fix: require patched YAML and HttpFoundation parsers

[brianvarskonst]

Changes

Kernel 1.1.9 already excludes the ExpressionLanguage releases affected by CVE-2026-109449. This patch raises YAML to ^8.1.6 for CVE-2026-109413 and HttpFoundation to ^8.1.9 for CVE-2026-108082 plus the whitespace-separator correction in 8.1.9.

Add dependency-boundary and parser regressions, including the chained-binary expression shape missed by the initial 8.1.6 fix, inline YAML depth, Cache-Control whitespace and whitespace header separators. Configuration remains supplied by trusted site and bundle files; this change does not establish a public untrusted YAML or expression input in SymPress.

Validation

• PHP 8.5.9: composer qa passes (90 tests, 396 assertions). Seven existing PHPUnit mock notices; the existing native CLI/FPM fixture skips because this isolated image lacks cgi-fcgi.
• New focused tests: 11 tests, 21 assertions, no skips or notices.
• composer validate --strict and dependency installation audit pass.
• Lowest runtime dependencies resolve to ExpressionLanguage 8.1.9, YAML 8.1.6, HttpFoundation 8.1.9 and DependencyInjection 8.1.8; focused security tests, coding standards, full PHPUnit (90 tests, 396 assertions), Composer validation and audit including dev dependencies pass.
• Full QA with those lowest runtime dependencies passes using current PHPStan 2.3.1, WordPress analysis 2.0.4 and WordPress stubs 7.1.2. The absolute lowest analysis toolchain has an existing internal is_wpe symbol error. Old EventDispatcher contracts emit an implicit-nullability deprecation on PHP 8.5; CLI diagnostics were routed to stderr so JSON fixture output remains parseable without hiding diagnostics.
• The chained-binary regression fails as expected with the official 8.1.6 ExpressionLanguage parser and passes on 8.1.9.

Prepare patch release 1.1.10 after review and rebase merge. No versioned lock file exists in this library.

Sources: https://symfony.com/cve-2026-109413, https://symfony.com/cve-2026-108082, https://symfony.com/cve-2026-109449.

[brianvarskonst]

Reviewed commit 672f5c2f0888718b43859c500fe8b9c82ce0dc1a against the current origin/main.

No blocking findings. The YAML requirement excludes all affected 8.x versions below 8.1.6; HttpFoundation 8.1.9 includes the security fix and the whitespace-separator correction. ExpressionLanguage 8.1.9 remains required by the already released Kernel 1.1.9.

The new tests check rejected/accepted dependency boundaries and actual DI expression, YAML lexer and request-header behavior, including the chained-binary expression shape missed by 8.1.6. The change does not claim a demonstrated remote ExpressionLanguage/YAML input in SymPress. Local highest QA and focused regressions passed; merge remains conditional on the current head's hosted checks and lowest-version verification.