Require Symfony ExpressionLanguage 8.1.9 or newer

[rebsweb]

Summary

The current symfony/expression-language: ^8.0 requirement permits Symfony 8 releases affected by CVE-2026-109449. Symfony identifies 8.1.9 as the complete fix; the earlier 8.1.6 fix missed some expression-tree shapes.

Require ^8.1.9 and synchronize the installation example and changelog. The existing container.expression_language service and supported service-expression configuration remain available. Other Symfony requirements are unchanged.

Validation

• composer validate --strict and composer audit --locked: passed with ExpressionLanguage 8.1.9.
• Composer resolution before the change admitted 8.1.6; after the change it rejects 8.1.6 and accepts 8.1.9. Advisory blocking was disabled only for these dry runs to isolate the manifest constraint; vulnerable code was not installed.
• composer qa: passed code style, static analysis and 79 tests / 375 assertions. PHPUnit reports seven notices and one skipped test. Ran on a temporary Linux-filesystem copy because the DATA mount does not provide the private directory permissions required by cache tests.
• Focused bundle, attribute and runtime-cache integration tests: 34 tests / 148 assertions passed.
• A normal expression evaluates correctly; bounded excessive unary and binary nesting both raise SyntaxError. Independent review also verified a compiled/dumped service-container parameter expression.
• Representative WordPress consumer dependency-resolution canary: the candidate Kernel requirement selects ExpressionLanguage 8.1.9 from the previously locked 8.1.6 graph, and the resulting locked audit passes. Existing package metadata was frozen; the target's sodium extension was modeled because it is absent from the local CLI. This verifies dependency compatibility, not a live WordPress boot or deployment.

This addresses the dependency version policy; it does not claim that this Kernel exposes untrusted expressions. Consumers still need to update their lockfiles after a release containing this change.

[brianvarskonst]

Reviewed exact head bdf149a. No blocking findings; independent review agrees.

The ^8.1.9 security floor matches Symfony's complete fix for CVE-2026-109449. Manifest, installation example, and changelog are synchronized; runtime code and public APIs are unchanged.

Validation:

• All three required GitHub checks passed: workflows / actionlint, qa / Discover Composer targets, qa / QA (.).
• Fresh isolated PHP 8.5.9 validation: composer validate --strict, dependency resolution selecting ExpressionLanguage 8.1.9, composer audit --locked, and composer qa passed. Local PHPUnit: 79 tests / 375 assertions, seven notices, one skipped test. Hosted QA: 79 tests / 391 assertions, seven notices, no skipped test.
• Normal expression evaluation, unary nesting rejection, binary tree-depth rejection, compiled service-container expressions, and dumped runtime-container expressions passed additional smoke checks.
• Independent theme-starter canary resolved the 93-package graph using this exact Kernel metadata, upgraded ExpressionLanguage 8.1.6 to 8.1.9, retained the other private package metadata, and passed composer audit --locked. Dependency resolution only; no WordPress boot or deployment.

Consumers must update their lockfiles after a release containing this change.

Advisory: https://symfony.com/blog/cve-2026-109449-unbounded-nesting-in-the-expression-parser-lets-untrusted-expressions-crash-the-process
CI: https://github.com/SymPress/kernel/actions/runs/38771718447