chore(security): phpcsutils 1.2.2 → 1.2.3 (CVE-2026-65954)

[rubenvdlinde]

Lock-only bump of phpcsstandards/phpcsutils 1.2.2 → 1.2.3 for CVE-2026-65954.

composer audit fails on advisory data alone, so a repo that changed nothing goes red once the advisory propagates. openbuild's Security (composer) cell was still green as of run 31524590763 (18:11Z), so this lands ahead of the failure rather than after it. composer audit reports no advisories after the bump, and it is exercised by CI actually running phpcs rather than only locking it.

---

This does not touch openbuild's three E2E failures — and here is why, measured

All three are pre-existing and none is attributable to any openbuild diff.

automations-rbac.spec.ts:124 — a support dialog, not the #173 500

Dies at line 130 clicking getByRole('combobox', {name:/application/i}). The input resolves and is "visible, enabled and stable"; every retry names:

<div … data-testid-modal="cn-support-dialog" class="dialog__modal cn-support-dialog modal-mask"> subtree intercepts pointer events

useSupportDialog (from CnAppRoot.vue, persistence: 'server') GETs /apps/openbuild/api/preferences/support-dialog-seen. openbuild is one of the few apps that actually serves that route, and PreferencesController::getPreference() answers HTTP 200 with {"value": null} — which the resolver reads as "not seen yet" and shows the modal. A 200 opens it. It is not an error dialog and not a symptom of the #173 500.

The repo already ships tests/e2e/support/appFixture.ts::suppressSupportDialog() and 13 spec files import it. This one does not.

automations-rbac.spec.ts:152 — the fixture app is never created

Dies at line 159 on getByRole('option', {name:/rbac.?automations.?app/i}) with no locator resolved to line at all — zero candidates, so this one is not the dialog. On development the string rbac-automations-app appears in exactly 3 places, all constants and comments inside the spec itself. ci-seed.sh seeds only hello-world; global-setup.ts provisions the four rbac-* users and no such app. The spec's own header records that the app was created by hand via the wizard during a live-verification session.

version-rollback.spec.ts:263 — predates PR #182 entirely

run	head_sha	failures
31438032584 (08-10 22:22)	2b1a8900	4 — automations-rbac:124, :152, builder-host.spec.ts:44, version-rollback:263
31459739568 (08-11 04:50)	2b1a8900	2 — automations-rbac:124, :152

Same commit, opposite verdicts. #182's diff touches three tests/e2e/spec-coverage/ files and nothing near it.

⚠️ That table also shows builder-host.spec.ts:44 flipping on one tree — relevant to the moving-additional-apps-ref hypothesis, which it does not settle either way. Same-SHA-opposite-verdict licenses exactly one conclusion: not attributable to any openbuild change. The two runs are six hours apart and the sibling app is cloned at a moving ref, so it does not discriminate a flake from a moving input. Naming a cause still needs the positive control nobody has run — pinning the sibling SHA and reproducing.

---

Two things left deliberately undone

The first two failures are fixed by the test-harness half of PR #177, which is review-only by explicit instruction. Duplicating suppressSupportDialog and its fixture-building beforeAll into this PR would conflict with a PR under human review and would land part of it by the back door. Left for that review — with one correction posted there: #177's green E2E demonstrates its harness changes, not its RBAC fix, because neither failing test ever issues an enable request.

version-rollback:263 is not masked. The available fix moves the row assertion inside openVersionHistory's existing retry loop. It would go green — and if the mechanism candidate is right (CnObjectSidebar.vue re-anchoring activeTab unconditionally on any tabs array-identity change, so the sidebar silently snaps back off "Version history"), it would hide a user-visible defect behind a retry. That mechanism is inferred from shipped source and not observed live — testing it needs a rig, and disk here is at 97%. A flake and a product bug look identical from CI; masking one masks the other.

[github-actions]

Quality Report — ConductionNL/openbuild @ 4ac9ce1

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
composer			✅	✅ 101/101
npm			✅	✅ 654/654
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					✅

---

Quality workflow — 2026-08-11 21:27 UTC

Download the full PDF report from the workflow artifacts.