Addresses code review feedback on PR #1238 covering workflow misconfigurations, PHP 8.4+ compatibility issues, security vulnerabilities, and language key naming violations.

Workflow Fixes

• composer-update.yml: Check both composer.lock and composer.json for changes; parse advisories array instead of checking file size
• docker.yml: Replace docker-compose (v1) with docker compose (v2)
• phpstan.yml: Add pull_request trigger to enable PR comments
• pint.yml: Add forked PR guard; replace --dirty with git diff-based file detection (actions/checkout produces clean tree)
• quickstart.yml: Remove Laravel commands (artisan migrate); use CodeIgniter config
• release.yml: Check application/language/english instead of resources/lang/en
• yarn-update.yml: Check both yarn.lock and package.json for changes

PHP Compatibility & Security

file_security_helper.php: Replace mb_rtrim() with rtrim() (PHP 8.4+ function):

// Before (breaks on PHP <8.4)
$realBaseWithSep = mb_rtrim($realBase, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;

// After (compatible)
$realBaseWithSep = rtrim($realBase, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;

mailer_helper.php: Fix referer validation host spoofing vulnerability:

// Before (vulnerable to prefix attacks)
if (!empty($referer) && str_starts_with($referer, $base_url)) {

// After (validates scheme, host, port)
$referer_parts = parse_url($referer);
$base_url_parts = parse_url($base_url);
// Compare normalized scheme, host, port

ClientTitleEnum.php: Fix tryFrom() false-positive on index 0:

// Before (treats index 0 as "not found", returns index instead of value)
if ($searchResult) {
    $returnObject->value = $searchResult;

// After (strict comparison, returns matched value)
if ($searchResult !== false) {
    $returnObject->value = $values[$searchResult];

Language Key Refactoring

Rename '417_barcode_*' → 'pdf_417_barcode_*' (12 keys) to follow text-prefix convention. Update labels to be country-agnostic:

• '417_barcode_settings_enable': "Enable PDF 417 Barcode for croatian clients" → "Enable PDF 417 Barcode"
• '417_barcode_settings_enable_hint': Remove country reference while keeping technical requirements

Updated 44 references in partial_settings_invoices.php (settings form fields, labels, trans() calls).

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.