[r-brown]

fix: harden signature verification and support PHP 8.2-8.5 19 + runs-on: ubuntu-24.04
20 strategy:
Dependencies 21 fail-fast: false

• Replace unmaintained fr3d/xmldsig with a direct robrichards/xmlseclibs 22 matrix:
  ^3.1.5 requirement (fixes CVE-2025-66578 and CVE-2026-32313, which could 23 - php-version: ['8.2', '8.3', '8.4']
  bypass digest/signature validation). Drops the needless ext-soap 23 + php-version: ['8.2', '8.3', '8.4', '8.5']
  requirement and the PHP 8.4+ deprecation warnings. 24
• Require ext-openssl and ext-libxml explicitly. 25 steps:
• phpunit ^10.5 -> ^11.5.50 (10.x is EOL; fixes CVE-2026-24765). 26 - uses: actions/checkout@v7
  30 with:
  Bug fixes 31 php-version: ${{ matrix.php-version }}
• ValidationService::validateOffline() accepted a correctly signed file but 32 coverage: none
  always returned empty results and ignored $meta. The signed XML is now 33 + extensions: curl, dom, libxml, mbstring, openssl
  converted to the same structure the online call returns. 34 tools: composer:v2
• Offline validation: empty or malformed XML now throws 35
  MalformedArgumentsException instead of PHP warnings or a ValueError. 36 - name: Validate composer manifests
  XML is loaded with LIBXML_NONET. 48 - name: Install dependencies
• NetLicensingService: clear the Authorization header for anonymous 49 run: composer install --prefer-dist --no-progress --no-interaction
  contexts. The curl instance is shared, so credentials from a previous 50
  call were being sent. 51 + - name: Audit dependencies for known vulnerabilities
• NetLicensingCurl::buildPostData(): escape the key in the regex and 52 + run: composer audit
  restore repeated-key encoding (discount=a&discount=b). With 53 +
  php-curl-class 13 it came out as discount[0]=a&discount[1]=b. 54 - name: Run PHPUnit
• examples: fix resource paths (DIR . '../resources' was wrong). 55 run: vendor/bin/phpunit --testsuite "Application Test Suite"
  56
  Tests and CI 57 - name: Run demo scenario (latest PHP)
• Replace DummyTest with 13 tests: signature accept/reject (wrong key, 54 - if: matrix.php-version == '8.4'
  tampered content, tampered signature, missing signature), comment 58 + if: matrix.php-version == '8.5'
  injection, malformed/empty input, XXE, credential isolation, and 59 run: |
  post-data encoding. 60 cd demo
• phpunit.xml: fail on deprecations and notices. 61 php NetLicensingDemo.php
• CI matrix PHP 8.2-8.5, ubuntu-24.04, composer audit step, nightly 62
  dependency test on 8.2 and 8.5.
• README: document supported PHP versions and the minimum patched ────────────────────────────────────────────────────────────────────────────────────────
  runtimes for CVE-2026-109618/109619 (8.2.35, 8.3.36, 8.4.27, 8.5.12). .github/workflows/netlicensing-php-dependency-test.yml
  ────────────────────────────────────────────────────────────────────────────────────────
  Verified on PHP 8.2, 8.3, 8.4 and 8.5: phpunit passes, composer validate 10
  --strict passes, composer audit is clean. Also passes with 11 jobs:
  --prefer-lowest on 8.2 and 8.5.