Summary
- Refresh PHP and JavaScript dependencies within compatible version constraints, including symfony/mime 8.1.10 to fix CVE-2026-45070, an email header injection vulnerability involving MIME parameter names. Composer and npm audits report no known vulnerabilities in the locked dependencies at release preparation; this does not audit container images or eliminate unknown vulnerabilities.
- Restore agent connections after HTTP client updates by using Guzzle 8-compatible transport options, preserving private-CA and hostname verification, a minimum of TLS 1.2, disabled redirects and proxies, and existing timeouts.
- Include the combined dependency/security note and agent transport note in all nine changelog languages.
Upgrade Notes
- No database migrations are included. Once the release images are published, pull the updated application and agent images and recreate both the application and every agent container, preserving storage volumes, configuration and
APP_KEY. Running containers are not updated automatically. - Agents retain their enrollment when their existing storage and configuration are preserved. Do not disable TLS verification or enroll agents again to work around the HTTP transport error.
- Existing direct dependency constraints remain unchanged. Reload the page to load the updated frontend assets.
Verification
- Final release changelog validation and targeted tests passed: 60 tests, 302 assertions. Composer and npm audits were repeated during release preparation and reported zero known vulnerabilities.
- Validation of the released tree passed the full PHP suite (1,768 passed, 27 optional/environment skips), frontend tests (236 passed), production frontend build, Pint and diff checks. The existing frontend bundle-size warning remains.
- MIME security regression tests reject four classes of invalid parameter names with the patched dependency; the same tests reproduced four failures against an isolated installation of the previous lockfile. Normal parameter serialization remains supported.
- All three main-branch CI jobs passed, including MySQL and PostgreSQL migration-recovery checks. Container image publication is handled by the tag-triggered GitHub Actions workflow; no running installation is modified by this release.
Full Changelog: v2.0.7...v2.0.8