Review Drupal 12 and 11.x composer dependencies for allowed versions with CVEs

These changes make sense to me. Increasing our minor version requirements for both Composer and Guzzle with the minor/major release ensures we're less likely to run into regressions from security updates with those, and increasing miscellaneous patch minima is also sensible.

One small suggestion on both MRs; while we want to increase minimum constraints as allowed by release policies, we probably shouldn't actually declare a conflict with that SF polyfill library unless Drupal really doesn't work with it on those versions. Changing that of course also requires regenerating the lockfile. 🙂

I tested this by applying the patch and running the following steps:

$ composer install
$ composer update --prefer-lowest --no-security-blocking
$ composer audit

On main this reports four problems in three dependencies, but these are all transient dependencies so nothing we can solve directly (unless we explicity turn them into actual dependencies):

 composer audit
Found 4 security vulnerability advisories affecting 3 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | google/protobuf                                                                  |
| Severity          | high                                                                             |
| Advisory ID       | PKSA-tcfz-w4fm-hhk9                                                              |
| CVE               | CVE-2026-6409                                                                    |
| Title             | Protobuf: Denial of Service issue through malicious messages containing negative |
|                   | varints or deep recursion                                                        |
| URL               | https://github.com/advisories/GHSA-p2gh-cfq4-4wjc                                |
| Affected versions | <4.33.6                                                                          |
| Reported at       | 2026-03-25T21:02:08+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | google/protobuf                                                                  |
| Severity          | high                                                                             |
| Advisory ID       | PKSA-yqjh-6qvh-g493                                                              |
| CVE               | CVE-2015-5237                                                                    |
| Title             | protobuf susceptible to buffer overflow                                          |
| URL               | https://github.com/advisories/GHSA-jwvw-v7c5-m82h                                |
| Affected versions | <3.4.0                                                                           |
| Reported at       | 2022-05-13T01:06:54+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | squizlabs/php_codesniffer                                                        |
| Severity          | high                                                                             |
| Advisory ID       | PKSA-rdkp-vv9z-mjkg                                                              |
| CVE               | CVE-2026-67434                                                                   |
| Title             | OS Command injection                                                             |
| URL               | https://github.com/PHPCSStandards/PHP_CodeSniffer/security/advisories/GHSA-hmqg- |
|                   | cxww-wqhq                                                                        |
| Affected versions | <3.13.6|>=4.0.0,<4.0.2                                                           |
| Reported at       | 2026-08-05T23:53:11+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/polyfill-intl-idn                                                        |
| Severity          | low                                                                              |
| Advisory ID       | PKSA-dwsq-ppd2-mb1x                                                              |
| CVE               | CVE-2026-46644                                                                   |
| Title             | CVE-2026-46644: symfony/polyfill-intl-idn accepts xn-- labels whose Punycode     |
|                   | payload decodes to ASCII-only: insecure equivalence                              |
| URL               | https://symfony.com/cve-2026-46644                                               |
| Affected versions | >=1.17.1,<1.38.1                                                                 |
| Reported at       | 2026-05-26T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

On 11.x I get a similar result without symfony/polyfill-intl-idn.

Therefore I think this is the correct thing to do and marking RTBC.

Committed to main. I ran composer update --lock to verify that the lockfile was correct. I then cherry-picked it to 12.0.x and did a composer update drupal/core to also verify that that the same hash applied to 12.0.x.

Repeated the same for 11.x.

Thanks everyone!

I meant to set this PTBP for lockfile updates on earlier branches, but forgot. (No constraint increases on the stable branches.)

@xjm if we are only doing lockfile updates on 11.5.x then that usually happens in a specific issue where we update all dependencies for each minor? I opened #3627487: Update PHP dependencies for 11.5.0 to track this as we haven't done it yet.

I'm fine with a separate issue, and that makes sense for 11.5 if we didn't do it yet. But it's the specific CVE above that we wanted to fix in the stable branches' lockfiles.