TicketsCAD v4.2.29

Administrators, after updating: run composer install as well as php sql/run_migrations.php, to
pick up the library update under Security below. If your maps use Dark or Light, get a free CARTO key
(see Fixed) and enter it in Settings → Tile Providers.

Fixed

• The Dark and Light maps showed "API KEY REQUIRED" on every tile. CARTO, which draws them,
  began requiring a free key in September 2026, and the built-in Dark and Light layers still used
  CARTO's old keyless address. Dark is where maps start in dark mode, so most maps were affected.
  Get a key at carto.com/basemaps/apikey (free, no account) and enter it in Settings → Tile
  Providers → "CARTO key for the Dark and Light maps". Until a key is set, Dark and Light are drawn
  from OpenStreetMap instead, recoloured, and go through the tile proxy like Street. The browser's
  security policy also blocked CARTO's keyed address, which affected CARTO chosen as the configured
  provider too (#150); it is now allowed.

Security

• symfony/http-foundation updated from 6.4.42 to 6.4.48 for CVE-2026-108082, a denial of service
  through a crafted Cache-Control request header. TicketsCAD does not call the affected code: the
  package arrives with the Ratchet library that the Zello proxy runs on, and inside Ratchet only the
  session component uses it, which TicketsCAD does not load. It is updated so composer audit stays
  clean. After git pull, run composer install to pick up the new version.