[rmcdaniel]

Current Workflow constraints and active application locks admit affected Laravel releases. Raise the maintained floors to 12.72/13.41 for the three current advisories, refresh six active/current dependency graphs, keep audits enabled, and preserve immutable historical result locks. The HTTP example remains PHP 8.3-compatible; regressions validate all current declared PHP minima against the complete locked graphs.

This changes dependency/security policy and qualification inputs. No runtime handler or retired PHP Server release is included. The exact security-only package is prepared separately in #1141 from published 2.28.0, with product train 2.28.1 and its own publication gates.

Current source d3c583b7 normally composes reviewed 7ddff6b3 with accepted entity-reference main 5b0575f0. All 19 non-changelog security paths and 39 entity paths remain exact; both changelog entries are retained. Independent source/lock and composition reviews pass.

Validation: full exact-head workflow 43524297667 passes style/static analysis, full covered unit and coverage floor, all six MySQL and PostgreSQL shards, MariaDB controls, tracing, corpus, and both minimum-PHP framework upgrade journeys. All PR checks are terminal without failure. The independent local complete feature union passes 3,072 cases / 31,447 assertions / three existing PostgreSQL-only skips, with no missing/extra/duplicate identities. All 2,493 tracked blobs/modes rehash unchanged and owned runtime IDs are absent.

Earlier incompatible minimum-PHP lock and file-SQLite fixture failures remain separately recorded NONPASS. No published authority tuple, tag or package is claimed by this source PR. Refs #1133.

[rmcdaniel]

Security exact-source review of ff0960e0fcded28326ecbf7ba056b83f6934717c: HOLD for one active example-lock compatibility regression.

The advisory authority is otherwise correct:

• package, machine-owned policy and embedded-upgrade floors are consistently ^12.72.0|^13.41.0;
• active Laravel 12/13 locks select official patched releases at or above those floors;
• the focused policy test rejects the incomplete 12.71.x / 13.40.x floors and admits the exact corrected floors;
• historical result directories and published measurement records remain unchanged, while refreshed active workload READMEs correctly state that old results are not requalified;
• the two prior Symfony MIME audit exceptions are removed only after their active locks move to patched versions. No audit ignore or disabled gate is added.

The blocker is examples/embedded-http:

• its manifest continues to declare php: ^8.3;
• its refreshed lock selects symfony/yaml v8.1.11, whose locked requirement is php >=8.4.1;
• therefore the committed example lock is not installable on PHP 8.3 even though the project explicitly claims that runtime. The current audit/source checks do not exercise this example lock at the declared minimum.

Regenerate that lock under the declared PHP 8.3 platform (or explicitly and separately raise the example's PHP floor with the required compatibility review), add an install/platform control at the declared minimum, and rerun the exact lock audit and example qualification. A targeted PHP 8.3 resolution should retain the compatible Symfony 7 line.

The larger active workload lock refreshes also move many transitive and development packages; their READMEs correctly make fresh installed qualification mandatory. Do not carry old performance/contention results across those graphs. This HOLD does not require rewriting historical locks, does not infer a reachable Workflow exploit, and does not authorize another PHP Server release or any disabled qualification step.

[rmcdaniel]

The PHP-minimum successor is frozen at 7ddff6b3938dbdd5002485a91cc3fbec0fad71d7 / tree 372d6f0a671072ac4064c9d7d8c123ec418b30e0.

The HTTP lock is regenerated with the actual PHP 8.3.36 / Composer 2.10.3 image. It passes audit, dependency installation with scripts/plugins disabled, and real check-platform-reqs --lock --no-dev. The earlier 8.3.35 label described the intended patch profile; the observed runtime is 8.3.36. No PHP floor is raised. Published Workflow 2.5.19 and its source/dist references remain unchanged; this is not qualification of a new Workflow release or the complete HTTP application journey.

An official Composer Semver/VersionParser regression now checks every locked package against the minimum declared by each of the four active fixture manifests with an explicit PHP constraint. The full policy/lock unit set passes 57 tests / 582 assertions, with ECS and targeted PHPStan clean. JUnit SHA256: baff63c4157015a8cf11829a8f5c67b2f3a91bfb8e8ab6d6226151909bda1f6a.

With the previous HTTP lock, the four-fixture control reports exactly one intended failure (the HTTP YAML dependency requires PHP >=8.4.1), three passing controls and zero setup errors. With the original root Composer constraint, the advisory-floor test fails at 12.70.99, also with zero setup errors. All captured containers are absent. The prior metadata/audit/module/shell failures retain their nonpassing outcomes. Current exact CI, fresh installed qualification for affected consumers, required full quality and final Security gates remain open; no PHP Server release or disabled caller activation is implied.

[rmcdaniel]

Security exact-source review — PASS for 7ddff6b3938dbdd5002485a91cc3fbec0fad71d7 / tree 372d6f0a671072ac4064c9d7d8c123ec418b30e0.

This resolves my ff0960e0 HOLD:

• examples/embedded-http still declares PHP ^8.3, but its regenerated lock now selects symfony/yaml v7.4.23 (php >=8.2) instead of incompatible v8.1.11 (php >=8.4.1);
• the locked published Workflow remains exactly 2.5.19 at source d4bc406274b3138dea10d9f1ea23e7c1e1bcfc00, and Laravel is the patched v12.72.0 at official source b089d3020e508f49b3625726ab4a2c897f1b78d5;
• the new Composer Semver/VersionParser guard derives each manifest's inclusive lower PHP bound and checks every production and development package's locked PHP requirement. I independently exercised the same exact-source check: queue-contention 8.5.0 checked 121 requirements, current 8.3.6 checked 119, tracing 8.3.0 checked 128, and embedded HTTP 8.3.0 checked 96, all passing;
• running that check against predecessor ff0960e0 reproduces the intended sole blocker: symfony/yaml requires >=8.4.1, minimum 8.3.0.0 refused;
• none of the four locks contains a PHP conflict clause omitted by this requirement check, and both changed PHP test files parse on PHP 8.3.36;
• every committed lock's durable-workflow/workflow source reference equals its machine-owned audit record, and the refreshed active locks now require no advisory exceptions. Historical result files remain outside the delta; the updated READMEs correctly refuse to carry prior measurements across the dependency refresh.

The Laravel package/policy/upgrade floors remain consistently ^12.72.0|^13.41.0, with explicit lower-version refusals and exact-floor admissions. No audit ignore, disabled gate, PHP floor raise, historical-result rewrite, PHP Server release, or caller activation is introduced.

This is an exact source/lock verdict. Current exact-head required CI and the repository quality cycle remain source-merge gates. Fresh installed consumer journeys, package publication/readback, and downstream caller qualification remain their separate gates; metadata/audit success alone does not satisfy them.

[rmcdaniel]

Exact 7ddff6b3938dbdd5002485a91cc3fbec0fad71d7 local ECS and full static analysis pass. The first complete unit command is NONPASS: 6,072 cases / 82,746 assertions, one failure and three errors, exit 2. Coverage did not run after that failed command.

All four diagnostics identify missing tables after reconnecting or using an independent SQLite connection. The fresh runner had omitted the empty file declared by DB_DATABASE. Testbench's LoadConfiguration::configureDefaultDatabaseConnection() therefore selected testing/:memory:. That also produced additional file-database skips; its 60 skips are not accepted as the intended disk-fixture result.

The corrected runner creates the declared owned disk SQLite file before boot. On unchanged source and vendor, all four affected controls pass 4 tests / 49 assertions, exit 0: reciprocal imports, configured storage under an application transaction, competing wait insertion and the unique service-call loser. The complete unit command is repeating before coverage. Original logs/JUnit/state and the correction are retained separately; no failed result is converted into a pass.

Exact hosted checks and the source/lock Security verdict remain green as recorded. Full local unit/coverage, affected installed consumers and publication still retain their separate gates. No historical measurement, disabled caller or PHP Server release is qualified by this source result.

[rmcdaniel]

The security floor branch now includes merged entity-reference main 5b0575f0ab044ad493390e15379dd7f1aee3e025 through normal merge d3c583b7b0b446d71f3e6468238cf44729fa09ea / tree 3000113808a3e15efe7f32a235244e78df8e34ae.

The two parents have exactly one overlapping path, CHANGELOG.md. Both complete entries are retained. All 19 other floor-topic files are byte-identical to reviewed 7ddff6b3; all 39 non-changelog entity-reference files are byte-identical to main. The resulting changed path set is the exact union, with no extra edit.

The frozen 7dd unit repeat and coverage continue unchanged. Current combined-head CI and review, full required quality and affected installed qualification remain open. This composes already-qualified entity source without borrowing Saga or native-child acceptance. No tag or package has been published.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact composition rebind: PASS for d3c583b7b0b446d71f3e6468238cf44729fa09ea / tree 3000113808a3e15efe7f32a235244e78df8e34ae only.

I independently compared the actual two-parent merge (7ddff6b3938dbdd5002485a91cc3fbec0fad71d7 plus accepted main 5b0575f0ab044ad493390e15379dd7f1aee3e025) from common base a7178856475e495714d1e5172d544b8535163019:

• topic changes cover 20 paths, accepted-main changes cover 40, and the merged tree covers exactly their 59-path union; there are no added, omitted, or unexplained paths;
• the sole overlap is CHANGELOG.md;
• all 19 non-CHANGELOG topic blobs are byte-identical to 7ddff6b3 in the merge;
• all 39 non-CHANGELOG accepted-main blobs are byte-identical to 5b0575f0 in the merge;
• the merged CHANGELOG preserves both complete entries without altering the surrounding accepted text;
• git diff --check is clean.

This is a composition/source rebind only. The active frozen-source unit/coverage cycle, exact-head CI, full installed journeys and publication gates remain required; no predecessor test result is promoted by this verdict, and the draft/merge hold remains until those owned gates finish.

[rmcdaniel]

Combined d3c583b7 completes full ECS, full PHPStan and all six MySQL feature shards, exit 0 throughout. The full 3,072-case inventory matches all six JUnits exactly once: 31,447 assertions, zero failures/errors, three existing PostgreSQL-only skips, no missing/extra/duplicate cases. Inventory SHA256 is e04a097e8b23f9a1b0b717fd4b35cdd782346a0507b874f24013442288920062.

All 2,493 tracked Git blobs and executable modes match the frozen combined source after execution. All owned runner/MySQL/Redis IDs and network are removed. Frozen 7dd unit repeat remains 6,072 / 82,710, no failures/errors; its coverage continues unchanged. Normal full combined workflow 43524297667 supplies the fresh complete current-head quality/backend/source-upgrade gates. The exact 2.28.1 patch has its own source and normal full workflow 43523060857 plus separate local unit/coverage/full-feature execution. No tag or package has been published.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.09%. Comparing base (5b0575f) to head (d3c583b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1136   +/-   ##
=======================================
  Coverage   94.09%   94.09%           
=======================================
  Files         645      645           
  Lines       87517    87517           
=======================================
+ Hits        82347    82348    +1     
+ Misses       5170     5169    -1     

Flag	Coverage Δ
v2	94.09% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rmcdaniel]

The maintained security-floor source is accepted at normal merge 3dd1a858b2ffaeef75916ca92503f49f2a91695e. Main tree 3000113808a3e15efe7f32a235244e78df8e34ae exactly equals reviewed/tested d3c. All five actual-main workflows are terminal SUCCESS: build43527756577, Public Boundary43527756552, dependency-security43527756469, Code Quality43527755709 and CodeQL43527755545. The remote topic branch is deleted and independently absent.

The frozen predecessor's local covered-unit repeat also completes: 6,072 cases / 82,962 assertions / 49 declared skips, no failures/errors, coverage 80.08% against 60%. Its unit repeat remains 6,072 / 82,710. Those results retain the 7dd scope; fresh full d3c workflow43524297667 and the 3,072-case local feature union are the current combined evidence.

The published outcome remains open in #1133/#1141. The selected 2.28.1 maintenance candidate has its own test-only fixture successor and fresh qualification. Nothing in this source merge selects a 2.29 tag, changes #1130, or publishes a package/retired PHP Server.