Update drupal/entity_browser module from 2.15.0 to 2.17.0

.ahoy.yml

@@ -44,6 +44,10 @@ commands:
     usage: Run PHPUnit tests.
     cmd: docker compose exec govcms sudo -u root -E sudo -u www-data -E /app/bin/phpunit "$@"
 
-  drupal-check:
-    usage: Static analysis tool to check for correctness and deprecation errors.
-    cmd: docker compose exec govcms drupal-check "$@"
+  phpstan:
+    usage: Check for Drupal deprecations and basic static-analysis errors.
+    cmd: docker compose exec govcms phpstan analyse --level=2 "$@"
+
+  phpstan-analysis:
+    usage: Run broader Drupal-aware static analysis with stricter type checking.
+    cmd: docker compose exec govcms phpstan analyse --level=6 "$@"

.docker/Dockerfile.govcms

@@ -34,7 +34,7 @@ COPY composer.json ./
 # Install Composer dependencies
 RUN \
     --mount=type=cache,mode=0777,target=/root/.composer/cache \
-    composer require palantirnet/drupal-rector mglaman/drupal-check --dev --no-update && \
+    composer require palantirnet/drupal-rector --dev --no-update && \
     composer update --no-scripts --no-autoloader && \
     cp vendor/palantirnet/drupal-rector/rector.php .
 

.github/workflows/security-audit.yml

@@ -0,0 +1,38 @@
+name: GovCMS scheduled security audit
+
+on:
+  schedule:
+    # Every day at 7:27 am Sydney time.
+    - cron: '27 7 * * *'
+      timezone: 'Australia/Sydney'
+
+  # Allows testing from the GitHub Actions UI.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security-audit:
+    runs-on: ubuntu-latest
+
+    container:
+      image: govcmstesting/ci:latest-php8.3-apache
+      options: --user root
+
+    steps:
+      - name: Check out 4.x-develop
+        uses: actions/checkout@v7
+        with:
+          ref: 4.x-develop
+
+      - name: Resolve GovCMS dependencies
+        run: >
+          composer update
+          --profile
+          --prefer-dist
+          --optimize-autoloader
+          --no-scripts
+
+      - name: Run Composer security audit
+        run: composer audit --locked

composer.json

@@ -47,15 +47,15 @@
         "drupal/ds": "3.37.0",
         "drupal/dynamic_entity_reference": "3.2.2",
         "drupal/embed": "1.10.0",
-        "drupal/encrypt": "3.2.0",
-        "drupal/entity_browser": "2.15.0",
+        "drupal/encrypt": "3.3.0",
+        "drupal/entity_browser": "2.17.0",
         "drupal/entity_class_formatter": "2.0.1",
         "drupal/entity_embed": "1.7.0",
         "drupal/entity_hierarchy": "3.3.15",
         "drupal/entity_reference_display": "2.0.5",
         "drupal/entity_reference_revisions": "1.14.0",
         "drupal/environment_indicator": "4.0.25",
-        "drupal/events_log_track": "4.0.2",
+        "drupal/events_log_track": "5.0.0",
         "drupal/externalauth": "2.0.12",
         "drupal/facets": "2.0.10",
         "drupal/fakeobjects": "2.0.1",
@@ -70,6 +70,7 @@
         "drupal/jquery_ui": "1.8.0",
         "drupal/jquery_ui_draggable": "2.1.0",
         "drupal/jquery_ui_droppable": "2.1.0",
+        "drupal/jsonapi_extras": "3.28.0",
         "drupal/key": "1.22.0",
         "drupal/layout_builder_modal": "2.0.0",
         "drupal/layout_builder_restrictions": "3.0.4",
@@ -113,17 +114,16 @@
         "drupal/simple_oauth": "6.1.1",
         "drupal/simple_sitemap": "4.2.3",
         "drupal/simplesamlphp_auth": "4.1.0",
-        "drupal/symfony_mailer": "1.6.2",
+        "drupal/symfony_mailer": "2.0.2",
         "drupal/tfa": "1.12.0",
         "drupal/token": "1.17.0",
         "drupal/twig_tweak": "3.4.2",
         "drupal/username_enumeration_prevention": "1.4.0",
         "drupal/views_data_export": "1.10.0",
-        "drupal/webform": "6.3.0-rc2",
+        "drupal/webform": "6.3.0",
         "drupal/workbench_access": "2.0.4",
         "govcms-assets/chosen": "3.1.3",
         "govcms-assets/dropzone": "5.9.3",
-        "oomphinc/composer-installers-extender": "^2.0",
         "simplesamlphp/simplesamlphp": "2.5.2",
         "webflo/drupal-finder": "^1.2"
     },
@@ -141,7 +141,6 @@
             "cweagans/composer-patches": true,
             "drupal/core-composer-scaffold": true,
             "dealerdirect/phpcodesniffer-composer-installer": true,
-            "oomphinc/composer-installers-extender": true,
             "drupal/core-vendor-hardening": true,
             "phpstan/extension-installer": true,
             "php-http/discovery": true,
@@ -172,9 +171,15 @@
         "enable-patching": true,
         "composer-exit-on-patch-failure": true,
         "patches": {
+            "drupal/jsonapi_extras": {
+                "Add a new dedicated permission for JSON API extra config - https://www.drupal.org/project/jsonapi_extras/issues/3309122": "https://www.drupal.org/files/issues/2026-05-06/jsonapi_extras-add-permission-3309122-10_1.patch"
+            },
             "drupal/entity_embed": {
                 "CKEditor 45 compatibility - https://www.drupal.org/project/entity_embed/issues/3531672": "https://www.drupal.org/files/issues/2025-08-08/entity_embed--fix-ckeditor-icon-reference--3531672-22.patch"
             },
+            "drupal/entity_reference_revisions": {
+                "hasAffectingChanges ignores delta 2+ if first one was not updated - https://www.drupal.org/project/entity_reference_revisions/issues/3582279": "https://git.drupalcode.org/project/entity_reference_revisions/-/commit/16b72c367ba3b734a294dc822f7dce79e8bb5aea.diff"
+            },
             "drupal/facets": {
                 "Creating requests causes failures on Drupal 10.3 - https://www.drupal.org/project/facets/issues/3466281": "https://www.drupal.org/files/issues/2024-11-21/3466281-7.patch"
             },

govcms.info.yml

@@ -3,7 +3,7 @@ type: profile
 description: 'A GovCMS Drupal Distribution for government and the public sector in Australia.'
 core_version_requirement: ^11
 project: 'govcms'
-version: '4.5.0'
+version: '4.5.0.1'
 
 distribution:
   name: GovCMS