Security: Restrict REST course self-enrolment - refs GHSA-qc88-h6gp-4gcg - #9237

Process completed with exit code 2.

Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires composer/composer 1.0.*@dev, found composer/composer[1.0.0-alpha1, ..., 1.0.3] but these were not loaded, because they are affected by security advisories ("PKSA-ddsx-fjz2-sbs3", "PKSA-ym19-cy3j-z6df", "PKSA-q3ht-3g42-rg8f", "PKSA-4pm6-g63v-5rkr", "PKSA-zcdk-qnhk-hq2g", "PKSA-pwvr-3754-v57r", "PKSA-t5r2-p5q9-mtpn", "PKSA-6bp1-9hfj-2cgv", "PKSA-m1ph-vmbx-2xd3", "PKSA-6zmq-d6mk-r5wm", "PKSA-93hy-9dc1-gbwt", "PKSA-9p8h-97x3-qxpm", "PKSA-qx8p-c3v3-6yfg"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. Problem 2 - Root composer.json requires symfony/validator ~3.0|~4.0, found symfony/validator[v3.0.0, ..., v3.4.47, v4.0.0, ..., v4.4.48] but these were not loaded, because they are affected by security advisories ("PKSA-w2tw-kmfg-rt9s"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. Problem 3 - Root composer.json requires symfony/yaml ~3.0|~4.0, found symfony/yaml[v3.0.0, ..., v3.4.47, v4.0.0, ..., v4.4.45] but these were not loaded, because they are affected by security advisories ("PKSA-xz3r-9gp4-4m1z", "PKSA-v5yj-8nmz-sk2q", "PKSA-ft77-7h5f-p3r6", "PKSA-b14r-zh1d-vdrc"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. Problem 4 - Root composer.json requires phpunit/phpunit 3.7.*, found phpunit/phpunit[3.7.0, ..., 3.7.38] but these were not loaded, because they are affected by security advisories ("PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. Problem 5 - Root composer.json requires alchemy/zippy ~0.2 -> satisfiable by alchemy/zippy[0.2.0, ..., 0.4.9]. - alchemy/zippy[0.2.0, ..., 0.2.1] require symfony/process ~2.0 -> found symfony/process[2.0.4, ..., v2.8.52] but these were not loaded, because they are affected by security advisories ("PKSA-rkkf-636k-qjb3", "PKSA-wws7-mr54-jsny"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. - alchemy/zippy[0.3.0, ..., 0.4.8] require symfony/process ^2.1|^3.0 -> found symfony/process[v2.1.0, ..., v2.8.52, v3.0.0, ..., v3.4.47] but these were not loaded, because they are affected by security advisories ("PKSA-rkkf-636k-qjb3", "PKSA-wws7-mr54-jsny"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add their IDs to the "policy.advisories.ignore-id" config or add the package to "policy.advisories.ignore". To turn the feature off entirely, you can set "policy.advisories.block" to false. - alchemy/zippy 0.4.9 requires symfony/process ^2.1 || ^3.0 || ^4.0 -> found symfony/process[v2.1.0, ..., v2.8.52, v3.0.0, ..., v3.4.47, v4.0.0, ..., v4.4.44] but these were not loaded, because they are affected by security advisories ("PKSA-rkkf-636k-qjb3", "PKSA-wws7-mr54-jsny"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add

Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v3, actions/checkout@v3, actions/setup-java@v1, browser-actions/setup-chrome@v1. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

setup-java v1 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.