[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the lockfile refresh unchanged. The source merge base equals the recorded target, and only Composer/npm locks change; dependency constraints, images and browser runtimes remain compatible. Local Docker-based validation, audits, PHP analysis/style and frontend checks passed. An offline SMS probe succeeds with Symfony error handling but emits a new nonfatal Vonage deprecation; live delivery and database behavior were not exercised.

Agent-assessed risk: Low. Resolved dependency sets install and pass application checks on the actual runtime; the observed Vonage deprecation adds logging noise without preventing the mocked SMS operation.

Evidence (11 items)

• Local check: git merge-base ad750d276bb02f53cbd4f92606da8a827e392170 refs/artidezi/inputs/source-pr; git diff --stat ad750d276bb02f53cbd4f92606da8a827e392170...refs/artidezi/inputs/source-pr; git diff --check (same range) — Merge base is exactly the target ad750d2; source 1e2edcf changes only app/composer.lock and app/frontend/package-lock.json (297 additions/297 deletions), with no whitespace errors. Assessed an isolated git archive of the source; target checkout remains clean and unchanged.
• Local check: ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist; ./bin/composer audit --locked — All passed in the source snapshot using the repository helper; manifest valid, locked install successful, no security vulnerability advisories. Composer platform.ext-mongodb was not used as runtime compatibility proof.
• Local check: docker build --iidfile var/php-image.id etc/docker/php; docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat var/php-image.id)" -ec <autoload/version probe and PHP checks> — Image build and vendor autoload passed. Actual runtime: PHP 8.5.12, MongoDB extension 2.5.5, mongodb/mongodb 2.5.0; extension satisfies library ^2.5 requirement. Library/driver/images unchanged by PR. Symfony components stay on coherent 8.1 constraints.
• Local check: In built PHP container: vendor/bin/phpstan analyse -c phpstan.neon --no-progress; vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php; vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php — All passed: PHPStan no errors, PHP style 0/146 files requiring fixes, Twig 38 files with no notices/warnings/errors. PHP CS Fixer notes runtime PHP 8.5 is newer than the declared project minimum; check mode changed no files.
• Local check: just js-analyze js-build; ./bin/node /bin/sh -c 'cd /app/src && npm audit && cd /app && npm ls --all' — Repository Node helper built image with npm ci; ESLint, tsc --noEmit, asset build, npm audit (0 vulnerabilities), and dependency/peer tree passed. React and React DOM both 19.3.1, unchanged. Initial npm ls from /app/src incorrectly reported missing dependencies because helper installs them at /app/node_modules; rerun from /app passed. Generated assets/dependencies exist only in the separate snapshot.
• Release notes: source — 4.9.4 explicitly adds support for brick/math ^0.19, ^0.20 and ^1.0, covering this lock refresh from Brick Math 0.18.0 to 1.0.0. Application has no direct Brick Math/Ramsey API usage.
• Release notes: source — First stable release has no changes from 0.20.0; compatibility with its UUID consumer is explicitly documented by Ramsey 4.9.4.
• Release notes: source — 4.14.0 documents runtime E_USER_DEPRECATED notices ahead of 5.0 and states no breaking changes. Application uses Basic credentials with injected Guzzle and SMS::send; offline verification below investigates its internal deprecated call.
• Release notes: source — 4.15.0 fixes the Guzzle version gate; application injects its Guzzle HTTP client explicitly.
• Local check: docker run --rm -i --network none ... --entrypoint php <built image>, inline PHP offline SmsSender probe using Guzzle MockHandler and history middleware — With test credentials and a fabricated successful SMS response, application SmsSender completed exactly one mocked /sms/json request under Symfony ErrorHandler. One Vonage Client::send E_USER_DEPRECATED notice observed. Earlier probe deliberately converting every PHP notice to an exception failed on that notice; actual Symfony ErrorHandler never throws deprecations (vendor/symfony/error-handler/ErrorHandler.php), and application PHP display_errors is Off. This is nonblocking logging noise. No external requests or real notifications sent.
• Evidence: Supplied source CI snapshot and inspection of affected integration points — Snapshot reports php/frontend success; independent controller gates still apply. No React loading, Bootstrap, Select2/Chosen, asset-path, Nagios configuration, image or workflow changes, so no browser session or nagios -v fixture was needed. No live DB, deployment environment, monitoring stack or real delivery was accessed; checks establish static/build and mocked SDK compatibility, not end-to-end production behavior.

Assessed source 1e2edcf8113796ffd33493d7c589b3c596b0091d.