Problem
.github/workflows/security-audit.yml pins PHP to an exact patch release:
# .github/workflows/security-audit.yml:23
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.3.30'while run-tests.yml and test-matrix.yml use floating minor versions ('8.2', '8.3', '8.4').
Where
.github/workflows/security-audit.yml:23
Why it matters
This is the workflow whose entire job is running composer audit on a schedule (weekly, per the cron trigger) to catch newly disclosed vulnerabilities. Pinning it to a specific patch version means it silently drifts out of date as new 8.3.x patch releases ship — nothing bumps it automatically, since Dependabot's github-actions ecosystem update only tracks action version tags (e.g. shivammathur/setup-php@v2), not inline php-version strings, and the composer ecosystem doesn't touch workflow YAML at all. Over time the audit job runs against an increasingly outdated PHP patch, which is a minor but real gap in a job specifically meant to catch security issues.
Suggested fix
Use a floating minor version consistent with the other workflows (e.g. '8.3'), or if pinning to an exact patch is intentional (e.g. for reproducibility), add an explicit Dependabot/Renovate rule that can bump it, or a periodic manual review note.
Problem
.github/workflows/security-audit.ymlpins PHP to an exact patch release:while
run-tests.ymlandtest-matrix.ymluse floating minor versions ('8.2','8.3','8.4').Where
.github/workflows/security-audit.yml:23Why it matters
This is the workflow whose entire job is running
composer auditon a schedule (weekly, per the cron trigger) to catch newly disclosed vulnerabilities. Pinning it to a specific patch version means it silently drifts out of date as new 8.3.x patch releases ship — nothing bumps it automatically, since Dependabot'sgithub-actionsecosystem update only tracks action version tags (e.g.shivammathur/setup-php@v2), not inlinephp-versionstrings, and thecomposerecosystem doesn't touch workflow YAML at all. Over time the audit job runs against an increasingly outdated PHP patch, which is a minor but real gap in a job specifically meant to catch security issues.Suggested fix
Use a floating minor version consistent with the other workflows (e.g.
'8.3'), or if pinning to an exact patch is intentional (e.g. for reproducibility), add an explicit Dependabot/Renovate rule that can bump it, or a periodic manual review note.