[brianvarskonst]

Changes

Raise ExpressionLanguage to ^8.1.9 for CVE-2026-109449 and YAML to ^8.1.6 for CVE-2026-109413. Require Kernel ^1.1.10 to retain its HttpFoundation 8.1.9 header-parser floor in lowest-version installations.

Add dependency-boundary tests and native DependencyInjection expression/YAML parser regressions. The expression cases include the chained-binary nesting missed by the initial 8.1.6 fix. SymPress's trusted service/configuration files do not establish a public untrusted expression or YAML input.

Lowest-version testing also verifies the existing development cache clearer. Require Symfony FrameworkBundle ^8.1.8, the first patch that loads its native cache debug warmer independently of the profiler; 8.1.0–8.1.7 cannot satisfy that existing runtime integration.

Validation

• PHP 8.5.9, highest dependencies with an isolated local path to the exact Kernel 1.1.10 change: composer qa passes (76 tests, 361 assertions).
• Four existing skips: three opt-in live cache backend tests and the APCu CLI test. No cache implementation changed.
• Lowest dependencies with FrameworkBundle 8.1.8, ExpressionLanguage 8.1.9, YAML 8.1.6 and HttpFoundation 8.1.9: full QA passes (77 tests, 363 assertions), with one visible deprecation from old EventDispatcher contracts and the same four existing skips.
• Dependency installation and explicit audit including dev dependencies, plus strict Composer validation, pass.
• Final validation uses the unchanged published manifest with no repository override: Composer installs Kernel v1.1.10 from its public ZIP at 1e6d052e7d18f1dd96efa06712f81ae50a1972e5; full lowest-version QA (77 tests, 363 assertions), strict validation and explicit audit including dev dependencies pass. Temporary local manifests and locks are excluded from the PR.
• GitHub checks pass on head 161ac60ddb73a83b4bdc82dff42e3007793e11a0, including the Redis/Memcached backend job.

Prepare patch release 1.0.7 after Kernel 1.1.10 is published, independent review and rebase merge. This library has no versioned lock file.

Sources: https://symfony.com/cve-2026-109449, https://symfony.com/cve-2026-109413, https://symfony.com/cve-2026-108082.

[brianvarskonst]

Independently reviewed final commit 161ac60ddb73a83b4bdc82dff42e3007793e11a0, including the additional native cache-warmer minimum. No blocking code findings.

ExpressionLanguage 8.1.9 and YAML 8.1.6 exclude the affected versions. Kernel 1.1.10 carries the safe HttpFoundation floor. The Symfony FrameworkBundle 8.1.8 minimum is supported by the official tag comparison and the existing development cache-clearer regression: 8.1.7 loads the debug service only with the profiler; 8.1.8 supports the required profiler-disabled development behavior.

The independent focused run passes 11 tests / 70 assertions with actual FrameworkBundle 8.1.8. The package's full highest and corrected-lowest QA and all hosted checks pass. Lowest dependencies expose an existing upstream PHP deprecation and opt-in backend skips; the hosted Redis/Memcached smoke succeeds. Merge is pinned to this reviewed head.