D4G-242 security updates July 2026

[maxstarkenburg]

Upgraded in this PR:

• Drupal core (security patch)
• field_group (to maintainer-supported version, which was just a move to semver, plus a few patches)

Didn't yet upgrade despite them listed in lando composer audit and mentioned in the ticket:

• guzzlehttp/guzzle due to workarounds currently required (see https://www.drupal.org/project/drupal/issues/3612247 or https://drupal.slack.com/archives/C5B7P7294/p1784633095628959) when we can likely just wait for the next patch version of core to resolve it, and it doesn't seem to be blocking lando blt tests so far from what I can tell.
• Similarly didn't upgrade composer/composer yet via this PR. Besides potentially possible via Bump composer/composer from 2.9.8 to 2.10.2 #368 instead, I was noticing that it produced errors when running lando composer install after merging that branch (or even when making the upgrade locally). Though a second run of lando composer install seems to resolve the issue on my local (not sure how other envs / build processes might get affected though). This lack of upgrade also don't seem to obstruct lando blt test at the moment.

We'll of course see shortly if the build passes or fails in the Acquia pipeline despite passing tests on my local.

[maxstarkenburg]

Forgot to note that for testing ...

• for core I just did a basic "is the site up and can I publish new content and not get dblog errors" test (I don't believe the vulnerabilities affected this site)
• for field_group, I poked around with some basic edits to the "Form display" of "CTA" and "Media & Text Column" (the only entities using field_group), as well as used their form widgets, checking for browser console (JS) errors, dblog issues, or other weirdness (none found)