fix: patch vulnerable framework and build dependencies

tests/Unit/FilesystemPathSecurityTest.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace Tests\Unit;
+
+use League\Flysystem\CorruptedPathDetected;
+use League\Flysystem\WhitespacePathNormalizer;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+class FilesystemPathSecurityTest extends TestCase
+{
+    #[DataProvider('corruptedPaths')]
+    public function test_corrupted_paths_are_rejected(string $path): void
+    {
+        $this->expectException(CorruptedPathDetected::class);
+
+        (new WhitespacePathNormalizer)->normalizePath($path);
+    }
+
+    /**
+     * @return array<string, array{string}>
+     */
+    public static function corruptedPaths(): array
+    {
+        return [
+            'control character' => ["avatars/user\x00.svg"],
+            'malformed UTF-8' => ["avatars/user\xFF.svg"],
+            'control character hidden by malformed UTF-8' => ["avatars/user\xFF\x00.svg"],
+        ];
+    }
+
+    public function test_valid_unicode_paths_remain_supported(): void
+    {
+        $this->assertSame(
+            'avatars/benützer.svg',
+            (new WhitespacePathNormalizer)->normalizePath('./avatars//benützer.svg'),
+        );
+    }
+}