chore(deps): update dependency coreruleset-v4-lts to v4.25.2 in config/_default/params.yaml

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
coreruleset-v4-lts	patch	4.25.1 → 4.25.2

---

Release Notes

coreruleset/coreruleset (coreruleset-v4-lts)

v4.25.2: (LTS)

Compare Source

v4.25.2 - 2026-10-02

Security Fixes

• Backport fix for [GHSA-575j-qr6p-9763] via adding REQUEST_FILENAME to the targets of the RCE rules, so command injection payloads placed in the URL path are inspected like those in ARGS (rules 932125-932390, except 932200, where every URL path contains the / it requires) (Max Leske)
• Backport fix for [GHSA-89h9-2j8h-9gp2] via lowercasing the charset parameter name before matching, so an uppercase or mixed-case CHARSET= in Content-Type can no longer skip the charset allow-list check (rule 920480) (Felipe Zipitría)
• Backport fix for [GHSA-qmx4-jfcv-fgww] via collecting every _charset_ value so a second multipart part or a query-string _charset_ can no longer shadow a disallowed charset (rule 922100) (Ervin Hegedüs)
• Backport fix removing a bypassable length bound in the SQL (X)OR injection detection (rule 942390) (Felipe Zipitría, cherry-pick of #​4713)
• Backport fix for [V29-260924] via tolerating trailing slashes as well as dots after the extension, so a PHP or JSP upload filename ending in / can no longer bypass the upload extension checks (rules 933110, 944140) (Felipe Zipitría, cherry-pick of #​4815)

Bug Fixes

• Backport false positive fix for the vega scanner user agent substring matching veganism.social (rule 913100) (Esad Cetiner, cherry-pick of #​4777)
• Backport fix so tx.crs_skip_response_analysis also skips the phase 4 response body rules; previously only the phase 3 header rules were skipped (new rule 950022) (Jozef Sudolský, cherry-pick of #​4807)

Other Changes

• Backport allowing and JSON-parsing application/*+json content types (including subtypes that contain a +, such as application/vc+ld+json) and the AWS application/x-amz-json-1.0/1.1 content types by default, so these JSON request bodies are no longer blocked by the content-type allow-list or left uninspected (new rules 901360, 901370) (Felipe Zipitría, cherry-pick of #​4775 and #​4828)
• Formalize rule 932171 (Shellshock, CVE-2014-6271) into a regex-assembly file and apply the standard [\s\x0b] whitespace-class normalization; the json. ARGS_NAMES prefix detection itself was already present on this branch via an untracked fix, so this is a maintainability/consistency change, not a functional fix (partial cherry-pick of #​4703)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Central YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5c015dfb-40d9-4f9e-bbf2-fc531bc16562

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}