• Documentation: add a notice for the PHP runtime security advisory of 21 Oct 2026 (CVE-2026-109618, CVE-2026-109619). These are PHP engine vulnerabilities; no library code changes are required. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor-patched package). See the advisory.
• CI: add PHP 8.5 to the test matrix.
• CI: bump actions/checkout to v7, stefanzweifel/git-auto-commit-action to v7, and dependabot/fetch-metadata to v3.1.0 (#172, #173, #174).