fix(deps): require November Symfony security patches

CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 where applicable.
 
+## 1.1.14 — 2026-11-06
+
+- Require the patched Symfony Config, Filesystem, HttpFoundation, HttpKernel, Routing and Yaml components from the 8.1.11 security release.
+- Rebuild the production kernel cache after upgrading so compiled route tables include the fix for CVE-2026-118516.
+
 ## 1.1.13 — 2026-10-24
 
 - Qualify native Symfony 8.2 service shutdown in the WordPress App lifecycle, with final cleanup, error continuation and shutdown-aware autoconfiguration. The native path stays inactive on Symfony 8.1 and Service Contracts 3.7.

composer.json

@@ -17,18 +17,18 @@
         "psr/clock": "^1.0",
         "psr/event-dispatcher": "^1.0",
         "psr/log": "^3.0",
-        "symfony/config": "^8.0",
+        "symfony/config": "^8.1.11",
         "symfony/console": "^8.0",
         "symfony/clock": "^8.0",
         "symfony/dependency-injection": "^8.1.8",
         "symfony/event-dispatcher": "^8.0",
         "symfony/expression-language": "^8.1.9",
-        "symfony/filesystem": "^8.0",
-        "symfony/http-foundation": "^8.1.9",
-        "symfony/http-kernel": "^8.1",
-        "symfony/routing": "^8.1",
+        "symfony/filesystem": "^8.1.11",
+        "symfony/http-foundation": "^8.1.11",
+        "symfony/http-kernel": "^8.1.11",
+        "symfony/routing": "^8.1.11",
         "symfony/service-contracts": "^3.6",
-        "symfony/yaml": "^8.1.6"
+        "symfony/yaml": "^8.1.11"
     },
     "require-dev": {
         "composer/semver": "^3.4",