FOUR-33162 - Fix High Security Vulnerabilities

[nolanpro]

Summary

• Ensure league/commonmark 2.10.0 in lockfile (fixes 4 high-severity GHSA advisories)
• Builds on FOUR-33066 branch
• Skipped: swagger-ui npm transitive deps (brace-expansion, immutable in vendor lockfile), theiconic/name-parser transitive guzzle/phpunit, swaggest/json-schema symfony/yaml, frankenphp grpc — require upstream or infra changes

Test plan

• composer install succeeds
• composer audit reports no advisories
• Application tests pass

Made with Cursor

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 7f4f59d. Configure here.}

[cursor]

Thermo Fisher package catalog entry removed

Medium Severity

package-thermofisher was dropped from extra.processmaker.custom in a security-only lockfile bump. LicensedPackageManifest builds its known-package list from that catalog, so this package is no longer license-gated or discoverable as a custom package, and any install pipeline that reads this list stops shipping it.

 

^{Reviewed by Cursor Bugbot for commit 7f4f59d. Configure here.}