Security package update

Execute from: Vendor updates playbook for vendor-owned packages; this runbook is the security-audit fix card.

When

composer audit or npm audit reports a vulnerability you intend to fix now.

Phase 0 — production safety

👤 Create a Hostinger (or host) backup in hPanel before local changes.

Local branch + update

cp composer.lock composer.lock.backup
git checkout develop && git pull
git checkout -b security-update/<package>-$(date +%Y%m%d)

composer update <vendor/package> --with-dependencies
# npm: cp package-lock.json package-lock.json.backup && npm audit fix

Automated gate (all must pass)

php artisan list > /dev/null && echo OK boots
php artisan route:list > /dev/null && echo OK routes
php artisan config:cache > /dev/null && echo OK config
php artisan view:cache > /dev/null && echo OK views
composer dump-autoload > /dev/null && echo OK autoload
npm run build 2>/dev/null || true

If any fails → git checkout develop && git branch -D security-update/... and restore lock file.

Merge + deploy

git checkout develop && git merge security-update/<branch>
git push origin develop
# Then follow code-test-ship runbook: staging → production

Document vendor-owned packages in _CUSTOMIZATIONS.md — WF4 vendor merge may conflict.

Abort if

Any automated check fails · manual smoke test fails · Friday after 3 PM · production backup not confirmed.

Related

Vendor updates playbook

Code → test → ship