[luismarinoc]

Description

Patch both pnpm toolchain layers affected by GHSA-qrv3-253h-g69c. The frontend setup warning belongs to the action bootstrap's package tree, separately from the clean application dependency audit. The previously selected project package manager is also affected; --ignore-scripts is not a mitigation for this advisory.

File	Change
.github/workflows/frontend.yaml	Pin pnpm/action-setup v6.0.10 at immutable SHA 0977fd99725f1db4007ccb2928dbb4e90d06cc86. The upstream release updates the bootstrap pnpm to 11.19.0.
package.json	Select exactly pnpm 10.34.4 with registry-verified SHA-512 integrity.
tests/Pdf/MPdfConverterTest.php	Preserve binary stream boundaries with validated lengths and 18 deterministic cases; production sanitization and its three security assertions are unchanged.

This PR combines the two-line toolchain correction with the test-only reader fix reviewed in #147: three files, 132 additions and 11 deletions. Workflow permissions, triggers, inputs and commands are unchanged. Dependency declarations, overrides and pnpm-lock.yaml are unchanged. The existing OpenSpec archive/canonical changes and delivery addendum remain local and are excluded.

Provenance

• The annotated v6.0.10 tag resolves to the pinned action commit.
• Upstream fix #283 documents the bootstrap update.
• Official advisory fixed floors are 10.34.4 and 11.8.0; previous selected 10.15.1 and bootstrap 11.7.0 are affected.
• The new package-manager integrity matches official npm registry metadata.

Validation

• Independent exact-substitution and manifest assertions.
• Official release/tag/advisory and registry integrity verification.
• Lockfile byte identity and SHA-256 preserved.
• git diff --check.
• ./php-cs-fixer.sh core '--dry-run --using-cache=no'.
• Node 24 CI: patched bootstrap and selected pnpm 10.34.4, frozen installation, production build and project audit.
• Workflow security checks; lockfile byte identity independently verified. The CI lock guard uses its existing trusted-author exemption.

No package manager was installed or executed locally for this change; static provenance is not runtime evidence. The old runtime warning is recorded in main run 34694756750. The separate legacy-layout warning is not claimed fixed. No warning suppression or force-fix is added.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• I verified that my code applies to the guidelines (composer code-check)
• I updated the documentation
• I agree that this code is used in Kimai

Full composer code-check was not run; the author agreement checkbox is left for the maintainer. This PR was reviewed as a draft and merged after explicit maintainer authorization. No manual deployment, application-data changes or unrelated warning remediation was performed.

Integrated test correction: #147

With explicit maintainer authorization, #147 was merged normally into this branch as 4d8e421cd0d75f60a9cc26f12c4e71abd41c0014 on 2026-09-12 at 18:16:30 UTC. No protection bypass or branch deletion was used. At that checkpoint, the tracker remained a draft and main publication was not yet authorized.

The child had nine successful checks on tested merge 60d47298bf03446d15bbe7480fa806c03e552119, including 4,805 full-suite tests on each PHP 8.2–8.5, migration round trips, application/test PHPStan, and frontend validation with the patched toolchain. Its 139-line test-only correction leaves production sanitization unchanged. Local independent synthetic verification passed 18 tests and 142 assertions.

Fresh CI on tracker head 4d8e421cd0d75f60a9cc26f12c4e71abd41c0014 passed all nine checks, through tested merge c438750d82837394b95174270be4946b3e04507c. Child success does not replace that validation. The earlier head 12d9c080cb59a75ac047f9f54d4979e5dbf92d7b had eight of nine checks pass and a PHP 8.5 PDF-test failure. The binary-boundary reader defect is independently demonstrated, but its causality for that historical failure remains unproven because assertion details and artifacts are unavailable.

main
 └── 📍 #146 Toolchain + reviewed test correction [merged into main]
      └── #147 PDF test reader [merged into #146 only]

Combined review scope is 143 changed lines across three files, with the test correction reviewed independently in #147. Expense archive/canonical documents and the delivery addendum remain excluded. Sass, legacy-layout, abandoned-package and release-lookup warnings remain separate maintenance items. The lock guard's trusted-author bypass is not byte-integrity proof; lock identity was checked independently.

Final publication evidence

After explicit maintainer approval, this PR merged normally into main as 067e5958c5279ae84f59b2af8f4ed6668400d67d on 2026-09-12 at 18:48:57 UTC. Fresh post-merge executions for that exact SHA completed successfully: seven workflows and ten checks.

• Full PHP suites: 4,805 tests on each PHP 8.2–8.5; successful MySQL migration round trips and PHP 8.5 coverage.
• PHP linting: application/test PHPStan, style, validation and security checks passed.
• Frontend: Node 24.20.0, pnpm 10.34.4, frozen installation and production build passed. Bootstrap audit reported zero vulnerabilities; the separate project audit reported no known vulnerabilities.

The version bot then created direct descendant 93acb75a7ce5b3adef3a319dd0850f52a6ec1deb, changing only src/Constants.php to version 2.62.166 / ID 26366. Its [skip ci] commit has no independently observed CI run. Neither CI nor this metadata-only descendant proves production deployment identity; no manual deployment was executed.

Known Sass, legacy-layout, release API, abandoned-package and deprecation warnings remain. The expense documentation remains local, excluded from this publication, and subject to a separate publication decision.