diff --git a/scripts/conformance/server-parity/README.md b/scripts/conformance/server-parity/README.md index 8714225e6..e6710ff1a 100644 --- a/scripts/conformance/server-parity/README.md +++ b/scripts/conformance/server-parity/README.md @@ -43,6 +43,8 @@ This embedded component observation makes no service SDK clock-helper claim. Server #820 refreshed only `symfony/http-foundation` to 7.4.21 in this lock and both `legacy-marker-aliases` role locks (GHSA-r925-mgvr-h9cc); Workflow packages and loaded-source hashes are unchanged. +Server #325 later refreshed only `symfony/mime` to 7.4.22 in the same three +locks (CVE-2026-45070), on the same terms. Run `bash scripts/conformance/server-parity/repeated-patch-profile.sh BACKEND PHP_URL NATIVE_URL` after the ordinary targets and adapter are prepared, with the same `RESOURCE_SCOPE` and database-image variables as the owning CI job. diff --git a/scripts/conformance/server-parity/corrected-markers/README.md b/scripts/conformance/server-parity/corrected-markers/README.md index 65afadece..5429ca844 100644 --- a/scripts/conformance/server-parity/corrected-markers/README.md +++ b/scripts/conformance/server-parity/corrected-markers/README.md @@ -66,7 +66,9 @@ in that complete Composer lock. The earlier 2.5.14 manifest, locks and failed policy recording remain unchanged apart from Server #820's bounded security refresh, which moved only `symfony/http-foundation` and `symfony/yaml` to 7.4.21 in all three role locks (GHSA-r925-mgvr-h9cc, GHSA-2v3c-qxhr-7vpv) and -kept every Workflow package and loaded-source hash; the published Server +kept every Workflow package and loaded-source hash. A later Server #325 +refresh moved only `symfony/mime` to 7.4.22 in the same locks +(CVE-2026-45070), on the same terms. The published Server reference still carries its own declared 2.5.14 package. Set `DW_PARITY_CORRECTED_ARTIFACTS` to the new manifest for this explicit embedded cohort, with separate `DW_PARITY_CORRECTED_STATE`, `DW_PARITY_CORRECTED_EVIDENCE` and diff --git a/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts-workflow-2.5.16.json b/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts-workflow-2.5.16.json index 8e6f128fb..872a4b578 100644 --- a/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts-workflow-2.5.16.json +++ b/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts-workflow-2.5.16.json @@ -21,7 +21,7 @@ }, "workflow": "2.5.16", "workflow_source_commit": "c677f374df788afa5c4d6df2b5cf0722f03a99d6", - "embedded_composer_lock_sha256": "957bf6e7d5b5acd0baaac88258b61ec1a8def8927d5fbd04632cb593772b3fd7", + "embedded_composer_lock_sha256": "f0be5009470cc9a02c861a2b8b1b731b5612f5acd9f4ffbda2212a3ec79375db", "workflow_loaded_sources": { "src/V2/Support/VersionDecisions.php": "ffb22f79ffc08eceb2ffd7b96ecb2ad91c931f9fb5fac8bc4bdde75a57eff5e1", "src/V2/Support/WorkflowExecutor.php": "85dd889ccaa5d973542a5b194e32bc043d1083248d2f4b9dff80b87ea77678d1", @@ -31,7 +31,7 @@ "embedded_original": { "version": "2.5.6", "source_commit": "29c94c14d9d413509b26ff761b997533c021fcfe", - "composer_lock_sha256": "88fd7506efe2fe488304fa6c69e5e8f0816def2cc09b59470008631127a6aba3", + "composer_lock_sha256": "6ddfe31bef1fa1256f3b43786388511fc6a014458ce66f233dc3b1a6eeb1d513", "shutdown": "normal_cli_exit", "loaded_sources": { "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c", diff --git a/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts.json b/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts.json index d1da1e931..8a3cf7b1a 100644 --- a/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts.json +++ b/tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts.json @@ -21,7 +21,7 @@ }, "workflow": "2.5.14", "workflow_source_commit": "563675723522b2d453f950f593ab91473e91c831", - "embedded_composer_lock_sha256": "d5c28b544d410193a47502ae5d93db3c6ed19b657f289bfd5a09de1738d9d747", + "embedded_composer_lock_sha256": "148031c70da0a5917823c2fa634918841e328b76ef09fb0874cba584a8b7591f", "workflow_loaded_sources": { "src/V2/Support/VersionDecisions.php": "ffb22f79ffc08eceb2ffd7b96ecb2ad91c931f9fb5fac8bc4bdde75a57eff5e1", "src/V2/Support/WorkflowExecutor.php": "9b85a1daf80fbe63d4f0ec3e23513c213e4971379f9a280495c0df6dc9655062", @@ -31,7 +31,7 @@ "embedded_original": { "version": "2.5.6", "source_commit": "29c94c14d9d413509b26ff761b997533c021fcfe", - "composer_lock_sha256": "88fd7506efe2fe488304fa6c69e5e8f0816def2cc09b59470008631127a6aba3", + "composer_lock_sha256": "6ddfe31bef1fa1256f3b43786388511fc6a014458ce66f233dc3b1a6eeb1d513", "shutdown": "normal_cli_exit", "loaded_sources": { "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c", diff --git a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-original/composer.lock b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-original/composer.lock index 1cee96f98..0b863196a 100644 --- a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-original/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-original/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype", diff --git a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-workflow-2.5.16/composer.lock b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-workflow-2.5.16/composer.lock index f5ce04eca..eccf197e0 100644 --- a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-workflow-2.5.16/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded-workflow-2.5.16/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype", diff --git a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded/composer.lock b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded/composer.lock index 2d9cf4beb..d20861a16 100644 --- a/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/corrected-markers/embedded/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype", diff --git a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/artifacts.json b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/artifacts.json index 17cd2e00b..cbb8edc3e 100644 --- a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/artifacts.json +++ b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/artifacts.json @@ -12,7 +12,7 @@ }, "workflow": "2.5.7", "workflow_source_commit": "e9a767b08c426234c25d2969adcb09473e7af56e", - "embedded_composer_lock_sha256": "a9e668b54fdbfb71abc19228da05c3ca4d091cdbdb3856e0394093db81c030a0", + "embedded_composer_lock_sha256": "7bafdb8ea2ba56870db6979bd858c3b1e52eecdd6f58ddc5d81a1064e6277f15", "workflow_loaded_sources": { "src/V2/Support/VersionDecisions.php": "7b57ad40b2514738ccdc377b576d731a16f12d9b55aa628bb5dbb79eac00cdd1", "src/V2/Support/WorkflowExecutor.php": "ece1207630be200271925f5770792f03e6bd55224a2abf7a6be86793fdfddaea", @@ -43,7 +43,7 @@ "embedded_original": { "version": "2.5.5", "source_commit": "26a840f25f487676d4e7eb6d75ba1391931566a5", - "composer_lock_sha256": "7d1b529eeeddd1afabec94d72fef3e2aec27f6c63e724a1c6e58497b3b13a1ab", + "composer_lock_sha256": "ac9d95807e8e080d176a555a171315aba183fa13e546a51e02b6c2afd478c967", "loaded_sources": { "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c", "src/V2/Support/WorkflowExecutor.php": "7616287fcb0fb7445c179939fee1dc91df435c3cff6b4b4b2a614d804f288031", diff --git a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded-original/composer.lock b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded-original/composer.lock index a8cff8166..4308c51dc 100644 --- a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded-original/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded-original/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype", diff --git a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded/composer.lock b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded/composer.lock index 8f933a9c1..615440154 100644 --- a/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/embedded/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype", diff --git a/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/artifacts.json b/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/artifacts.json index 8f6bc2803..f50e4df2e 100644 --- a/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/artifacts.json +++ b/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/artifacts.json @@ -12,7 +12,7 @@ }, "workflow": "2.5.7", "workflow_source_commit": "e9a767b08c426234c25d2969adcb09473e7af56e", - "embedded_composer_lock_sha256": "a9e668b54fdbfb71abc19228da05c3ca4d091cdbdb3856e0394093db81c030a0", + "embedded_composer_lock_sha256": "7bafdb8ea2ba56870db6979bd858c3b1e52eecdd6f58ddc5d81a1064e6277f15", "workflow_loaded_sources": { "src/V2/Support/VersionDecisions.php": "7b57ad40b2514738ccdc377b576d731a16f12d9b55aa628bb5dbb79eac00cdd1", "src/V2/Support/WorkflowExecutor.php": "ece1207630be200271925f5770792f03e6bd55224a2abf7a6be86793fdfddaea", diff --git a/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/embedded/composer.lock b/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/embedded/composer.lock index 8f933a9c1..615440154 100644 --- a/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/embedded/composer.lock +++ b/tests/Fixtures/ServerParityProfiles/repeated-patch-clock/embedded/composer.lock @@ -4781,16 +4781,16 @@ }, { "name": "symfony/mime", - "version": "v7.4.13", + "version": "v7.4.22", "source": { "type": "git", "url": "https://github.com/symfony/mime.git", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770" + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676" }, "dist": { "type": "zip", - "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770", - "reference": "a845722765c4f6b2ce88beaf4f4479975b186770", + "url": "https://api.github.com/repos/symfony/mime/zipball/94a4c017435bc515f5ac80421a2c555fb9ca3676", + "reference": "94a4c017435bc515f5ac80421a2c555fb9ca3676", "shasum": "" }, "require": { @@ -4814,7 +4814,7 @@ "symfony/process": "^6.4|^7.0|^8.0", "symfony/property-access": "^6.4|^7.0|^8.0", "symfony/property-info": "^6.4|^7.0|^8.0", - "symfony/serializer": "^6.4.3|^7.0.3|^8.0" + "symfony/serializer": "^6.4.44|^7.4.17|^8.1.5" }, "type": "library", "autoload": { @@ -4846,7 +4846,7 @@ "mime-type" ], "support": { - "source": "https://github.com/symfony/mime/tree/v7.4.13" + "source": "https://github.com/symfony/mime/tree/v7.4.22" }, "funding": [ { @@ -4866,7 +4866,7 @@ "type": "tidelift" } ], - "time": "2026-05-23T16:22:37+00:00" + "time": "2026-10-28T17:57:58+00:00" }, { "name": "symfony/polyfill-ctype",