[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

The assessment needs a maintainer decision.

The lock refresh integrates directly with the recorded target and passed PHP/static/frontend build checks. Approval is blocked by the required full npm audit: 13 moderate development-tool findings remain for GHSA-g3hv-75wg-m249, already present on the target; npm reports no compatible fix. Production npm and Composer audits are clean. An operator must decide whether to accept the existing tooling exposure or wait for supported dependency updates; no checkout changes were made. Remaining debt is the vulnerable minimatch tooling chain, to migrate through consumers supporting minimatch >=11.0.1; no new deprecation or retirement deadline was identified.

Agent-assessed risk: Medium. Runtime dependencies and checks look compatible, but the required frontend audit fails on an existing moderate development-tool denial-of-service advisory.

Maintainer question

• Should PR #55 be accepted with the existing dev-only GHSA-g3hv-75wg-m249 exposure and failing full npm audit, or held until upstream tooling supports patched minimatch >=11.0.1?

Evidence (12 items)

• Local check: git diff 468a18ea503421ac18a28d65e8a30108688277ed...refs/artidezi/inputs/source-pr; structured comparison of both lockfiles — Merge base equals recorded target 468a18e. Only app/composer.lock and app/frontend/package-lock.json change: Composer semver 3.5.2 to 3.6.0, Symfony 8.1 patch/polyfill updates, Babel/tooling and browser database patches. Symfony constraints remain coherent; updated cache requirement ^8.1.1 is met by var-exporter 8.1.10. React/React DOM, browser runtime packages, build.mjs, MongoDB library/driver, images and Nagios configuration are unchanged.
• Release notes: source — Describes compactConstraint performance caching and cache clearing, without a migration requirement.
• Release notes: source — Maintenance release documents component bug fixes; no affected removal or required application migration identified.
• Local check: Isolated git archive of refs/artidezi/inputs/source-pr; ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist; ./bin/composer audit --locked — All passed: composer.json valid, 92 packages installed and autoload generated, no security advisories. Checks used the source archive, leaving the target checkout untouched.
• Local check: docker build --iidfile /tmp/pr55-php-image.id etc/docker/php; docker run --rm --network none --entrypoint php <built-image> -r <version probe> — Build succeeded using cached layers from the actual Dockerfile. Runtime probe reports PHP 8.5.12 and MongoDB extension 2.5.5, satisfying unchanged mongodb/mongodb 2.5.x requirement ext-mongodb ^2.5; runtime compatibility is not inferred solely from Composer platform minimum.
• Local check: docker run --rm --network none --user <uid:gid> --mount type=bind,src=<candidate>,dst=/code --workdir /code/app --entrypoint /bin/sh <built-image> -ec "vendor/bin/phpstan analyse -c phpstan.neon && vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php && vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php" — Passed PHPStan with no errors, PHP style with 0 of 146 files needing fixes, and Twig lint for 38 files with no notices/warnings/errors. PHP CS Fixer separately cautions that runtime PHP 8.5 exceeds declared PHP 8.4 minimum; no suppression was added.
• Local check: ./bin/node /bin/sh -c 'cd /app/src && npm audit && eslint . && tsc --noEmit && npm run build && npm ls --all' — Node image build/npm ci succeeded. npm audit failed with 13 moderate findings rooted in minimatch; subsequent commands in this first chain did not execute. No audit suppression applied.
• Local check: ./bin/node /bin/sh -c 'cd /app/src && eslint . && tsc --noEmit && npm run build && npm ls --all' — ESLint, TypeScript and asset build passed. The final npm ls failed because /app/src is a source bind mount, while this helper intentionally installs dependencies in /app; corrected location checked separately. Generated output remained outside the checkout.
• Local check: ./bin/node /bin/sh -c 'cd /app && npm ls --all > /tmp/peer-tree.txt && echo Installed-dependency-tree-valid && cd /app/src && npm audit --omit=dev' — Passed: installed dependency tree valid, including peers; production audit found 0 vulnerabilities. Full audit failure is limited to dev dependencies. No browser exercise or nagios -v run: their runtime assets/loading paths and configuration/images did not change. No live stack/database or deployment environment was accessed.
• Documentation: source — CVE-2026-118764: attacker-controlled glob patterns can cause CPU/memory amplification; affected minimatch <11.0.1, patched 11.0.1. Candidate and target both retain dev-only minimatch 3.1.5 and 10.2.6. ESLint/config-array/eslintrc/react plugin require ^3.x and typescript-estree ^10.2.2, excluding the patched major; npm audit reports no compatible fix. A forced major override would violate declared consumer support.
• Evidence: Supplied source CI snapshot at 45d728c96990c879c14317f00d8a2e5f2921758a — frontend and php reported success. This point-in-time evidence does not override the independently observed npm audit failure or controller forge gates.
• Local check: git status --porcelain=v1; git rev-parse HEAD — Working tree clean; HEAD remains recorded target 468a18e. No commits, remote operations or workflow edits.

Assessed source 45d728c96990c879c14317f00d8a2e5f2921758a.