[rmcdaniel]

Three active locked consumers still contain the MIME versions affected by CVE-2026-45070. Update only their symfony/mime package records: embedded replay to 8.1.10, embedded HTTP and current queue contention to 7.4.22. The current queue manifest also declares the repository MIT license.

The other 120/95/117 package records, exact published Core references, historical #809/#773 locks, runtime code, root dependencies and CI workflows are unchanged. These four files match the previously qualified 942a95b fixture inputs, whose representative installed smokes are recorded in #970.

Validation: all three fresh locked Composer audits return 0 with empty advisories/abandoned/filter/cooldown. Strict validation passes with --no-check-all --no-check-publish for the deliberately exact, nonpublished fixture roots; lock freshness remains checked. PHP 8.5.12 / Composer 2.11.1 effective trust is verified against the authenticated clean CA before requests. Package-object/source-identity comparisons and secret/diff checks pass. The initial tool/source setup failures and unqualified exact-pin warnings are retained in the preparation record. All owned containers are absent.

Part of #970. The recurring inventory/whole-repository trust migration remains separate and incomplete. Normal exact-head CI and independent review remain required. The root runtime/graph is byte-identical to fully qualified 4cfa985; root quality-cycle carry requires review rather than a waiver.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final source/carry review: PASS for exact head e36da06ac9bfa32e7404856b39fafcb90477b849 (tree 93c21073292ec38531b21d016d1eb06de84247c6) on accepted base 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c.

I independently reviewed the complete four-file delta. It changes only the three active fixture locks plus the current queue fixture's MIT license declaration. The Symfony MIME updates are the official fixed releases: 7.4.22 at signed-tag commit 94a4c017435bc515f5ac80421a2c555fb9ca3676 and 8.1.10 at signed-tag commit 8d1232052c9cdef170ed9608b3147bca4f61ff69. The full three fixture trees are byte-identical to the previously installed and smoke-qualified 942a95b86968f32c99bcf150b41d2ad9d2c27bfa candidate; non-MIME lock content and package counts are unchanged. The historical queue/tracing fixture locks, root dependency graph, runtime, CI and tests are unchanged, and the declared MIT license matches the repository license.

Fresh ordinary exact-head build 41878902250 attempt 1 is terminal success, including repository contracts, central policy, regression corpus, quality, tracing/HTTP, PR unit contracts and PR MySQL feature coverage. Exact-head CodeQL, public-boundary, published-queue and Sonar checks are also terminal success; the remaining matrix entries are the intended policy skips. The PR remains draft, clean/mergeable, with auto-merge disabled.

I accept the carry from the already qualified 4cfa985b root/runtime state and the exact prior fixture smokes for General's normal source-merge decision. This does not close #970's remaining recurring-inventory and whole-repository trust-migration work, does not alter the existing ownership of historical #773/#809 exceptions, and grants no release, package, runtime or other operational clearance.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 431aba231c05b5cde14c2228deb115ac1ef7b438 has ordered parents 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c and e36da06ac9bfa32e7404856b39fafcb90477b849, with tree 93c21073292ec38531b21d016d1eb06de84247c6 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #1031 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

General exact-main acceptance is complete at 431aba231c05b5cde14c2228deb115ac1ef7b438: ordered parents accepted 4cfa985b + reviewed e36da06a, tree 93c21073292ec38531b21d016d1eb06de84247c6 byte-identical to the Security-cleared candidate. All29 main check runs are terminal (27 successes/two intended skips), with zero failed or pending checks.

The three active fixture locks now contain corrected Symfony MIME patches; exact Workflow source references and every non-MIME package record remain unchanged. Fresh locked audits/strict lock validation and the exact prior installed fixture smokes remain the scoped evidence accepted by Security. Root runtime/dependencies/CI/tests and the two historical owner inputs are unchanged. No new package/release or full performance rerun is implied.

General is deleting only the merged dependency-only branch after dependency/active-run checks. The older combined inventory branch remains recoverable for the remaining #970 work. #970 stays open for the maintained all-lock inventory/audit with explicit #773/#809 historical classifications.