[dependabot]

Bumps the composer group with 14 updates in the / directory:

Package	From	To
phpunit/phpunit	9.5.21	9.6.33
guzzlehttp/psr7	2.4.0	2.13.2
league/commonmark	2.3.3	2.10.7
league/flysystem	3.1.0	3.36.0
nesbot/carbon	2.59.1	2.73.0
nyholm/psr7	1.5.1	1.8.2
psy/psysh	0.11.5	0.11.23
symfony/http-foundation	6.1.2	6.4.50
symfony/http-kernel	6.1.2	6.4.50
symfony/mailer	6.1.2	6.4.49
symfony/mime	6.1.1	6.4.49
symfony/polyfill-intl-idn	1.26.0	1.43.0
symfony/process	6.1.0	6.4.49
symfony/routing	6.1.1	6.4.50

Updates phpunit/phpunit from 9.5.21 to 9.6.33

Changelog

Sourced from phpunit/phpunit's changelog.

[9.6.33] - 2026-01-27

Changed

• To prevent Poisoned Pipeline Execution (PPE) attacks using prepared .coverage files in pull requests, a PHPT test will no longer be run if the temporary file for writing code coverage information already exists before the test runs

[9.6.32] - 2026-01-24

Changed

• PHPUnit\Framework\MockObject exceptions are now subtypes of PHPUnit\Exception

[9.6.31] - 2025-12-06

• No changes; phpunit.phar rebuilt with PHP 8.4 to work around PHP-Scoper issue #1139

[9.6.30] - 2025-12-01

Changed

• Updated list of deprecated PHP configuration settings for PHP 8.4, PHP 8.5, and PHP 8.6

[9.6.29] - 2025-09-24

• No changes; phpunit.phar rebuilt with updated dependencies

[9.6.28] - 2025-09-23

• No changes; phpunit.phar rebuilt with updated dependencies

[9.6.27] - 2025-09-14

Changed

• #6366: Exclude __sleep() and __wakeup() from test double code generation on PHP >= 8.5

[9.6.26] - 2025-09-11

Changed

• Implement __serialize() in addition to __sleep() (which will be deprecated in PHP 8.5)

[9.6.25] - 2025-08-20

Changed

• Do not configure report_memleaks setting (which will be deprecated in PHP 8.5) for PHPT processes

[9.6.24] - 2025-08-10

... (truncated)

Commits

• fea0625 Prepare release
• 1a677f6 Merge branch '8.5' into 9.6
• 1015741 Prepare release
• 1cce5f3 Merge branch '8.5' into 9.6
• 3141742 Do not run PHPT test when its temporary file for code coverage information ex...
• 0b3170a We do not need to unserialize() objects here
• 261086a Extract method
• fdd6b86 Fix CS/WS issue
• 492ee10 Prepare release
• 81edce2 Merge branch '8.5' into 9.6
• Additional commits viewable in compare view

Updates guzzlehttp/psr7 from 2.4.0 to 2.13.2

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.2

• Fix StreamWrapper flushes reporting failure
• Fix CachingStream skipping unread bytes after repeated writes

2.13.1

Added

• Add support for PHP 8.6

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

• Validate the URI host so getHost() matches the URI authority (GHSA-c2w2-prh8-qm98)

2.12.2

Fixed

• Report URI parsing, filtering, and normalization PCRE failures explicitly
• Report HTTP message parser PCRE failures explicitly
• Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

• Reject CR/LF in HTTP method, protocol version, and reason phrase (GHSA-vm85-hxw5-5432)

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.2 - 2026-10-18

Fixed

• Fix StreamWrapper flushes reporting failure
• Fix CachingStream skipping unread bytes after repeated writes

2.13.1 - 2026-08-24

Added

• Add support for PHP 8.6

Fixed

• Prefix relative paths that begin with a colon segment with ./ instead of throwing

2.13.0 - 2026-07-16

Added

• Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

• Use locale-independent ASCII case folding everywhere case is normalized
• Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

• Compare header names and hosts with locale-independent ASCII lowercasing
• Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

• Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

• Anchor server port and response start-line patterns to the true end of input
• Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
• Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
• Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

... (truncated)

Commits

• adee536 Release 2.13.2
• 4dbc3d2 Fix CachingStream skipping unread bytes after repeated writes (#893)
• 8ace0da Report successful flushes from the stream wrapper (#891)
• 95e7828 Release 2.13.1
• a583cbe Add PHP 8.6 to the CI matrix and version guidance (#883)
• 93b91b0 Prefix relative paths that begin with a colon segment instead of throwing (#878)
• 5b1264e Test that noncanonical IPv4 host spellings pass through unchanged (#874)
• dad8962 Release 2.13.0
• 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
• a1372ea Add tests locking in no-file upload handling (#856)
• Additional commits viewable in compare view

Updates league/commonmark from 2.3.3 to 2.10.7

Release notes

Sourced from league/commonmark's releases.

2.10.7

Fixed

• Fixed AutolinkExtension keeping trailing punctuation inside very long URLs containing long runs of punctuation, and removed the excessive regex backtracking that caused it (#1170)

2.10.6

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

2.10.5

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

2.10.4

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

2.10.3

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

2.10.2

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

Full Changelog: thephpleague/commonmark@2.10.1...2.10.2

2.10.1

What's Changed

• fix: accept unordered_list_markers config in InlinesOnlyExtension by @​dualfroz in thephpleague/commonmark#1151

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.10.7] - 2026-10-31

Fixed

• Fixed AutolinkExtension keeping trailing punctuation inside very long URLs containing long runs of punctuation, and removed the excessive regex backtracking that caused it (#1170)

[2.10.6] - 2026-10-30

Fixed

• Fixed ExternalLinkExtension not treating some links as external when browsers would navigate to an external host, such as https:///example.com, http:example.com, or ///example.com; hosts are now determined the way browsers do (#1169)

[2.10.5] - 2026-10-30

Fixed

• Fixed link reference definitions keeping a partially parsed title when the title on the following line is never closed or is followed by other text; the definition now has no title, as the spec requires (#1162)
• Fixed task list items being recognized when the [ ] or [x] marker is directly followed by other content (- [x]done); the GFM spec requires whitespace after the marker (#1164)
• Fixed the content indentation of a list item whose content is a single character after two to four spaces (- a): it was computed as if one space followed the marker, so the next line could be read as part of the item, nesting a following item inside it (#1163)
• Fixed a table inside a block quote or list item absorbing the lines that follow it as table rows when those lines are lazy continuation lines (not prefixed with > or indented); they now end the container as in GitHub's cmark-gfm (#1165)
• Fixed link reference definitions accepting an unescaped ( inside a parenthesized title (#1168)

[2.10.4] - 2026-10-17

Fixed

• Fixed HeadingPermalinkExtension overwriting an id set on a heading by the AttributesExtension when heading_permalink/apply_id_to_heading is enabled; the existing id is now used (with the configured prefix) for both the heading and its permalink (#1159, #1160)
• Fixed Symfony DebugClassLoader deprecation notice about ArrayCollection::offsetGet() by adding an explicit @return annotation (#1158)

[2.10.3] - 2026-09-21

Fixed

• Fixed footnote links and backlinks pointing at the wrong anchor when footnote/footnote_id_prefix or footnote/ref_id_prefix contains an uppercase character; the configured prefix is now emitted verbatim in the href as it already was in the matching id (#524)
• Fixed inline raw HTML tags being escaped when the tag name or an attribute name contains an uppercase letter, such as <svg viewBox="..."> or <Warning> (#1096)

[2.10.2] - 2026-09-21

This is a security release to address a denial of service vulnerability in the Table extension and a raw HTML filtering bypass in the DisallowedRawHtml extension.

Changed

• Improved performance of parsing table delimiter rows and splitting table rows into cells by scanning bytes directly instead of stepping a Cursor (roughly 4x faster for delimiter rows and 6x for cell splitting, and more on multibyte rows)

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML that ends with a disallowed tag name, such as a line containing only <script (GHSA-97jj-33gv-5xf9)
• Fixed quadratic-time parsing of long paragraphs when the Table extension is enabled (GHSA-3q6v-r5mr-hxv8)
• Fixed table detection to match the GFM spec and reference implementation:
  • Header rows no longer require a | character
  • Header rows must now have the same number of cells as the delimiter row (previously, fewer cells were accepted)

[2.10.1] - 2026-09-07

Fixed

• Accept unordered_list_markers config in InlinesOnlyExtension (#1015, #1151)

... (truncated)

Commits

• 8eb53e9 Prepare to release 2.10.7
• 5da14da Strip trailing autolink punctuation without a backtracking regex (#1170)
• cb3d6a5 Prepare to release 2.10.6
• e4e5339 Find external link hosts the way browsers do (#1169)
• 6d6ed04 Prepare to release 2.10.5
• f292c64 Reject an unescaped ( in a parenthesized reference definition title (#1168)
• baa5b10 Do not add lazy continuation lines to a table inside a container (#1165)
• 67ce8b3 Fix the list item padding for single-character content (#1163)
• 5bddd73 Require whitespace after a task list item marker (#1164)
• de6e417 Drop a link reference definition title that fails to parse (#1162)
• Additional commits viewable in compare view

Updates league/flysystem from 3.1.0 to 3.36.0

Release notes

Sourced from league/flysystem's releases.

3.16.0

What's Changed

Other Changes

• Document ziparchive adapter by @​ajgarlag in thephpleague/flysystem#1665
• added uploadcare package as third party adapter by @​markvaneijk in thephpleague/flysystem#1667
• Update set-subsplit-default-branch.yml replacing checkout@v2 for checkout@v3 by @​DannyvdSluijs in thephpleague/flysystem#1671
• Fix PathPrefixedAdapter checksum by @​smnandre in thephpleague/flysystem#1687
• [AsyncAwsS3] adapt options for a temporary url same as in the AwsS3V3Adapter by @​smoench in thephpleague/flysystem#1683
• Fix ZipArchiveAdapter not overwriting on move by @​kynx in thephpleague/flysystem#1685
• Add docker files to .gitattributes by @​VincentLanglet in thephpleague/flysystem#1688
• Add phpunit v10.x support by @​remi-san in thephpleague/flysystem#1692
• Adding licenses to splits by @​PhilinTv in thephpleague/flysystem#1695
• [WebDAV] Fix getting individual file attributes by @​ro0NL in thephpleague/flysystem#1700

New Contributors

• @​markvaneijk made their first contribution in thephpleague/flysystem#1667
• @​smnandre made their first contribution in thephpleague/flysystem#1687
• @​smoench made their first contribution in thephpleague/flysystem#1683
• @​kynx made their first contribution in thephpleague/flysystem#1685
• @​VincentLanglet made their first contribution in thephpleague/flysystem#1688
• @​remi-san made their first contribution in thephpleague/flysystem#1692
• @​PhilinTv made their first contribution in thephpleague/flysystem#1695
• @​ro0NL made their first contribution in thephpleague/flysystem#1700

Full Changelog: thephpleague/flysystem@3.15.1...3.16.0

Changelog

Sourced from league/flysystem's changelog.

3.36.0 - 2026-09-02

• [SFTP V3] Support multiple fingerprints for zero-downtime fingerprint changes.
• [FTP] Unset connection when resolving the root failed.

3.35.3 - 2026-08-22

• [Filesystem] Report broken utf-8 as corrupted path

3.35.2 - 2026-07-06

• [AwsS3V3] Let ACL config take precedence over visibility during copy (#1905)

3.35.1 - 2026-06-25

• [AwsS3V3] Remove lock file from artefact.

3.35.0 - 2026-06-22

• [Filesystem] Guard against null mime-type return at Filesystem level (#1901)

3.34.0 - 2026-05-26

Added

• [Filesystem] Add ability to disable relative path resolution inside the configured root path.

3.33.0 - 2026-03-25

Changes

• [SFTP V3] Add support for multiple fingerprints (#1893)

3.32.0 - 2026-02-25

Changes

• [AwsS3V3] Allow SSE-C options when fetching file metadata

3.31.0 - 2026-01-23

Changes

• [AsyncAwsS3] Allow V3

3.30.2 - 2025-11-10

Fixes

• [Local] Clear last error for rename and copy operations (#1883)

... (truncated)

Commits

• f7fb152 Prep changelog
• 7b51e82 Merge branch 'bdtripp-fix/ftp-root-null' into 3.x
• aeda031 Fixed borked merge
• d8cd3e2 Merge branch '3.x' into fix/ftp-root-null
• c8fa31b Merge pull request #1908 from ghazalfaraj/3.x
• f749c94 Add multiple fingerprint formats
• 5fc8404 Corrected release date
• 3f44b99 Prpe changelog for release
• ef4a9a5 Report broken utf-8 as a corrupted path.
• 7c4259b Update github actions managed by me.
• Additional commits viewable in compare view

Updates nesbot/carbon from 2.59.1 to 2.73.0

Release notes

Sourced from nesbot/carbon's releases.

2.73.0

Complete commits list: briannesbitt/Carbon@2.72.6...2.73.0

Summary:

• Support PHP 8.4 CarbonPHP/carbon#13

2.72.6

Complete commits list: CarbonPHP/carbon@2.72.5...2.72.6

Summary:

• Validate locale earlier

Commits

• 9228ce9 Merge pull request #13 from thecaliskan/2.x
• 142f0f5 changed CS rule
• dc27804 changed CS rule
• 8910c51 changed expected result for PHP 8.4
• d1e695f Added PHP 8.3 and PHP 8.4 test for laravel and removed PHP 8.4 lowest test ma...
• 5dca8dc Fixes for PHP 8.4
• 8c3e607 Fixes for implicit nullability deprecation
• 5f4c750 upgraded phpunit version on tests
• a4932f3 Fixed CS
• d6f5afb Added PHP 8.4 support
• Additional commits viewable in compare view

Updates nyholm/psr7 from 1.5.1 to 1.8.2

Release notes

Sourced from nyholm/psr7's releases.

Release 1.8.2

What's Changed

• Fix .gitattributes by @​VincentLanglet in Nyholm/psr7#250
• [PHP 8.4] Fixes for implicit nullability deprecation by @​Ayesh in Nyholm/psr7#255

New Contributors

• @​VincentLanglet made their first contribution in Nyholm/psr7#250
• @​Ayesh made their first contribution in Nyholm/psr7#255

Full Changelog: Nyholm/psr7@1.8.1...1.8.2

Release 1.8.1

What's Changed

• Fix error handling in Stream::getContents() by @​nicolas-grekas in Nyholm/psr7#252

Full Changelog: Nyholm/psr7@1.8.0...1.8.1

Release 1.8.0

What's Changed

• README.md: add badges for GH Actions by @​alexislefebvre in Nyholm/psr7#237
• Deprecate HttplugFactory and make dependency on php-http/message-factory optional by @​murat11 in Nyholm/psr7#243

New Contributors

• @​alexislefebvre made their first contribution in Nyholm/psr7#237
• @​murat11 made their first contribution in Nyholm/psr7#243

Full Changelog: Nyholm/psr7@1.7.0...1.8.0

Release 1.7.0

What's Changed

• chore: drop php 7.1 support by @​simPod in Nyholm/psr7#226
• Allow psr/http-message v2 by @​nicolas-grekas in Nyholm/psr7#234
• Use zval storage for Stream instances created from strings by @​nicolas-grekas in Nyholm/psr7#230
• Improve performance of creating streams from strings by @​nicolas-grekas in Nyholm/psr7#241
• Update changelog by @​nicolas-grekas in Nyholm/psr7#240

Full Changelog: Nyholm/psr7@1.6.1...1.7.0

Release 1.6.1

Security fix for header validation. See GHSA-wjfc-pgfp-pv9c

What's Changed

See change log for changes.

What's Changed

• [CI] Remove scutinizer by @​Nyholm in Nyholm/psr7#231
• [CI] Just some code style changes by @​Nyholm in Nyholm/psr7#232

... (truncated)

Changelog

Sourced from nyholm/psr7's changelog.

1.8.2

• Fix deprecation warnings in PHP 8.4

1.8.1

• Fix error handling in Stream::getContents()

1.8.0

• Deprecate HttplugFactory, use Psr17Factory instead
• Make depencendy on php-http/message-factory optional

1.7.0

• Bump to PHP 7.2 minimum
• Allow psr/http-message v2
• Use copy-on-write for streams created from strings

1.6.1

• Security fix: CVE-2023-29197

1.6.0

Changed

• Seek to the begining of the string when using Stream::create()
• Populate ServerRequest::getQueryParams() on instantiation
• Encode reserved characters in userinfo in Uri
• Normalize leading slashes for Uri::getPath()
• Make Stream's constructor public
• Add some missing type checks on arguments

Commits

• a71f2b1 Changelog for 1.8.2 (#258)
• 229484f [PHP 8.4] Fixes for implicit nullability deprecation (#255)
• fd12ffc Fix .gitattributes (#250)
• aa5fc27 Fix error handling in Stream::getContents() (#252)
• 3cb4d16 Deprecate HttplugFactory and make dependency on php-http/message-factory opti...
• 7f77c0e README.md: add badges for GH Actions (#237)
• ed7cf98 Update changelog (#240)
• 21644a7 Improve performance of creating streams from strings (#241)
• 083ce36 Use zval storage for Stream instances created from strings (#230)
• 6a31c27 Allow psr/http-message v2 (#234)
• Additional commits viewable in compare view

Updates psy/psysh from 0.11.5 to 0.11.23

Release notes

Sourced from psy/psysh's releases.

PsySH v0.11.23

• Fixed CWD configuration poisoning vulnerability (CVE-2026-25129). Backported Restricted Mode from v0.12. PsySH now requires explicit trust before loading local config (.psysh.php), local PsySH binaries, or Composer autoloads from untrusted projects. Configure with trustProject config option, --trust-project / --no-trust-project CLI flags, or PSYSH_TRUST_PROJECT env var.

PsySH v0.11.22

• Fix Sudo static property manipulation in PHP 8.3.

PsySH v0.11.21

Made a bunch of behind the scenes fixes, that you probably won't even notice. Specifically:

• Ensure that parse errors show the original message, not "unexpected EOF" (unless that was the original error).
• Prettier output for Symfony Console exceptions.
• Improve argument parsing for timeit command.
• Remove very deprecated Symfony TableHelper fallback (it's been unsupported by our oldest supported Console version for years).
• A bunch of static analysis improvements.

PsySH v0.11.20

• Fix undefined array key (when argv doesn't exist) in userland readline implementation (Thanks @​BafS!)

PsySH v0.11.19

New:

• Add strictTypes config option to enforce strict types by default.

PsySH v0.11.18

• Fix environment variable lookup when running from the cli-server SAPI (Thanks @​supriyo-biswas!)

PsySH v0.11.17

• Use high resolution timing for timeit command.
• Clean up a few edge cases where formatting markup shows up in output.

PsySH v0.11.16

• Fix a few edge cases around array assignment.

PsySH v0.11.15

• Bypass visibility restrictions when using reflecting commands (dump, doc, show, list).
• Highlight code comments in grey, if availble.
• Support more cases of (valid but weird) empty array dim fetch.

PsySH v0.11.14

• Replace undefined DS constant (Thanks @​dereckson!)

PsySH v0.11.13

• Fix a prompt configuration regression.

Setting prompt by itself is deprecated, and has been replaced by Themes. Check them out!

Note that specifying a prompt without setting a theme configuration will implicitly use the classic theme.

PsySH v0.11.12

• Fix an input rendering bug in Userland readline implementation.

... (truncated)

Commits

• e9ac4fa Bump to v0.11.23
• 8ec3d58 Add Restricted Mode for untrusted projects
• 128fa1b Merge branch 'release/0.11.22' into 0.11
• 0db96a7 Bump to v0.11.22
• 5927f39 Fix Sudo static property manipulation in PHP 8.3.
• 8a11c39 Test against PHP 8.3 and 8.4
• 1013fdd Update alias for v0.11.x-dev
• bcb2210 Merge branch 'release/0.11.21'
• 2b78273 Bump to v0.11.21
• 2be8beb Oops.
• Additional commits viewable in compare view

Updates symfony/http-foundation from 6.1.2 to 6.4.50

Release notes

Sourced from symfony/http-foundation's releases.

v6.4.50

Changelog (symfony/http-foundation@v6.4.49...v6.4.50)

• security #GHSA-xg2q-4rrq-657q Add the list of private ranges usable as trusted proxies (@​nicolas-grekas)
• security #cve-2026-118514 Match HEAD requests when GET is listed in a MethodRequestMatcher (@​nicolas-grekas)
• security #cve-2026-118514 Match HEAD requests when GET is listed in a RequestMatcher (@​nicolas-grekas)
• security #GHSA-5mx8-mwrp-5693 Don't let Request::getBaseUrl() start with a host chosen by the client (@​nicolas-grekas)
• bug #67829 Fix Request::getBaseUrl() for a percent-encoded or wrong-case script name after a prefix, and behind an alias (@​jack-worman)
• bug #67826 Don't use the script name as Request::getBaseUrl() when it's not in the URI path (@​jack-worman)
• bug #67804 Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment (@​jack-worman)
• bug #67814 Fix UrlHelper for fragments behind a trusted X-Forwarded-Prefix and for an empty path (@​nicolas-grekas)
• bug #67800 Preserve the base URL for query and fragment references (@​ahbaqdadi)
• minor #67760 Do not expose the DSN in the exception thrown for unsupported connections (@​nicolas-grekas)
• minor #67746 Mark the DSN and options of SessionHandlerFactory as # (@​nicolas-grekas)
• bug #67614 Reject trailing newlines in Content-Disposition fallbacks (@​ahbaqdadi)

[EOM] End of maintenance release for branch 6.4 [SECURITY] Security release

v6.4.49

Changelog (symfony/http-foundation@v6.4.48...v6.4.49)

• bug #67504 Ignore malformed and multiple ranges in BinaryFileResponse (@​jack-worman)
• bug #67501 Don't reject suffix ranges longer than the file in BinaryFileResponse (@​jack-worman)
• bug #67296 Handle filter failures in array values (@​nicolas-grekas)
• bug #67345 Fix cookie names and header parsing (@​nicolas-grekas)
• bug #67126 Fix MigratingSessionHandler sending needless cookies to delete empty sessions (@​nicolas-grekas)
• bug #67123 Destroy empty sessions in updateTimestamp() of the Redis, Memcached, MongoDb and Pdo session handlers (@​PhilETaylor)
• bug #67125 Don't marshall empty session data in MarshallingSessionHandler (@​nicolas-grekas)
• bug #67059 Don't announce a Content-Length on non-successful BinaryFileResponse (@​lazerg)
• bug #67060 Register the session shutdown function only once in NativeSessionStorage (@​lazerg)

[SECURITY] Security release

v6.4.48

Changelog (symfony/http-foundation@v6.4.47...v6.4.48)

• bug #66694 Don't warn about request input keys nested too deeply (@​logosur)
• bug #66513 Keep the session ID when the session handler fails to read (@​Firehed, @​nicolas-grekas)
• bug #66491 Fix HeaderUtils::split() when a separator is a whitespace character (@​nicolas-grekas)

v6.4.47

Changelog (symfony/http-foundation@v6.4.46...v6.4.47)

• bug #66251 Make session handlers non-serializable (@​mcdruid)
• bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@​nicolas-grekas)

v6.4.46

Changelog (symfony/http-foundation@v6.4.45...v6.4.46)

... (truncated)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.2

• Add five not-globally-reachable ranges to IpUtils::PRIVATE_SUBNETS: 192.0.0.0/24, 192.88.99.0/24, 224.0.0.0/4, 100::/64 and ff00::/8
• Add Response::cacheControl() to set the targeted cache directives defined by RFC 9213, e.g. CDN-Cache-Control
• Deprecate not passing an expiry to UriSigner::sign()
• Add the $defaultExpiration argument to UriSigner::__construct()
• Add argument $version to UriSigner::sign(), UriSigner::check(), UriSigner::checkRequest(), and UriSigner::verify() to bind a signed URI to a state token
• Add ParameterBag::filterCallback() to filter a parameter value through a callback
• Reject a Cookie whose name uses the __Secure-/__Host- prefix when its attributes break the prefix contract
• Deprecate the Request::$trustedHosts property, it is never populated anymore
• Report the actual header value when the ResponseHeaderSame constraint fails
• Add ClearableSessionHandlerInterface for clearing all session data
• Add Request::getStructuredSuffixFormat() to resolve a mime type to the format of its structured syntax suffix, e.g. application/vnd.api+json to json
• Accept a list of secrets in UriSigner::__construct() to rotate them
• Allow passing a ResponseHeaderBag as the third argument of StreamedResponse::__construct()
• Add arguments $isolate and $debug to AttributeBag::__construct(), and $attributeBagFactory to SessionFactory::__construct()
• Deprecate saving changes made to session attributes without calling set() afterwards
• Accept the 308 status code in Response::isCacheable()
• Stop adding a default Cache-Control: no-cache, private header to 308 RedirectResponse instances
• Add argument $clock to MetadataBag::__construct()
• Add RedisSessionHandler::shutdown() to close lazy connections

8.1

• Add BinaryFileResponse::shouldDeleteFileAfterSend()
• Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead
• Add SessionHasFlashMessage test constraint
• Response::__construct() now accepts a ResponseHeaderBag as its third argument
• ParameterBag::getInt() and ParameterBag::getBoolean() now throw UnexpectedValueException instead of silently returning 0/false when the value cannot be converted

8.0

• Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
• Add argument $subtypeFallback to Request::getFormat()
• Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
• Trigger PHP warning when using Response::sendHeaders() after headers have already been sent; use a StreamedResponse instead
• Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
• Add argument $partitioned to ResponseHeaderBag::clearCookie()
• Add argument $expiration to UriSigner::sign()
• Remove Request::get(), use properties ->attributes, query or request directly instead
• Remove accepting null $format argument to Request::setFormat()

7.4

... (truncated)

Commits

• f0cd207 Merge branch '5.4' into 6.4
• afd6f5a security #GHSA-xg2q-4rrq-657q [HttpFoundation] Add the list of private ranges...
• 33abc60 security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is li...
• 6c66f8d security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is li...
• 91ec806 [HttpFoundation] Fix Request::getBaseUrl() for a percent-encoded or wrong-cas...
• 1ddc022 Merge branch '5.4' into 6.4
• a35ec70 [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by ...
• a2ba30d [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher
• 0a57039 [HttpFoundation] Don't use the script name as Request::getBaseUrl() when it's...
• 5ca03b3 Merge branch '5.4' into 6.4
• Additional commits viewable in compare view

Updates symfony/http-kernel from 6.1.2 to 6.4.50

Release notes

Sourced from symfony/http-kernel's releases.

v6.4.50

Changelog (symfony/http-kernel@v6.4.49...v6.4.50)

• minor #67839 Release v6.4.50
• security #GHSA-wg5q-m2ww-f3c9 Restore the router context of the parent request after a sub-request (@​nicolas-grekas)
• bug #67683 Compute # durations without daylight saving time (@​nicolas-grekas)
• bug