[fabeat]

The lock holds symfony/yaml v8.1.9, and an advisory published today covers it:

Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document
Hold a Process — GHSA-hwfg-qwvh-2wfx, PKSA-nktx-f1n1-b4yd

The affected versions are >=8.1.0,<8.1.11, so v8.1.11 is the one the advisory stops
at, and it is the newest version on the line the lock is on.

The second change in the lock is the directives package's path reference, which moves
from ffcda3d to 1044638 — the merge commit of the 0.3.1 release. The lock recorded
the release branch's commit; the pipeline checks out main, so the lock now says what
the pipeline installs.

The phpunit advisory is left alone. phpunit/phpunit v13.4.3 is covered by
CVE-2026-119193, which v13.4.4 fixes — but pest v5.3.3 conflicts with phpunit 13.4.4,
so the fix drags a test framework upgrade into a lock file. That advisory is from the
27th of October, it affects the development dependencies only, and it is not what this
change is about.

The site builds, the suite passes (126 tests), and every address on every page still
resolves.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud