[mrrobot47]

Since 2026-11-01, Composer 2.11 on the runners refuses symfony/yaml 4.4.* (CVE-2026-109413, CVE-2026-45304, CVE-2026-45305, CVE-2026-45133), guzzlehttp/psr7 1.x (CVE-2026-59882 and five more) and, behind it, guzzlehttp/guzzle 7.8 (the last guzzle 7 line that accepts psr7 1.x), so every develop push and PR build fails at "Install dependencies" and no tests run.

This is a CI-only stopgap. On the composer update path (develop and PRs), the workflow adds config.policy.advisories.ignore entries for exactly these three packages, each limited to the version line in use (symfony/yaml 4.4., guzzlehttp/psr7 1.9., guzzlehttp/guzzle 7.8.*), with on-audit: false so composer audit still reports them. Nothing else is unblocked: any other package with an advisory, or a newer advisory-affected version of these, still fails the build.

Not changed: the committed composer.json and composer.lock, and the phar build for master and tags, which runs composer install from the lock and isn't blocked. The Behat job only takes the lock path on master (as before); on tags it already ran composer update, so it gets the ignore too, which keeps the next release tag's tests from failing the same way.

The real fix, moving to a fixed symfony/yaml (with the Symfony 4.4 components and Behat that come with it) and to acmephp/core 2.x with guzzlehttp/psr7 2.x and a current guzzle, is planned for v4.15.0. The ignore goes away with it.

[Copilot]

🟡 Changes recommended

The test-job condition incorrectly applies advisory exceptions to release tags, which should retain the existing lock-file-based composer install behavior.

1 open issue

• Exclude release tags from test-job advisory exceptions · New

What changed in this PR

Adds a temporary CI-only workaround for Composer advisory blocks so dependency updates can proceed while dependency upgrades are planned.

Changes:

• Defines version-scoped advisory exceptions for symfony/yaml, guzzlehttp/psr7, and guzzlehttp/guzzle, while keeping audit reporting enabled.
• Applies the exceptions before composer update in the build and test jobs without changing committed Composer files.

File	Description
.github/​workflows/​test_and_build.yml	Defines shared advisory exceptions and applies them to dependency-update steps.

_{Review effort: Balanced}