[cakmoel]

Summary

Applies the dependency updates requested by the four open Dependabot PRs in a single, current lock refresh generated from main (532e9152):

Package	From	To	Dependabot PR
phpstan/phpstan	2.2.13	2.3.5	#147
vlucas/phpdotenv	5.7.0	5.8.0	#148
filp/whoops	2.18.4	2.19.3	#149
voku/anti-xss	4.1.44	4.1.46	#150

Also refreshes the transitive symfony/polyfill-iconv (1.37.0 -> 1.43.0).

Why a combined lock refresh

PRs #148, #149 and #150 are based on 80b75e65, before the medoo 2.6.1 and php-cs-fixer 3.95.28 merges. Merging them as-is would downgrade catfan/medoo, friendsofphp/php-cs-fixer, composer/semver, and several Symfony packages. Regenerating the lock from current main avoids those regressions.

This also picks up the newest patches: filp/whoops 2.19.3 (over 2.19.2) and voku/anti-xss 4.1.46 (over 4.1.45, which includes the additional GHSA-28pp-7fjp-8v32 fix).

composer.json constraints already allow every selected version, so only composer.lock changes.

Verification

• composer validate --strict: valid
• composer audit: no advisories (only the 3 pre-existing abandoned packages)
• phpunit --testsuite "Unit Tests": 1375 tests, 3253 assertions, 10 skipped, all passing
• Full suite: 2463 tests / 5348 assertions, with the exact same 33 errors + 14 failures as the pre-update baseline (pre-existing constructor-signature and server-dependent smoke tests; identical test list, not just identical counts)
• Targeted security tests (Sanitization, SecurityRemediation, dotenv/anti-xss): 28 tests, 97 assertions, passing
• composer phpstan (level 1): clean, 491 files

Supersedes #147, #148, #149, #150.