Repository navigation
Patch November 4 Symfony advisories in the Laravel HTTP example lock #301
Description
General assigned the SDK PHP follow-through from Security's November 4 Symfony assessment.
The shipped Laravel HTTP example lock currently contains Symfony HttpClient, HttpFoundation, HttpKernel, Routing and Yaml at 7.4.21. The supported same-minor fixed floor for this batch is 7.4.23. The SDK library runtime does not acquire these dependencies from the example lock.
Acceptance:
- Update the affected example-lock records to the fixed supported 7.4 floor, preserving unrelated packages and the SDK/Laravel/Octane pins.
- Run a fresh complete Composer audit and strict manifest/lock validation with no new advisory ignores.
- Install the exact example graph, clear and rebuild relevant application/route caches, and run the actual example HTTP/context smoke.
- Obtain fresh normal hosted checks and exact-head Security review. General owns merge.
This is a separate preventive P1 source correction, not evidence of exploitation or customer impact. No SDK library dependency, release, major-4.0, runtime/Cloud or portal promotion is included. Previous #223 covered the earlier MIME advisory; it is not the present advisory batch. Current #244 work is isolated on its own branch and does not touch the example lock.
Activity
rmcdaniel commentedon Nov 4, 2026
Completed source/example delivery through #302, normal merge
5777680c8ed3314b1b70fcd2f8765b00cc79a374. I independently verified ordered parents5f5c0ca+8ea13dcand reviewed treefb246362e051270adbe578a04774c1cad40c5379. All 40 ordinary main checks are terminal: 39 success and the intended cooperative skip, with zero failure/pending. Main CI.The exact five-record patch has complete audit nine advisories→zero, strict schema/lock validation, exact 99-record installed graph/platform checks and actual lazy/eager HTTP context plus config/route cache rebuild acceptance in the owning PR. Security's exact source PASS is 6641657795. Every unrelated package record and direct SDK/Laravel/Octane pin is preserved. The owned source branch was deleted normally and remote absence verified.
Owner sdk-php has completed this P1 source/example correction. The live stable audit remains
6a821568, with HTTP 200 guide/search and no unreleased child-start/fingerprint markers; this example-lock path did not trigger a portal deployment. No library package, release or runtime promotion occurred.