[rmcdaniel]

Retired PHP Server 2.11.8 contains Laravel 13.34.0, affected by three published advisories. Add the reviewed conditional exposure classification and operator action: block framework storage routes, stop issuing local temporary signed links, retire the PHP service and follow bounded backup-first native guidance. The notice distinguishes affected dependencies from an unproven default Server exploit and preserves the historical takeover limits.

The active source Composer lock also failed required audit for CVE-2026-128083. Raise the Laravel floor to 13.41 and update only Laravel plus required Prompts. This repairs source/CI dependencies; it does not patch the frozen PHP image. The disabled publisher, release identity, frozen tags/comparators and native selections are unchanged.

Refs #1214. Accepted main 3f21b754 has complete-tree equality with reviewed 2c808ecf; all source/queue checks and independent Security/General wording review pass. Final metadata validation/audit and the actual public repository notice readback pass. Delivery evidence includes the exact results and declared skips. Docs #540 and Server’s independent live checks are delivered. #1214 is closed for the selected assessment/notice outcome; the retired PHP artifact remains unpatched.

[rmcdaniel]

Security source/notice review: PASS, scoped to exact 2c808ecf90c6684aa16468191dad8a05333a83da.

Independent checks:

• The notice correctly distinguishes affected dependency exposure from a demonstrated Server exploit. Its prerequisite descriptions match the three primary advisories: no shipped Concurrency::run() or signed-URL generation path was found, while the framework-registered signed local-storage routes make the expiration-bypass path conditionally relevant to issued/operator-extension URLs.
• The operator actions are appropriately bounded: block both GET and PUT /storage/*, stop issuing/reusing local-disk signed links, review extensions, preserve a restorable backup, and keep PHP roles stopped during applicable migration. The notice explicitly says those actions do not install the upstream fixes or prove extensions safe.
• Retirement and migration wording is closed: PHP 2.11.8 remains retired/unpatched; no new PHP release is claimed; existing tags/images and the disabled publisher remain unchanged; a source Composer update is not presented as an installed-image patch; native takeover is backup-first and not described as automatic conversion or as newly qualified by the latest native release.
• The active-source manifest moves only the Laravel floor to ^13.41. Normalized lock comparison shows only Laravel v13.34.0 to official v13.41.0 / 95934d2868c90c1aa8e711791ea33d1e990e1719 and its required Prompts update to official v0.3.27 / abdfc75a1ae6c6f21522daed50da7124cbff09d2; unrelated resolved packages are byte-preserved. JSON and diff checks pass, with no advisory ignore, audit bypass, scan suppression, workflow, publisher, release, image, or tag mutation.

This is a source/notice verdict, not a PHP runtime or release qualification. General's final wording/retirement disposition and terminal exact-head required CI remain merge gates. The PHP publisher must stay disabled and no PHP release, rebuilt image, automatic conversion, or installed patch may be inferred.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General product-wording/user-action review PASS for exact 2c808ec. I compared the four-file change to Security's artifact-bound exposure assessment 6863324238 and the recorded #1002 retirement decision. The notice accurately distinguishes affected dependencies, conditional signed storage-route reachability and absence of a demonstrated default product exploit. The ingress GET/PUT block, stopped link issuance, backup/role-stop guidance and exact historical takeover limits are concrete; it does not promise an automatic latest-native data conversion. The development Composer floor/lock fix repairs active source audit only and does not relabel the frozen 2.11.8 image as patched.

Please retain normal source/Security/current CI gates, then carry the notice through Docs/customer-surface delivery and actual public readback. The PHP publisher remains disabled and all retired tags/comparators stay frozen. This verdict is wording/source-scope approval, not a new PHP release or installed-artifact qualification.

[rmcdaniel]

Source and repository notice delivered through the normal merge queue at 3f21b754418ffea5e786f2bd48481a35c92ab1a2, tree b1185ac37ddaf568e4950983765ce7183a7cf8b8. The complete accepted tree equals reviewed 2c808ecf; parents, ancestry and exact four-file delta are verified. The completed remote/local topic branches are absent.

General's exact wording/user-action PASS, Security's exact source/notice PASS, all 18 head successes/eight intended skips and the normal merge-group checks passed. Merge-group runs: PHP/source contracts 43500452701, shared inputs 43500452663, public boundary 43500452637. The full PHP feature result reports 3,634 cases/90,234 assertions, 51 existing skips and six deprecations, followed by the separate 51-case/250-assertion and one-case/12-assertion regression suites. No failure was waived.

The accepted public notice reads back byte-exact, SHA256 2c14bce0cfd996ea2ce0c67030584882785bfd3f0f901b13e6a2b0cea598a12e. Final source lock validation and audit pass, SHA256 ed471d235d19f3ffc5ef717572b158a6f7a82be2c5dfc44d727351fbdad36b55. That is active-source maintenance, not an installed PHP patch. The publisher, frozen PHP image/tags/comparators and native selections remain unchanged.

Docs #540 delivery now verifies all 32 public pages/eight locales after protected Pages 43502529070. Server’s independent four-English-page and exact machine-artifact readback also passes. All five actual-main source workflows (43501079637, 43501080396, 43501080380, 43501080368 and 43501080485) are terminal SUCCESS at the accepted source. #1214 is closed for the selected assessment/notice outcome.