Bump the composer-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the composer-dependencies group with 4 updates in the / directory: doctrine/doctrine-migrations-bundle, symfony/ux-live-component, symfony/ux-turbo and symfony/ux-twig-component.

Updates doctrine/doctrine-migrations-bundle from 3.7.0 to 4.0.1

Release notes

Sourced from doctrine/doctrine-migrations-bundle's releases.

4.0.1

Release Notes for 4.0.1

4.0.1

• Total issues resolved: 0
• Total pull requests resolved: 4
• Total contributors: 3

CI

• 676: Change target branch for Dependabot thanks to @​greg0ire
• 674: Group Doctrine workflow updates together thanks to @​greg0ire
• 662: Bump doctrine/.github/.github/workflows/release-on-milestone-closed.yml from 13.0.0 to 13.1.0 thanks to @​dependabot[bot]

Documentation

• [667: [Documentation] Remove annotations from documentation](doctrine/DoctrineMigrationsBundle#667) thanks to @​MrYamous

This release also contains changes from https://github.com/doctrine/DoctrineMigrationsBundle/releases/tag/3.7.1

4.0.0

Release Notes for 4.0.0

Backwards incompatible release (major)

4.0.0

• Total issues resolved: 0
• Total pull requests resolved: 14
• Total contributors: 3

Breaking Changes

• 615: Drop support for old packages thanks to @​greg0ire
• 574: Remove support for container-aware migrations thanks to @​derrabus
• 571: Drop unsupported versions of PHP thanks to @​greg0ire
• 656: Drop support for old versions of dependencies thanks to @​greg0ire
• 650: Make property readonly thanks to @​greg0ire
• 595: Make classes internal thanks to @​greg0ire
• 593: Make all classes final thanks to @​greg0ire

Improvement

• 577: Modernize code thanks to @​derrabus
• 576: Remove support for Symfony 5 thanks to @​derrabus

Bugfixes

... (truncated)

Upgrade guide

Sourced from doctrine/doctrine-migrations-bundle's upgrade guide.

Upgrade

4.0.0

Dependencies

• Support for PHP < 8.4 has been dropped.
• Support for doctrine/orm < 3 has been dropped.
• Support for doctrine/doctrine-bundle < 3 has been dropped.

BC break: final, internal classes

Some classes have been marked as final and @internal because they are not supposed to be extended or even referenced outside of the bundle.

BC break: type declarations

Type declarations have been added to all method signatures and properties. You might have to adjust your own code to abide by the new type declarations.

BC break: Removed support for container-aware migrations

• Migrations that implement ContainerAwareInterface will no longer have the container injected automatically.
• The ContainerAwareMigrationFactory class has been removed.

Upgrade to 3.5

Final classes

Some classes have been marked as @final because they are not supposed to be extended. They will be final, and most of them will be marked with @internal in 4.0.0.

From 2.x to 3.0.0

• The configuration for the migration namespace and directory changed as follows:

Before

doctrine_migrations:
    dir_name: '%kernel.project_dir%/src/Migrations'
    namespace: DoctrineMigrations

After

doctrine_migrations:
    migrations_paths:
</tr></table> 

... (truncated)

Commits

• 43e9212 Merge pull request #684 from greg0ire/4.0.x
• 0eb7b39 Merge remote-tracking branch 'origin/3.7.x' into 4.0.x
• 0005669 Merge pull request #683 from HypeMC/fix-680
• a0d82ea Don't disable filesystem migrations when service migrations are enabled
• 1fd1454 Merge pull request #679 from doctrine/dependabot/github_actions/3.7.x/doctrin...
• 9c01913 Bump the doctrine group with 6 updates
• 0faf830 Add SECURITY.md to link to reporting policy and email.
• d509b0d Bump the doctrine group with 6 updates (#677)
• df832dc Merge pull request #675 from doctrine/dependabot/github_actions/doctrine-53ad...
• 17afddd Bump the doctrine group with 6 updates
• Additional commits viewable in compare view

Updates symfony/console from 8.1.5 to 8.1.6

Release notes

Sourced from symfony/console's releases.

v8.1.6

Changelog (symfony/console@v8.1.5...v8.1.6)

• bug #65692 Escape context strings written to the terminal (@​nicolas-grekas)
• bug #65637 Fix profiling a command stopped at ConsoleEvents::COMMAND (@​Spomky)
• bug #65613 Fix service arguments not resolved when a command is invoked by alias or abbreviation (@​lazerg)

Commits

• eb7d995 Merge branch '7.4' into 8.1
• 23d6f88 Merge branch '6.4' into 7.4
• 3b8473e [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::...
• ad7e62b [Console] Fix service arguments not resolved when a command is invoked by ali...
• See full diff in compare view

Updates symfony/framework-bundle from 8.1.5 to 8.1.6

Release notes

Sourced from symfony/framework-bundle's releases.

v8.1.6

Changelog (symfony/framework-bundle@v8.1.5...v8.1.6)

• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@​nicolas-grekas)
• bug #65637 Fix profiling a command stopped at ConsoleEvents::COMMAND (@​Spomky)

Commits

• 18ea259 Merge branch '7.4' into 8.1
• 45d6d66 Merge branch '6.4' into 7.4
• a19f20a Merge branch '5.4' into 6.4
• af61a85 Revert "Give the Redis test probes an explicit connect timeout"
• 608e729 Merge branch '7.4' into 8.1
• 859a180 Merge branch '6.4' into 7.4
• c658a54 Merge branch '5.4' into 6.4
• 7179635 Give the Redis test probes an explicit connect timeout
• 530edfd Declare the polyfills needed by the code on PHP 7.2
• f7e55a4 Merge branch '7.4' into 8.1
• Additional commits viewable in compare view

Updates symfony/process from 8.1.5 to 8.1.6

Release notes

Sourced from symfony/process's releases.

v8.1.6

Changelog (symfony/process@v8.1.5...v8.1.6)

• bug #65739 Ignore invalid env var names and non-scalar env values (@​nicolas-grekas, @​dionisvl)
• bug #65738 Stop leaking CGI/FastCGI request-context vars to subprocesses (@​nicolas-grekas)

Commits

• See full diff in compare view

Updates symfony/ux-live-component from 2.36.0 to 3.4.0

Release notes

Sourced from symfony/ux-live-component's releases.

v3.4.0

Changelog (symfony/ux-live-component@v3.3.0...v3.4.0)

• bug #3730 Fix broken assets/tsconfig.json reference breaking webpack 5.109+ builds (@​zalesak)

v3.3.0

Changelog (symfony/ux-live-component@v3.2.0...v3.3.0)

• bug #3676 Avoid 500 errors on malformed hydration payloads (@​Amoifr)
• bug #3688 Fix data-loading scanner ignoring data-live-ignore subtrees (@​Amoifr)
• bug #3690 Fix support for nullable collection properties on component (@​rogierknoester)

v3.2.0

Changelog (symfony/ux-live-component@v3.1.0...v3.2.0)

• no significant changes

v3.1.0

Changelog (symfony/ux-live-component@v3.0.0...v3.1.0)

• security #557 Require X-Requested-With header to prevent CSRF (@​Kocal)
• security #cve-2026-49208 Parse format-less date LiveProps strictly with RFC 3339 (@​Kocal)
• security #cve-2026-49209 Cap the number of actions per _batch request (@​Kocal)
• security #cve-2026-49210 Reject malicious child component tags (@​Kocal)
• security #cve-2026-49212 Bind HMAC checksum to component name and slot (@​Kocal)
• feature #3432 Improve form validation error messages in exceptions (@​PierreCapel)
• bug #3566 Make LiveComponentSubscriber safe-by-default (@​Kocal)
• bug #3508 Fix dynamic template resolution when using "loading" attribute (@​xDeSwa)
• feature #3442 Use aria-busy attribute during component re-render (@​Amoifr)

v3.0.0

Changelog (symfony/ux-live-component@v2.34.0...v3.0.0)

• feature #3452 Remove compatibility layer with Symfony PropertyInfo <7.1 (@​Kocal)
• feature #3453 Update minimum required Symfony version to 7.4 (@​Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@​Kocal)
• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)
• bug #3398 Post-merge fixes for 3.x (@​Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@​Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@​Kocal)
• feature #3051 Remove deprecations (@​smnandre)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@​Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@​Kocal)

Changelog

Sourced from symfony/ux-live-component's changelog.

CHANGELOG

3.5

• Add LiveResponse::downloadUrl() and LiveResponse::downloadFile() to trigger a file download from a LiveAction, pointing the browser at a URL or sending the contents with the response, while the component keeps its state
• Add LiveResponse::remove() to take a component off the page from a LiveAction, instead of re-rendering it: the root element is removed and the Stimulus controller disconnects, and the server skips the render entirely

3.1

• Fix dynamic template resolution when using the loading attribute on a deferred component
• Use aria-busy attribute during component re-render
• Include field paths and violation messages in UnprocessableEntityHttpException thrown by submitForm() when validation fails
• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.
• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent check. See section 2.36 below for details.

3.0

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4
• Remove csrf argument from AsLiveComponent in favor of same-origin/CORS
• Remove compatibility layer with Symfony PropertyInfo <7.1
• Remove LegacyLivePropMetadata

2.36

• Reject malicious child component tags during rendering to prevent crafted component names from being rendered (security fix).

• Cap the number of actions allowed per _batch request to prevent abuse (security fix).

• Parse format-less date LiveProps strictly using RFC 3339 to avoid lenient date parsing of attacker-controlled values (security fix).

• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.

• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent requests, in addition to the existing Accept: application/vnd.live-component+html check, to prevent CSRF. The Accept header alone is CORS-safelisted and offers no protection against cross-origin requests crafted with fetch().

  BC break (minor): clients calling LiveComponent endpoints cross-origin must now add X-Requested-With to their CORS Access-Control-Allow-Headers allow-list. The bundled Stimulus controller already sends this header, so standard usage is unaffected.

2.35

• Allow Symfony UX 3.x packages

2.33

... (truncated)

Commits

• bb7a955 Fix issue #3728
• 120e6be bug #3676 [LiveComponent] Avoid 500 errors on malformed hydration payloads (A...
• 09f8a63 bug #3688 [LiveComponent] Fix data-loading scanner ignoring data-live-ignore ...
• d369255 bug #3690 [LiveComponent] Fix support for nullable collection properties on c...
• 0d0c75b [LiveComponent] Support nullable collection properties on component
• 54c37b4 Merge branch '2.x' into 3.x
• 4814fac Bump npm packages to v2.36.2
• 67c0707 [LiveComponent] Fix data-loading scanner ignoring data-live-ignore subtrees
• 0baaf91 Merge branch '2.x' into 3.x
• 976729a Bump npm packages to v2.36.1
• Additional commits viewable in compare view

Updates symfony/ux-turbo from 2.36.0 to 3.4.0

Release notes

Sourced from symfony/ux-turbo's releases.

v3.4.0

Changelog (symfony/ux-turbo@v3.3.0...v3.4.0)

• minor #3735 Add sync-packages.php to normalize packages .gitattributes (@​Kocal)
• bug #3730 Fix broken assets/tsconfig.json reference breaking webpack 5.109+ builds (@​zalesak)

v3.3.0

Changelog (symfony/ux-turbo@v3.2.0...v3.3.0)

• no significant changes

v3.2.0

Changelog (symfony/ux-turbo@v3.1.0...v3.2.0)

• bug #3614 Conflict with Mercure >=0.7.0 <0.7.2 (@​Kocal)

v3.1.0

Changelog (symfony/ux-turbo@v3.0.0...v3.1.0)

• feature #3505 Add <turbo-mercure-stream-source> custom element (@​seb-jean)
• feature #3462 Add TurboFrame service to detect Turbo Frame requests (@​seb-jean)
• feature #3439 Add minimal frame layout template (@​seb-jean)

v3.0.0

Changelog (symfony/ux-turbo@v2.34.0...v3.0.0)

• feature #3453 Update minimum required Symfony version to 7.4 (@​Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@​Kocal)
• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)
• feature #3186 Remove BC layers for methods and parameters (@​Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@​Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@​Kocal)
• feature #3100 Remove deprecations for 3.0 (@​smnandre)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@​Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@​Kocal)

Changelog

Sourced from symfony/ux-turbo's changelog.

CHANGELOG

3.2.0

• Prevent installation alongside symfony/mercure 0.7.0 and 0.7.1, which are incompatible

3.1.0

• Add a minimal layout for Turbo Frame responses, allowing head content like meta tags to work properly
• Add TurboFrame service methods and Twig functions turbo_is_frame_request()/turbo_frame_request_id() to detect Turbo Frame requests
• Add <turbo-mercure-stream-source> custom element, turbo_stream_from() Twig function and <twig:Turbo:Stream:From> Twig component
• Deprecate turbo_stream_listen() Twig function, use turbo_stream_from() or the <twig:Turbo:Stream:From> Twig component instead
• Deprecate Symfony\UX\Turbo\Twig\TurboStreamListenRendererInterface interface, use Symfony\UX\Turbo\StreamSourceRendererInterface instead
• Deprecate Symfony\UX\Turbo\Bridge\Mercure\TurboStreamListenRenderer class, use Symfony\UX\Turbo\Bridge\Mercure\MercureStreamSourceRenderer instead
• Deprecate Symfony\UX\Turbo\Bridge\Mercure\TopicSet class
• Deprecate the mercure-turbo-stream Stimulus controller, use the <turbo-mercure-stream-source> custom element instead

3.0.0

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4
• Remove old compatibility layer with deprecated StimulusTwigExtension from WebpackEncoreBundle ^1.0, use StimulusBundle instead
• Remove BC layer for TurboStreamListenRendererInterface::renderTurboStreamListen() $eventSourceOptions parameter

2.35

• Allow Symfony UX 3.x packages

2.32

• Add support for MercureBundle ^0.4.1 and Mercure ^0.7.0

2.30

• Ensure compatibility with PHP 8.5

2.29.0

• Add Symfony 8 support

2.24.0

• Add Twig Extensions for meta tags
• Add support for authentication to the EventSource via turbo_stream_listen

2.22.0

• Add <twig:Turbo:Stream> component
• Add <twig:Turbo:Frame> component
• Add support for custom actions in TurboStream and TurboStreamResponse

... (truncated)

Commits

• daa104b Add sync-packages.php to normalize packages .gitattributes
• 7c91d23 Fix issue #3728
• 5420abd [Documention][Turbo] Remove mention to unsupported Symfony version
• 505f246 Merge branch '2.x' into 3.x
• ccb3c68 Bump npm packages to v2.36.2
• b1e683e Update CHANGELOGs for 3.2.0
• 62cacc7 Merge branch '2.x' into 3.x
• b161df2 Bump npm packages to v2.36.1
• dcc2da8 Merge branch '2.x' into 3.x
• 8af1035 Drop PR warning and auto-closing on subtree splits
• Additional commits viewable in compare view

Updates symfony/ux-twig-component from 2.36.0 to 3.4.0

Release notes

Sourced from symfony/ux-twig-component's releases.

v3.4.0

Changelog (symfony/ux-twig-component@v3.3.0...v3.4.0)

• feature #3395 Support component tag names from expressions and component objects (@​andreybotanic)
• minor #3735 Add sync-packages.php to normalize packages .gitattributes (@​Kocal)

v3.3.0

Changelog (symfony/ux-twig-component@v3.2.0...v3.3.0)

• no significant changes

v3.2.0

Changelog (symfony/ux-twig-component@v3.1.0...v3.2.0)

• feature #3602 Allow standalone usage with any PSR-11 container (@​guillaume-sainthillier)
• feature #3600 Expose pre/embedded render methods on ComponentRendererInterface (@​treztreiz)

v3.1.0

Changelog (symfony/ux-twig-component@v3.0.0...v3.1.0)

• feature #3455 Use twig.safe_class tag and move setLexer to TwigComponentPass (@​GromNaN)
• bug #3500 Include attribute name in null value error message (@​IndraGunawan)
• feature #3512 Add provide() and inject() Twig functions (@​Kocal)

v3.0.0

Changelog (symfony/ux-twig-component@v2.34.0...v3.0.0)

• feature #3453 Update minimum required Symfony version to 7.4 (@​Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@​Kocal)
• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)
• feature #3408 Add support for AttributeValueInterface from twig/html-extra:^3.24.0 in ComponentAttributes (@​Kocal)
• bug #3398 Post-merge fixes for 3.x (@​Kocal)
• bug #3191 Fix 2.x -> 3.x merge (@​Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@​Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@​Kocal)
• bug #3105 Remove dev-dependency on WebpackEncoreBundle (@​Kocal)
• feature #3040 Remove deprecations (@​smnandre)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@​Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@​Kocal)

Changelog

Sourced from symfony/ux-twig-component's changelog.

3.4.0

• Add support for dynamic component names in the {% component %} tag using a parenthesized expression, e.g. {% component (prefix ~ i) %}{% endcomponent %}

3.2.0

• Add ComponentRendererInterface::preCreateForRender(), ComponentRendererInterface::startEmbeddedComponentRender(), and ComponentRendererInterface::finishEmbeddedComponentRender() methods
• Allow using ComponentFactory and ComponentRuntime with any PSR-11 container, making symfony/dependency-injection optional for standalone usage

3.1.0

• Add provide() and inject() Twig functions to share state from a parent component down to deeply-nested descendants without prop drilling
• Include the attribute name in the error message thrown when an attribute value is null

3.0.0

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4
• The configuration twig_component.defaults could not be nullable anymore
• Remove method PreCreateForRenderEvent::getProps() in favor of PreCreateForRenderEvent::getInputProps()
• Remove cva Twig function in favor of html_cva Twig function from twig/html-extra
• Passing null as an attribute value when using ComponentAttributes (or attributes Twig variable) will now throw an exception, use remove() instead
• Remove method ComponentAttributes::add(), use {{ attributes.defaults(stimulus_controller('...')) }} instead
• The ComponentTemplateFinder does not accept Twig\Environment as first argument anymore, pass a LoaderInterface instead
• The ComponentTemplateFinder does not accept a nullable directory argument anymore, pass a string instead
• Remove old compatibility layer with deprecated StimulusTwigExtension from WebpackEncoreBundle ^1.0, use StimulusBundle instead

2.35

• Add support for AttributeValueInterface from twig/html-extra:^3.24.0 in ComponentAttributes
• Allow Symfony UX 3.x packages

2.33

• Extended support for the index.html.twig template fallback when resolving namespaced anonymous components
• Add support for dynamic template resolution with AsTwigComponent(template: FromMethod('getCustomFuntion'))

2.32

• Add option profiler.collect_components to control component data collection in the profiler (enabled in debug mode by default)
• Add support for using directory name as component name for anonymous components

2.30

• Ensure compatibility with PHP 8.5

... (truncated)

Commits

• 520e1da [TwigComponent] Support component tag names from expressions
• 2cf40a5 Add sync-packages.php to normalize packages .gitattributes
• 2f3a1b7 [Documentation][TwigComponent] Fix syntax
• c52d34b [TwigComponent] Allow standalone usage with any PSR-11 container
• 94d5c84 Merge branch '2.x' into 3.x
• 61df99c Drop PR warning and auto-closing on subtree splits
• 5ef94a5 [TwigComponent] Expose pre/embedded render methods on `ComponentRendererInter...
• 93b4782 Update CHANGELOGs for 3.1.0
• afdea19 [TwigComponent] Use twig.safe_class tag and move setLexer to TwigComponentPass
• 4da7840 [CI] Workflows hardenings, thanks to Zizmor
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions