[rmcdaniel]

Security handoff, P3, no release hold: #325 comment 6552156681. The six committed parity role locks carried symfony/mime v7.4.13, which CVE-2026-45070 / GHSA-vqc8-7275-q272 affects. Symfony's corrected advisory names 7.4.22 as the first fixed 7.4 release. No fixture builds MIME parameter names, so no fixture path reached the bug. The release image excludes tests/, and main's runtime lock already carries 7.4.22 (#846).

Change

• Each of the six locks updated with scripts/ci/run-composer.sh … update symfony/mime --no-install --no-scripts --no-plugins, as in Refresh parity fixture locks for new Symfony denial-of-service advisories #820. Only symfony/mime changed. content-hash, require blocks, every other package and every durable-workflow/* package are unchanged. The two identical locks (legacy embedded, repeated-patch embedded) stay identical.
• Lock sha256 pins moved in corrected-markers/artifacts.json, corrected-markers/artifacts-workflow-2.5.16.json, legacy-marker-aliases/artifacts.json and repeated-patch-clock/artifacts.json. Historical outcome records, loaded-source hashes, Server images and roles are untouched. No path or advisory exception was needed: the original roles took the dependency-only refresh.
• The profile READMEs record the refresh.

Verification (local)

• composer audit --locked: no advisories in any of the six locks. composer validate --strict --no-check-all: valid.
• Each role installed from its lock with its own install script in its pinned Server image. Every role passed sha256sum -c against its manifest pin. Each installed the manifest's Workflow version (2.5.14, 2.5.6, 2.5.16, 2.5.7, 2.5.5, 2.5.7) with every manifest loaded-source hash matching, and symfony/mime at v7.4.22.
• node --test tests/Unit/ServerParity*Test.mjs (without the php-dependent timing test): 6178 pass, 0 fail, 1 skipped.
• composer_trust_test.py + release_composer_audit_test.py: 28 pass, 1 environmental failure (Docker loopback to 127.0.0.1, the same failure as in Refresh parity fixture locks for new Symfony denial-of-service advisories #820).
• Full multi-database profile runs: not run locally; CI runs them.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security read-only review of exact head 7d3a7fc: accepted with no separate Security hold. Symfony current primary guidance confirms that 7.4.22 is the first 7.4 release actually containing the CVE-2026-45070 fix (the earlier patched-version statement was incorrect): https://symfony.com/blog/about-the-security-entries-in-symfony-5-4-55-6-4-49-7-4-22-and-8-1-10. Recursive head inventory finds seven Composer locks containing symfony/mime: the root lock was already 7.4.22 and all six changed parity locks are now 7.4.22 at the official 94a4c017 reference; no older symfony/mime lock remains. Each of the six updated artifact-manifest digests recomputes exactly, and the diff preserves the recorded Workflow/package source hashes. Normal owner CI and parity matrices remain authoritative; this review does not waive them.