Refresh parity fixture locks for Symfony Mime CVE-2026-45070

scripts/conformance/server-parity/README.md

@@ -43,6 +43,8 @@ This embedded component observation makes no service SDK clock-helper claim.
 Server #820 refreshed only `symfony/http-foundation` to 7.4.21 in this lock and
 both `legacy-marker-aliases` role locks (GHSA-r925-mgvr-h9cc); Workflow
 packages and loaded-source hashes are unchanged.
+Server #325 later refreshed only `symfony/mime` to 7.4.22 in the same three
+locks (CVE-2026-45070), on the same terms.
 Run `bash scripts/conformance/server-parity/repeated-patch-profile.sh BACKEND
 PHP_URL NATIVE_URL` after the ordinary targets and adapter are prepared, with
 the same `RESOURCE_SCOPE` and database-image variables as the owning CI job.

scripts/conformance/server-parity/corrected-markers/README.md

@@ -66,7 +66,9 @@ in that complete Composer lock. The earlier 2.5.14 manifest, locks and failed
 policy recording remain unchanged apart from Server #820's bounded security
 refresh, which moved only `symfony/http-foundation` and `symfony/yaml` to
 7.4.21 in all three role locks (GHSA-r925-mgvr-h9cc, GHSA-2v3c-qxhr-7vpv) and
-kept every Workflow package and loaded-source hash; the published Server
+kept every Workflow package and loaded-source hash. A later Server #325
+refresh moved only `symfony/mime` to 7.4.22 in the same locks
+(CVE-2026-45070), on the same terms. The published Server
 reference still carries its own declared 2.5.14 package. Set `DW_PARITY_CORRECTED_ARTIFACTS` to the new
 manifest for this explicit embedded cohort, with separate
 `DW_PARITY_CORRECTED_STATE`, `DW_PARITY_CORRECTED_EVIDENCE` and

tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts-workflow-2.5.16.json

@@ -21,7 +21,7 @@
   },
   "workflow": "2.5.16",
   "workflow_source_commit": "c677f374df788afa5c4d6df2b5cf0722f03a99d6",
-  "embedded_composer_lock_sha256": "957bf6e7d5b5acd0baaac88258b61ec1a8def8927d5fbd04632cb593772b3fd7",
+  "embedded_composer_lock_sha256": "f0be5009470cc9a02c861a2b8b1b731b5612f5acd9f4ffbda2212a3ec79375db",
   "workflow_loaded_sources": {
     "src/V2/Support/VersionDecisions.php": "ffb22f79ffc08eceb2ffd7b96ecb2ad91c931f9fb5fac8bc4bdde75a57eff5e1",
     "src/V2/Support/WorkflowExecutor.php": "85dd889ccaa5d973542a5b194e32bc043d1083248d2f4b9dff80b87ea77678d1",
@@ -31,7 +31,7 @@
   "embedded_original": {
     "version": "2.5.6",
     "source_commit": "29c94c14d9d413509b26ff761b997533c021fcfe",
-    "composer_lock_sha256": "88fd7506efe2fe488304fa6c69e5e8f0816def2cc09b59470008631127a6aba3",
+    "composer_lock_sha256": "6ddfe31bef1fa1256f3b43786388511fc6a014458ce66f233dc3b1a6eeb1d513",
     "shutdown": "normal_cli_exit",
     "loaded_sources": {
       "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c",

tests/Fixtures/ServerParityProfiles/corrected-markers/artifacts.json

@@ -21,7 +21,7 @@
   },
   "workflow": "2.5.14",
   "workflow_source_commit": "563675723522b2d453f950f593ab91473e91c831",
-  "embedded_composer_lock_sha256": "d5c28b544d410193a47502ae5d93db3c6ed19b657f289bfd5a09de1738d9d747",
+  "embedded_composer_lock_sha256": "148031c70da0a5917823c2fa634918841e328b76ef09fb0874cba584a8b7591f",
   "workflow_loaded_sources": {
     "src/V2/Support/VersionDecisions.php": "ffb22f79ffc08eceb2ffd7b96ecb2ad91c931f9fb5fac8bc4bdde75a57eff5e1",
     "src/V2/Support/WorkflowExecutor.php": "9b85a1daf80fbe63d4f0ec3e23513c213e4971379f9a280495c0df6dc9655062",
@@ -31,7 +31,7 @@
   "embedded_original": {
     "version": "2.5.6",
     "source_commit": "29c94c14d9d413509b26ff761b997533c021fcfe",
-    "composer_lock_sha256": "88fd7506efe2fe488304fa6c69e5e8f0816def2cc09b59470008631127a6aba3",
+    "composer_lock_sha256": "6ddfe31bef1fa1256f3b43786388511fc6a014458ce66f233dc3b1a6eeb1d513",
     "shutdown": "normal_cli_exit",
     "loaded_sources": {
       "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c",

tests/Fixtures/ServerParityProfiles/legacy-marker-aliases/artifacts.json

@@ -12,7 +12,7 @@
   },
   "workflow": "2.5.7",
   "workflow_source_commit": "e9a767b08c426234c25d2969adcb09473e7af56e",
-  "embedded_composer_lock_sha256": "a9e668b54fdbfb71abc19228da05c3ca4d091cdbdb3856e0394093db81c030a0",
+  "embedded_composer_lock_sha256": "7bafdb8ea2ba56870db6979bd858c3b1e52eecdd6f58ddc5d81a1064e6277f15",
   "workflow_loaded_sources": {
     "src/V2/Support/VersionDecisions.php": "7b57ad40b2514738ccdc377b576d731a16f12d9b55aa628bb5dbb79eac00cdd1",
     "src/V2/Support/WorkflowExecutor.php": "ece1207630be200271925f5770792f03e6bd55224a2abf7a6be86793fdfddaea",
@@ -43,7 +43,7 @@
   "embedded_original": {
     "version": "2.5.5",
     "source_commit": "26a840f25f487676d4e7eb6d75ba1391931566a5",
-    "composer_lock_sha256": "7d1b529eeeddd1afabec94d72fef3e2aec27f6c63e724a1c6e58497b3b13a1ab",
+    "composer_lock_sha256": "ac9d95807e8e080d176a555a171315aba183fa13e546a51e02b6c2afd478c967",
     "loaded_sources": {
       "src/V2/Support/VersionResolver.php": "e760da9abea6ca74057c84c7e30b841bb4a039fa185ec376b2b3332de16e756c",
       "src/V2/Support/WorkflowExecutor.php": "7616287fcb0fb7445c179939fee1dc91df435c3cff6b4b4b2a614d804f288031",

tests/Fixtures/ServerParityProfiles/repeated-patch-clock/artifacts.json

@@ -12,7 +12,7 @@
   },
   "workflow": "2.5.7",
   "workflow_source_commit": "e9a767b08c426234c25d2969adcb09473e7af56e",
-  "embedded_composer_lock_sha256": "a9e668b54fdbfb71abc19228da05c3ca4d091cdbdb3856e0394093db81c030a0",
+  "embedded_composer_lock_sha256": "7bafdb8ea2ba56870db6979bd858c3b1e52eecdd6f58ddc5d81a1064e6277f15",
   "workflow_loaded_sources": {
     "src/V2/Support/VersionDecisions.php": "7b57ad40b2514738ccdc377b576d731a16f12d9b55aa628bb5dbb79eac00cdd1",
     "src/V2/Support/WorkflowExecutor.php": "ece1207630be200271925f5770792f03e6bd55224a2abf7a6be86793fdfddaea",