fix(deps): patch bundled Composer CVEs across PHP 8.1–8.4 agents

[BenElferink]

What

Scans the bundled Composer dependencies of every PHP agent (8.1–8.4) with composer audit and remediates all reported security advisories so the container image vulnerability scan (.github/workflows/vuln-scan.yml) comes back clean.

The vendored dependencies are committed (and scoped with PHP-Scoper), so each fix regenerates the scoped vendor/ using the project's own build pipeline:

composer install --optimize-autoloader --no-dev --no-plugins --ignore-platform-reqs   # on PHP 8.4
php-scoper add-prefix --config=_helpers/scoper.inc.php                                 # Odigos\ prefix
php _helpers/build-classmap.php <version-dir>                                          # classmap + autoload patches

Advisories remediated

Before this change composer audit reported 17–18 advisories across 10–11 packages per version. After it, all four versions report No security vulnerability advisories found.

Package	Before	After
guzzlehttp/guzzle	7.10.0	7.12.3
guzzlehttp/psr7	2.8.0	2.12.3
slim/slim	4.15.1	4.15.2
symfony/http-foundation	7.4.3 / 6.4.31	7.4.13 / 6.4.41
symfony/http-kernel	7.4.3 / 6.4.31	7.4.13 / 6.4.41
symfony/mailer	7.4.3 / 6.4.31	7.4.12 / 6.4.40
symfony/mime	7.4.0 / 6.4.30	7.4.13 / 6.4.41
symfony/routing	7.4.3 / 6.4.30	7.4.13 / 6.4.41
symfony/polyfill-intl-idn	1.33.0	1.38.1
yiisoft/yii2	2.0.54	2.0.55
laravel/framework	12.48.1 (8.2–8.4)	12.62.0 (8.2–8.4)

Covered CVEs include: CVE-2026-55767, CVE-2026-55568, CVE-2026-55766, CVE-2026-49214, CVE-2026-48998 (guzzle/psr7); CVE-2026-48157 (slim); CVE-2026-48736, CVE-2026-45075, CVE-2026-45068, CVE-2026-45070, CVE-2026-45067, CVE-2026-48784, CVE-2026-45065, CVE-2026-46644 (symfony); CVE-2026-39850 (yii2); CVE-2026-48019 + Laravel signed-URL / CRLF advisories.

PHP 8.1 Laravel removal (please review)

On PHP 8.1, laravel/framework can only resolve to 10.x (Laravel 11/12/13 require PHP ≥ 8.2). The reported Laravel advisories have no patched release on the 10.x line — fixes only exist in Laravel 12.60+/12.61.1+/13.10+. There is therefore no way to keep Laravel on 8.1 and clear the scan.

Because the release image bundles all versions into a single scanned image, the vulnerable 8.1 Laravel files would keep the scan red. This PR removes open-telemetry/opentelemetry-auto-laravel from the 8.1 agent only. This aligns with the existing support matrix:

• tests.yaml only runs Laravel e2e on 8.2/8.3/8.4 (never 8.1), with the comment # Laravel: requires PHP 8.2+.
• README.md is updated to document the exclusion.

Laravel auto-instrumentation is unchanged for 8.2/8.3/8.4. If 8.1 Laravel support must be retained (accepting the known unpatched CVEs), this commit can be reverted independently.

Verification

• composer audit --locked → clean on all four versions.
• Autoloader smoke test on 8.1/8.2/8.3/8.4: vendor/autoload.php loads and both scoped (Odigos\Ramsey\…, Odigos\Google\Protobuf\…) and excluded (GuzzleHttp\…, OpenTelemetry\SDK\…, Psr\…) classes resolve.
• Relying on the existing OpenTelemetry PHP Agent Tests workflow (symfony/laravel/cakephp/yii e2e trace collection) to confirm the dependency bumps don't regress trace export.

Notes

• Scoped vendor/ was regenerated with PHP-Scoper 0.18.19 (current latest, same as the Dockerfile). A small number of files differ only by an added trailing newline; unchanged scoped packages are byte-identical.

  

emergency-ticket id: EMR-1955