Skip to content

chore(deps): bump the composer group across 1 directory with 8 updates - #454

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-a4381639c2
Closed

chore(deps): bump the composer group across 1 directory with 8 updates#454
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-a4381639c2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the composer group with 5 updates in the / directory:

Package From To
symfony/mailer 6.4.34 6.4.40
symfony/mailjet-mailer 6.4.34 6.4.40
twig/twig 3.23.0 3.27.0
guzzlehttp/guzzle 7.10.0 7.15.2
symfony/yaml 6.4.34 6.4.43

Updates symfony/mailer from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/mailer's releases.

v6.4.40

Changelog (symfony/mailer@v6.4.31...v6.4.40)

Commits
  • 94fd44f Merge branch '5.4' into 6.4
  • 5b5385b [Mailer] Add end-of-options separator before recipients in SendmailTransport;...
  • 602519c PHP CS Fixer: backports changes toward 6.4 branch
  • a2918c6 CS fixes - native_function_invocation & static_lambda
  • d56a83b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates symfony/mailjet-mailer from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/mailjet-mailer's releases.

v6.4.40

Changelog (symfony/mailjet-mailer@v6.4.35...v6.4.40)

v6.4.35

Changelog (symfony/mailjet-mailer@v6.4.34...v6.4.35)

Commits
  • 1b8100c [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials
  • 2e1486a [Mailer] [Mailjet] Fix inline attachments with custom Content-ID.
  • See full diff in compare view

Updates twig/twig from 3.23.0 to 3.27.0

Release notes

Sourced from twig/twig's releases.

v3.27.0

Changelog (twigphp/Twig@v3.26.0...v3.27.0)

  • security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders (@​fabpot)
  • security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (@​fabpot)
  • security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (@​fabpot)
  • security #535 Fix sandbox __toString bypasses via Traversable in join/replace filters and the in/not in operators (@​fabpot)
  • security #534 Fix sandbox bypass in the "column" filter under SourcePolicyInterface (@​fabpot)
  • feature #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions (@​fabpot)
  • feature #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@​fabpot)
  • bug #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@​fabpot)
  • bug #4807 Escape root profile name in HtmlDumper (@​fabpot)
  • bug #4808 Restrict allowed classes in Profile::unserialize() (@​fabpot)
  • feature #4803 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface (@​fabpot)

v3.26.0

Changelog (twigphp/Twig@v3.25.0...v3.26.0)

v3.25.0

Changelog (twigphp/Twig@v3.24.0...v3.25.0)

v3.24.0

Changelog (twigphp/Twig@v3.23.0...v3.24.0)

  • feature #3930 Add an html_attr function to make outputting HTML attributes easier (@​mpdude, @​polarbirke)
  • bug #4778 Fix null coalescing operator with imported macros (@​fabpot)
  • feature #4775 Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity (@​fabpot)
  • bug #4774 Ensure filters/attributes aren't mistaken for operators (@​brandonkelly)
  • feature #4771 Deprecate passing non AbstractExpression nodes to MatchesBinary (@​fabpot)
  • feature #4769 Deprecate passing a non-AbstractExpression node to Parser::setParent() (@​fabpot)
  • feature #4748 Support short-circuiting in null-safe operator chains (@​HypeMC)
  • feature #4743 Add html_attr_relaxed escaping strategy (@​mpdude)

... (truncated)

Changelog

Sourced from twig/twig's changelog.

3.27.0 (2026-05-27)

  • Add a strict mode to Twig\Sandbox\SecurityPolicy to opt-in to the 4.0 behavior for the extends/use tags and the parent/block/attribute functions, which are otherwise still implicitly allowed in a sandbox
  • Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
  • Fix sandbox filter/tag/function allow-list bypass when the sandbox state changed between renders of a cached Template instance
  • Fix PHP 8.1+ implicit float-to-int deprecation triggered by sandboxed ArrayAccess attribute access with a float key
  • Restrict allowed classes in Twig\Profiler\Profile::unserialize() to prevent arbitrary class instantiation
  • Escape root profile name in HtmlDumper
  • Fix sandbox bypass in deprecated internal wrappers twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() (src/Resources/core.php)
  • Deprecate the Twig\Sandbox\SourcePolicyInterface interface with no replacement
  • Fix sandbox bypass in the "column" filter when sandboxing is enabled via SourcePolicyInterface
  • Fix sandbox __toString bypass via Traversable arguments to the join and replace filters (also covers containers that implement both Stringable and Traversable)
  • Fix sandbox __toString bypass via the in and not in operators
  • Prevent a stack overflow in SandboxExtension::ensureToStringAllowed() when a self-referencing iterable is passed to a sandboxed template
  • Add support for any expression as a dynamic mapping key (attribute access, filters, ...)
  • Fix sandbox __toString policy bypass via dynamic mapping keys

3.26.0 (2026-05-20)

  • Document that the sandbox doesn't protect against resource exhaustion
  • Document template_from_string caveats when used in a sandboxed environment
  • Add docs on Markup about the goal of this class in the context of a sandbox
  • Pre-escape HTML input on the spaceless filter
  • Pre-escape HTML input on inline_css and inky_to_html filters
  • Fix XSS by adjusting is_safe annotation on HTML-emitting filters
  • [Profiler] Escape template and profile names in HtmlDumper
  • Fix unbounded memoisation of IntlDateFormatter / NumberFormatter
  • Fix sandbox bypass in the "column" filter
  • Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template
  • Fix sandbox bypass: PHP code injection via {% use %} template name
  • Fix sandbox bypass: PHP code injection via _self / import macro reference
  • Fix sandbox bypass in object destructuring assignment
  • Fix sandbox bypass: propagate Source to checkArrow for source-policy sandboxing
  • Encode single quotes as \x27 in Compiler::string() as a defense-in-depth measure
  • Fix sandbox __toString bypasses
  • Add Twig\Node\CoercesChildrenToStringInterface to let nodes declare which of their child nodes will be string-coerced at runtime so the sandbox wraps them with a __toString check

3.25.0 (2026-05-17)

  • Add a needs_is_sandboxed option for filters, functions, and tests
  • Use deterministic suffixes for generated embed classes
  • Lazy-load EscaperRuntime in EscaperExtension

3.24.0 (2026-03-17)

  • Deprecate not implementing the getOperatorTokens() method in ExpressionParserInterface implementations
  • Deprecate passing a non-AbstractExpression node to Twig\Node\Expression\Binary\MatchesBinary constructor
  • Deprecate passing a non-AbstractExpression node to Parser::setParent()
  • Add support for renaming variables in object destructuring ({name: userName} = user)
  • Add html_attr_relaxed escaping strategy that preserves :, @, [, and ] for front-end framework attribute names

... (truncated)

Commits
  • 04ae1bf Prepare the 3.27.0 release
  • 99a1038 security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox ...
  • 23eb6eb Fix sandbox filter/tag/function allow-list bypass when sandbox state changes ...
  • 7d55aa8 security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (...
  • 9fcf690 security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (...
  • 635cea4 Document new support for any expression as a dynamic mapping key
  • 9ff4101 Fix sandbox __toString policy bypass via dynamic mapping keys
  • baebc46 security #535 Fix sandbox __toString bypasses via Traversable in join/`...
  • e3f6665 Fix deprecation notices in tests
  • 475fb69 Guard sandbox __toString walker against self-referencing iterables
  • Additional commits viewable in compare view

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.2

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.2

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.2 - 2026-07-26

Security

Fixed

  • Preserve RequestException when the stream handler rejects a request before opening a stream

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

... (truncated)

Commits

Updates symfony/mime from 6.4.34 to 6.4.43

Release notes

Sourced from symfony/mime's releases.

v6.4.43

Changelog (symfony/mime@v6.4.41...v6.4.43)

v6.4.41

Changelog (symfony/mime@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/mime@v6.4.37...v6.4.40)

v6.4.37

Changelog (symfony/mime@v6.4.36...v6.4.37)

v6.4.36

Changelog (symfony/mime@v6.4.35...v6.4.36)

v6.4.35

Changelog (symfony/mime@v6.4.34...v6.4.35)

Commits
  • 38421e1 [HttpKernel][Mime][Serializer] Scope the new regression tests to the componen...
  • 11f670c [Serializer] Check the denormalized class is a Mime part in MimeMessageNormal...
  • 34ed849 [Mime] Fix dropped whitespace between multiple encoded words
  • 4f0be2e Drop PR warning and auto-closing on subtree splits
  • 5575d37 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
  • 7ccfb0c Merge branch '5.4' into 6.4
  • 8f89d3a [Mime] Reject email addresses containing line breaks in Address
  • f2f05cb [Mime] Fix transient test
  • 330077b bug #64047 [Mime] Preserve inline part filename instead of overwriting it wit...
  • 4c7099f [Mime] Preserve inline part filename instead of overwriting it with the Conte...
  • Additional commits viewable in compare view

Updates symfony/polyfill-intl-idn from 1.33.0 to 1.38.1

Release notes

Sourced from symfony/polyfill-intl-idn's releases.

v1.38.1

Changelog (symfony/polyfill-intl-idn@v1.31.0...v1.38.1)

v1.37.0

Changelog (symfony/polyfill-intl-idn@v1.36.0...v1.37.0)

  • no significant changes

v1.36.0

Changelog (symfony/polyfill-intl-idn@v1.35.0...v1.36.0)

  • no significant changes

v1.35.0

Changelog (symfony/polyfill-intl-idn@v1.34.0...v1.35.0)

  • no significant changes

v1.34.0

Changelog (symfony/polyfill-intl-idn@v1.33.0...v1.34.0)

  • no significant changes
Commits
  • dc21118 [Intl][Idn] Reject xn-- labels whose Punycode payload decodes to ASCII-only
  • See full diff in compare view

Updates guzzlehttp/psr7 from 2.8.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

... (truncated)

Commits
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • 2cf293e Merge branch '2.12' into 2.13
  • c685419 Fold cross-origin host comparison without locale sensitivity (#852)
  • 226b5b3 Add locale-independent ASCII case folding helpers (#850)
  • 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
  • Additional commits viewable in compare view

Updates symfony/yaml from 6.4.34 to 6.4.43

Release notes

Sourced from symfony/yaml's releases.

v6.4.43

Changelog (symfony/yaml@v6.4.42...v6.4.43)

v6.4.42

Changelog (symfony/yaml@v6.4.41...v6.4.42)

v6.4.41

Changelog (symfony/yaml@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/yaml@v6.4.39...v6.4.40)

v6.4.39

Changelog (symfony/yaml@v6.4.38...v6.4.39)

v6.4.38

Changelog (symfony/yaml@v6.4.34...v6.4.38)

Commits
  • d2ee2da bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strin...
  • aa06ec5 [Yaml] Fix parsing and dumping of NaN
  • 05d1794 [Yaml] Fix parsing of integers with a leading plus sign
  • e4d98a3 [Yaml] Fix line folding after trailing backslashes in quoted strings
  • 989dfb7 Unsafe unserialize phpstan rule
  • 907f845 Drop PR warning and auto-closing on subtree splits
  • 9bb6ebd [Yaml] Fix parsing inline anchored values
  • e8fdf34 CS fix
  • 69b7344 Merge branch '5.4' into 6.4
  • ae0bbb4 [Yaml] Allow trailing newlines after the end-of-document marker
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the composer group across 1 directory with 8 updates
b5964e2 
Bumps the composer group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [symfony/mailer](https://github.com/symfony/mailer) | `6.4.34` | `6.4.40` |
| [symfony/mailjet-mailer](https://github.com/symfony/mailjet-mailer) | `6.4.34` | `6.4.40` |
| [twig/twig](https://github.com/twigphp/Twig) | `3.23.0` | `3.27.0` |
| [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) | `7.10.0` | `7.15.2` |
| [symfony/yaml](https://github.com/symfony/yaml) | `6.4.34` | `6.4.43` |



Updates `symfony/mailer` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/mailer/releases)
- [Changelog](https://github.com/symfony/mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailer@v6.4.34...v6.4.40)

Updates `symfony/mailjet-mailer` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/mailjet-mailer/releases)
- [Changelog](https://github.com/symfony/mailjet-mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailjet-mailer@v6.4.34...v6.4.40)

Updates `twig/twig` from 3.23.0 to 3.27.0
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.23.0...v3.27.0)

Updates `guzzlehttp/guzzle` from 7.10.0 to 7.15.2
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/7.15.2/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.15.2)

Updates `symfony/mime` from 6.4.34 to 6.4.43
- [Release notes](https://github.com/symfony/mime/releases)
- [Changelog](https://github.com/symfony/mime/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mime@v6.4.34...v6.4.43)

Updates `symfony/polyfill-intl-idn` from 1.33.0 to 1.38.1
- [Release notes](https://github.com/symfony/polyfill-intl-idn/releases)
- [Commits](symfony/polyfill-intl-idn@v1.33.0...v1.38.1)

Updates `guzzlehttp/psr7` from 2.8.0 to 2.13.0
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/3.0/CHANGELOG.md)
- [Commits](guzzle/psr7@2.8.0...2.13.0)

Updates `symfony/yaml` from 6.4.34 to 6.4.43
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v6.4.34...v6.4.43)

---
updated-dependencies:
- dependency-name: symfony/mailer
  dependency-version: 6.4.40
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: symfony/mailjet-mailer
  dependency-version: 6.4.40
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: twig/twig
  dependency-version: 3.27.0
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.2
  dependency-type: direct:development
  dependency-group: composer
- dependency-name: symfony/mime
  dependency-version: 6.4.43
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/polyfill-intl-idn
  dependency-version: 1.38.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/yaml
  dependency-version: 6.4.43
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 8, 2026
@rubenvdlinde

rubenvdlinde commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

Closing as superseded by development. Measured, per package, against origin/development@0bb4d3d5.

Package PR wants on development
symfony/mailer 6.4.40 v6.4.40 at target — includes the CVE-2026-45068 SendmailTransport fix this PR cites
symfony/mailjet-mailer 6.4.40 v6.4.40 at target
twig/twig 3.27.0 v3.27.0 at target
guzzlehttp/guzzle 7.15.2 7.15.2 at target
symfony/yaml 6.4.43 v6.4.40 three patches behind

Four of five are already at the exact version this PR proposes. The fifth, symfony/yaml 6.4.40 → 6.4.43, carries no advisory: composer audit on development is clean, and hydra-gates gate-4 (composer-audit) reports PASS on a full-tree run of origin/development. Nothing security-relevant is lost by closing.

Why this landed on main at all

main is 740 commits behind development and carries a different composer.lock — the tree this PR measures is not the tree anyone develops on. #445 set target-branch: development for exactly that reason.

That redirect is currently inert: Dependabot reads .github/dependabot.yml from the repository's default branch, which is main, and main has no .github/dependabot.yml. Verified by directory listing rather than a per-file lookup — origin/main carries 14 files under .github/, all workflows, none of them a dependabot config; origin/development has one.

Until that file exists on the default branch, Dependabot keeps raising PRs against a 740-commit-stale tree, where — as #445 already recorded — they also collect no meaningful check runs. Tracked separately.

@dependabot @github

dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/composer/composer-a4381639c2 branch August 8, 2026 10:55
@rubenvdlinde rubenvdlinde mentioned this pull request Aug 8, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rubenvdlinde