TuxCare rebuilt league/oauth2-client to address 3 CVEs. Fixed in 1.4.2-p1+tuxcare.
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_lang/packagist/CLSA-2026-1788257251.json"