Update composer dependencies

[turegjorup]

Link to ticket

TODO: no ticket linked yet — please add before review.

Description

composer audit has been failing on develop — 15 advisories across four packages — so this is a plain composer update within the existing constraints. It clears all 15: composer audit --locked now reports none.

The four that carried advisories:

Package	From	To	Fixes
guzzlehttp/guzzle	7.10.6	7.15.5	9 advisories, incl. CVE-2026-69246 (high): noncanonical host bypasses host-based checks
easycorp/easyadmin-bundle	5.0.11	5.5.1	CVE-2026-54087 (high): stored XSS via uploaded files served inline, and a custom-action dispatcher that bypassed access_control
guzzlehttp/psr7	2.10.4	2.13.1	Host confusion via weak URI host validation, CRLF injection in start-line serialization
api-platform/core	4.3.7	4.3.17	Relation IRIs not type-checked, cross-user attribute leak in JSON:API

Guzzle and PSR-7 come in under the OIDC library, so they reach the login path; EasyAdmin is the whole admin UI and is the largest single jump here (5.0.11 → 5.5.1, one minor line to another).

97 lock entries move in total, Symfony 8.1.0 → 8.1.5 across the board among them. composer.json is untouched — nothing needed a constraint change.

Two regenerated files ride along, both consequences rather than choices: public/api-spec-v1.yaml, because symfony/yaml now writes sequence items on their own line (the JSON spec is byte-identical, so no API change), and config/reference.php, which Symfony rewrites on cache:clear.

Screenshot of the result

No user interface changes of our own. EasyAdmin's own 5.5 changes are visible in the admin UI, so it is worth a click through the CRUD screens on staging.

Checklist

• My code is covered by test cases.
• My code passes our test (all our tests).
• My code passes our static analysis suite.
• My code passes our continuous integration process.

No new tests: this changes dependencies only, and the existing suite (45 tests, including the admin smoke test) is what verifies it. PHPUnit, PHPStan, PHP-CS-Fixer, twig-cs-fixer, markdownlint and Prettier all pass locally.

Additional comments or questions

The EasyAdmin jump is the one to look at twice. The advisory forces at least 5.5.1 — CVE-2026-54087 is fixed in 5.0.13, but the access-control bypass is only fixed in 5.5.1 — so staying on the 5.0 line was not an option. AdminSmokeTest passes and PHPStan is clean, neither of which proves the admin UI still looks right.

This also carries itk-dev/openid-connect-bundle 5.0.0 → 5.1.1, which ^5.0 allows. 5.1 deprecates leaving client_secret_expires_at unset, so develop will log that deprecation until #92 lands and configures it. #92 supersedes this with 6.0.0, and the two will conflict in composer.lock; merging this first and rebasing #92 is the simpler order.

[github-actions]

API Specification - Non-breaking changes

No changelog changes

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.63%. Comparing base (bae8493) to head (9d14251).
⚠️ Report is 14 commits behind head on develop.

Additional details and impacted files

@@              Coverage Diff              @@
##             develop      #93      +/-   ##
=============================================
+ Coverage      37.14%   37.63%   +0.49%     
- Complexity       948      955       +7     
=============================================
  Files            133      135       +2     
  Lines           2972     2997      +25     
=============================================
+ Hits            1104     1128      +24     
- Misses          1868     1869       +1     

Flag	Coverage Δ
unittests	37.63% <ø> (+0.49%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.