Updated contrib dependencies and applied the 'drupal/ai' security release.

[AlexSkrypnyk]

Summary

drupal/ai moves from 1.4.7 to 1.4.8, which is a security release closing SA-CONTRIB-2026-119 (cross-site scripting, CVE-2026-84911) and SA-CONTRIB-2026-120 (access bypass, CVE-2026-84912). The module is a transitive dependency of drupal/ai_image_alt_text, drupal/ai_provider_openai and drupal/gemini_provider, so it appears in composer.lock only and has no constraint line in composer.json.

Both advisories declare affected versions <1.3.13 || >=1.4.0 <1.4.8, so the installed 1.4.7 was inside the affected range from the day the advisories were published on 2026-09-02. composer audit against the pre-update lock reported both; against the updated lock it reports none.

After merge composer audit is clean, drupal/core stays on 11.4.6 so there are no database updates and no configuration to import, and the remaining eight package moves are build and test tooling that never runs on the live site. This PR changes no application code, no configuration and no templates.

Before / After

composer audit
┌─────────────────────────────┐        ┌─────────────────────────────┐
│ BEFORE                      │        │ AFTER                       │
│                             │        │                             │
│ drupal/ai 1.4.7             │        │ drupal/ai 1.4.8             │
│  ├─ SA-CONTRIB-2026-119 XSS │   ->   │  └─ (no advisories)         │
│  └─ SA-CONTRIB-2026-120 AB  │        │                             │
│                             │        │                             │
│ 2 advisories, 1 package     │        │ 0 advisories                │
└─────────────────────────────┘        └─────────────────────────────┘

rector/rector version resolution
BEFORE                                  AFTER
palantirnet/drupal-rector 1.1.2         palantirnet/drupal-rector 1.1.3
  requires rector/rector ^2             requires rector/rector ^2
                                        conflicts rector/rector >=2.6.2
        │                                       │
        v                                       v
  resolves to latest ^2                  resolves to 2.6.1
        │                                       │
        v                                       v
  composer.lock pinned 2.6.2             constraint enforces the ceiling
  (hold held only by the lock)           (lock no longer load-bearing)

Checklist before requesting a review

• Subject includes ticket number as [#123] Verb in past tense.
• Ticket number #123 added to description
• Added context in Changed section
• Self-reviewed code and commented in commented complex areas.
• Added tests for fix/feature.
• Relevant tests run and passed locally.

Changed

1. drupal/ai 1.4.7 to 1.4.8 (security). Closes SA-CONTRIB-2026-119 (cross-site scripting, CVE-2026-84911) and SA-CONTRIB-2026-120 (access bypass, CVE-2026-84912), both rated moderately critical and both reported on 2026-09-02. Lock-only change, since drupal/ai reaches this site through drupal/ai_image_alt_text, drupal/ai_provider_openai and drupal/gemini_provider.

2. rector/rector 2.6.2 to 2.6.1 (downgrade). palantirnet/drupal-rector 1.1.3 adds "conflict": {"rector/rector": ">=2.6.2"} (palantirnet/drupal-rector#421), because rector 2.6.2 removed PHPUnitSetList and the Drupal8/Drupal9/Drupal10 set lists reference it (palantirnet/drupal-rector#420). Composer therefore resolves the engine down to 2.6.1. This site runs core 11.4, so DrupalSetProvider only loads the 11.x sets, and those never referenced PHPUnitSetList; the downgrade follows the dependency constraint rather than fixing a defect that was reachable here. It does replace the lock-only hold this project was carrying with an upstream-declared ceiling. Rector\Set\ValueObject\ComposerTriggeredSet and Rector\Set\Contract\SetProviderInterface both exist in 2.6.1, so rector.php still resolves.

3. palantirnet/drupal-rector 1.1.2 to 1.1.3. Carries the conflict declaration above; the project's patches/3540378-rector-skip-webform-cards-tests.patch still applies cleanly against it.

4. drevops/behat-steps 3.14.1 to 3.14.2. Expands fixture path resolution for file and image fields held in subdirectories (drevops/behat-steps#764). No step definitions were renamed or removed, so no .feature migration is required.

5. drush/drush 13.7.6 to 13.7.7. Fixes inconsistent self versus static use in AutowireTrait (drush-ops/drush#6476).

6. drupal/moderated_content_bulk_publish 2.0.52 to 2.0.53. Routine patch release; constraint bumped from ^2.0 to ^2.0.53 by bump-after-update.

7. Static analysis and logging. phpstan/phpstan 2.2.10 to 2.2.13, phpstan/phpdoc-parser 2.3.3 to 2.3.5, monolog/monolog 3.10.0 to 3.11.0.

8. composer.json constraint bumps. config.bump-after-update is enabled, so the five direct-dependency constraints tightened to the newly installed versions. composer validate --strict passes and composer normalize reports the file already normalized.

9. No config.audit.ignore reconciliation. The key is absent from composer.json, so there were no suppressed advisories to prune.

Reviewer notes

The one thing worth watching in CI is lint. rector/rector moved and phpstan/phpstan gained three patch releases, so either may surface findings the previous combination did not. Nothing in this diff changes application code, so any such finding is a tooling-visibility change rather than a regression introduced here.

Post-merge there is nothing to run by hand: no database updates, no configuration import, no cache rebuild beyond the normal deployment steps.

Screenshots

N/A

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 14 days. After that, they cost $0.25 per reviewed file.}

Or wait 15 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 95 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 468646bc-f1c1-489b-8abb-cab900dc5a7e

📥 Commits

Reviewing files that changed from the base of the PR and between c9b4703 and 0aa2e7b.

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• composer.json

---

_{Comment @coderabbitai help to get the list of available commands.}

[AlexSkrypnyk]

All five constraint changes in this file are mechanical: config.bump-after-update is enabled, so composer update tightened each direct dependency's floor to the version it just installed. None of them is a deliberate policy change, and no dependency was added or removed. composer validate --strict passes and composer normalize reports the file already normalized.

Routine, per line:

• drupal/moderated_content_bulk_publish ^2.0 to ^2.0.53 (this line). Patch release; the constraint gains a floor it did not previously state.
• drush/drush ^13.7.6 to ^13.7.7 - fixes inconsistent self versus static use in AutowireTrait, Issue #6470 Fixes inconsistent use of self vs static in AutowireTrait drush-ops/drush#6476. Nothing in web/modules/custom subclasses it.
• drevops/behat-steps ^3.14.1 to ^3.14.2 - expands fixture path resolution for file and image fields in subdirectories, [#760] Expanded fixture paths for file and image fields in subdirectories. behat-steps#764. No step definitions were renamed or removed, so the 41 feature files under tests/behat/features need no migration; ahoy lint and ahoy test-unit pass unchanged.
• phpstan/phpstan ^2.2.10 to ^2.2.13 - three patch releases. ahoy lint-be reports [OK] No errors against phpstan.neon, so no new findings on this codebase.

The one that carries a real decision:

• palantirnet/drupal-rector ^1.1.2 to ^1.1.3. Its only functional change is adding "conflict": {"rector/rector": ">=2.6.2"} (fix: conflict with rector/rector >=2.6.2 (#420) palantirnet/drupal-rector#421), because rector 2.6.2 removed PHPUnitSetList while the Drupal8/Drupal9/Drupal10 set lists still reference it (rector 2.6.2+ breaks Drupal*SetList because PHPUnitSetList was removed palantirnet/drupal-rector#420). Composer therefore resolves rector/rector down to 2.6.1 in the lock. That downgrade is not reachable-defect-driven here: this site is on core 11.4, and DrupalSetProvider only loads the sets whose version core satisfies, so only the 11.x sets load and none of those referenced PHPUnitSetList. What it does change is where the ceiling lives - this project had been holding rector at 2.6.2 in composer.lock alone, and that hold is now declared upstream by the constraint instead. Rector\Set\ValueObject\ComposerTriggeredSet and Rector\Set\Contract\SetProviderInterface both still exist in 2.6.1, so rector.php resolves unchanged and [OK] Rector is done! locally.

Not visible in this file: the security fix in this PR is drupal/ai 1.4.7 to 1.4.8, which closes SA-CONTRIB-2026-119 (XSS, CVE-2026-84911) and SA-CONTRIB-2026-120 (access bypass, CVE-2026-84912). drupal/ai is transitive - it arrives through drupal/ai_image_alt_text, drupal/ai_provider_openai and drupal/gemini_provider - so it has no constraint line here and moves only in composer.lock. composer audit reported both advisories against the pre-update lock and reports none against this one.

[github-actions]

Code coverage (threshold: 80%)

  Classes: 51.85% (14/27)
  Methods: 77.17% (71/92)
  Lines:   89.15% (756/848)

Per-class coverage

Drupal\do_ai_alt_text\AltTextGenerator
  Methods:  85.71% ( 6/ 7)   Lines:  98.72% ( 77/ 78)
Drupal\do_ai_alt_text\Plugin\Action\RegenerateImageAltText
  Methods: 100.00% ( 8/ 8)   Lines: 100.00% ( 63/ 63)
Drupal\do_base\EventSubscriber\PreviewLinkCacheSubscriber
  Methods:  33.33% ( 1/ 3)   Lines:  11.11% (  1/  9)
Drupal\do_base\EventSubscriber\ThemeColorSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  40.00% (  4/ 10)
Drupal\do_base\Hook\AutomatedListPagerHook
  Methods: 100.00% ( 5/ 5)   Lines: 100.00% ( 31/ 31)
Drupal\do_base\Hook\LibraryInfoAlterHook
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% (  9/  9)
Drupal\do_base\Hook\MetatagsAlterHook
  Methods: 100.00% ( 7/ 7)   Lines: 100.00% ( 58/ 58)
Drupal\do_base\Hook\PageAttachmentsHook
  Methods:  87.50% ( 7/ 8)   Lines:  94.92% ( 56/ 59)
Drupal\do_base\NavigationScriptHash
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 27/ 27)
Drupal\do_base\Twig\ImageDimensionsExtension
  Methods:  40.00% ( 2/ 5)   Lines:  81.48% ( 44/ 54)
Drupal\do_content_api\EventSubscriber\JsonApiWriteGateSubscriber
  Methods:  66.67% ( 2/ 3)   Lines:  88.89% (  8/  9)
Drupal\do_content_api\Hook\EntityCreateAccessHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 12/ 12)
Drupal\do_content_api\Hook\ModerationPolicyHook
  Methods:  50.00% ( 1/ 2)   Lines:  93.75% ( 15/ 16)
Drupal\do_content_api\Routing\RouteSubscriber
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  6/  6)
Drupal\do_feed\FeedUrlBuilder
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 18/ 18)
Drupal\do_feed\Form\FeedSettingsForm
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 15/ 15)
Drupal\do_feed\Hook\EntityDeleteHook
  Methods:  50.00% ( 1/ 2)   Lines:  92.31% ( 12/ 13)
Drupal\do_feed\Hook\EntityPresaveHook
  Methods: 100.00% ( 4/ 4)   Lines: 100.00% ( 54/ 54)
Drupal\do_feed\Hook\PreprocessParagraphHook
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 14/ 14)
Drupal\do_feed\Hook\PreprocessViewsViewRowRssHook
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  3/  3)
Drupal\do_feed\Hook\ViewsPreViewHook
  Methods:  50.00% ( 1/ 2)   Lines:  96.43% ( 27/ 28)
Drupal\do_generated_content\Generator\CaseMatrix
  Methods: 100.00% ( 3/ 3)   Lines: 100.00% ( 12/ 12)
Drupal\do_generated_content\Generator\RelativeDate
  Methods: 100.00% ( 1/ 1)   Lines: 100.00% (  1/  1)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.56%. Comparing base (c9b4703) to head (0aa2e7b).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #324   +/-   ##
========================================
  Coverage    86.56%   86.56%           
========================================
  Files           28       28           
  Lines          655      655           
========================================
  Hits           567      567           
  Misses          88       88           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.