Skip to content

Bump the all-dependencies group with 18 updates - #589

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/composer/all-dependencies-3fdffc03de
Open

Bump the all-dependencies group with 18 updates#589
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/composer/all-dependencies-3fdffc03de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 7, 2026

Copy link
Copy Markdown
Contributor

Bumps the all-dependencies group with 18 updates:

Package From To
composer/composer 2.9.8 2.10.2
doctrine/dbal 4.4.1 4.4.4
doctrine/doctrine-bundle 2.18.2 2.19.0
doctrine/orm 3.6.1 3.6.7
guzzlehttp/guzzle-services 1.7.0 1.7.3
symfony/config 7.4.4 7.4.15
symfony/console 7.4.11 7.4.15
symfony/dotenv 7.4.0 7.4.15
symfony/filesystem 7.4.11 7.4.15
symfony/flex 2.10.0 2.11.0
symfony/form 7.4.4 7.4.15
symfony/monolog-bundle 3.11.1 3.11.2
symfony/security-csrf 7.4.4 7.4.8
symfony/twig-bundle 7.4.4 7.4.15
symfony/var-exporter 7.4.9 7.4.14
symfony/yaml 7.4.13 7.4.15
twig/extra-bundle 3.23.0 3.24.0
twig/twig 3.27.1 3.28.0

Updates composer/composer from 2.9.8 to 2.10.2

Release notes

Sourced from composer/composer's releases.

2.10.2

  • Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
  • Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
  • Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
  • Security: Only follow HTTP redirects from HTTP responses (#12948)
  • Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
  • Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
  • Added warning output in self-update command when using a soon-to-be EOL version (#12920)
  • Added download retry when a GitHub codeload URL returns a 400 (#12962)
  • Fixed audit command to output the audit result to stdout (#12904)
  • Fixed backspace characters being output to non-decorated output (#12925)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)
  • Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Full Changelog: composer/composer@2.10.1...2.10.2

2.10.1

  • Security: Fixed shell escaping when opening an editor (#12903)
  • Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
  • Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
  • Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
  • Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
  • Fixed warnings from Composer repositories being printed twice in some cases (#12907)

Full Changelog: composer/composer@2.10.0...2.10.1

2.10.0

Read the Composer 2.10 Release Announcement for more details on the release highlights.

Full Changelog

  • BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
  • BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
  • Security: Added dependency policies to block package versions where malware was detected on update/install or report it with audit (#12786)
  • Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
  • Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
  • Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)
  • Added --strict-psr-autoloader flag to install and update commands (#12647)
  • Added source-fallback config option to disable or enable source fallback on download failure (#12698)
  • Added --require parameter to create-project to add new packages to the project as it gets installed (#12738)
  • Optimized plugin autoloading by avoiding regenerating classmaps for every package per plugin (#12696)
  • Optimized PoolOptimizer memory usage (#12783)
  • Optimized classmap dumping performance
  • Deprecated most of the audit config in favor of the new policy one (#12804, see #12786 for the RFC and upgrade docs)
  • Fixed update --bump-after-update to only bump packages that actually were updated (#12733)
  • Fixed GitHub API authentication errors not being visible to the user (#12737)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.10.2] 2026-07-01

  • Security: Validate package names (GHSA-499r-g7pc-vmp9)
  • Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
  • Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
  • Security: Only follow HTTP redirects from HTTP responses (#12948)
  • Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
  • Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
  • Added warning output in self-update command when using a soon-to-be EOL version (#12920)
  • Added download retry when a GitHub codeload URL returns a 400 (#12962)
  • Fixed audit command to output the audit result to stdout (#12904)
  • Fixed backspace characters being output to non-decorated output (#12925)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)
  • Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
  • Fixed security advisory blocking causing issues with xdebug enabled (#12935)

[2.10.1] 2026-06-04

  • Security: Fixed shell escaping when opening an editor (#12903)
  • Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
  • Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
  • Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
  • Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
  • Fixed warnings from Composer repositories being printed twice in some cases (#12907)

[2.10.0] 2026-05-28

  • BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
  • BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
  • Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
  • Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
  • Fixed audit command returning a success code when the vendor dir was not present (#12880)

[2.10.0-RC2] 2026-05-20

  • Since 2.10.0-RC1, fixes in 2.9.6 - 2.9.8, many of which security relevant, are also included
  • Since 2.10.0-RC1 a lot of the new filter list config format was modified - see #12786 for the latest state of this new feature
  • Added a new policy config block to control all security related update/install/audit policies. This replaces and deprecates most of the audit config (#12804 for implementation, #12786 for RFC/upgrade docs)
  • Enabled blocking of malware packages at install time by default
  • Fixed --no-plugins handling regression (#12789)
  • Fixed regression in startup performance when many scripts are defined (#12832)
  • Improved classmap dumping performance

[2.10.0-RC1] 2026-04-01

  • Security: Added filter lists to block package versions where malware was detected on update or report it with audit (#12786)
  • Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
  • Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
  • Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
  • Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)

... (truncated)

Commits
  • 8d4439f Release 2.10.2
  • 79d92f0 Update changelog
  • 8887ad7 Merge commit from fork
  • 502c6c4 Merge commit from fork
  • 145e74d Update deps
  • e42b4f1 Retry downloads failing with HTTP 400 on a fresh connection (#12962)
  • 8c3eba8 Add basic command level telemetry (#12952)
  • c5f92a0 Bump actions/checkout from 6.0.3 to 7.0.0 (#12949)
  • b7c4e39 Sanitize JSON parse errors in Http\Response to avoid leaking response bodies ...
  • 6665153 Add VersionsTest for self update behavior
  • Additional commits viewable in compare view

Updates doctrine/dbal from 4.4.1 to 4.4.4

Release notes

Sourced from doctrine/dbal's releases.

4.4.4

Release Notes for 4.4.4

4.4.4

  • Total issues resolved: 1
  • Total pull requests resolved: 18
  • Total contributors: 6

Bug,Error Handling,PostgreSQL

Bug,MySQL,Schema Introspection

Schema Definition,Test Suite

Bug,Indexes,Schema Definition

Static Analysis,Test Suite

Connections,Error Handling,Test Suite

Identifiers,Schema Introspection,Schema Management,Test Suite

Connections,Drivers,Results,Test Suite

Documentation,Test Suite

Platforms,Test Suite

... (truncated)

Commits
  • fb9e0ff Merge branch '3.10.x' into 4.4.x
  • c95589d fix(MariaDb): add support of new reserved word TO_DATE (12.3+) (#7391)
  • ff5c186 Merge tag '4.2.5' into 4.4.x
  • 6ea4f27 Merge pull request #7462 from morozov/fix-introspection-of-table-names-differ...
  • 7e086ed Distinguish table names differing only in case
  • 20af8cd Merge pull request #7458 from morozov/implicit-indexes-docs
  • fdec68d Explain the real reason implicit indexes exist
  • 1c8bfc4 Merge pull request #7453 from morozov/cover-core-value-objects
  • 28fd6b2 Cover renameColumn reuse of unaffected objects
  • 00276ae Test object set re-keying on rename and removal
  • Additional commits viewable in compare view

Updates doctrine/doctrine-bundle from 2.18.2 to 2.19.0

Release notes

Sourced from doctrine/doctrine-bundle's releases.

2.19.0

Release Notes for 2.19.0

2.19.0

  • Total issues resolved: 0
  • Total pull requests resolved: 4
  • Total contributors: 2

CI

Test Suite

BC Break,Bug

Deprecation

2.18.5

Release Notes for 2.18.5

2.18.x bugfix release (patch)

2.18.5

  • Total issues resolved: 0
  • Total pull requests resolved: 0
  • Total contributors: 0

Bug

2.18.4

Release Notes for 2.18.4

2.18.x bugfix release (patch)

2.18.4

  • Total issues resolved: 0

... (truncated)

Commits
  • 07b90f7 Merge branch '2.18.x' into 2.19.x
  • 0bc4188 Twig 4 compatibility (BC break) (#2265)
  • 0ab4e5e Add PHP 8.5 and Symfony 7.4 to the test matrix (#2267)
  • 9a56b05 Fix PHPUnit warning on incomplete version constraint (#2266)
  • d31e63f Merge release 2.18.5 into 2.19.x (#2264)
  • 9f8cf33 Revert "Fix doctrine:database:create failing without server_version for some ...
  • 2bbb339 Merge branch '2.18.x' into 2.19.x
  • 175f8ff Fix dark theme time bar colors in the profiler
  • 6316ebc Fix doctrine:database:create failing without server_version for some connections
  • c747e6a Add functional regression test for EntityValueResolver on primary-key routes ...
  • Additional commits viewable in compare view

Updates doctrine/orm from 3.6.1 to 3.6.7

Release notes

Sourced from doctrine/orm's releases.

3.6.7

This release contains the changes from https://github.com/doctrine/orm/releases/tag/2.20.13

3.6.6

Release Notes for 3.6.6

3.6.x bugfix release (patch)

3.6.6

  • Total issues resolved: 0
  • Total pull requests resolved: 3
  • Total contributors: 1

Bugfixes

CI

3.6.5

Release Notes for 3.6.5

3.6.x bugfix release (patch)

3.6.5

  • Total issues resolved: 0
  • Total pull requests resolved: 1
  • Total contributors: 1

Bugfixes

3.6.4

Release Notes for 3.6.4

3.6.x bugfix release (patch)

3.6.4

  • Total issues resolved: 0
  • Total pull requests resolved: 3
  • Total contributors: 3

Bugfixes

... (truncated)

Commits
  • bc217c0 Merge pull request #12486 from greg0ire/3.6.x
  • e75a435 Merge remote-tracking branch 'origin/2.20.x' into 3.6.x
  • f525f32 Merge pull request #12482 from greg0ire/fix-el-formatting
  • 4689337 Avoid passing arrays to get_class
  • 471b129 Merge pull request #12477 from greg0ire/avoid-overwrite
  • f2530f2 Merge pull request #12476 from greg0ire/def-expr-depr
  • 18977e0 Avoid adding the same foreign key twice for STI
  • 54b4f4b Address string default expression deprecation
  • 8b64c10 Merge pull request #12475 from greg0ire/fix-job-labels
  • fdea8dc Use correct matrix element name
  • Additional commits viewable in compare view

Updates guzzlehttp/guzzle-services from 1.7.0 to 1.7.3

Release notes

Sourced from guzzlehttp/guzzle-services's releases.

1.7.3

  • Require guzzlehttp/guzzle ^7.15 and guzzlehttp/psr7 ^2.13
  • Require guzzlehttp/command ^1.5.3 and guzzlehttp/uri-template ^1.0.10
  • Replace deprecated Guzzle JSON utility methods with native JSON functions
  • Normalize operation HTTP methods with locale-independent ASCII uppercasing
  • Capitalize magic command names with locale-independent ASCII folding

1.7.2

  • Require guzzlehttp/guzzle ^7.13.3 and guzzlehttp/psr7 ^2.12.4
  • Require guzzlehttp/command ^1.5.2 and guzzlehttp/uri-template ^1.0.9
  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

1.7.1

  • Require guzzlehttp/guzzle ^7.12.3 and guzzlehttp/psr7 ^2.12.3
  • Require guzzlehttp/command ^1.5.1 and guzzlehttp/uri-template ^1.0.8
  • Fixed XML response parsing for default-namespace sentAs object properties
  • Report PCRE errors separately from ordinary schema pattern mismatches
Changelog

Sourced from guzzlehttp/guzzle-services's changelog.

1.7.3 - 2026-07-17

  • Require guzzlehttp/guzzle ^7.15 and guzzlehttp/psr7 ^2.13
  • Require guzzlehttp/command ^1.5.3 and guzzlehttp/uri-template ^1.0.10
  • Replace deprecated Guzzle JSON utility methods with native JSON functions
  • Normalize operation HTTP methods with locale-independent ASCII uppercasing
  • Capitalize magic command names with locale-independent ASCII folding

1.7.2 - 2026-07-08

  • Require guzzlehttp/guzzle ^7.13.3 and guzzlehttp/psr7 ^2.12.4
  • Require guzzlehttp/command ^1.5.2 and guzzlehttp/uri-template ^1.0.9
  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

1.7.1 - 2026-06-23

  • Require guzzlehttp/guzzle ^7.12.3 and guzzlehttp/psr7 ^2.12.3
  • Require guzzlehttp/command ^1.5.1 and guzzlehttp/uri-template ^1.0.8
  • Fixed XML response parsing for default-namespace sentAs object properties
  • Report PCRE errors separately from ordinary schema pattern mismatches
Commits

Updates symfony/config from 7.4.4 to 7.4.15

Release notes

Sourced from symfony/config's releases.

v7.4.15

Changelog (symfony/config@v7.4.14...v7.4.15)

  • bug #64670 Accept env placeholders for scalar alternatives in generated array-shapes (@​yvh)
  • bug #64822 Escape "*/" in generated array-shape comments (@​lazerg)
  • bug #64857 Escape comment-closing sequence in generated config builders (@​sadiqk2)

v7.4.14

Changelog (symfony/config@v7.4.10...v7.4.14)

v7.4.10

Changelog (symfony/config@v7.4.9...v7.4.10)

v7.4.9

Changelog (symfony/config@v7.4.6...v7.4.9)

v7.4.8

Changelog (symfony/config@v7.4.7...v7.4.8)

  • no significant changes

v7.4.7

Changelog (symfony/config@v7.4.6...v7.4.7)

  • no significant changes

v7.4.6

Changelog (symfony/config@v7.4.5...v7.4.6)

Commits
  • b18e338 [Config] Accept env placeholders for scalar alternatives in generated array-s...
  • cf3e089 Merge branch '6.4' into 7.4
  • 977d47c [Config] Keep "*/" default values readable by escaping the slash
  • e39cdd9 [Config] Escape comment-closing sequence in generated config builders
  • 7b665e4 Merge branch '6.4' into 7.4
  • 922d980 Harden __toString trampolines via __unserialize()
  • c6343f4 Merge branch '6.4' into 7.4
  • 1152f21 Unsafe unserialize phpstan rule
  • 992eb8e Merge branch '6.4' into 7.4
  • 56b43e9 Drop PR warning and auto-closing on subtree splits
  • Additional commits viewable in compare view

Updates symfony/console from 7.4.11 to 7.4.15

Release notes

Sourced from symfony/console's releases.

v7.4.15

Changelog (symfony/console@v7.4.14...v7.4.15)

v7.4.14

Changelog (symfony/console@v7.4.13...v7.4.14)

v7.4.13

Changelog (symfony/console@v7.4.11...v7.4.13)

Commits
  • 088ec6f Merge branch '6.4' into 7.4
  • 3b643aa [Console] Decorate stdout and stderr independently when a formatter is injected
  • 8b00823 Merge branch '6.4' into 7.4
  • ac2d6ae bug #64843 [Console] Fix table borders around colspan cells and header-less t...
  • f2ae6d8 [Console] Fix table borders around colspan cells and header-less tables
  • 0ecccdf [Console] Fix two ValueError crashes on multibyte / multi-column widths
  • 5e0e5b8 Merge branch '6.4' into 7.4
  • 8693e05 [Console] Fall back to "stty sane" when restoring the captured terminal state...
  • 91fbf79 Merge branch '6.4' into 7.4
  • 5cbb467 [Console] Fix SymfonyStyle questions when using output sections
  • Additional commits viewable in compare view

Updates symfony/dotenv from 7.4.0 to 7.4.15

Release notes

Sourced from symfony/dotenv's releases.

v7.4.15

Changelog (symfony/dotenv@v7.4.14...v7.4.15)

v7.4.14

Changelog (symfony/dotenv@v7.4.11...v7.4.14)

v7.4.11

Changelog (symfony/dotenv@v7.4.9...v7.4.11)

v7.4.9

Changelog (symfony/dotenv@v7.4.8...v7.4.9)

v7.4.8

Changelog (symfony/dotenv@v7.4.7...v7.4.8)

v7.4.7

Changelog (symfony/dotenv@v7.4.6...v7.4.7)

  • bug #63496 Defer variable and command expansion to account for overrides from subsequent .env files (@​nicolas-grekas)

v7.4.6

Changelog (symfony/dotenv@v7.4.5...v7.4.6)

  • bug #63372 Use SYMFONY_DOTENV_PATH variable when dumping dotenv (@​Spea)
Commits
  • 99b5b14 Merge branch '6.4' into 7.4
  • 9b82700 [Dotenv] Don't collapse backslashes of external env var values
  • 23f6c99 [Dotenv] Don't truncate external env vars containing $ when only reachable vi...
  • 045d497 Merge branch '6.4' into 7.4
  • c7cce4c [Dotenv] Allow multiple underscores at start
  • 9b9c7a0 Merge branch '6.4' into 7.4
  • d71597d Drop PR warning and auto-closing on subtree splits
  • 1506847 Merge branch '6.4' into 7.4
  • fccc03c [Dotenv] Don't truncate external env vars containing $ when referenced via ${...
  • 82e9b13 Merge branch '6.4' into 7.4
  • Additional commits viewable in compare view

Updates symfony/filesystem from 7.4.11 to 7.4.15

Release notes

Sourced from symfony/filesystem's releases.

v7.4.15

Changelog (symfony/filesystem@v7.4.11...v7.4.15)

Commits
  • ff16a16 [Filesystem] Handle PHP 8.6 removing function arguments in error messages
  • cfc6662 Merge branch '6.4' into 7.4
  • 9ff03da [Filesystem] Trim trailing whitespace from the tempnam() prefix
  • c8266e4 Merge branch '6.4' into 7.4
  • 850a4e3 Drop PR warning and auto-closing on subtree splits
  • See full diff in compare view

Updates symfony/flex from 2.10.0 to 2.11.0

Release notes

Sourced from symfony/flex's releases.

v2.11.0

What's Changed

New Contributors

Full Changelog: symfony/flex@v2.10.0...v2.11.0

Commits
  • 4a6d98e bug #1090 [DockerComposeConfigurator] Fix duplicate top-level key on reconfig...
  • 3446c0f [DockerComposeConfigurator] Fix duplicate top-level key on reconfigure
  • 1b27cd3 bug #1083 Fix "null as array offset" deprecation in DockerComposeConfigurator...
  • acdf466 feature #1077 Add SYMFONY_ALLOW_CONTRIB variable (GromNaN)
  • bd9c559 Add SYMFONY_ALLOW_CONTRIB variable
  • f5c68e3 minor #1056 Upgrade to PHPUnit 12 (HypeMC)
  • e67bbcd Upgrade to PHPUnit 12
  • 6581d4d feature #1087 Add --no-changelog option to recipes:update (7ochem)
  • 48cad51 Add --no-changelog option to recipes:update
  • 168d502 bug #1091 Fix resolving aliases when running composer req (nicolas-grekas)
  • Additional commits viewable in compare view

Updates symfony/form from 7.4.4 to 7.4.15

Release notes

Sourced from symfony/form's releases.

v7.4.15

Changelog (symfony/form@v7.4.14...v7.4.15)

v7.4.14

Changelog (https://github.com/symfony/form/compare/v7....

Description has been truncated

@dependabot
Bump the all-dependencies group with 18 updates
d34896a 
Bumps the all-dependencies group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [composer/composer](https://github.com/composer/composer) | `2.9.8` | `2.10.2` |
| [doctrine/dbal](https://github.com/doctrine/dbal) | `4.4.1` | `4.4.4` |
| [doctrine/doctrine-bundle](https://github.com/doctrine/DoctrineBundle) | `2.18.2` | `2.19.0` |
| [doctrine/orm](https://github.com/doctrine/orm) | `3.6.1` | `3.6.7` |
| [guzzlehttp/guzzle-services](https://github.com/guzzle/guzzle-services) | `1.7.0` | `1.7.3` |
| [symfony/config](https://github.com/symfony/config) | `7.4.4` | `7.4.15` |
| [symfony/console](https://github.com/symfony/console) | `7.4.11` | `7.4.15` |
| [symfony/dotenv](https://github.com/symfony/dotenv) | `7.4.0` | `7.4.15` |
| [symfony/filesystem](https://github.com/symfony/filesystem) | `7.4.11` | `7.4.15` |
| [symfony/flex](https://github.com/symfony/flex) | `2.10.0` | `2.11.0` |
| [symfony/form](https://github.com/symfony/form) | `7.4.4` | `7.4.15` |
| [symfony/monolog-bundle](https://github.com/symfony/monolog-bundle) | `3.11.1` | `3.11.2` |
| [symfony/security-csrf](https://github.com/symfony/security-csrf) | `7.4.4` | `7.4.8` |
| [symfony/twig-bundle](https://github.com/symfony/twig-bundle) | `7.4.4` | `7.4.15` |
| [symfony/var-exporter](https://github.com/symfony/var-exporter) | `7.4.9` | `7.4.14` |
| [symfony/yaml](https://github.com/symfony/yaml) | `7.4.13` | `7.4.15` |
| [twig/extra-bundle](https://github.com/twigphp/twig-extra-bundle) | `3.23.0` | `3.24.0` |
| [twig/twig](https://github.com/twigphp/Twig) | `3.27.1` | `3.28.0` |


Updates `composer/composer` from 2.9.8 to 2.10.2
- [Release notes](https://github.com/composer/composer/releases)
- [Changelog](https://github.com/composer/composer/blob/main/CHANGELOG.md)
- [Commits](composer/composer@2.9.8...2.10.2)

Updates `doctrine/dbal` from 4.4.1 to 4.4.4
- [Release notes](https://github.com/doctrine/dbal/releases)
- [Commits](doctrine/dbal@4.4.1...4.4.4)

Updates `doctrine/doctrine-bundle` from 2.18.2 to 2.19.0
- [Release notes](https://github.com/doctrine/DoctrineBundle/releases)
- [Commits](doctrine/DoctrineBundle@2.18.2...2.19.0)

Updates `doctrine/orm` from 3.6.1 to 3.6.7
- [Release notes](https://github.com/doctrine/orm/releases)
- [Commits](doctrine/orm@3.6.1...3.6.7)

Updates `guzzlehttp/guzzle-services` from 1.7.0 to 1.7.3
- [Release notes](https://github.com/guzzle/guzzle-services/releases)
- [Changelog](https://github.com/guzzle/guzzle-services/blob/2.0/CHANGELOG.md)
- [Commits](guzzle/guzzle-services@1.7.0...1.7.3)

Updates `symfony/config` from 7.4.4 to 7.4.15
- [Release notes](https://github.com/symfony/config/releases)
- [Changelog](https://github.com/symfony/config/blob/8.2/CHANGELOG.md)
- [Commits](symfony/config@v7.4.4...v7.4.15)

Updates `symfony/console` from 7.4.11 to 7.4.15
- [Release notes](https://github.com/symfony/console/releases)
- [Changelog](https://github.com/symfony/console/blob/8.2/CHANGELOG.md)
- [Commits](symfony/console@v7.4.11...v7.4.15)

Updates `symfony/dotenv` from 7.4.0 to 7.4.15
- [Release notes](https://github.com/symfony/dotenv/releases)
- [Changelog](https://github.com/symfony/dotenv/blob/8.2/CHANGELOG.md)
- [Commits](symfony/dotenv@v7.4.0...v7.4.15)

Updates `symfony/filesystem` from 7.4.11 to 7.4.15
- [Release notes](https://github.com/symfony/filesystem/releases)
- [Changelog](https://github.com/symfony/filesystem/blob/8.2/CHANGELOG.md)
- [Commits](symfony/filesystem@v7.4.11...v7.4.15)

Updates `symfony/flex` from 2.10.0 to 2.11.0
- [Release notes](https://github.com/symfony/flex/releases)
- [Commits](symfony/flex@v2.10.0...v2.11.0)

Updates `symfony/form` from 7.4.4 to 7.4.15
- [Release notes](https://github.com/symfony/form/releases)
- [Changelog](https://github.com/symfony/form/blob/8.2/CHANGELOG.md)
- [Commits](symfony/form@v7.4.4...v7.4.15)

Updates `symfony/monolog-bundle` from 3.11.1 to 3.11.2
- [Release notes](https://github.com/symfony/monolog-bundle/releases)
- [Changelog](https://github.com/symfony/monolog-bundle/blob/4.x/CHANGELOG.md)
- [Commits](symfony/monolog-bundle@v3.11.1...v3.11.2)

Updates `symfony/security-csrf` from 7.4.4 to 7.4.8
- [Release notes](https://github.com/symfony/security-csrf/releases)
- [Changelog](https://github.com/symfony/security-csrf/blob/8.2/CHANGELOG.md)
- [Commits](symfony/security-csrf@v7.4.4...v7.4.8)

Updates `symfony/twig-bundle` from 7.4.4 to 7.4.15
- [Release notes](https://github.com/symfony/twig-bundle/releases)
- [Changelog](https://github.com/symfony/twig-bundle/blob/8.2/CHANGELOG.md)
- [Commits](symfony/twig-bundle@v7.4.4...v7.4.15)

Updates `symfony/var-exporter` from 7.4.9 to 7.4.14
- [Release notes](https://github.com/symfony/var-exporter/releases)
- [Changelog](https://github.com/symfony/var-exporter/blob/8.2/CHANGELOG.md)
- [Commits](symfony/var-exporter@v7.4.9...v7.4.14)

Updates `symfony/yaml` from 7.4.13 to 7.4.15
- [Release notes](https://github.com/symfony/yaml/releases)
- [Changelog](https://github.com/symfony/yaml/blob/8.2/CHANGELOG.md)
- [Commits](symfony/yaml@v7.4.13...v7.4.15)

Updates `twig/extra-bundle` from 3.23.0 to 3.24.0
- [Release notes](https://github.com/twigphp/twig-extra-bundle/releases)
- [Commits](twigphp/twig-extra-bundle@v3.23.0...v3.24.0)

Updates `twig/twig` from 3.27.1 to 3.28.0
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/3.x/CHANGELOG)
- [Commits](twigphp/Twig@v3.27.1...v3.28.0)

---
updated-dependencies:
- dependency-name: composer/composer
  dependency-version: 2.10.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: doctrine/dbal
  dependency-version: 4.4.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: doctrine/doctrine-bundle
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: doctrine/orm
  dependency-version: 3.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: guzzlehttp/guzzle-services
  dependency-version: 1.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/config
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/console
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/dotenv
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/filesystem
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/flex
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: symfony/form
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/monolog-bundle
  dependency-version: 3.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/security-csrf
  dependency-version: 7.4.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/twig-bundle
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/var-exporter
  dependency-version: 7.4.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: symfony/yaml
  dependency-version: 7.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: twig/extra-bundle
  dependency-version: 3.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: twig/twig
  dependency-version: 3.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 7, 2026
@dependabot
dependabot Bot requested review from a team and JamesDominy as code owners August 7, 2026 10:10
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@JamesDominy JamesDominy Awaiting requested review from JamesDominy JamesDominy is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants