Problem
composer audit --locked --no-interaction reports three high-severity advisories in repository development tools:
The findings were discovered while running the required security gate for #156. They are unrelated to the service-assertion implementation and should not be hidden inside that feature PR.
Acceptance criteria
- Update the affected development dependencies to patched versions compatible with PHP 8.3.
- Regenerate
composer.lock through Composer rather than hand-editing it.
composer audit --locked --no-interaction passes with no advisories.- Full tests and PHPCS run with the updated tools.
- Do not hand-edit version targets or
docs/CHANGELOG.md; release automation owns them.
Problem
composer audit --locked --no-interactionreports three high-severity advisories in repository development tools:phpunit/phpunitbelow9.6.33: CVE-2026-24765 / GHSA-vvj3-c3rp-c85psquizlabs/php_codesnifferbelow3.13.6: CVE-2026-67434 / GHSA-hmqg-cxww-wqhqwp-coding-standards/wpcsbelow3.4.1: CVE-2026-45293 / GHSA-3pwp-g2mj-5p3vThe findings were discovered while running the required security gate for #156. They are unrelated to the service-assertion implementation and should not be hidden inside that feature PR.
Acceptance criteria
composer.lockthrough Composer rather than hand-editing it.composer audit --locked --no-interactionpasses with no advisories.docs/CHANGELOG.md; release automation owns them.