From 0c849ca4e7e88528a2b13f70841b914a71e3ff61 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Thu, 27 Aug 2026 20:18:35 +0930
Subject: [PATCH] fix: unpin symfony/http-foundation to allow patch updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes constraint from exact '7.4.13' to '^7.4.13'. The pin was
introduced for CVE-2026-48736 but is overly restrictive — any 7.4.x
release >= 7.4.13 includes the fix. This allows future security
patches to install via composer update.

Note: Symfony 8.x is blocked by laravel/framework ^12 which requires
symfony/http-foundation ^7.2.0. Symfony 8 support arrives with Laravel 13.
---
 composer.json |  2 +-
 composer.lock | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/composer.json b/composer.json
index 6d7decd47..0d0beb8ff 100644
--- a/composer.json
+++ b/composer.json
@@ -46,7 +46,7 @@
         "spatie/laravel-image-optimizer": "^1.8.2",
         "stevebauman/purify": "^6.2.0",
         "symfony/http-client": "^7.3",
-        "symfony/http-foundation": "7.4.13",
+        "symfony/http-foundation": "^7.4.13",
         "symfony/mailgun-mailer": "^7.3"
     },
     "require-dev": {
diff --git a/composer.lock b/composer.lock
index f19906b45..eb1006751 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "3f9605bcb018445854695b1622c79767",
+    "content-hash": "57ee2f0ee62176740a40de79e05dac80",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -8393,16 +8393,16 @@
         },
         {
             "name": "symfony/http-foundation",
-            "version": "v7.4.13",
+            "version": "v7.4.17",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-foundation.git",
-                "reference": "bc354f47c62301e990b7874fa662326368508e2c"
+                "reference": "2ebe78c083501dfb9509b31a7aedcae4d60a391f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/bc354f47c62301e990b7874fa662326368508e2c",
-                "reference": "bc354f47c62301e990b7874fa662326368508e2c",
+                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/2ebe78c083501dfb9509b31a7aedcae4d60a391f",
+                "reference": "2ebe78c083501dfb9509b31a7aedcae4d60a391f",
                 "shasum": ""
             },
             "require": {
@@ -8451,7 +8451,7 @@
             "description": "Defines an object-oriented layer for the HTTP specification",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-foundation/tree/v7.4.13"
+                "source": "https://github.com/symfony/http-foundation/tree/v7.4.17"
             },
             "funding": [
                 {
@@ -8471,7 +8471,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-24T11:20:33+00:00"
+            "time": "2026-08-20T09:55:18+00:00"
         },
         {
             "name": "symfony/http-kernel",