RD-API-Server v1.6.3

Why upgrade

Several libraries the server ships had published security advisories:

Package	Was	Now	Advisories addressed
league/commonmark	2.8.2	2.10.3	unsafe-link and on* event-handler filter bypasses in AttributesExtension; multiple parser denial-of-service issues
guzzlehttp/guzzle	7.12.1	7.15.5	host-based checks bypassable with non-canonical hosts, among others
guzzlehttp/psr7	2.12.1	2.13.1	one moderate advisory
laravel/framework	13.16.1	13.33.0	no open advisory; brought current within 13.x

The runtime image moves to PHP 8.5.11 (from 8.5.8) and the bundled Compose to MariaDB
11.8.9 (from 11.8.8) — both patch releases in the same series, still pinned by digest.

Upgrading

Pull the new image and recreate the container as usual:

docker compose pull && docker compose up -d

If you use the bundled db service, the MariaDB patch update is applied when the container is
recreated; no dump/restore is needed within the 11.8 series.

Verification

• PHPUnit: 699 tests, 3714 assertions — pass
• Pint and PHPStan — pass
• composer audit and npm audit — no advisories
• Full CI gate set (runtime image smoke test on amd64/arm64, browser E2E) on the release PR