[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/composer (source)	patch	2.11.1 → 2.11.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve the Composer Docker image update from 2.11.1 to 2.11.2 unchanged. The PR contains only the helper image tag change and is based directly on the recorded target; upstream security fixes require no repository adaptation. Candidate-image strict validation and locked installation passed, and the supplied PHP/frontend CI snapshot is successful; those suites were not rerun locally. Remaining debt: installation reports the existing transitive vonage/nexmo-bridge package as abandoned, with no replacement suggested; its retirement date and migration path are not established by this assessment. No deprecation or removal is introduced by this update.

Agent-assessed risk: Low. A single build-tool patch update fixes security issues and passes the existing helper’s validation and install paths without tracked changes.

Evidence (7 items)

• Local check: git merge-base a7e473a996917fea5b82213b5e9bcf3cdea82dcf refs/artidezi/inputs/source-pr; git diff a7e473a996917fea5b82213b5e9bcf3cdea82dcf...refs/artidezi/inputs/source-pr — Merge base equals the recorded target. The only change is bin/composer image 2.11.1 -> 2.11.2; no newer-target integration differences exist. git diff --check passed.
• Release notes: source — Official release fixes command execution through transport options, zip extraction traversal, cross-host credential leakage, bundled symfony/filesystem vulnerability, and redirect header leakage. No deprecation or migration requirement is listed; inspected helper and Composer declarations reveal no affected custom transport/header options.
• Local check: mkdir -p var/composer-cache; sed 's@​docker.io/composer:2.11.1@​docker.io/composer:2.11.2@​' bin/composer | bash -s -- validate --strict — Passed: ./composer.json is valid. Executes the candidate helper in memory without changing the checkout, including its user initialization and cache mounts.
• Local check: sed 's@​docker.io/composer:2.11.1@​docker.io/composer:2.11.2@​' bin/composer | bash -s -- install --no-interaction --prefer-dist — Passed: installed all 92 locked packages and generated autoload files. Existing vonage/nexmo-bridge abandonment warning remains; no unrelated dependency updates made. This checks the Composer image, not the application PHP runtime.
• Local check: docker run --rm --network none --entrypoint composer docker.io/composer:2.11.2 --version — Passed: Composer 2.11.2, PHP 8.5.12. Pulled image digest sha256:5bcb28b8d0edc4091125f8218f9d088f998bdfc843f8fbb9a4beb4dcd8625684.
• Evidence: Supplied source CI snapshot for 561bb9ed111253a13fe3e9bc713ecb2e5fef6565 — php and frontend checks both report success. Relied on these for application analysis, style, lint, type checking and asset build; did not independently rerun those suites or build the unchanged application PHP image.
• Local check: git status --porcelain; git rev-parse HEAD — Working tree clean; HEAD remains a7e473a. No commits or forge actions performed.

Assessed source 561bb9ed111253a13fe3e9bc713ecb2e5fef6565.