Fix events map OOM + security dependency patches

app/Http/Controllers/Api/EventsController.php

@@ -33,30 +33,58 @@ public function event(Event $event)
 
         public function list(Request $request)
         {
+            // Map payload is ~150k lean rows; PHP 8.4 FPM defaults to 128M and OOMs
+            // while hydrating Eloquent models or writing the Redis cache blob.
+            ini_set('memory_limit', '512M');
+
             $year = $request->input('year')
                 ? $request->input('year')
                 : Carbon::now()->year;
 
-            if (Cache::has('events'.$year)) {
-                $events = Cache::get('events'.$year);
-            } else {
-                $events = Event::getByYear($year);
-
-                $events = $this->eventTransformer->transformCollection($events);
+            $cacheKey = 'events'.$year;
 
-                // FIX: group by UPPERCASE country
-                $events = $events->groupBy(function ($event) {
-                    return strtoupper(trim($event['country']));
-                });
-
-                if ($year == Carbon::now()->year) {
-                    Cache::add(
-                        'events'.$year,
-                        $events,
-                        300
-                    );
+            if (Cache::has($cacheKey)) {
+                $events = Cache::get($cacheKey);
+            } else {
+                $grouped = [];
+
+                Event::query()
+                    ->select('id', 'geoposition', 'country_iso')
+                    ->where('status', 'APPROVED')
+                    ->whereNotNull('geoposition')
+                    ->where('geoposition', '!=', '')
+                    ->where('start_date', '>', Carbon::createFromDate($year, 1, 1))
+                    ->when(
+                        (int) $year !== (int) Carbon::now()->year,
+                        fn ($query) => $query->where(
+                            'end_date',
+                            '<',
+                            Carbon::createFromDate($year, 12, 31)
+                        ),
+                        // Keep prior behaviour: compare against "now", not the integer year
+                        // (end_date >= 2026 cast almost every row through and blew memory).
+                        fn ($query) => $query->where(
+                            'end_date',
+                            '>=',
+                            Carbon::now('Europe/Brussels')
+                        )
+                    )
+                    ->cursor()
+                    ->each(function ($event) use (&$grouped) {
+                        $country = strtoupper(trim((string) $event->country_iso));
+                        $grouped[$country][] = [
+                            'id' => $event->id,
+                            'geoposition' => $event->geoposition,
+                            'country' => $country,
+                        ];
+                    });
+
+                $events = collect($grouped);
+
+                if ((int) $year === (int) Carbon::now()->year) {
+                    Cache::put($cacheKey, $events, 300);
                 } else {
-                    Cache::forever('events'.$year, $events);
+                    Cache::forever($cacheKey, $events);
                 }
             }
 

app/Http/Controllers/SearchController.php

@@ -82,6 +82,9 @@ protected function getPaginatedEvents(EventFilters $filters)
 
     protected function transformEventsForMap(EventFilters $filters)
     {
+        // Same FPM 128M ceiling as /api/event/list — raise before building/caching markers.
+        ini_set('memory_limit', '512M');
+
         $flattened = Arr::flatten($filters->getFilters());
         $filtered = array_filter($flattened, fn($v) => $v !== null && $v !== '');
         $composed_key = 'map_' . implode(',', $filtered);
@@ -96,8 +99,8 @@ protected function transformEventsForMap(EventFilters $filters)
                 ->filter($filters)
                 ->cursor()
                 ->each(function ($event) use (&$grouped) {
-                    $transformed = app(\App\Http\Transformers\EventTransformer::class)->transform($event);
-                    $country = $transformed['country'] ?? 'unknown';
+                    $transformed = $this->eventTransformer->transform($event);
+                    $country = strtoupper(trim((string) ($transformed['country'] ?? 'unknown')));
                     $grouped[$country][] = $transformed;
                 });
 

composer-test.json

@@ -39,7 +39,6 @@
         "stevebauman/purify": "^6.2",
         "torann/geoip": "^3.0",
         "willvincent/feeds": "^2.6"
-
     },
     "require-dev": {
         "barryvdh/laravel-debugbar": "^3.10",
@@ -89,7 +88,15 @@
     "config": {
         "preferred-install": "dist",
         "sort-packages": true,
-        "optimize-autoloader": true
+        "optimize-autoloader": true,
+        "audit": {
+            "ignore": {
+                "PKSA-d5tc-s1qs-h781": "Laravel 11 has no fix; needs framework 12.69+",
+                "PKSA-m5cs-t1y6-qpcs": "Laravel 11 has no fix; needs framework 12.61.1+",
+                "PKSA-3r5d-mb8f-1qw9": "Laravel 11 has no fix; needs framework 12.60+",
+                "PKSA-mdq4-51ck-6kdq": "Laravel 11 has no fix; needs framework 12.60+"
+            }
+        }
     },
     "repositories": [
         {

composer.json

@@ -104,7 +104,15 @@
     "config": {
         "preferred-install": "dist",
         "sort-packages": true,
-        "optimize-autoloader": true
+        "optimize-autoloader": true,
+        "audit": {
+            "ignore": {
+                "PKSA-d5tc-s1qs-h781": "Laravel 11 has no fix; needs framework 12.69+",
+                "PKSA-m5cs-t1y6-qpcs": "Laravel 11 has no fix; needs framework 12.61.1+",
+                "PKSA-3r5d-mb8f-1qw9": "Laravel 11 has no fix; needs framework 12.60+",
+                "PKSA-mdq4-51ck-6kdq": "Laravel 11 has no fix; needs framework 12.60+"
+            }
+        }
     },
     "repositories": [
         {