fix(security): bump slim/slim to 4.15.2 (CVE-2026-48157)

[fabiodalez-dev]

composer audit now flags CVE-2026-48157 (reflected XSS in Slim's HtmlErrorRenderer, affecting >=4.4.0,<=4.15.1), which fails the Static quality checks gate on every PR and release. Patch bump within the existing ^4.13 constraint — no application code changes.

Verified: slim/slim 4.15.2, platform_check.php stays >= 80200 (php 8.2 pin intact), autoloader has 0 PHPStan refs, composer audit reports no advisories, app boots.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (7)

• composer.lock is excluded by !**/*.lock
• vendor/composer/autoload_classmap.php is excluded by !vendor/**
• vendor/composer/autoload_static.php is excluded by !vendor/**
• vendor/composer/installed.json is excluded by !vendor/**
• vendor/composer/installed.php is excluded by !vendor/**
• vendor/slim/slim/Slim/Error/Renderers/HtmlErrorRenderer.php is excluded by !vendor/**
• vendor/slim/slim/Slim/Routing/RouteCollector.php is excluded by !vendor/**

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b57da39d-a73e-47b4-b3d1-a45f3caa2989

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/slim-cve-2026-48157

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}