $value, int $flags, string $context): mixed
     {
         if (str_starts_with($value, '*')) {
-            if (false !== $pos = strpos($value, '#')) {
-                $value = substr($value, 1, $pos - 2);
-            } else {
-                $value = substr($value, 1);
+            $value = substr($value, 1);
+
+            // remove comments
+            if (self::preg_match('/[ \t]+#/', $value, $match, \PREG_OFFSET_CAPTURE)) {
+                $value = substr($value, 0, $match[0][1]);
             }
 
             if (!\array_key_exists($value, $this->refs)) {
@@ -764,17 +797,18 @@ private function parseValue(string $value, int $flags, string $context): mixed
             return $this->refs[$value];
         }
 
-        if (\in_array($value[0], ['!', '|', '>'], true) && self::preg_match('/^(?:'.self::TAG_PATTERN.' +)?'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $value, $matches)) {
+        if (\in_array($value[0], ['!', '|', '>'], true) && self::preg_match('/^(?:'.self::TAG_PATTERN.'[ \t]+)?'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $value, $matches)) {
             $modifiers = $matches['modifiers'] ?? '';
 
             $data = $this->parseBlockScalar($matches['separator'], preg_replace('#\d+#', '', $modifiers), abs((int) $modifiers));
 
             if ('' !== $matches['tag'] && '!' !== $matches['tag']) {
-                if ('!!binary' === $matches['tag']) {
-                    return Inline::evaluateBinaryScalar($data);
-                }
-
-                return new TaggedValue(substr($matches['tag'], 1), $data);
+                return match ($matches['tag']) {
+                    '!!binary' => Inline::evaluateBinaryScalar($data),
+                    '!!str' => $data,
+                    '!!float' => (float) $data,
+                    default => new TaggedValue(substr($matches['tag'], 1), $data),
+                };
             }
 
             return $data;
@@ -871,9 +905,12 @@ private function parseBlockScalar(string $style, string $chomping = '', int $ind
 
         $isCurrentLineBlank = $this->isCurrentLineBlank();
         $blockLines = [];
+        $longestBlankLine = 0;
 
         // leading blank lines are consumed before determining indentation
-        while ($notEOF && $isCurrentLineBlank) {
+        while ($notEOF && $isCurrentLineBlank && (!$indentation || \strlen($this->currentLine) <= $indentation)) {
+            $longestBlankLine = max($longestBlankLine, \strlen($this->currentLine));
+
             // newline only if not EOF
             if ($notEOF = $this->moveToNextLine()) {
                 $blockLines[] = '';
@@ -888,32 +925,44 @@ private function parseBlockScalar(string $style, string $chomping = '', int $ind
             for ($i = 0; $i < $currentLineLength && ' ' === $this->currentLine[$i]; ++$i) {
                 ++$indentation;
             }
+
+            // a comment less indented than the leading empty lines is not content, the indentation is then the one of the longest empty line
+            if ($indentation < $longestBlankLine && $this->isCurrentLineComment()) {
+                $indentation = $longestBlankLine;
+            }
         }
 
-        if ($indentation > 0) {
-            $pattern = \sprintf('/^ {%d}(.*)$/', $indentation);
+        if (!$notEOF || !$indentation || strspn($this->currentLine, ' ') < $indentation) {
+            if ($notEOF) {
+                $this->moveToPreviousLine();
+            } elseif (!$this->isCurrentLineLastLineInDocument()) {
+                $blockLines[] = '';
+            }
 
-            while (
-                $notEOF && (
-                    $isCurrentLineBlank
-                    || self::preg_match($pattern, $this->currentLine, $matches)
-                )
-            ) {
-                if ($isCurrentLineBlank && \strlen($this->currentLine) > $indentation) {
-                    $blockLines[] = substr($this->currentLine, $indentation);
-                } elseif ($isCurrentLineBlank) {
-                    $blockLines[] = '';
-                } else {
-                    $blockLines[] = $matches[1];
-                }
+            // without content, the line breaks of the empty lines are only kept with the "+" chomping indicator
+            return '+' === $chomping ? str_repeat("\n", \count($blockLines)) : '';
+        }
 
-                // newline only if not EOF
-                if ($notEOF = $this->moveToNextLine()) {
-                    $isCurrentLineBlank = $this->isCurrentLineBlank();
-                }
+        $pattern = \sprintf('/^ {%d}(.*)$/', $indentation);
+
+        while (
+            $notEOF && (
+                $isCurrentLineBlank
+                || self::preg_match($pattern, $this->currentLine, $matches)
+            )
+        ) {
+            if ($isCurrentLineBlank && \strlen($this->currentLine) > $indentation) {
+                $blockLines[] = substr($this->currentLine, $indentation);
+            } elseif ($isCurrentLineBlank) {
+                $blockLines[] = '';
+            } else {
+                $blockLines[] = $matches[1];
+            }
+
+            // newline only if not EOF
+            if ($notEOF = $this->moveToNextLine()) {
+                $isCurrentLineBlank = $this->isCurrentLineBlank();
             }
-        } elseif ($notEOF) {
-            $blockLines[] = '';
         }
 
         if ($notEOF) {
@@ -926,16 +975,15 @@ private function parseBlockScalar(string $style, string $chomping = '', int $ind
         // folded style
         if ('>' === $style) {
             $text = '';
-            $previousLineIndented = false;
+            $previousLineIndented = null;
             $previousLineBlank = false;
 
             for ($i = 0, $blockLinesCount = \count($blockLines); $i < $blockLinesCount; ++$i) {
                 if ('' === $blockLines[$i]) {
                     $text .= "\n";
-                    $previousLineIndented = false;
                     $previousLineBlank = true;
-                } elseif (' ' === $blockLines[$i][0]) {
-                    $text .= "\n".$blockLines[$i];
+                } elseif (' ' === $blockLines[$i][0] || "\t" === $blockLines[$i][0]) {
+                    $text .= (null === $previousLineIndented ? '' : "\n").$blockLines[$i];
                     $previousLineIndented = true;
                     $previousLineBlank = false;
                 } elseif ($previousLineIndented) {
@@ -1022,37 +1070,81 @@ private function isCurrentLineLastLineInDocument(): bool
         return ($this->offset + $this->currentLineNb) >= ($this->totalNumberOfLines - 1);
     }
 
-    private function cleanup(string $value): string
+    private function cleanup(string $value, ?bool &$hasContentOnStartMarkerLine = null): string
     {
+        $hasContentOnStartMarkerLine = false;
+
         $value = str_replace(["\r\n", "\r"], "\n", $value);
 
-        // strip YAML header
-        $count = 0;
-        $value = preg_replace('#^%YAML[: ][\d.]++[^\n]*+\n#u', '', $value, -1, $count);
-        $this->offset += $count;
-
-        // remove leading comments
-        $trimmedValue = preg_replace('#^(?:\#[^\n]*+\n)++#', '', $value, -1, $count);
-        if (1 === $count) {
-            // items have been removed, update the offset
-            $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n");
-            $value = $trimmedValue;
+        // remove the YAML header, and the comments and empty lines before the content
+        $value = $this->removeLeadingLines('#^(?:[ \t]*+(?:\#[^\n]*+)?+\n)*+(?:%YAML[: ][\d.]++[^\n]*+\n(?:[ \t]*+(?:\#[^\n]*+)?+\n)*+)?+#', $value);
+
+        // document markers and the properties of the root node are only found at the top level, not in nested blocks
+        if (null !== $this->totalNumberOfLines) {
+            return $value;
         }
 
-        // remove start of the document marker (---)
-        $trimmedValue = preg_replace('#^---[^\n]*+\n#', '', $value, -1, $count);
-        if (1 === $count) {
-            // items have been removed, update the offset
-            $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n");
-            $value = $trimmedValue;
+        // remove start of the document marker (---), with the YAML 1.0 directives, or the node properties and block scalar header that can follow it alone, as they were always ignored
+        $value = preg_replace('#^---(?:[ \t]++(?:%[^\n]*+|(?:(?:[!&][^ \t\n]*+|[|>][-+0-9]*+)[ \t]*+)++(?=(?:\#[^\n]*+)?+(?:\n|\z)))?+|(?=\n)|\z)#', '', $value, -1, $count);
+
+        // remove the anchor of the root node, as nothing can refer to it
+        $value = preg_replace('#^((?:![^! \t\n][^ \t\n]*+[ \t]++)?+)&[^ \t\n]++(?:[ \t]++|(?=\n)|\z)#', '$1', $value);
 
-            // remove end of the document marker (...)
-            $value = preg_replace('#\.\.\.\s*+$#', '', $value);
+        // remove the lines left without content
+        $offset = $this->offset;
+        $value = $this->removeLeadingLines('#^(?:[ \t]*+(?:\#[^\n]*+)?+\n)++#', $value);
+        $hasContentOnStartMarkerLine = 1 === $count && $offset === $this->offset;
+
+        // remove end of the document marker (...), which can only be followed by comments
+        $value = preg_replace('#^\.\.\.(?:[ \t]++(?:\#[^\n]*+)?+)?+(?:\n[ \t]*+(?:\#[^\n]*+)?+)*+\z#m', '', $value);
+
+        if (self::preg_match('#^(?:---|\.\.\.)(?:[ \t][^\n]*+)?+$#m', $value, $matches, \PREG_OFFSET_CAPTURE)) {
+            throw new ParseException('Multiple documents are not supported.', $this->offset + substr_count($value, "\n", 0, $matches[0][1]) + 1, $matches[0][0], $this->filename);
         }
 
         return $value;
     }
 
+    /**
+     * Tells whether the next line belongs to a block scalar whose header ends the given value.
+     *
+     * Unlike isNextLineIndented(), empty and comment-like lines are not skipped, as they can be part of the block scalar.
+     */
+    private function isNextLineInBlockScalar(string $value): bool
+    {
+        if (!isset($this->lines[$this->currentLineNb + 1]) || !self::preg_match('/:[ \t]+(?:'.self::TAG_PATTERN.'[ \t]+)?'.self::BLOCK_SCALAR_HEADER_PATTERN.'$/', $value)) {
+            return false;
+        }
+
+        $nextLine = $this->lines[$this->currentLineNb + 1];
+
+        return '' === trim($nextLine, ' ') || strspn($nextLine, ' ') > $this->getCurrentLineIndentation();
+    }
+
+    /**
+     * Turns "!tag &anchor value" into "&anchor !tag value", as both orders are allowed.
+     *
+     * Built-in tags are left alone: "!!str &foo" is the "&foo" string, as in flow collections.
+     */
+    private function moveAnchorBeforeTag(string $value): string
+    {
+        if (str_starts_with($value, '!!')) {
+            return $value;
+        }
+
+        return preg_replace('#^'.self::TAG_PATTERN.' ++(&[^ ]++)#u', '$2 $1', $value);
+    }
+
+    private function removeLeadingLines(string $pattern, string $value): string
+    {
+        $trimmedValue = preg_replace($pattern, '', $value);
+
+        // items have been removed, update the offset
+        $this->offset += substr_count($value, "\n") - substr_count($trimmedValue, "\n");
+
+        return $trimmedValue;
+    }
+
     private function isNextLineUnIndentedCollection(): bool
     {
         $currentIndentation = $this->getCurrentLineIndentation();
@@ -1066,11 +1158,7 @@ private function isNextLineUnIndentedCollection(): bool
             }
         } while (!$EOF && ($this->isCurrentLineEmpty() || $this->isCurrentLineComment()));
 
-        if ($EOF) {
-            return false;
-        }
-
-        $ret = $this->getCurrentLineIndentation() === $currentIndentation && $this->isStringUnIndentedCollectionItem();
+        $ret = !$EOF && $this->getCurrentLineIndentation() === $currentIndentation && $this->isStringUnIndentedCollectionItem();
 
         for ($i = 0; $i < $movements; ++$i) {
             $this->moveToPreviousLine();
@@ -1125,7 +1213,8 @@ private function getLineTag(string $value, int $flags, bool $nextLineCheck = tru
             return null;
         }
 
-        if ($nextLineCheck && !$this->isNextLineIndented()) {
+        // unlike a sequence item, the value of a mapping key can also be a sequence that is not indented
+        if ($nextLineCheck && !$this->isNextLineIndented() && ($this->isStringUnIndentedCollectionItem() || !$this->isNextLineUnIndentedCollection())) {
             return null;
         }
 
@@ -1133,6 +1222,11 @@ private function getLineTag(string $value, int $flags, bool $nextLineCheck = tru
 
         // Built-in tags
         if ($tag && '!' === $tag[0]) {
+            // "!!str" and "!!binary" can be resolved as inline scalars when they don't apply to a nested block
+            if (!$nextLineCheck && \in_array($tag, ['!str', '!binary'], true) && !$this->isNextLineIndented()) {
+                return null;
+            }
+
             throw new ParseException(\sprintf('The built-in tag "!%s" is not implemented.', $tag), $this->getRealCurrentLineNb() + 1, $value, $this->filename);
         }
 
@@ -1191,7 +1285,7 @@ private function lexInlineQuotedString(int &$cursor = 0): string
             if ($this->isCurrentLineBlank()) {
                 $previousLineWasNewline = true;
                 $previousLineWasTerminatedWithBackslash = false;
-            } elseif ('\\' === $this->currentLine[-1]) {
+            } elseif ('"' === $quotation && 1 === (\strlen($this->currentLine) - \strlen(rtrim($this->currentLine, '\\'))) % 2) {
                 $previousLineWasNewline = false;
                 $previousLineWasTerminatedWithBackslash = true;
             } else {
@@ -1253,6 +1347,18 @@ private function lexInlineSequence(int &$cursor = 0, bool $consumeUntilEol = tru
     }
 
     private function lexInlineStructure(int &$cursor, string $closingTag, bool $consumeUntilEol = true): string
+    {
+        $state = $this->getState();
+        $state->enterNestingLevel($this->getRealCurrentLineNb() + 1, $this->currentLine, $this->filename);
+
+        try {
+            return $this->doLexInlineStructure($cursor, $closingTag, $consumeUntilEol);
+        } finally {
+            $state->leaveNestingLevel();
+        }
+    }
+
+    private function doLexInlineStructure(int &$cursor, string $closingTag, bool $consumeUntilEol = true): string
     {
         $value = $this->currentLine[$cursor];
         ++$cursor;
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/CHANGELOG.TXT b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/CHANGELOG.TXT
index 3c600bc89..098bb31e9 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/CHANGELOG.TXT
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/CHANGELOG.TXT
@@ -1,3 +1,6 @@
+6.11.4 (2026-08-28)
+	- TCPDF is deprecated: added a runtime E_USER_DEPRECATED notice and updated the documentation.
+
 6.11.3 (2026-04-21)
 	- Added deprecation notice.
 	- Improved composer.json.
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/README.md b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/README.md
index 00ad81a18..6aa484439 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/README.md
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/README.md
@@ -1,29 +1,39 @@
 # TCPDF
 
-> Legacy PDF engine for PHP. **Deprecated** and maintained for existing integrations.
+> Legacy PDF engine for PHP. **DEPRECATED**: migrate to [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf).
 
 [![Latest Stable Version](https://poser.pugx.org/tecnickcom/tcpdf/version)](https://packagist.org/packages/tecnickcom/tcpdf)
 [![License](https://poser.pugx.org/tecnickcom/tcpdf/license)](https://packagist.org/packages/tecnickcom/tcpdf)
 [![Downloads](https://poser.pugx.org/tecnickcom/tcpdf/downloads)](https://packagist.org/packages/tecnickcom/tcpdf)
-[![Donate via PayPal](https://img.shields.io/badge/donate-paypal-87ceeb.svg)](https://www.paypal.com/donate/?hosted_button_id=NZUEC5XS8MFBJ)
 
-If TCPDF helps your business, please consider supporting development via [PayPal](https://www.paypal.com/donate/?hosted_button_id=NZUEC5XS8MFBJ).
+[![Sponsor on GitHub](https://img.shields.io/badge/sponsor-github-EA4AAA.svg?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/tecnickcom)
+
+> 💖 **`tc-lib-pdf`** is the actively-developed successor to **TCPDF**, which is installed 100M+ times across 500+ PHP packages and is now maintenance-only. If your company depends on it, [become a sponsor](https://github.com/sponsors/tecnickcom) to keep this shared infrastructure secure and maintained. See [Sponsors](#sponsors) for tiers.
+
 
 ---
 
 ## Deprecation Notice
 
-TCPDF is **deprecated** and in **maintenance-only mode**.
+TCPDF is **DEPRECATED** and receives no updates of any kind: no new features, no bug fixes, and no security fixes.
+
+All users are invited to migrate to [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf), the modern and modular successor.
+
+Using TCPDF constitutes [CWE-1104: Use of Unmaintained Third Party Components](https://cwe.mitre.org/data/definitions/1104.html). See [SECURITY.md](SECURITY.md).
 
-Active feature development has moved to [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf), the modern and modular successor.
+Instantiating the `TCPDF` class raises an `E_USER_DEPRECATED` notice once per process. The notice is raised with `@` so that PHP never prints it into the document output: it reaches custom error handlers and deprecation collectors, not the generated PDF. Define `TCPDF_SILENCE_DEPRECATION` before loading the library to disable it entirely:
 
-For new projects, use `tecnickcom/tc-lib-pdf`. This repository remains available for legacy systems and critical compatibility fixes.
+```php
+define('TCPDF_SILENCE_DEPRECATION', true);
+```
+
+Silencing the notice does not remove the need to migrate.
 
 ### Migration Path
 
-- New projects: install `tecnickcom/tc-lib-pdf`.
-- Existing TCPDF users: keep TCPDF for current production workloads and migrate in phases.
-- Teams seeking modern architecture, Composer-first design, and stronger type-safety should prioritize `tc-lib-pdf`.
+- New projects: install `tecnickcom/tc-lib-pdf`. Do not start new work on TCPDF.
+- Existing projects: plan the migration now and move in phases. Every release still on TCPDF carries unpatched defects, including security ones.
+- Every migration requires regression checks to preserve rendering parity for existing documents.
 
 ### Why Migrate to tc-lib-pdf
 
@@ -33,21 +43,15 @@ For new projects, use `tecnickcom/tc-lib-pdf`. This repository remains available
 - Lower long-term risk: reduces technical debt tied to legacy APIs and supports ongoing PHP ecosystem evolution.
 - Improved delivery speed: teams can implement and ship new PDF capabilities with less friction.
 
-Migration still requires planning and regression checks to preserve rendering parity for existing documents.
-
-### Future Compatibility Possibility
-
-As a long-term possibility, TCPDF could be refactored to use `tc-lib-pdf` internally as a backend while preserving a practical level of backward compatibility for existing TCPDF integrations.
-
-This is not part of a committed roadmap and there is no guarantee it will happen. It is documented here only as a potential direction that may be evaluated in the future.
-
 ---
 
 ## Overview
 
 TCPDF is a pure-PHP library for generating PDF documents and barcodes directly in application code.
 
-It has been widely used across many PHP stacks and still provides a complete feature set for text rendering, page composition, graphics, signatures, forms, and standards-oriented output.
+It has been widely used across many PHP stacks and covers text rendering, page composition, graphics, signatures, forms, and standards-oriented output.
+
+The feature list below documents the frozen code as it stands. Nothing will be added to it, and nothing in it will be fixed. Use [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf) instead.
 
 | | |
 |---|---|
@@ -99,6 +103,8 @@ It has been widely used across many PHP stacks and still provides a complete fea
 
 Optional extensions for richer output in some workflows: `gd`, `zlib`, `imagick`.
 
+Compatibility with future PHP versions will not be added.
+
 ---
 
 ## Third-Party Fonts
@@ -123,9 +129,3 @@ For full details, see the bundled notices in the corresponding subdirectories un
 ## ICC Profile
 
 TCPDF includes `sRGB.icc` from the Debian [`icc-profiles-free`](https://packages.debian.org/source/stable/icc-profiles-free) package.
-
----
-
-## Contact
-
-Nicola Asuni <info@tecnick.com>
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/SECURITY.md b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/SECURITY.md
new file mode 100644
index 000000000..85e4d8095
--- /dev/null
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/SECURITY.md
@@ -0,0 +1,56 @@
+# Security Policy (TCPDF 6.x)
+
+This policy covers the TCPDF 6.x series, the code shipped in this package.
+
+## CRITICAL NOTICE
+
+**TCPDF 6.x is DEPRECATED, unmaintained, and receives no security fixes.**
+
+No security patches, advisories, or CVE remediations will be issued for this series. Known and unknown vulnerabilities in this code base will remain unfixed.
+
+Using TCPDF 6.x in production constitutes [CWE-1104: Use of Unmaintained Third Party Components](https://cwe.mitre.org/data/definitions/1104.html).
+
+## Structural Vulnerability Classes
+
+TCPDF 6.x contains multiple recurring vulnerability classes that are inherent to its design. Individual reports in these classes have been patched over the years, and equivalent issues keep reappearing: the exposure comes from the public API contract, not from isolated defects. Removing these classes requires changing documented behaviour that existing applications depend on, so they cannot be permanently fixed within 6.x without breaking backward compatibility.
+
+The list below describes structural exposure. It is not an inventory of specific known defects.
+
+| Class | CWE | Origin in TCPDF 6.x |
+|---|---|---|
+| Server-side request forgery | [CWE-918](https://cwe.mitre.org/data/definitions/918.html) | Images, fonts, and other resources are fetched from caller-supplied URLs through cURL and stream functions. |
+| Path traversal and local file disclosure | [CWE-22](https://cwe.mitre.org/data/definitions/22.html), [CWE-73](https://cwe.mitre.org/data/definitions/73.html) | Filesystem paths supplied by the caller are opened directly for images, fonts, ICC profiles, and templates. |
+| Unsafe stream wrappers and object injection | [CWE-502](https://cwe.mitre.org/data/definitions/502.html) | Path arguments reach PHP file APIs, so wrapper schemes such as `phar://` are reachable from caller-controlled strings. |
+| XML external entities and entity expansion | [CWE-611](https://cwe.mitre.org/data/definitions/611.html), [CWE-776](https://cwe.mitre.org/data/definitions/776.html) | SVG input is processed by an XML parser. |
+| Uncontrolled resource consumption | [CWE-400](https://cwe.mitre.org/data/definitions/400.html), [CWE-674](https://cwe.mitre.org/data/definitions/674.html), [CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) | HTML, CSS, and SVG are parsed with recursive descent and extensive regular expressions over unbounded input. |
+| Unsafe parsing of binary input | [CWE-20](https://cwe.mitre.org/data/definitions/20.html) | Font, image, and barcode data are decoded with minimal validation of lengths and offsets. |
+| Broken or risky cryptography | [CWE-327](https://cwe.mitre.org/data/definitions/327.html) | The document encryption API still exposes the legacy RC4 and MD5 based PDF security handlers. |
+| Insecure temporary files | [CWE-377](https://cwe.mitre.org/data/definitions/377.html) | Intermediate data is written to a shared cache directory configured by a global constant. |
+| Injection into generated documents | [CWE-94](https://cwe.mitre.org/data/definitions/94.html), [CWE-116](https://cwe.mitre.org/data/definitions/116.html) | Embedded JavaScript, annotations, links, and form actions are assembled from caller-supplied strings. |
+| Insecure defaults | [CWE-1188](https://cwe.mitre.org/data/definitions/1188.html) | Behaviour is driven by global `K_*` constants whose permissive defaults enable remote and filesystem access. |
+
+## Supported Versions
+
+| Version | Supported |
+|---|---|
+| 6.x | ❌ No |
+| < 6.x | ❌ No |
+
+No release in the 6.x series or earlier is supported.
+
+## Reporting a Vulnerability
+
+Vulnerability reports against TCPDF 6.x are not accepted and will not be triaged, patched, or assigned an advisory.
+
+Report vulnerabilities affecting the maintained successor, [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf), through that project's security policy.
+
+## Required Action
+
+Migrate to [tc-lib-pdf](https://github.com/tecnickcom/tc-lib-pdf).
+
+Until migration is complete, treat every TCPDF 6.x deployment as an accepted risk:
+
+- Never pass untrusted input (HTML, images, fonts, URLs, file paths) to TCPDF.
+- Run PDF generation in an isolated process with no network access and restricted filesystem permissions.
+- Disable remote resource fetching and PHP stream wrappers where possible.
+- Record the exposure in the project risk register.
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/VERSION b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/VERSION
index 060e73a63..8384713b1 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/VERSION
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/VERSION
@@ -1 +1 @@
-6.11.3
\ No newline at end of file
+6.11.4
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/composer.json b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/composer.json
index cc5904d20..8bd11b501 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/composer.json
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/composer.json
@@ -1,7 +1,8 @@
 {
     "name": "tecnickcom/tcpdf",
     "type": "library",
-    "description": "Deprecated legacy PDF engine for PHP. For new projects use tecnickcom/tc-lib-pdf.",
+    "description": "Deprecated legacy PDF engine for PHP. Migrate to tecnickcom/tc-lib-pdf.",
+    "abandoned": "tecnickcom/tc-lib-pdf",
     "keywords": [
         "PDF",
         "tcpdf",
@@ -25,7 +26,7 @@
         "ext-curl": "*"
     },
     "suggest": {
-        "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF for new projects.",
+        "tecnickcom/tc-lib-pdf": "Modern replacement for TCPDF.",
         "ext-gd": "Enables additional image handling in some workflows.",
         "ext-imagick": "Enables additional image format support when available.",
         "ext-zlib": "Recommended for compressed streams and related features."
@@ -63,13 +64,12 @@
         ]
     },
     "support": {
-        "issues": "https://github.com/tecnickcom/TCPDF/issues",
         "source": "https://github.com/tecnickcom/TCPDF"
     },
     "funding": [
         {
-            "type": "paypal",
-            "url": "https://www.paypal.com/donate/?hosted_button_id=NZUEC5XS8MFBJ"
+        "type": "github",
+        "url": "https://github.com/sponsors/tecnickcom"
         }
     ]
 }
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/datamatrix.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/datamatrix.php
index 77822fdf1..05fd713c9 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/datamatrix.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/datamatrix.php
@@ -106,6 +106,7 @@
 * @package com.tecnick.tcpdf
 * @author Nicola Asuni
 * @version 1.0.004
+* @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
 */
 class Datamatrix {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/pdf417.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/pdf417.php
index 4c9a4b3d1..6a9ef6717 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/pdf417.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/pdf417.php
@@ -89,6 +89,7 @@
  * @package com.tecnick.tcpdf
  * @author Nicola Asuni
  * @version 1.0.003
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class PDF417 {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/qrcode.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/qrcode.php
index 72cbf15e8..1b7c4c2c3 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/qrcode.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/barcodes/qrcode.php
@@ -261,6 +261,7 @@
  * @package com.tecnick.tcpdf
  * @author Nicola Asuni
  * @version 1.0.010
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class QRcode {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_colors.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_colors.php
index fc5aeb08f..31435233c 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_colors.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_colors.php
@@ -44,6 +44,7 @@
  * @package com.tecnick.tcpdf
  * @version 1.0.004
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_COLORS {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php
index 96be66f5d..32c7dc23d 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_filters.php
@@ -47,6 +47,7 @@
  * @brief This is a PHP class for decoding common PDF filters.
  * @version 1.0.001
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_FILTERS {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_font_data.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_font_data.php
index d7eae2f30..9bb788e22 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_font_data.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_font_data.php
@@ -44,6 +44,7 @@
  * @package com.tecnick.tcpdf
  * @version 1.0.001
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_FONT_DATA {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_fonts.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_fonts.php
index 1fc24f5af..99ed0aca9 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_fonts.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_fonts.php
@@ -44,6 +44,7 @@
  * @package com.tecnick.tcpdf
  * @version 1.1.1
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_FONTS {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_images.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_images.php
index 2d8b96e62..af61bcb0e 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_images.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_images.php
@@ -48,6 +48,7 @@
  * @brief PHP class for generating PDF documents without requiring external extensions.
  * @version 1.0.005
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_IMAGES {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_static.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_static.php
index 86dbad577..00a9c2436 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_static.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/include/tcpdf_static.php
@@ -48,6 +48,7 @@
  * @brief PHP class for generating PDF documents without requiring external extensions.
  * @version 1.1.5
  * @author Nicola Asuni - info@tecnick.com
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF_STATIC {
 
@@ -55,7 +56,7 @@ class TCPDF_STATIC {
 	 * Current TCPDF version.
 	 * @private static
 	 */
-	private static $tcpdf_version = '6.11.3';
+	private static $tcpdf_version = '6.11.4';
 
 	/**
 	 * String alias for total number of pages.
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf.php
index b369532dc..a7b791cfe 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf.php
@@ -1,9 +1,9 @@
 <?php
 //============================================================+
 // File name   : tcpdf.php
-// Version     : 6.11.3
+// Version     : 6.11.4
 // Begin       : 2002-08-03
-// Last Update : 2026-03-03
+// Last Update : 2026-08-28
 // Author      : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
 // License     : GNU-LGPL v3 (https://www.gnu.org/copyleft/lesser.html)
 // -------------------------------------------------------------------
@@ -28,6 +28,10 @@
 // See LICENSE.TXT file for more information.
 // -------------------------------------------------------------------
 //
+// DEPRECATED :
+//   TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf
+//   (https://github.com/tecnickcom/tc-lib-pdf).
+//
 // Description :
 //   This is a PHP class for generating PDF documents without requiring external extensions.
 //
@@ -103,8 +107,9 @@
  * </ul>
  * Tools to encode your unicode fonts are on fonts/utils directory.</p>
  * @package com.tecnick.tcpdf
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  * @author Nicola Asuni
- * @version 6.11.3
+ * @version 6.11.4
  */
 
 // TCPDF configuration
@@ -128,7 +133,8 @@
  * TCPDF project (http://www.tcpdf.org) has been originally derived in 2002 from the Public Domain FPDF class by Olivier Plathey (http://www.fpdf.org), but now is almost entirely rewritten.<br>
  * @package com.tecnick.tcpdf
  * @brief PHP class for generating PDF documents without requiring external extensions.
- * @version 6.11.3
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
+ * @version 6.11.4
  * @author Nicola Asuni - info@tecnick.com
  * @IgnoreAnnotation("protected")
  * @IgnoreAnnotation("public")
@@ -1891,6 +1897,13 @@ class TCPDF {
 	 * @see getPageSizeFromFormat(), setPageFormat()
 	 */
 	public function __construct($orientation='P', $unit='mm', $format='A4', $unicode=true, $encoding='UTF-8', $diskcache=false, $pdfa=false) {
+		// deprecation notice, raised once per process and silenced by defining TCPDF_SILENCE_DEPRECATION;
+		// the @ prevents the default handler from printing it into the document output
+		static $deprecation_notice = true;
+		if ($deprecation_notice && !(defined('TCPDF_SILENCE_DEPRECATION') && TCPDF_SILENCE_DEPRECATION)) {
+			$deprecation_notice = false;
+			@trigger_error('TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf (https://github.com/tecnickcom/tc-lib-pdf).', E_USER_DEPRECATED);
+		}
 		// set file ID for trailer
 		$serformat = (is_array($format) ? json_encode($format) : $format);
 		$this->file_id = md5(TCPDF_STATIC::getRandomSeed('TCPDF'.$orientation.$unit.$serformat.$encoding));
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_1d.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_1d.php
index 34cb6da17..81dae8342 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_1d.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_1d.php
@@ -27,6 +27,10 @@
 // See LICENSE.TXT file for more information.
 // -------------------------------------------------------------------
 //
+// DEPRECATED :
+//   TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf
+//   (https://github.com/tecnickcom/tc-lib-pdf).
+//
 // Description : PHP class to creates array representations for
 //               common 1D barcodes to be used with TCPDF.
 //
@@ -46,6 +50,7 @@
  * @package com.tecnick.tcpdf
  * @version 1.0.027
  * @author Nicola Asuni
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDFBarcode {
 
diff --git a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_2d.php b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_2d.php
index 0e1163653..7e616ee32 100644
--- a/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_2d.php
+++ b/htdocs/xoops_lib/vendor/tecnickcom/tcpdf/tcpdf_barcodes_2d.php
@@ -27,6 +27,10 @@
 // See LICENSE.TXT file for more information.
 // -------------------------------------------------------------------
 //
+// DEPRECATED :
+//   TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf
+//   (https://github.com/tecnickcom/tc-lib-pdf).
+//
 // Description : PHP class to creates array representations for
 //               2D barcodes to be used with TCPDF.
 //
@@ -46,6 +50,7 @@
  * @package com.tecnick.tcpdf
  * @version 1.0.015
  * @author Nicola Asuni
+ * @deprecated TCPDF is deprecated: migrate to tecnickcom/tc-lib-pdf.
  */
 class TCPDF2DBarcode {
 
diff --git a/htdocs/xoops_lib/vendor/webmozart/assert/CHANGELOG.md b/htdocs/xoops_lib/vendor/webmozart/assert/CHANGELOG.md
index d62c758f0..39eb54acf 100644
--- a/htdocs/xoops_lib/vendor/webmozart/assert/CHANGELOG.md
+++ b/htdocs/xoops_lib/vendor/webmozart/assert/CHANGELOG.md
@@ -1,6 +1,16 @@
 Changelog
 =========
 
+## 2.5.0
+
+### Added
+
+- Added `keysExist`, and the `nullOrKeysExist`, `allKeysExist`, and `allNullOrKeysExist` variants.
+
+### Changed
+
+- `propertyExists` now preserves `class-string` and object types through its return value, improving static analysis support.
+
 ## 2.4.1
 
 ### Fixed
diff --git a/htdocs/xoops_lib/vendor/webmozart/assert/README.md b/htdocs/xoops_lib/vendor/webmozart/assert/README.md
index fef4eda59..af48b0a46 100644
--- a/htdocs/xoops_lib/vendor/webmozart/assert/README.md
+++ b/htdocs/xoops_lib/vendor/webmozart/assert/README.md
@@ -201,6 +201,7 @@ Method                                             | Description
 -------------------------------------------------- | ------------------------------------------------------------------
 `keyExists($array, $key, $message = '')`           | Check that a key exists in an array
 `keyNotExists($array, $key, $message = '')`        | Check that a key does not exist in an array
+`keysExist($array, $keys, $message = '')`          | Check that all the given keys exist in an array
 `validArrayKey($key, $message = '')`               | Check that a value is a valid array key (int or string)
 `count($array, $number, $message = '')`            | Check that an array contains a specific number of elements
 `minCount($array, $min, $message = '')`            | Check that an array contains at least a certain number of elements
diff --git a/htdocs/xoops_lib/vendor/webmozart/assert/src/Assert.php b/htdocs/xoops_lib/vendor/webmozart/assert/src/Assert.php
index 31c861b9f..e73c55037 100644
--- a/htdocs/xoops_lib/vendor/webmozart/assert/src/Assert.php
+++ b/htdocs/xoops_lib/vendor/webmozart/assert/src/Assert.php
@@ -2030,9 +2030,11 @@ public static function implementsInterface(mixed $value, mixed $interface, strin
     /**
      * @psalm-pure
      *
-     * @param string|object $classOrObject
+     * @template T as class-string|object
+     * @param T $classOrObject
      * @param string|callable():string $message
      *
+     * @return T
      * @throws InvalidArgumentException
      */
     public static function propertyExists(mixed $classOrObject, mixed $property, string|callable $message = ''): object|string
@@ -2146,6 +2148,40 @@ public static function keyExists(mixed $array, string|int $key, string|callable
         return $array;
     }
 
+    /**
+     * @psalm-pure
+     *
+     * @param iterable<string|int> $keys
+     * @param string|callable():string $message
+     *
+     * @throws InvalidArgumentException
+     */
+    public static function keysExist(mixed $array, mixed $keys, string|callable $message = ''): array
+    {
+        static::isArray($array, $message);
+        static::isIterable($keys);
+
+        $missing = [];
+
+        foreach ($keys as $key) {
+            static::validArrayKey($key, 'Expected an array key. Got: %s');
+
+            if (!(isset($array[$key]) || \array_key_exists($key, $array))) {
+                $missing[] = $key;
+            }
+        }
+
+        if ([] !== $missing) {
+            $message = self::resolveMessage($message);
+            static::reportInvalidArgument(\sprintf(
+                $message ?: 'Expected the keys %s to exist.',
+                \implode(', ', \array_map(static::valueToString(...), $missing))
+            ));
+        }
+
+        return $array;
+    }
+
     /**
      * @psalm-pure
      *
diff --git a/htdocs/xoops_lib/vendor/webmozart/assert/src/Mixin.php b/htdocs/xoops_lib/vendor/webmozart/assert/src/Mixin.php
index a714f16cb..ce3519609 100644
--- a/htdocs/xoops_lib/vendor/webmozart/assert/src/Mixin.php
+++ b/htdocs/xoops_lib/vendor/webmozart/assert/src/Mixin.php
@@ -4711,10 +4711,12 @@ public static function allNullOrImplementsInterface(mixed $value, mixed $interfa
     /**
      * @psalm-pure
      *
-     * @param string|object|null       $classOrObject
+     * @template T as class-string|object
+     *
+     * @param T|null                   $classOrObject
      * @param string|callable():string $message
      *
-     * @return string|object|null
+     * @return T|null
      *
      * @throws InvalidArgumentException
      */
@@ -4728,10 +4730,12 @@ public static function nullOrPropertyExists(mixed $classOrObject, mixed $propert
     /**
      * @psalm-pure
      *
-     * @param iterable<string|object>  $classOrObject
+     * @template T as class-string|object
+     *
+     * @param iterable<T>              $classOrObject
      * @param string|callable():string $message
      *
-     * @return iterable<string|object>
+     * @return iterable<T>
      *
      * @throws InvalidArgumentException
      */
@@ -4749,10 +4753,12 @@ public static function allPropertyExists(mixed $classOrObject, mixed $property,
     /**
      * @psalm-pure
      *
-     * @param iterable<string|object|null> $classOrObject
-     * @param string|callable():string     $message
+     * @template T as class-string|object|null
+     *
+     * @param iterable<T>              $classOrObject
+     * @param string|callable():string $message
      *
-     * @return iterable<string|object|null>
+     * @return iterable<T>
      *
      * @throws InvalidArgumentException
      */
@@ -5021,6 +5027,65 @@ public static function allNullOrKeyExists(mixed $array, string|int $key, callabl
         return $array;
     }
 
+    /**
+     * @psalm-pure
+     *
+     * @param iterable<string|int>     $keys
+     * @param string|callable():string $message
+     *
+     * @return array|null
+     *
+     * @throws InvalidArgumentException
+     */
+    public static function nullOrKeysExist(mixed $array, mixed $keys, callable|string $message = ''): ?array
+    {
+        null === $array || static::keysExist($array, $keys, $message);
+
+        return $array;
+    }
+
+    /**
+     * @psalm-pure
+     *
+     * @param iterable<string|int>     $keys
+     * @param string|callable():string $message
+     *
+     * @return iterable<array>
+     *
+     * @throws InvalidArgumentException
+     */
+    public static function allKeysExist(mixed $array, mixed $keys, callable|string $message = ''): iterable
+    {
+        static::isIterable($array);
+
+        foreach ($array as $entry) {
+            static::keysExist($entry, $keys, $message);
+        }
+
+        return $array;
+    }
+
+    /**
+     * @psalm-pure
+     *
+     * @param iterable<string|int>     $keys
+     * @param string|callable():string $message
+     *
+     * @return iterable<array|null>
+     *
+     * @throws InvalidArgumentException
+     */
+    public static function allNullOrKeysExist(mixed $array, mixed $keys, callable|string $message = ''): iterable
+    {
+        static::isIterable($array);
+
+        foreach ($array as $entry) {
+            null === $entry || static::keysExist($entry, $keys, $message);
+        }
+
+        return $array;
+    }
+
     /**
      * @psalm-pure
      *