Update all non-major dependencies

[benjaminjonard]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
api-platform/core (source)	4.2.10 → 4.2.11
doctrine/doctrine-bundle (source)	3.1.0 → 3.2.2
doctrine/orm (source)	3.5.8 → 3.6.0
friendsofphp/php-cs-fixer	3.92.1 → 3.92.4
intl-messageformat	11.0.1 → 11.0.8
justinrainbow/json-schema	6.6.3 → 6.6.4
lexik/jwt-authentication-bundle	3.1.1 → 3.2.0
phpunit/php-code-coverage	12.5.1 → 12.5.2
rector/rector (source)	2.2.14 → 2.3.0
symfony/browser-kit (source)	7.4.0 → 7.4.3
symfony/cache (source)	7.4.1 → 7.4.3
symfony/console (source)	7.4.1 → 7.4.3
symfony/dependency-injection (source)	7.4.2 → 7.4.3
symfony/finder (source)	7.4.0 → 7.4.3
symfony/form (source)	7.4.1 → 7.4.3
symfony/framework-bundle (source)	7.4.1 → 7.4.3
symfony/http-client (source)	7.4.1 → 7.4.3
symfony/http-foundation (source)	7.4.1 → 7.4.3
symfony/http-kernel (source)	7.4.2 → 7.4.3
symfony/process (source)	v7.4.0 → v7.4.3
symfony/property-access (source)	7.4.0 → 7.4.3
symfony/property-info (source)	7.4.1 → 7.4.3
symfony/routing (source)	7.4.0 → 7.4.3
symfony/security-core (source)	7.4.0 → 7.4.3
symfony/security-http (source)	7.4.1 → 7.4.3
symfony/serializer (source)	7.4.2 → 7.4.3
symfony/translation (source)	7.4.0 → 7.4.3
symfony/twig-bridge (source)	7.4.1 → 7.4.3
symfony/twig-bundle (source)	7.4.0 → 7.4.3
symfony/validator (source)	7.4.2 → 7.4.3
symfony/var-dumper (source)	7.4.0 → 7.4.3
symfony/web-profiler-bundle (source)	7.4.0 → 7.4.3
webpack	5.103.0 → 5.104.1
zenstruck/foundry	2.8.2 → 2.8.4

---

Release Notes

api-platform/core (api-platform/core)

v4.2.11

Compare Source

Bug fixes

• 0d9a44bef fix(laravel): allow custom error handler for non-api operations (#​7622)
• 17415f789 fix(serializer): allow CsvEncoder::AS_COLLECTION_KEY in context (#​7613)
• 2a3449818 fix(symfony): check that required package are installed before configuring services (#​7607)
• 40ad56859 fix(jsonld): allow mapping collection output with itemUriTemplate (#​7620)
• 9f11aed8a fix(state): delete with stateOptions and object mapper (#​7615)
• a2da50905 fix(symfony): enable ReDoc when Swagger UI is disabled (#​7617)
• c0998928e fix(symfony): enable to set default values for stale-while-revalidate and stale-if-error cache headers via config file (#​7606)
• d847ad629 fix(jsonapi): handle missing attributes in ErrorNormalizer (#​7569)

doctrine/DoctrineBundle (doctrine/doctrine-bundle)

v3.2.2

Compare Source

Release Notes for 3.2.2

Fixes possible 3.2.0 BC break when XML mapping is used

3.2.2

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Bug

• 2190: Fix position of $enableXsdValidation in DoctrineOrmMappingsPass::createXmlMappingDriver thanks to @​KDederichs

v3.2.1

Compare Source

Release Notes for 3.2.1

3.2.1

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Bugfixes

• 2187: Reintroduce missing use statement thanks to @​alcohol

v3.2.0

Compare Source

Release Notes for 3.2.0

Feature release (minor)

3.2.0

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Feature

• 2172: Wire commands for inspecting configured listeners thanks to @​HypeMC

v3.1.1

Compare Source

Release Notes for 3.1.1

3.1.x bugfix release (patch)

3.1.1

• Total issues resolved: 0

• Total pull requests resolved: 3

• Total contributors: 3

• 2160: Remove VarExporter from dependencies thanks to @​derrabus

Deprecation

• 2150: clarify message to better hint which "auto_mapping" option is deprecated thanks to @​xabbuh

Documentation

• 2151: Fix DBAL documentation links and update filter link thanks to @​sad270

This release also contains the changes from https://github.com/doctrine/DoctrineBundle/releases/tag/2.18.2

doctrine/orm (doctrine/orm)

v3.6.0

Compare Source

Release Notes for 3.6.0

Feature release (minor)

3.6.0

• Total issues resolved: 0
• Total pull requests resolved: 21
• Total contributors: 13

New Feature

• 12268: Add hints to QueryBuilder thanks to @​pmaasz
• 12165: Add commands for inspecting configured listeners thanks to @​HypeMC
• 12071: Add JSON format option for orm:mapping:describe command output thanks to @​stlgaits
• 12065: Use enum values from enumType in DiscriminatorColumn and check DiscriminatorMap values against it thanks to @​whataboutpereira

Deprecation

• 12279: Deprecate string default expressions thanks to @​greg0ire
• 12273: Deprecate FieldMapping::$default thanks to @​greg0ire
• 12126: Deprecate specifying nullable on primary key columns thanks to @​greg0ire
• 12051: Stop using QueryBuilder::getRootAlias() thanks to @​greg0ire

Improvement

• 12232: SQLFilter: replace internal array shape with class thanks to @​derrabus

• 12214: Stop using deprecated Collections constants thanks to @​derrabus

• 12198: Update DQL arbitrary joins to use the ON keyword instead of WITH thanks to @​stof

• 12110: Allow Symfony 8 thanks to @​derrabus

• 12095: Performance optimization in ScalarColumnHydrator::hydrateAllData() thanks to @​maxm86545

• 12068: QueryBuilder: prevent misuse of DELETE with LIMIT thanks to @​janedbal

• 12196: Add deprecation messages for methods that were only annotated as being @deprecated thanks to @​mpdude

• 12131: Feature: add support for ClassLocator thanks to @​rela589n

Bugfixes

• 12138: fix pull request URL thanks to @​xabbuh

Documentation

• 12313: doc: do not mention InverseJoinColumn since it’s only with PHP 8.0 thanks to @​alexislefebvre

Test Suite

• 12135: Add missing assertion in test thanks to @​greg0ire

CI

• 12112: Include stability in coverage file key thanks to @​derrabus
• 12102: Run tests with Symfony 8 thanks to @​derrabus

PHP-CS-Fixer/PHP-CS-Fixer (friendsofphp/php-cs-fixer)

v3.92.4

Compare Source

• fix: ComposerJsonReader - handle more syntaxes (#​9327)
• UX: Runner/Parallel/Process - friendly message when tmp dir not writable (#​9319)
• docs: fix RST links (#​9321)
• DX: internal commands for working with tokens (#​9251)
• chore: Add CS commit to .git-blame-ignore-revs
• chore: apply trailing_comma_in_multiline: elements.arguments (#​9314)
• deps: upgrade dev-deps (#​9318)

v3.92.3

Compare Source

• fix: using Rule Customisation Policy with parallel runner (#​9309)
• chore: phpstan - cover .php-cs-fixer.dist.php (#​9311)
• chore: .php-cs-fixer.dist.php - drop wrongly called ignoreVCSIgnored (#​9310)

v3.92.2

Compare Source

• fix: let @php-cs-fixer-ignore accept custom fixer names (#​9306)
• chore: introduce PHP_CS_FIXER_IGNORE_MISMATCHED_RULES_EXCEPTIONS (#​9307)

formatjs/formatjs (intl-messageformat)

v11.0.8

Compare Source

11.0.8 (2026-01-02)

Bug Fixes

• intl-messageformat: fix value having special key like constructor, fix ##​4490 (#​5751) (83d24fe) - by @​longlho
• intl-messageformat: handle bigint, fix #​5081 (#​5743) (aa40318) - by @​longlho

v11.0.7

Compare Source

v11.0.6

Compare Source

v11.0.5

Compare Source

v11.0.4

Compare Source

v11.0.2

Compare Source

jsonrainbow/json-schema (justinrainbow/json-schema)

v6.6.4

Compare Source

Changed

• ci: Run workflows against 5.x.x branches (#​859)

Fixed

• UriValidator: Allow file:/ and file:/// (#​856)
• Fix .php-cs-fixer.dist.php export-ignore (#​861)

lexik/LexikJWTAuthenticationBundle (lexik/jwt-authentication-bundle)

v3.2.0

Compare Source

• feature #​1295 Allow to pass extra data when handling success authentication (@​VincentLanglet)
• feature #​1303 Add PHP 8.5 support (@​Chris8934)
• feature #​1300 Support Symfony 8.x & web-token suite 4.x (@​dt-thomas-durand)
• feature #​1278 Remove lcobucci/clock dependency (@​VincentLanglet)

sebastianbergmann/php-code-coverage (phpunit/php-code-coverage)

v12.5.2: phpunit/php-code-coverage 12.5.2

Compare Source

Fixed

• #​1131: Invalid XML generated when both PCOV and Xdebug are loaded

rectorphp/rector (rector/rector)

v2.3.0: Released Rector 2.3

Compare Source

New Features 🥳

• Introduce FileNode to handle file-level changes (#​7728) to be used instead of FileWithoutNamespace node - see https://github.com/rectorphp/rector-src/blob/main/UPGRADING.md for the upgrade
• Add PrivatizeFinalClassConstantRector (#​7753), Thanks @​simonschaufi!
• [dead-code] Add RemoveParentDelegatingConstructorRector (#​7769)

Bugfixes 🐛

• Manage named arguments in ArgumentAdderRector rule (#​7777), Thanks @​carlos-granados!
• [compat] Add SymplifyQuoteEscapeRector deprecated rule for BC layer (#​7744)
• [Php81] Skip on Param default on ArrayToFirstClassCallableRector (#​7749)
• [CodeQuality] Handle ternary in identical left/right on UseIdenticalOverEqualWithSameTypeRector (#​7748)
• fix: chained calls on static calls (#​7746), Thanks @​calebdw!
• [code-quality] Extract standalone SortAttributeNamedArgsRector from SortNamedParamRector, to slightly different areas (#​7750)
• [rename] Rename SortNamedParamRector to SortCallLikeNamedArgsRector to be more clear about the intent (#​7751)
• [Php85] Skip under unset() on ArrayFirstLastRector (#​7752)
• [Php81] ArrayToFirstClassCallableRector should not skip non-public methods from owning scope (#​7760), Thanks @​acoulton!
• [fix] wrap ternary in parenthese on string casting, if only cond is casted (#​7745)
• [internal] Fix inline replace block removal not removed on deep block for InlineIfToExplicitIfRector + ReplaceBlockToItsStmtsRector (#​7764)
• [TypeDeclaration] Skip class not found on ObjectTypedPropertyFromJMSSerializerAttributeTypeRector (#​7774)
• [Php85] Skip defined int or string on ArrayKeyExistsNullToEmptyStringRector (#​7758)

Removed 💀

• [DeadCode] Skip trait on RemoveAlwaysTrueIfConditionRector (#​7759)
• [internal] Remove duplicated enterNode() type check already handled in node traverser (#​7717)
• [dx] warn about deprecated beforeTraverse() method once FileNode is ready (#​7768)
• [DeadCode] Skip next assign expr has side effect inside try {} on RemoveDoubleAssignRector (#​7775)
• [DeadCode] Skip with different default param value child vs parent on RemoveParentDelegatingConstructorRector (#​7776)

rectorphp/rector-symfony 🎵

• bump (#​911)
• [code-quality] Add ReturnDirectJsonResponseRector (#​910)
• Fix scoped downgrade SymfonyClass (#​909)
• cover is safe (#​908)
• [twig] add explicit attribute name arg, to improve context (#​907)
• [Symfony73] Fix named arg different position crash on InvokableCommandInputAttributeRector (#​905)
• [CodeQuality] Skip UserInterface instance on ControllerMethodInjectionToConstructorRector (#​904)
• create ClassMethod directly in InvokableCommandInputAttributeRector, to keep newline per attribute (#​903)
• Remove InvokableCommandInputAttributeRector from set (#​901)
• [Validator] use constants for Email (#​900), Thanks @​JohJohan

rectorphp/rector-doctrine 🟠

• Make use of FileNode (#​474)

rectorphp/rector-phpunit 🟢

• [AnnotationsToAttributes] Handle both annotation and attributes exists on DataProviderAnnotationToAttributeRector (#​603)
• [fix] skip AddInstanceofAssertForNullableArgumentRector on assert call (#​602)
• [code-quality] Add AddInstanceofAssertForNullableArgumentRector (#​601)
• use FileNode in DeclareStrictTypesTestsRector (#​599)

symfony/browser-kit (symfony/browser-kit)

v7.4.3

Compare Source

Changelog (symfony/browser-kit@v7.4.2...v7.4.3)

• bug symfony/symfony#62758 [BrowserKit] Allow Cookie expiration to be an int (@​derrabus)

symfony/cache (symfony/cache)

v7.4.3

Compare Source

Changelog (symfony/cache@v7.4.2...v7.4.3)

• bug symfony/symfony#62873 [Cache] Fix namespace of chained pools when using another chain as template (@​nicolas-grekas)
• bug symfony/symfony#62840 [Cache] Fix stampede protection when forcing item recomputation (@​nicolas-grekas)
• bug symfony/symfony#62490 [FrameworkBundle] Fix cache:pool:prune exit code on failure (@​yoeunes)
• bug symfony/symfony#62793 [Cache] Fix calling the callback wrapper for ChainAdapter (@​nicolas-grekas)
• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@​nicolas-grekas)

symfony/console (symfony/console)

v7.4.3

Compare Source

Changelog (symfony/console@v7.4.2...v7.4.3)

• bug symfony/symfony#62813 [Console] Fix EofShortcut instruction when using a modern terminal on Windows (@​fperxas)
• bug symfony/symfony#62827 [Console] Fix choice autocomplete issue when string has spaces (@​ayyoub-afwallah)
• bug symfony/symfony#62764 [Console] Escape `` in description of console commands (@​SiebeVE)

symfony/dependency-injection (symfony/dependency-injection)

v7.4.3

Compare Source

Changelog (symfony/dependency-injection@v7.4.2...v7.4.3)

• bug symfony/symfony#62843 [DependencyInjection] Fix referencing build-time array parameters (@​nicolas-grekas)
• bug symfony/symfony#62755 [DependencyInjection] Fix #[AutowireCallable] sometimes incorrectly inlined (@​HypeMC)
• bug symfony/symfony#62715 [DependencyInjection] Fix sharing services used only by tagged iterators (@​nicolas-grekas)

symfony/finder (symfony/finder)

v7.4.3

Compare Source

Changelog (symfony/finder@v7.4.2...v7.4.3)

• bug symfony/symfony#62741 [Finder] Fix converting unanchored glob patterns to regex (@​nicolas-grekas)

symfony/form (symfony/form)

v7.4.3

Compare Source

Changelog (symfony/form@v7.4.2...v7.4.3)

• bug symfony/symfony#62841 [Form] Always normalize CRLF and CR to LF in TextareaType (@​alexandre-daubois)
• bug symfony/symfony#62759 [Form] do not use PHPUnit mock objects without configured expectations (@​xabbuh)

symfony/framework-bundle (symfony/framework-bundle)

v7.4.3

Compare Source

Changelog (symfony/framework-bundle@v7.4.2...v7.4.3)

• bug symfony/symfony#62877 [Translation] Add ResetInterface and reset method to DataCollectorTranslator (@​tourze, @​adming-zz, @​nicolas-grekas)
• bug symfony/symfony#62818 [Config][FrameworkBundle] Allow using ParamConfigurator with every configurable value (@​jack-worman)
• bug symfony/symfony#62490 [FrameworkBundle] Fix cache:pool:prune exit code on failure (@​yoeunes)
• bug symfony/symfony#62692 [FrameworkBundle] Enable console profiling only if the console is actually available (@​dbu)

symfony/http-client (symfony/http-client)

v7.4.3

Compare Source

Changelog (symfony/http-client@v7.4.2...v7.4.3)

• bug symfony/symfony#62845 [HttpClient] Fix ever growing $maxHostConnections (@​nicolas-grekas)
• bug symfony/symfony#62728 [HttpClient] mark response stale when age equals freshness lifetime (@​Lctrs)
• bug symfony/symfony#62699 [HttpClient] Fix ScopingHttpClient to always pass base_uri as string instead of parsed array (@​santysisi)
• bug symfony/symfony#62706 [HttpClient] Fix PHP deprecation when using AmpHttpClient (@​nicolas-grekas)
• bug symfony/symfony#62698 [HttpClient] Fix copy as curl for arrays with resources & unreachable host (@​HypeMC)

symfony/http-foundation (symfony/http-foundation)

v7.4.3

Compare Source

Changelog (symfony/http-foundation@v7.4.2...v7.4.3)

• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@​nicolas-grekas)

symfony/http-kernel (symfony/http-kernel)

v7.4.3

Compare Source

Changelog (symfony/http-kernel@v7.4.2...v7.4.3)

• no significant changes

symfony/process (symfony/process)

v7.4.3

Compare Source

Changelog (symfony/process@v7.4.2...v7.4.3)

• bug symfony/symfony#62775 [Process] Fix dealing with broken stdin pipes (@​nicolas-grekas)

symfony/property-access (symfony/property-access)

v7.4.3

Compare Source

Changelog (symfony/property-access@v7.4.2...v7.4.3)

• bug symfony/symfony#62772 [PropertyInfo] Fix calling same-named method with required args instead of reading public property (@​makraz)

symfony/property-info (symfony/property-info)

v7.4.3

Compare Source

Changelog (symfony/property-info@v7.4.2...v7.4.3)

• bug symfony/symfony#62772 [PropertyInfo] Fix calling same-named method with required args instead of reading public property (@​makraz)
• bug symfony/symfony#62396 [PropertyInfo] Fix inconsistency between isWritable and getWriteInfo (@​yoeunes)
• bug symfony/symfony#62717 [PropertyInfo] fix @var tag support for PhpStanExtractor (@​qconer)
• bug symfony/symfony#62686 [PropertyInfo] Fix PseudoType support in PhpDocTypeHelper (@​VincentLanglet)

symfony/routing (symfony/routing)

v7.4.3

Compare Source

Changelog (symfony/routing@v7.4.2...v7.4.3)

• bug symfony/symfony#62791 [Routing] Fix simple parameter mappings in routes (@​nicolas-grekas)
• bug symfony/symfony#62747 [Routing] Do not renumber query parameters with numeric key (@​tillhoerner)

symfony/security-core (symfony/security-core)

v7.4.3

Compare Source

Changelog (symfony/security-core@v7.4.2...v7.4.3)

• bug symfony/symfony#62796 [Security] do not use PHPUnit mock objects without configured expectations (@​xabbuh)

symfony/security-http (symfony/security-http)

v7.4.3

Compare Source

Changelog (symfony/security-http@v7.4.2...v7.4.3)

• bug symfony/symfony#62796 [Security] do not use PHPUnit mock objects without configured expectations (@​xabbuh)

symfony/serializer (symfony/serializer)

v7.4.3

Compare Source

Changelog (symfony/serializer@v7.4.2...v7.4.3)

• bug symfony/symfony#62797 [Serializer] Fix inconsistent field naming from accessors when using groups (@​nicolas-grekas)
• bug symfony/symfony#62773 [Serializer] Do not skip nested null values when denormalizing (@​MatTheCat)
• bug symfony/symfony#62740 [Serializer] Fix php 8.5 warning unexpected NAN value was coerced to … (@​aaa2000)

symfony/translation (symfony/translation)

v7.4.3

Compare Source

Changelog (symfony/translation@v7.4.2...v7.4.3)

• bug symfony/symfony#62877 [Translation] Add ResetInterface and reset method to DataCollectorTranslator (@​tourze, @​adming-zz, @​nicolas-grekas)
• bug symfony/symfony#62808 [Translation] do not use PHPUnit mock objects without configured expectations (@​xabbuh)

symfony/twig-bridge (symfony/twig-bridge)

v7.4.3

Compare Source

Changelog (symfony/twig-bridge@v7.4.2...v7.4.3)

• bug symfony/symfony#62744 [TwigBridge] do not use PHPUnit mock objects without configured expectations (@​xabbuh)
• bug symfony/symfony#62695 [TwigBridge] do not render button labels if they are explicitly disabled (@​xabbuh)

symfony/twig-bundle (symfony/twig-bundle)

v7.4.3

Compare Source

Changelog (symfony/twig-bundle@v7.4.2...v7.4.3)

• bug symfony/symfony#62810 [TwigBundle] Align TemplateIterator handling of @​! original bundle templates with TwigExtension (@​mbessolov)
• bug symfony/symfony#62710 [TwigBundle] Fix unintended BC break for the exception_controller twig setting (@​stof)

symfony/validator (symfony/validator)

v7.4.3

Compare Source

Changelog (symfony/validator@v7.4.2...v7.4.3)

• bug symfony/symfony#62745 [Validator] do not use PHPUnit mock objects without configured expectations (@​xabbuh)
• bug symfony/symfony#62716 [Validator] fix handling named arguments in Existence constraint (@​xabbuh)

symfony/var-dumper (symfony/var-dumper)

v7.4.3

Compare Source

Changelog (symfony/var-dumper@v7.4.2...v7.4.3)

• bug symfony/symfony#62805 [VarDumper] Fix dumper selection for Accept: / requests (@​apoca)

symfony/web-profiler-bundle (symfony/web-profiler-bundle)

v7.4.3

Compare Source

Changelog (symfony/web-profiler-bundle@v7.4.2...v7.4.3)

• bug symfony/symfony#62858 [WebProfilerBundle] Fix using URL objects with EventSource (@​HypeMC)

webpack/webpack (webpack)

v5.104.1

Compare Source

Patch Changes

• 2efd21b: Reexports runtime calculation should not accessing WEBPACK_IMPORT_KEY decl with var.
• c510070: Fixed a user information bypass vulnerability in the HttpUriPlugin plugin.

v5.104.0

Compare Source

Minor Changes

• d3dd841: Use method shorthand to render module content in __webpack_modules__ object.
• d3dd841: Enhance import.meta.env to support object access.
• 4baab4e: Optimize dependency sorting in updateParent: sort each module only once by deferring to finishUpdateParent(), and reduce traversal count in sortWithSourceOrder by caching WeakMap values upfront.
• 04cd530: Handle more at-rules for CSS modules.
• cafae23: Added options to control the renaming of at-rules and various identifiers in CSS modules.
• d3dd841: Added base64url, base62, base58, base52, base49, base36, base32 and base25 digests.
• 5983843: Provide a stable runtime function variable __webpack_global__.
• d3dd841: Improved localIdentName hashing for CSS.

Patch Changes

• 22c48fb: Added module existence check for informative error message in development mode.
• 50689e1: Use the fully qualified class name (or export name) for [fullhash] placeholder in CSS modules.
• d3dd841: Support universal lazy compilation.
• d3dd841: Fixed module library export definitions when multiple runtimes.
• d3dd841: Fixed CSS nesting and CSS custom properties parsing.
• d3dd841: Don't write fr

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[benjaminjonard]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: git stash pop || true
Too many revisions specified: '||' 'true'