In @.github/workflows/composer-update.yml:
- Around line 50-58: The current workflow step "Run Composer audit" uses a file
size check on audit-report.json which is a false positive because composer audit
emits {"advisories": {}} even when no issues exist; change the check to parse
the JSON and inspect the "advisories" object instead (for example, use jq or a
short python snippet to test if .advisories is empty) and set the GITHUB_OUTPUT
variable "vulnerabilities_found" to true only when .advisories contains entries;
update the step with the id "audit" to replace the -s audit-report.json
conditional with a JSON-aware check against .advisories.

In @.github/workflows/phpstan.yml:
- Around line 65-66: The "Comment on PR (if available)" step has an unreachable
condition (github.event_name == 'pull_request') because this workflow only
triggers on workflow_dispatch; update the workflow trigger or the step
condition: either add pull_request to the top-level on: triggers in this
phpstan.yml so the condition can be true, or change/remove the step's if: guard
and instead use a trigger/condition that matches how you intend to run it (e.g.,
use workflow_run or check github.event_name == 'workflow_run' / pass a PR
context from a caller) so the step can actually execute; locate the step by its
name "Comment on PR (if available)" to apply the change.

In @.github/workflows/phpunit.yml:
- Around line 37-49: The workflow contains Laravel-specific steps (php artisan
key:generate, php artisan test) and references .env.testing.example which are
not applicable to this CodeIgniter 3.3 project; remove or replace those lines
and instead run PHPUnit directly (e.g., vendor/bin/phpunit or phpunit) with the
repository's phpunit.xml configuration, ensure tests use the project's
configuration file (ipconfig.php) by copying or linking it into the test
environment before running tests, and delete any references to artisan commands
(php artisan key:generate, php artisan migrate, php artisan db:seed) so the CI
either runs CodeIgniter-compatible PHPUnit steps or the workflow is removed if
tests are not intended to run.

In @.github/workflows/pint.yml:
- Around line 93-101: The "Commit and Push Changes" workflow step currently
always runs git push and will fail for forked PRs because GITHUB_TOKEN is
read-only; update the step's if condition (the step named "Commit and Push
Changes" that already checks steps.verify_diff.outputs.has_changes) to also
require that the run is not a forked pull request by validating same-repo or
non-pull_request contexts (for example, require
github.event.pull_request.head.repo.full_name == github.repository or require
github.event_name != 'pull_request' / github.ref startsWith 'refs/heads/' for
manual/branch runs) so the push only runs when the action has push permission.

In @.github/workflows/quickstart.yml:
- Around line 64-65: The workflow currently runs the "Run database migrations"
step which invokes `php artisan migrate --force` unconditionally and will fail
without a DB; either remove or comment out that step (the step named "Run
database migrations" invoking `php artisan migrate --force`) if smoke tests
don't need DB, or alternatively ensure tests use an in-memory SQLite by updating
`.env.testing.example` to set DB_CONNECTION=sqlite and DB_DATABASE=:memory:, or
re-enable the MySQL service in the workflow so migrations can run; pick one
approach and apply it consistently so the `php artisan migrate --force` step no
longer fails.

In @.github/workflows/release.yml:
- Around line 425-439: The workflow step "Create GitHub Draft Pre-Release"
currently uses softprops/action-gh-release@v1 which is deprecated; update the
action reference to the v2 release (e.g., softprops/action-gh-release@v2 or
`@v2.5.0`) in the step that defines tag_name/name/body_path/files/draft/prerelease
so the newer action is used; after changing the version, verify input names
(tag_name, name, body_path, files, draft, prerelease) still match v2 docs and
adjust any differences in parameter names or behavior for the step if needed.

In @.github/workflows/test-php.yml:
- Around line 3-4: The workflow trigger was changed to only workflow_dispatch
which disables automatic PR testing; restore automatic runs by adding the
pull_request trigger back alongside workflow_dispatch (e.g., include a top-level
triggers block that contains both pull_request and workflow_dispatch) so tests
run on PR open/update while still allowing manual dispatch; update the
workflow's on: stanza to include both triggers.

In @.github/workflows/yarn-update.yml:
- Around line 107-131: The security-only upgrade step currently uses the command
referenced as yarn upgrade "$pkg" --latest which can bump across major versions;
change it to use yarn upgrade "$pkg" (remove --latest) so upgrades respect
existing semver ranges in package.json and avoid breaking major-version jumps
for the packages gathered in VULNERABLE_PACKAGES; ensure the loop that echoes
and calls yarn upgrade uses the updated command.

In `@application/helpers/file_security_helper.php`:
- Line 87: The code uses mb_rtrim (e.g., when building $realBaseWithSep in
file_security_helper.php) which exists only in PHP 8.4+, causing fatal errors on
the declared PHP 8.1+ target; replace mb_rtrim with the multibyte-safe rtrim (or
call rtrim with a UTF-8-aware normalization step) so the code runs on PHP
8.1–8.3, and apply the same replacement to other occurrences (index.php lines
around 209/248/275, phpmailer_helper.php usage, pdf_helper.php,
dropzone_helper.php) or alternatively update the project minimum PHP requirement
and Setup.php PHP version check to 8.4.0 to match mb_rtrim usage.

In `@application/helpers/mailer_helper.php`:
- Around line 248-260: Replace the brittle str_starts_with() origin check with a
same-origin comparison that parses and compares URL components: call parse_url()
on both base_url() and $_SERVER['HTTP_REFERER'], ensure scheme, host and port
(normalize default ports) match before assigning $redirect = $referer, and treat
root-relative referers (starting with "/") as safe; otherwise set $redirect =
base_url(); apply the same fix where str_starts_with is used (mailer_helper.php
logic around $_SERVER['HTTP_REFERER'] and the Sessions controller check) and
keep the final redirect($redirect) behavior unchanged.

In `@application/modules/clients/Enums/ClientTitleEnum.php`:
- Around line 20-31: The tryFrom method mis-handles array_search results and
returns the index instead of the matched string: change the truthy check to a
strict !== false (i.e. if ($searchResult !== false)) and set the returned
object's value to the actual string from getValues() (e.g. $returnObject->value
= $values[$searchResult] or simply $value) so lookups like 'mr' (index 0)
succeed and callers get the string value; keep the StdClass return pattern and
leave other behavior untouched.

In @.github/workflows/composer-update.yml:
- Around line 93-99: The "Run smoke tests" workflow step currently invokes
Laravel-specific commands ("php artisan key:generate" and "php artisan test")
which are not applicable to CodeIgniter 3; update that step (named "Run smoke
tests") to remove those artisan commands and replace them with CI3-appropriate
checks such as running PHPUnit directly (e.g., "php vendor/bin/phpunit
--configuration phpunit.smoke.xml --env=testing") or a lightweight CI3 bootstrap
check (e.g., a script that loads index.php or runs a CI3 smoke test suite); also
remove or reconsider "continue-on-error: true" so the step reports meaningful
failures.

In @.github/workflows/phpstan.yml:
- Around line 33-45: The workflow step "Parse and format PHPStan results" (id:
parse-results) references a missing script
`.github/scripts/parse-phpstan-results.php`; fix by either adding that script to
the repository with the expected name and executable contents or update the step
to call the correct existing script path/filename that parses phpstan.json;
ensure the replacement path is committed and executable and that the step still
writes output to phpstan-report.md and returns appropriate exit codes on
failure.
- Around line 19-24: Replace the missing composite action reference by switching
the job step that currently uses "uses: ./.github/actions/setup-php-composer" to
a public action (e.g. "shivammathur/setup-php") and align the PHP version to
match the test matrix (change php-version from '8.4' to '8.2'); preserve the
php-extensions ('json') and composer-flags (--prefer-dist --no-interaction
--no-progress) in the step inputs for parity with the original intent, or
alternatively add the actual composite action file under
.github/actions/setup-php-composer if you prefer a local action.

In @.github/workflows/pint.yml:
- Around line 14-17: Update the pull_request branches list so the workflow
triggers on the repo's actual default branch: under the pull_request -> branches
array replace the non-existent "develop" entry with "development" (leaving
"master" as-is if needed) so the workflow's branch filter matches the real
branch names.

In @.github/workflows/release.yml:
- Around line 197-202: The workflow currently deletes all mPDF fonts except
those matching the pattern '! -name "DejaVu*"', which will break PDFs for
non-Latin scripts; replace that hardcoded filter with a configurable keep-list
by reading an environment variable (e.g., MPDF_KEEP_FONTS or MPDF_LOCALES) and
use it to build the find exclusion list (replace the '! -name "DejaVu*"' token
with generated '! -name "<font1>*" -o ! -name "<font2>*"' etc.), or
alternatively preserve a curated set of additional Unicode fonts (e.g.,
FreeSerif, Quivira) by changing the filter to '! -name "DejaVu*" -o ! -name
"FreeSerif*" -o ! -name "Quivira*"', and ensure the QR cleanup (rm -rf
vendor/mpdf/mpdf/src/QrCode/data/*) remains unchanged; also update workflow
docs/comments to explain the new MPDF_KEEP_FONTS variable and its impact on
non-Latin PDFs.
- Around line 76-79: Update the directory existence validation in the shell
if-block that currently checks for "resources/lang/en" (the Laravel path);
change it to verify the CodeIgniter directory "application/language/english"
instead so the if [ ! -d "resources/lang/en" ] check becomes an if [ ! -d
"application/language/english" ] check and the error message is updated to
reference application/language/english.

In @.github/workflows/yarn-update.yml:
- Around line 203-211: The workflow step with id "updated-packages" calls the
missing script ".github/scripts/generate-package-update-report.cjs" and will
fail when steps.check-changes.outputs.changes_detected == 'true'; fix by either
adding the script at .github/scripts/generate-package-update-report.cjs or make
the step robust—modify the step's run to first test for the script's existence
(or add a conditional using exists check) and skip generating the report if not
present, ensuring the step name "Get updated packages" and the condition
steps.check-changes.outputs.changes_detected remain correct.

In `@application/helpers/mailer_helper.php`:
- Around line 250-278: The root-relative referer check using
str_starts_with($referer, '/') is allowing protocol-relative URLs like
//evil.com; update the logic around $referer (the initial root-relative branch)
to only treat single-leading-slash paths as safe by rejecting or excluding
values that start with '//' (e.g., require str_starts_with($referer, '/') &&
!str_starts_with($referer, '//') or equivalent), leaving the existing
same-origin parse_url-based validation (the base_url/parse_url block that
compares $base_scheme/$base_host/$base_port with
$referer_scheme/$referer_host/$referer_port) unchanged and defaulting to
base_url() when validation fails.

In `@application/modules/sessions/controllers/Sessions.php`:
- Around line 528-573: The current _get_safe_referer method treats any string
starting with '/' as safe, which incorrectly allows protocol-relative referers
like '//evil.com'; update _get_safe_referer to explicitly reject referers that
start with '//' by checking for that prefix before the root-relative shortcut
(i.e., ensure str_starts_with($referer, '//') leads to using the safe default),
then keep the existing handling for single-leading-slash paths and full
same-origin URL checks so only true root-relative paths ('/path') and
same-origin absolute URLs are allowed.