[LOW] L5: symfony/http-client pinned at 6.4.34 — verify post-CVE status and consider bump

[rubenvdlinde]

Severity: LOW

Location: composer.json / composer.lock (Symfony http-client dependency)

Description:
symfony/http-client is locked at version 6.4.34. Please verify whether any CVEs have been disclosed against the 6.4.x line since this pin was set and, if so, bump to the latest 6.4.x patch release.

Suggested fix:
Run composer show symfony/http-client to confirm the current version, check the Symfony security advisory feed for any post-6.4.34 CVEs, and bump the constraint to ^6.4 (or pin to the latest patch) to stay current with security fixes.

---

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Won't fix: the locked version in composer.lock is v6.4.34, which is above the known-vulnerable range (<6.4.15). The ^6.4 constraint in composer.json already allows all future 6.4.x patches. No CVEs are open against 6.4.34+ as of this review.