Skip to content

Bump the composer group across 1 directory with 5 updates - #2037

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-60b2266854
Open

Bump the composer group across 1 directory with 5 updates#2037
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-60b2266854

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown

Bumps the composer group with 4 updates in the / directory: guzzlehttp/guzzle, symfony/yaml, twig/twig and symfony/http-foundation.

Updates guzzlehttp/guzzle from 7.10.0 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2

Security

7.14.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

... (truncated)

Commits

Updates symfony/yaml from 6.4.34 to 6.4.40

Release notes

Sourced from symfony/yaml's releases.

v6.4.40

Changelog (symfony/yaml@v6.4.39...v6.4.40)

v6.4.39

Changelog (symfony/yaml@v6.4.38...v6.4.39)

v6.4.38

Changelog (symfony/yaml@v6.4.34...v6.4.38)

Commits
  • 68dcd1f Merge branch '5.4' into 6.4
  • b0b2705 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking
  • 5a351ff [Yaml] Bound collection-alias resolution in the parser
  • e4fb993 [Yaml] Reject non-stringables when using "!!binary"
  • b02ba66 [Yaml] Bound recursion depth in the parser
  • f8d2f4a [Yaml] fix flow collection drops &anchor and !!str &anchor items
  • 323ed2d CS fixes - native_function_invocation & static_lambda
  • f33e2fb Backport some CS fixes from 7.4
  • fe7a693 [CS] Back config from 8.1 and apply heredoc_indentation rule
  • See full diff in compare view

Updates twig/twig from 3.23.0 to 3.27.0

Release notes

Sourced from twig/twig's releases.

v3.27.0

Changelog (twigphp/Twig@v3.26.0...v3.27.0)

  • security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders (@​fabpot)
  • security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (@​fabpot)
  • security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (@​fabpot)
  • security #535 Fix sandbox __toString bypasses via Traversable in join/replace filters and the in/not in operators (@​fabpot)
  • security #534 Fix sandbox bypass in the "column" filter under SourcePolicyInterface (@​fabpot)
  • feature #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends/use tags and the parent/block/attribute functions (@​fabpot)
  • feature #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@​fabpot)
  • bug #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@​fabpot)
  • bug #4807 Escape root profile name in HtmlDumper (@​fabpot)
  • bug #4808 Restrict allowed classes in Profile::unserialize() (@​fabpot)
  • feature #4803 Deprecate the "Twig\Sandbox\SourcePolicyInterface" interface (@​fabpot)

v3.26.0

Changelog (twigphp/Twig@v3.25.0...v3.26.0)

v3.25.0

Changelog (twigphp/Twig@v3.24.0...v3.25.0)

v3.24.0

Changelog (twigphp/Twig@v3.23.0...v3.24.0)

  • feature #3930 Add an html_attr function to make outputting HTML attributes easier (@​mpdude, @​polarbirke)
  • bug #4778 Fix null coalescing operator with imported macros (@​fabpot)
  • feature #4775 Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity (@​fabpot)
  • bug #4774 Ensure filters/attributes aren't mistaken for operators (@​brandonkelly)
  • feature #4771 Deprecate passing non AbstractExpression nodes to MatchesBinary (@​fabpot)
  • feature #4769 Deprecate passing a non-AbstractExpression node to Parser::setParent() (@​fabpot)
  • feature #4748 Support short-circuiting in null-safe operator chains (@​HypeMC)
  • feature #4743 Add html_attr_relaxed escaping strategy (@​mpdude)

... (truncated)

Changelog

Sourced from twig/twig's changelog.

3.27.0 (2026-05-27)

  • Add a strict mode to Twig\Sandbox\SecurityPolicy to opt-in to the 4.0 behavior for the extends/use tags and the parent/block/attribute functions, which are otherwise still implicitly allowed in a sandbox
  • Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template
  • Fix sandbox filter/tag/function allow-list bypass when the sandbox state changed between renders of a cached Template instance
  • Fix PHP 8.1+ implicit float-to-int deprecation triggered by sandboxed ArrayAccess attribute access with a float key
  • Restrict allowed classes in Twig\Profiler\Profile::unserialize() to prevent arbitrary class instantiation
  • Escape root profile name in HtmlDumper
  • Fix sandbox bypass in deprecated internal wrappers twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() (src/Resources/core.php)
  • Deprecate the Twig\Sandbox\SourcePolicyInterface interface with no replacement
  • Fix sandbox bypass in the "column" filter when sandboxing is enabled via SourcePolicyInterface
  • Fix sandbox __toString bypass via Traversable arguments to the join and replace filters (also covers containers that implement both Stringable and Traversable)
  • Fix sandbox __toString bypass via the in and not in operators
  • Prevent a stack overflow in SandboxExtension::ensureToStringAllowed() when a self-referencing iterable is passed to a sandboxed template
  • Add support for any expression as a dynamic mapping key (attribute access, filters, ...)
  • Fix sandbox __toString policy bypass via dynamic mapping keys

3.26.0 (2026-05-20)

  • Document that the sandbox doesn't protect against resource exhaustion
  • Document template_from_string caveats when used in a sandboxed environment
  • Add docs on Markup about the goal of this class in the context of a sandbox
  • Pre-escape HTML input on the spaceless filter
  • Pre-escape HTML input on inline_css and inky_to_html filters
  • Fix XSS by adjusting is_safe annotation on HTML-emitting filters
  • [Profiler] Escape template and profile names in HtmlDumper
  • Fix unbounded memoisation of IntlDateFormatter / NumberFormatter
  • Fix sandbox bypass in the "column" filter
  • Fix sandbox bypass in the {% sandbox %} tag when including a preloaded template
  • Fix sandbox bypass: PHP code injection via {% use %} template name
  • Fix sandbox bypass: PHP code injection via _self / import macro reference
  • Fix sandbox bypass in object destructuring assignment
  • Fix sandbox bypass: propagate Source to checkArrow for source-policy sandboxing
  • Encode single quotes as \x27 in Compiler::string() as a defense-in-depth measure
  • Fix sandbox __toString bypasses
  • Add Twig\Node\CoercesChildrenToStringInterface to let nodes declare which of their child nodes will be string-coerced at runtime so the sandbox wraps them with a __toString check

3.25.0 (2026-05-17)

  • Add a needs_is_sandboxed option for filters, functions, and tests
  • Use deterministic suffixes for generated embed classes
  • Lazy-load EscaperRuntime in EscaperExtension

3.24.0 (2026-03-17)

  • Deprecate not implementing the getOperatorTokens() method in ExpressionParserInterface implementations
  • Deprecate passing a non-AbstractExpression node to Twig\Node\Expression\Binary\MatchesBinary constructor
  • Deprecate passing a non-AbstractExpression node to Parser::setParent()
  • Add support for renaming variables in object destructuring ({name: userName} = user)
  • Add html_attr_relaxed escaping strategy that preserves :, @, [, and ] for front-end framework attribute names

... (truncated)

Commits
  • 04ae1bf Prepare the 3.27.0 release
  • 99a1038 security #558 Fix sandbox filter/tag/function allow-list bypass when sandbox ...
  • 23eb6eb Fix sandbox filter/tag/function allow-list bypass when sandbox state changes ...
  • 7d55aa8 security #cve-2026-48805 Fix sandbox bypass in deprecated internal wrappers (...
  • 9fcf690 security #552 Fix sandbox __toString policy bypass via dynamic mapping keys (...
  • 635cea4 Document new support for any expression as a dynamic mapping key
  • 9ff4101 Fix sandbox __toString policy bypass via dynamic mapping keys
  • baebc46 security #535 Fix sandbox __toString bypasses via Traversable in join/`...
  • e3f6665 Fix deprecation notices in tests
  • 475fb69 Guard sandbox __toString walker against self-referencing iterables
  • Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.9.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

... (truncated)

Commits
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • 2cf293e Merge branch '2.12' into 2.13
  • c685419 Fold cross-origin host comparison without locale sensitivity (#852)
  • 226b5b3 Add locale-independent ASCII case folding helpers (#850)
  • 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
  • Additional commits viewable in compare view

Updates symfony/http-foundation from 6.4.35 to 6.4.41

Release notes

Sourced from symfony/http-foundation's releases.

v6.4.41

Changelog (symfony/http-foundation@v6.4.35...v6.4.41)

Commits
  • 48d76c2 security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUt...
  • 10d5daa [HttpFoundation] Fix tests for PHP 8.6: session.cookie_samesite=Lax
  • 3ebc78a [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS
  • 5402ad1 Remove wrong documentation
  • 92eeee6 CS fixes - native_function_invocation & static_lambda
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the composer group across 1 directory with 5 updates
b0c5dc2 
Bumps the composer group with 4 updates in the / directory: [guzzlehttp/guzzle](https://github.com/guzzle/guzzle), [symfony/yaml](https://github.com/symfony/yaml), [twig/twig](https://github.com/twigphp/Twig) and [symfony/http-foundation](https://github.com/symfony/http-foundation).


Updates `guzzlehttp/guzzle` from 7.10.0 to 7.15.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/8.0/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.10.0...7.15.1)

Updates `symfony/yaml` from 6.4.34 to 6.4.40
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v6.4.34...v6.4.40)

Updates `twig/twig` from 3.23.0 to 3.27.0
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.23.0...v3.27.0)

Updates `guzzlehttp/psr7` from 2.9.0 to 2.13.0
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/3.0/CHANGELOG.md)
- [Commits](guzzle/psr7@2.9.0...2.13.0)

Updates `symfony/http-foundation` from 6.4.35 to 6.4.41
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/8.2/CHANGELOG.md)
- [Commits](symfony/http-foundation@v6.4.35...v6.4.41)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.1
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: symfony/yaml
  dependency-version: 6.4.40
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: twig/twig
  dependency-version: 3.27.0
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/http-foundation
  dependency-version: 6.4.41
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file minor Minor version bump php Pull requests that update php code labels Jul 21, 2026
@dependabot dependabot Bot mentioned this pull request Jul 21, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file minor Minor version bump php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants