Skip to content

chore(deps): bump the composer group across 1 directory with 8 updates - #369

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5d2e010ccc
Closed

chore(deps): bump the composer group across 1 directory with 8 updates#369
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5d2e010ccc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 5 updates in the / directory:

Package From To
symfony/mailer 6.4.34 6.4.40
symfony/mailjet-mailer 6.4.34 6.4.40
twig/twig 3.23.0 3.27.0
guzzlehttp/guzzle 7.10.0 7.15.1
symfony/yaml 6.4.34 6.4.42

Updates symfony/mailer from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/mailer's releases.

v6.4.40

Changelog (symfony/mailer@v6.4.31...v6.4.40)

Commits
  • 94fd44f Merge branch '5.4' into 6.4
  • 5b5385b [Mailer] Add end-of-options separator before recipients in SendmailTransport;...
  • 602519c PHP CS Fixer: backports changes toward 6.4 branch
  • a2918c6 CS fixes - native_function_invocation & static_lambda
  • d56a83b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates symfony/mailjet-mailer from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/mailjet-mailer's releases.

v6.4.40

Changelog (symfony/mailjet-mailer@v6.4.35...v6.4.40)

v6.4.35

Changelog (symfony/mailjet-mailer@v6.4.34...v6.4.35)

Commits
  • 1b8100c [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials
  • 2e1486a [Mailer] [Mailjet] Fix inline attachments with custom Content-ID.
  • See full diff in compare view

Updates twig/twig from 3.23.0 to 3.27.0

Release notes

Sourced from twig/twig's releases.

v3.27.0

Changelog (twigphp/Twig@v3.26.0...v3.27.0)

  • security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders (@​fabpot)
  • security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (@​fabpot)
  • security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (@​fabpot)
  • security #535 Fix sandbox __toString bypasses via Traversable in join/replace filters and the in/not in operators (@​fabpot)
  • security #534 Fix sandbox bypass in the "column" filter under SourcePolicyInterface (@​fabpot)
  • feature #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions (@​fabpot)
  • feature #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@​fabpot)
  • bug #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@​fabpot)
  • bug #4807 Escape root profile name in HtmlDumper (@​fabpot)
  • bug #4808 Restrict allowed classes in Profile::unserialize() (@​fabpot)
  • feature #4803 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface (@​fabpot)

v3.26.0

Changelog (twigphp/Twig@v3.25.0...v3.26.0)

v3.25.0

Changelog (twigphp/Twig@v3.24.0...v3.25.0)

v3.24.0

Changelog (twigphp/Twig@v3.23.0...v3.24.0)

  • feature #3930 Add an html_attr function to make outputting HTML attributes easier (@​mpdude, @​polarbirke)
  • bug #4778 Fix null coalescing operator with imported macros (@​fabpot)
  • feature #4775 Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity (@​fabpot)
  • bug #4774 Ensure filters/attributes aren't mistaken for operators (@​brandonkelly)
  • feature #4771 Deprecate passing non AbstractExpression nodes to MatchesBinary (@​fabpot)
  • feature #4769 Deprecate passing a non-AbstractExpression node to Parser::setParent() (@​fabpot)
  • feature #4748 Support short-circuiting in null-safe operator chains (@​HypeMC)
  • feature #4743 Add html_attr_relaxed escaping strategy (@​mpdude)

... (truncated)

Changelog

Sourced from twig/twig's changelog.

3.27.0 (2026-05-27)

  • Add a strict mode to Twig\Sandbox\SecurityPolicy to opt-in to the 4.0 behavior for the extends/use tags and the parent/block/attribute functions, which are otherwise still implicitly allowed in a sandbox
  • Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
  • Fix sandbox filter/tag/function allow-list bypass when the sandbox state changed between renders of a cached Template instance
  • Fix PHP 8.1+ implicit float-to-int deprecation triggered by sandboxed ArrayAccess attribute access with a float key
  • Restrict allowed classes in Twig\Profiler\Profile::unserialize() to prevent arbitrary class instantiation
  • Escape root profile name in HtmlDumper
  • Fix sandbox bypass in deprecated internal wrappers twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() (src/Resources/core.php)
  • Deprecate the Twig\Sandbox\SourcePolicyInterface interface with no replacement
  • Fix sandbox bypass in the "column" filter when sandboxing is enabled via SourcePolicyInterface
  • Fix sandbox __toString bypass via Traversable arguments to the join and replace filters (also covers containers that implement both Stringable and Traversable)
  • Fix sandbox __toString bypass via the in and not in operators
  • Prevent a stack overflow in SandboxExtension::ensureToStringAllowed() when a self-referencing iterable is passed to a sandboxed template
  • Add support for any expression as a dynamic mapping key (attribute access, filters, ...)
  • Fix sandbox __toString policy bypass via dynamic mapping keys

3.26.0 (2026-05-20)

  • Document that the sandbox doesn't protect against resource exhaustion
  • Document template_from_string caveats when used in a sandboxed environment
  • Add docs on Markup about the goal of this class in the context of a sandbox
  • Pre-escape HTML input on the spaceless filter
  • Pre-escape HTML input on inline_css and inky_to_html filters
  • Fix XSS by adjusting is_safe annotation on HTML-emitting filters
  • [Profiler] Escape template and profile names in HtmlDumper
  • Fix unbounded memoisation of IntlDateFormatter / NumberFormatter
  • Fix sandbox bypass in the "column" filter
  • Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template
  • Fix sandbox bypass: PHP code injection via {% use %} template name
  • Fix sandbox bypass: PHP code injection via _self / import macro reference
  • Fix sandbox bypass in object destructuring assignment
  • Fix sandbox bypass: propagate Source to checkArrow for source-policy sandboxing
  • Encode single quotes as \x27 in Compiler::string() as a defense-in-depth measure
  • Fix sandbox __toString bypasses
  • Add Twig\Node\CoercesChildrenToStringInterface to let nodes declare which of their child nodes will be string-coerced at runtime so the sandbox wraps them with a __toString check

3.25.0 (2026-05-17)

  • Add a needs_is_sandboxed option for filters, functions, and tests
  • Use deterministic suffixes for generated embed classes
  • Lazy-load EscaperRuntime in EscaperExtension

3.24.0 (2026-03-17)

  • Deprecate not implementing the getOperatorTokens() method in ExpressionParserInterface implementations
  • Deprecate passing a non-AbstractExpression node to Twig\Node\Expression\Binary\MatchesBinary constructor
  • Deprecate passing a non-AbstractExpression node to Parser::setParent()
  • Add support for renaming variables in object destructuring ({name: userName} = user)
  • Add html_attr_relaxed escaping strategy that preserves :, @, [, and ] for front-end framework attribute names

... (truncated)

Commits
  • 04ae1bf Prepare the 3.27.0 release
  • 99a1038 security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox ...
  • 23eb6eb Fix sandbox filter/tag/function allow-list bypass when sandbox state changes ...
  • 7d55aa8 security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (...
  • 9fcf690 security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (...
  • 635cea4 Document new support for any expression as a dynamic mapping key
  • 9ff4101 Fix sandbox __toString policy bypass via dynamic mapping keys
  • baebc46 security #535 Fix sandbox __toString bypasses via Traversable in join/`...
  • e3f6665 Fix deprecation notices in tests
  • 475fb69 Guard sandbox __toString walker against self-referencing iterables
  • Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2

Security

7.14.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

... (truncated)

Commits

Updates symfony/mime from 6.4.34 to 6.4.41

Release notes

Sourced from symfony/mime's releases.

v6.4.41

Changelog (symfony/mime@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/mime@v6.4.37...v6.4.40)

v6.4.37

Changelog (symfony/mime@v6.4.36...v6.4.37)

v6.4.36

Changelog (symfony/mime@v6.4.35...v6.4.36)

v6.4.35

Changelog (symfony/mime@v6.4.34...v6.4.35)

Commits
  • 5575d37 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
  • 7ccfb0c Merge branch '5.4' into 6.4
  • 8f89d3a [Mime] Reject email addresses containing line breaks in Address
  • f2f05cb [Mime] Fix transient test
  • 330077b bug #64047 [Mime] Preserve inline part filename instead of overwriting it wit...
  • 4c7099f [Mime] Preserve inline part filename instead of overwriting it with the Conte...
  • e2ae51d [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType()
  • 3d48678 More CS fixes
  • 05099f5 CS fixes - native_function_invocation & static_lambda
  • f56fd2b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • Additional commits viewable in compare view

Updates symfony/polyfill-intl-idn from 1.33.0 to 1.38.1

Release notes

Sourced from symfony/polyfill-intl-idn's releases.

v1.38.1

Changelog (symfony/polyfill-intl-idn@v1.31.0...v1.38.1)

v1.37.0

Changelog (symfony/polyfill-intl-idn@v1.36.0...v1.37.0)

  • no significant changes

v1.36.0

Changelog (symfony/polyfill-intl-idn@v1.35.0...v1.36.0)

  • no significant changes

v1.35.0

Changelog (symfony/polyfill-intl-idn@v1.34.0...v1.35.0)

  • no significant changes

v1.34.0

Changelog (symfony/polyfill-intl-idn@v1.33.0...v1.34.0)

  • no significant changes
Commits
  • dc21118 [Intl][Idn] Reject xn-- labels whose Punycode payload decodes to ASCII-only
  • See full diff in compare view

Updates guzzlehttp/psr7 from 2.8.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

... (truncated)

Commits
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • 2cf293e Merge branch '2.12' into 2.13
  • c685419 Fold cross-origin host comparison without locale sensitivity (#852)
  • 226b5b3 Add locale-independent ASCII case folding helpers (#850)
  • 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
  • Additional commits viewable in compare view

Updates symfony/yaml from 6.4.34 to 6.4.42

Release notes

Sourced from symfony/yaml's releases.

v6.4.42

Changelog (symfony/yaml@v6.4.41...v6.4.42)

v6.4.41

Changelog (symfony/yaml@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/yaml@v6.4.39...v6.4.40)

v6.4.39

Changelog (symfony/yaml@v6.4.38...v6.4.39)

v6.4.38

Changelog (symfony/yaml@v6.4.34...v6.4.38)

Commits
  • 989dfb7 Unsafe unserialize phpstan rule
  • 907f845 Drop PR warning and auto-closing on subtree splits
  • 9bb6ebd [Yaml] Fix parsing inline anchored values
  • e8fdf34 CS fix
  • 69b7344 Merge branch '5.4' into 6.4
  • ae0bbb4 [Yaml] Allow trailing newlines after the end-of-document marker
  • 68dcd1f Merge branch '5.4' into 6.4
  • b0b2705 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking
  • 5a351ff [Yaml] Bound collection-alias resolution in the parser
  • e4fb993 [Yaml] Reject non-stringables when using "!!binary"
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the composer group across 1 directory with 8 updates
3b0628e 
Bumps the composer group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [symfony/mailer](https://github.com/symfony/mailer) | `6.4.34` | `6.4.40` |
| [symfony/mailjet-mailer](https://github.com/symfony/mailjet-mailer) | `6.4.34` | `6.4.40` |
| [twig/twig](https://github.com/twigphp/Twig) | `3.23.0` | `3.27.0` |
| [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) | `7.10.0` | `7.15.1` |
| [symfony/yaml](https://github.com/symfony/yaml) | `6.4.34` | `6.4.42` |



Updates `symfony/mailer` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/mailer/releases)
- [Changelog](https://github.com/symfony/mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailer@v6.4.34...v6.4.40)

Updates `symfony/mailjet-mailer` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/mailjet-mailer/releases)
- [Changelog](https://github.com/symfony/mailjet-mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailjet-mailer@v6.4.34...v6.4.40)

Updates `twig/twig` from 3.23.0 to 3.27.0
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.23.0...v3.27.0)

Updates `guzzlehttp/guzzle` from 7.10.0 to 7.15.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/8.0/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.15.1)

Updates `symfony/mime` from 6.4.34 to 6.4.41
- [Release notes](https://github.com/symfony/mime/releases)
- [Changelog](https://github.com/symfony/mime/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mime@v6.4.34...v6.4.41)

Updates `symfony/polyfill-intl-idn` from 1.33.0 to 1.38.1
- [Release notes](https://github.com/symfony/polyfill-intl-idn/releases)
- [Commits](symfony/polyfill-intl-idn@v1.33.0...v1.38.1)

Updates `guzzlehttp/psr7` from 2.8.0 to 2.13.0
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/3.0/CHANGELOG.md)
- [Commits](guzzle/psr7@2.8.0...2.13.0)

Updates `symfony/yaml` from 6.4.34 to 6.4.42
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v6.4.34...v6.4.42)

---
updated-dependencies:
- dependency-name: symfony/mailer
  dependency-version: 6.4.40
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: symfony/mailjet-mailer
  dependency-version: 6.4.40
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: twig/twig
  dependency-version: 3.27.0
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.1
  dependency-type: direct:development
  dependency-group: composer
- dependency-name: symfony/mime
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/polyfill-intl-idn
  dependency-version: 1.38.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/yaml
  dependency-version: 6.4.42
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Jul 21, 2026
@dependabot dependabot Bot mentioned this pull request Jul 21, 2026
Closed
@rubenvdlinde rubenvdlinde mentioned this pull request Aug 6, 2026
Merged
@rubenvdlinde

rubenvdlinde commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Closing: superseded by development, and targeting a branch where nothing verifies it.

This PR targets main, which is 729 commits behind development. It also collected no check runs at all beyond a neutral CodeQL — main still carries the old self-contained code-quality.yml, so nothing built or tested these bumps.

Every version proposed here is already met or exceeded on development:

package this PR targets main at development
axios 1.13.5 1.19.0
dompurify 2.5.8 3.4.13
handlebars 4.7.8 4.7.9
js-yaml 4.1.1 4.3.1
postcss 8.5.6 8.5.25
ws 8.19.0 8.21.2
form-data 4.0.5 4.0.6
twig/twig v3.23.0 v3.27.0
guzzlehttp/guzzle 7.10.0 7.15.2
guzzlehttp/psr7 2.8.0 2.13.0
symfony/mime v6.4.34 v7.4.12

shell-quote, websocket-driver and serialize-javascript are no longer in development's dependency tree at all.

Measured directly on development: 0 composer advisories, and after #443 0 critical / 0 high npm advisories.

main receives these fixes through the normal release flow (development → beta → main), not by bumping it directly. #445 repoints Dependabot at development so future PRs land where the gates run.

@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/composer/composer-5d2e010ccc branch August 6, 2026 11:17
rubenvdlinde added a commit that referenced this pull request Aug 6, 2026
@rubenvdlinde
chore(ci): point Dependabot at development, where the gates actually …
8f14a11 
…run (#445)

Dependabot targeted the DEFAULT branch `main`, which is 729 commits behind
`development` and carries a different lockfile. Two consequences, both bad:

1. The alert list measured the wrong tree. Open alerts claimed 5 critical /
   51 high; `development` actually had 1 critical / 2 high on npm and ZERO
   composer advisories (the critical twig/twig <3.26.0 alert is moot there —
   development is on 3.27.0).

2. The PRs were ungated. #368 and #369 collected no check runs at all beyond
   a neutral CodeQL, because `main` still carries the old self-contained
   code-quality workflow. An unverified dependency PR is how this fleet
   previously shipped an unbuildable image for two months.

Also adds the missing composer and github-actions ecosystems — composer had no
entry, so its only PRs were security updates against main.

Trade-off is stated in the file: security updates only ever target the default
branch, so these become version updates. A verified version update on
development beats an unmergeable security update on a dead main.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde