[rmcdaniel]

The required standalone lock audit reports six advisories affecting Symfony HTTP and routing dependencies. This lock-only patch updates symfony/http-foundation 7.4.21, symfony/http-kernel 7.4.14 and symfony/routing 7.4.13 to their maintained 7.4.23 fixes.

Exactly three package records change; all other 76 package records, root manifests, SDK 3.9.4 source/dist, PHP 8.3.36 platform, product/release inputs and Core pins remain unchanged. Composer’s optional publication timestamps on five otherwise unchanged packages were omitted to keep this delta confined to the affected family.

Validation: the complete before audit reproduces six advisories; the final exact lock passes strict Composer validation and a fresh complete audit with zero advisories and zero abandoned packages. The existing standalone lock regression tests pass 4/4, and its public SDK source/dist identity contract passes. Lock SHA-256: bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506. Normal CI and independent Security review remain required.

Refs #279. This source fix is separate from saved-view #278, whose original audit failure remains recorded. Source merge alone does not deliver a patched standalone artifact: release, image publication, frozen #275 cohorts, observer, operator-stop and Cloud gates remain separate. General retains merge and delivery decisions.

[rmcdaniel]

Source packet for P1 #279:

• H 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1, base/current main ade2b459d566070af65ab062ed73599542fbd6df, tree 4f97f15414e523d1163b358e1a59de2ea33e9dff.
• One file: standalone/composer.lock, 22 insertions / 19 deletions. Exactly three of 79 package records change: HttpFoundation 7.4.21 → 7.4.23 (7fb73cffa06e2bcc2cb523fcccb1e8174106b206), HttpKernel 7.4.14 → 7.4.23 (94c57f4c5c45a311d244a0aeadb72b14ee41d25d), Routing 7.4.13 → 7.4.23 (0000ade604b7bc798cb1e75edf6f17df48185f73). Each source/dist reference agrees. All other 76 records and all top-level lock metadata are unchanged.
• Complete audit before the update: six advisories in those three packages, reproducing the owning failure. Final exact-byte audit: zero advisories and abandoned packages. Strict validation uses Composer’s documented --no-check-all for the intentional exact SDK requirement; the security audit remains complete and unsuppressed. PHP CLI 8.4.27 / Composer 2.11.1 respects the unchanged PHP 8.3.36 lock platform.
• Existing standalone contract tests pass 4/4. The public SDK identity validator passes unchanged SDK 3.9.4 at 11085f0c624674a4b70d3a6fb3e83eaff3869fcb, with matching source/dist. Final lock SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506; complete final audit JSON SHA-256 0046e84f375c11ed2bdc90e758acd0530b66a6905121613e20e9fac2525684f2.

The bounded metadata-only runners exited and were removed; no package installation, local image build or runtime workload occurred. Five unrelated optional published-time additions emitted by Composer were omitted before final exact-byte validation/audit. Normal CI and independent Security disposition remain pending.

The standalone lock at frozen release source 275bd593 is byte-identical to the affected main-Q baseline; this source fact is provided for Security’s separately assigned artifact/deployed inventory assessment. It does not establish exploitability or a deployment result. No old P=M clearance transfers to this source. General retains merge and delivery; every #275 release, observer, cohort, stopped-task and Cloud gate remains separate. #279 remains open through the delivery decision and acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source checkpoint for exact head 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1, base ade2b459d566070af65ab062ed73599542fbd6df, tree 4f97f154: source scope is correct; final PASS waits for every authoritative exact-head check to become terminal.

Independent canonical comparison of standalone/composer.lock confirms exactly three of 79 package objects change—HttpFoundation, HttpKernel, and Routing—to upstream v7.4.23. All 76 other package objects, the empty packages-dev set, and every top-level lock field are identical. The exact remote lock bytes hash to bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506, matching the owner's final validation receipt.

The three split-package tags independently resolve to the locked references 7fb73cffa06e2bcc2cb523fcccb1e8174106b206, 94c57f4c5c45a311d244a0aeadb72b14ee41d25d, and 0000ade604b7bc798cb1e75edf6f17df48185f73. 7.4.23 is the maintained fixed floor for this November 4 HTTP advisory batch. No ignore, dependency-range change, source/product change, or unrelated package update is present.

Keep frozen #275 and every scan/release/observer/operator-stop gate separate. This checkpoint is source-only and transfers no image, deployed, or publication clearance. Final carry still requires the ordinary Build and Smoke records to be fully terminal on this exact head, with no log-only inference.

[rmcdaniel]

Terminal source qualification at exact H 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1, base ade2b459d566070af65ab062ed73599542fbd6df, tree 4f97f15414e523d1163b358e1a59de2ea33e9dff:

• Authoritative check-run rollup: 35 success, 4 intended skips, 0 failure, 0 nonterminal. All seven associated workflow runs are completed/success. Build and complete database/Laravel qualification, service image smoke, release contracts including fresh locked audit.
• Intended skips: responsive workflow-list dialogs, responsive run detail, candidate cancellation inspection source (unchanged source scope), and the separately dispatched published-image qualification job (not invoked).
• Fresh PR readback remains draft, mergeable/CLEAN, exactly one changed file, and the same head/base. Open PR-ref code-scanning alerts are empty. Root manifests, all unrelated 76 lock records, SDK/Core pins and release/provenance/scan/tuple inputs are unchanged from Q.

The exact-lock local audit/source packet remains 6640698760. Independent Security disposition and General’s source-merge decision remain pending. CI source-image checks do not constitute publication or acceptance of a patched released artifact; no registry, tag, Release, observer, cohort, stopped-task or Cloud gate is cleared.

[rmcdaniel]

Security final source PASS for exact head 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1, base ade2b459d566070af65ab062ed73599542fbd6df, tree 4f97f15414e523d1163b358e1a59de2ea33e9dff.

The independently reviewed delta remains one file, standalone/composer.lock. Exactly three of 79 package objects change: HttpFoundation, HttpKernel, and Routing move to the maintained fixed v7.4.23 split-package references. The other 76 package objects, empty packages-dev, top-level lock fields, root constraints, and product/source inputs are unchanged. The exact final lock bytes remain SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506.

Fresh authoritative readback on this exact head is terminal: 39 check runs comprise 35 successes and four intended skips, with zero failures and zero nonterminal records. The PR remains draft, mergeable/CLEAN, and bound to the reviewed head/base. Open code-scanning alerts for refs/pull/280/head are empty. The owner’s terminal packet is 6640897455; the prior independent source checkpoint is 6640857481.

This clears the exact #280 dependency source correction for General’s normal merge decision. It does not transfer clearance to frozen #275 or to any image, scan, registry, Release, cohort, observer, stopped-task, Cloud, deployed, or publication gate. Those remain separate and unchanged.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge b535db5a780b25d125fa10361a578c8eaf8b788a has ordered parents ade2b459d566070af65ab062ed73599542fbd6df and 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1, with tree 4f97f15414e523d1163b358e1a59de2ea33e9dff exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #280 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Ordinary merged-main source acceptance is complete.

Actual main b535db5a780b25d125fa10361a578c8eaf8b788a has ordered parents ade2b459d566070af65ab062ed73599542fbd6df and reviewed head 1bc13c7c41f8c57d0ee3a0d87034cfce212d0bb1. Tree 4f97f15414e523d1163b358e1a59de2ea33e9dff exactly equals the Security-reviewed tree; there is no tree delta from H. The committed standalone lock retains SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506, with exactly the three fixed Symfony 7.4.23 records and the other 76 records unchanged.

Fresh exact-main checks are fully terminal: 33 success / 4 intended skips / 0 failure / 0 nonterminal. All six associated workflows are completed/success, including main build and main service-image smoke. These are ordinary source checks, not publication or acceptance of a new released image.

The task worktree is clean at actual main. The merged security/symfony-20261104 branch was deleted locally and remotely only after verifying its exact remote head H, H ancestry in actual main, and that no worktree still needed that branch. Remote absence was independently checked; H remains reachable through the accepted merge. The separate active #278 branch was preserved.

The immutable 2.15.0 annotated object remains 0ac99f5b732e03aa20ca1688ee8f7a9e8bc9fb60; no tag or alias was written. #279 remains open through shipped-image remediation. The requested 2.15.1 packet is preparation only: no new release build, scan, workflow dispatch, registry/Release, observer, cohort substitution or stopped task follows from this source acceptance.