>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3585060. --> Reported by: [penyaskito](https://www.drupal.org/user/959536) Related to !924 >>> <h3 id="overview">Overview</h3> <pre>No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.<br>Loading composer repositories with package information<br>Updating dependencies<br>Your requirements could not be resolved to an installable set of packages.<br>&nbsp; Problem 1<br>&nbsp;&nbsp;&nbsp; - Root composer.json requires drupal/core-recommended 11.3.6 -&gt; satisfiable by drupal/core-recommended[11.3.6].<br>&nbsp;&nbsp;&nbsp; - drupal/core-recommended 11.3.6 requires drupal/core 11.3.6 -&gt; found drupal/core[11.3.6] but these were not loaded, because they are affected by security advisories ("SA-CORE-2026-001", "SA-CORE-2026-003", "SA-CORE-2026-002"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.</pre><p>after today's security releases.</p> <h3 id="proposed-resolution">Proposed resolution</h3> <p>Pin Drupal core to latest security releases.<br> Also: <a href="https://github.com/phpstan/phpstan/releases/tag/2.1.48">PHPStan 2.1.48</a> release 29 minutes ago.</p> <h3 id="ui-changes">User interface changes</h3>