[vokomarov]

Security dependency upgrades — api

Source of findings: security.yml run #41167247866 (Dependabot had no open alerts)

Severity	Package	From → To	CVE / GHSA
—	symfony/mime	7.4.12 → 7.4.22	CVE-2026-45070

What changed

• Bumped transitive symfony/mime (via symfony/mailer, spiral/testing) to clear CVE-2026-45070: email header injection via non-token characters in MIME parameter names.
• Lockfile only (composer update symfony/mime). Existing constraints already allow the patched version.

Codebase changes (if any)

• None. Dependency bump only.

Verification

• composer audit --locked → No security vulnerability advisories found.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.62%. Comparing base (5b4fef2) to head (b3a40f6).

Additional details and impacted files

@@            Coverage Diff            @@
##             master     #236   +/-   ##
=========================================
  Coverage     99.62%   99.62%           
  Complexity     1506     1506           
=========================================
  Files           231      231           
  Lines          5077     5077           
=========================================
  Hits           5058     5058           
  Misses           19       19           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.