[renovate]

This PR contains the following updates:

Package	Update	Change
docker.io/mongo (source)	patch	9.0.4 → 9.0.8

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[artidezi-etke-cc]

Approved: no adaptation is required under the configured project policy.

Approve unchanged: the PR only updates compose.yml from MongoDB 9.0.4 to 9.0.8, bringing upstream security and reliability fixes. It integrates cleanly with the recorded target and its existing same-series deployment handling. Composer validation, dependency installation, PHP image build and isolated database CRUD checks passed; supplied PHP/frontend CI is green. Existing-data upgrade and production workload behavior were not rehearsed. Remaining debt: no new deprecations or required migrations identified in this patch update.

Agent-assessed risk: Low. Same-series database patch with successful actual-driver smoke coverage, though existing-data upgrades and production workloads were not exercised.

Evidence (8 items)

• Local check: git diff f7548faf68641fb0adc7ef0bab1e5b7f8b573076...refs/artidezi/inputs/source-pr; git merge-base f7548faf68641fb0adc7ef0bab1e5b7f8b573076 refs/artidezi/inputs/source-pr; git diff --stat refs/artidezi/inputs/source-pr...HEAD — Merge base equals recorded target f7548fa. The sole PR hunk changes the MongoDB image 9.0.4 to 9.0.8; there are no target-only changes to preserve.
• Release notes: source — 9.0.7 contains security, authorization, memory-safety and reliability fixes; 9.0.8 fixes cross-compiled archive directory naming. No additional patch-level deprecation or required application migration is listed. Repository search found no uses of the deprecated BSON validation flags or relevant changed internal command options.
• Documentation: source — Library 2.5 requires extension 2.5 or later. Target locks library 2.5.1 and builds driver 2.5.7, satisfying the requirement; actual runtime versions were also verified in the smoke test.
• Evidence: bin/deploy/run.sh and app/src/Devture/Component/DBAL/Repository/BaseMongoRepository.php — Deployment identifies image major.minor: 9.0.4 and 9.0.8 both resolve to 9.0, using existing files rather than the major/minor dump-and-restore path. Repository CRUD APIs informed the smoke fixture. No deployment scripts, live configuration or live database were executed/read.
• Local check: docker pull docker.io/mongo:9.0.8; docker run --rm --network none --entrypoint mongod mongo:9.0.8 --version — Passed on linux/amd64. Downloaded digest sha256:1444adda2e4b8d6a0d7f242a625d834a78d6e3aa6e4ed1b0b4c2dab2318c5e3d; binary reports 9.0.8. Temporary isolated server returned ping ok and FCV 9.0; bundled mongodump reports 100.20.1. Other architectures were not run.
• Local check: mkdir -p var/composer-cache && ./bin/composer validate --strict; ./bin/composer install --no-interaction --prefer-dist; docker build --iidfile /tmp/artidezi-php-image.id etc/docker/php — All passed from the unchanged checkout. Composer reports composer.json valid. PHP image successfully built using the repository Dockerfile, rather than relying on Composer platform metadata.
• Local check: docker run -d --rm --name artidezi-tsk-01m76vk5-mongo --network none --tmpfs /data/db --tmpfs /data/configdb mongo:9.0.8 --bind_ip 127.0.0.1; docker run --rm --network container:artidezi-tsk-01m76vk5-mongo --user "$(id -u):$(id -g)" --mount "type=bind,src=$PWD,dst=/code,readonly" --mount type=bind,src=/tmp/artidezi-mongo-smoke.php,dst=/smoke.php,readonly --entrypoint php85 "$(cat /tmp/artidezi-php-image.id)" /smoke.php — Passed with MongoDB 9.0.8, PHP 8.5.12, ext-mongodb 2.5.7 and mongodb/mongodb 2.5.1. Ad hoc fixture loaded the locked vendor autoloader and checked unique-index creation, BSON ObjectId, insertOne, findOne, replaceOne/upsert, sorted/limited find, countDocuments and deleteOne; threw on unexpected results and dropped its fixture database. Server used temporary RAM-backed storage, no host ports or external network, and was stopped/removed afterward. This exercises basic library APIs, not full Symfony repositories, production data, dump/restore or an existing-volume upgrade.
• Evidence: Supplied source-head CI snapshot for 15b96c831c67dda9009ee1b0b1b58d1599e9befa — php and frontend check runs completed successfully. Full PHPStan/style/Twig and frontend lint/type/build suites were not rerun to duplicate supplied CI; focused local validation covered the changed database runtime instead. Forge state must still be refreshed by the controller.

Assessed source 15b96c831c67dda9009ee1b0b1b58d1599e9befa.