[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve PR #69 unchanged. The lock refresh integrates directly with the recorded target and needs no repository compatibility fixes: PHP 8.5 supports the new Laminas requirement, Symfony constraints remain coherent, and browser runtime dependencies are unchanged. Composer validation/install, PHP image build, PHP analysis/style checks, frontend lint/typecheck/build and npm dependency-tree validation passed on an isolated archive of the source head. Remaining debt: the abandoned Nexmo alias bridge is still required transitively by Vonage; application code already uses Vonage names, no shutdown date is published, and removal awaits an SDK release that drops the bridge.

Agent-assessed risk: Low. Compatible lock-only updates passed local checks on the configured runtimes; live database and notification behavior were deliberately not exercised.

Evidence (12 items)

• Local check: git merge-base db89ead693dce286ba13e3a9626c7e7a9a92f3a5 refs/artidezi/inputs/source-pr; git diff --stat db89ead693dce286ba13e3a9626c7e7a9a92f3a5...refs/artidezi/inputs/source-pr — Merge base equals recorded target; source head 00c3c62 changes only app/composer.lock and app/frontend/package-lock.json. No newer target changes need reconciliation. Version/field comparison found Laminas 3.9.0→3.10.0, Symfony patches and contracts 3.8.1, abandoned metadata for unchanged vonage/nexmo-bridge 0.1.2, and npm development/transitive refreshes; no browser runtime version or asset-path changes.
• Release notes: source — Release adds PHP 8.6 compatibility and removes PHP 8.2. Repository requires PHP >=8.4 and actually builds 8.5.12, so removal has no affected supported runtime.
• Release notes: source — Official changelog reports no significant changes; v3.8.1 notes likewise report none. Existing Symfony component constraints remain 8.1.* with compatible contract ranges.
• Release notes: source — Consulted official patch changelog for updated Symfony components; no repository migration identified for the changed lock entries.
• Documentation: source — Archived October 23, 2026; bridge aliases legacy Nexmo names to Vonage. README recommends Vonage names. Search of application/configuration/sample/docs/scripts found no Nexmo uses outside the lock. SmsSender.php and services.yaml already use Vonage. Locked vonage/client-core 4.15.0 requires the bridge directly; no runtime shutdown date or drop-in replacement is stated. Retaining this pre-existing transitive requirement requires no shim or suppression; future SDK removal is the migration path.
• Local check: Isolated git archive of refs/artidezi/inputs/source-pr: mkdir -p var/composer-cache; ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist — Both commands passed. Install emitted the abandoned bridge warning, which was investigated and not suppressed. Validation/install used the repository Composer helper from a clean source archive; main checkout was never changed.
• Local check: docker build --iidfile /tmp/pr69-php-image.id etc/docker/php — Passed. Then ran php runtime/autoload probe in this image with --network none: PHP 8.5.12, ext-mongodb 2.5.7, vendor autoload successful. Unchanged mongodb/mongodb 2.5.1 requires ext-mongodb ^2.5, satisfied by the actual image rather than merely the Composer platform minimum.
• Local check: docker run --rm --network none --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code" --workdir /code/app --entrypoint /bin/sh "$(cat /tmp/pr69-php-image.id)" -ec 'vendor/bin/phpstan analyse -c phpstan.neon && vendor/bin/php-cs-fixer check --config=.php-cs-fixer.dist.php && vendor/bin/twig-cs-fixer lint --config=.twig-cs-fixer.dist.php' — All passed on the source archive: PHPStan 145 files/no errors, PHP CS Fixer 146 files/no fixes, Twig 38 files/no notices/warnings/errors. PHP CS Fixer emitted a nonblocking general warning that runtime 8.5 exceeds declared project minimum 8.4; check mode changed no source. No database or notification integration was run.
• Local check: just js-analyze js-build — Passed in the isolated source archive using repository Docker helpers: npm ci, ESLint, TypeScript --noEmit and asset generation. No generated assets or node_modules committed. No browser interaction check: React loading, Bootstrap, Select2, esbuild and asset paths are unchanged.
• Local check: docker run --rm --network none --entrypoint /bin/sh localhost/devture-nagadmin/node:latest -c 'node --version && npm ls react react-dom && npm ls --all >/dev/null' — Passed with Node 26.13.0; React and React DOM resolve to 19.3.1, shared/deduplicated. Complete installed dependency tree validates without peer dependency errors.
• Evidence: Supplied source CI snapshot — Source frontend and php checks report success; treated as supporting point-in-time evidence only. Controller must independently refresh forge gates. No forge action performed.
• Local check: git status --porcelain=v1; git rev-parse HEAD — Working tree clean and HEAD remains db89ead. No commits, remotes or tags created.

Assessed source 00c3c6258dee356bbf6addbc8bceed1b6a58e8da.