[brianvarskonst]

The committed Composer lock resolved Symfony ExpressionLanguage 8.1.6, affected by CVE-2026-109449. Require the published Kernel 1.1.10 and Twig Bundle 1.2.3 security patches so fresh and lowest-version installations retain safe parser requirements. Update only those packages, their Framework Bundle dependency and ExpressionLanguage/YAML/HttpFoundation to Symfony 8.1.9. YAML 8.1.8 and HttpFoundation 8.1.8 in the previous lock already include their original security fixes; HttpFoundation 8.1.9 also corrects the whitespace-separator regression.

Prepare patch 1.1.4 with consistent theme, npm and translation-catalog versions, and document current public Packagist installation and dependency floors. The ignored local WordPress fixture lock is not added to the repository. No public untrusted expression or YAML parsing entry point is established by this change.

Validation: complete composer qa (strict manifest validation, 24 PHP files, 14 compiled Twig templates, coding standards, PHPStan, nine PHPUnit tests/25 assertions and 36 standalone assertions); Composer audit including development packages; translation catalog consistency (61 messages). Hosted asset and disposable WordPress/browser checks run against this exact PR head. Existing sites, DDEV data and other checkouts remain untouched.

All four hosted checks passed. A fresh published lowest solve, strict validation and audit pass with ExpressionLanguage/HttpFoundation 8.1.9 and YAML 8.1.6. Full QA also passes against these minimum runtime dependencies after updating only the disposable copy's mocking development tools to versions compatible with PHP 8.5. True all-lowest development dependencies expose old Patchwork/Mockery compatibility failures; no production constraints, committed dev lock or test execution were weakened.

[brianvarskonst]

Independently reviewed final head d4cd52803c23936b5108201997809535735fec77 against origin/main (4256651). No blocking findings in the eight changed files.

The root lock changes exactly six packages: verified Kernel 1.1.10, Framework Bundle 1.0.7, Twig Bundle 1.2.3 and the three targeted Symfony components at 8.1.9. No development dependencies, scripts, plugins, audit rules or other lock fields change. Package minimums also retain the fixes under lowest-version resolution. CSS/npm/POT version metadata consistently uses 1.1.4; npm lock changes only the root version. Source exports remain unchanged and exclude local fixtures/authentication/test artifacts.

The existing Unreleased navigation/description corrections are correctly assigned to this next patch's changelog. Package QA, translations, strict Composer validation and the development-inclusive audit pass. Lowest resolution and audit prove the targeted security floors; old Patchwork tooling has a separately documented PHP 8.5 incompatibility. Merge must wait for all hosted checks on this exact SHA, including DDEV/Playwright.