Photo.scr is not a Composr file, and does not appear in the Git repository, the server, my local checkout, and there's no reference to it in the code itself.

Something external must have infected Composr's directory. Either the upgrade is a coincidence, or somehow something injected itself into the upgrade process on your end.

Thank you I thought it was a weird file name to be in so many directories. Microsoft defender found and removed it. just wanted to check and see if I missed something. now I have to figure out how it got there.