Resolve composer & npm security advisories (#525)

.github/workflows/security-audit.yml

@@ -0,0 +1,45 @@
+name: Security Audit
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  composer-audit:
+    name: Composer Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.5'
+          extensions: iconv, json, simplexml, intl, pdo_pgsql
+          coverage: none
+
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-progress --no-interaction --no-scripts
+
+      - name: Run composer audit
+        run: composer audit --no-interaction
+
+  npm-audit:
+    name: NPM Audit (production dependencies)
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      # Only production (browser-shipped) dependencies are gated. Remaining advisories
+      # live exclusively in the webpack build tool chain (devDependencies).
+      - name: Run npm audit
+        run: npm audit --omit=dev --package-lock-only

composer.json

@@ -73,7 +73,7 @@
         "php-http/httplug-bundle": "^2.3",
         "php-http/message": "^1.7",
         "phpdocumentor/reflection-docblock": "^5.3",
-        "phpstan/phpdoc-parser": "^1.2",
+        "phpstan/phpdoc-parser": "^2.0",
         "predis/predis": "^2.0",
         "presta/sitemap-bundle": "^4.0@dev",
         "sonata-project/seo-bundle": "^3.9",
@@ -95,9 +95,9 @@
         "willdurand/geocoder-bundle": "^6.0"
     },
     "require-dev": {
-        "phpstan/phpstan": "^1.12",
+        "phpstan/phpstan": "^2.0",
         "phpunit/phpunit": "^12.0",
-        "rector/rector": "^1.2",
+        "rector/rector": "^2.0",
         "symfony/browser-kit": "^8.0",
         "symfony/css-selector": "^8.0",
         "symfony/debug-bundle": "^8.0",