Repository navigation
[php] New version of symfony/http-foundation (8.1.11) broke the build - #6
Open
depfu[bot] wants to merge 1 commit into
Open
depfu[bot] wants to merge 1 commit into
depfu[bot] wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We've tested your project with an updated dependency and the build failed.
This version is either within the version range you specified or you haven't specified a version/range. To be able to test your project with the new version, we've taken the liberty of pinning the version for this branch and pull request.
Unfortunately, we encountered failing tests after pinning. This means that this new version is not compatible with your project and the test failure will potentially also happen on fresh installs.
If you have correctly specified a semantic versioning version range, you should probably also file an issue with the upstream project as they might have released an update that's breaking SemVer rules, which is not cool. (But then again, not all projects explicitly follow SemVer)
We've left the pull request open for you to investigate this issue. Please don't merge it as is, because, again, we've pinned the version of symfony/http-foundation for this test run.
What changed?
✳️ symfony/http-foundation (^5.2|^6.0|^7.0|^8.0 → 8.1.11) · Repo · Changelog
Release Notes
8.1.11
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 33 commits:
Merge branch '7.4' into 8.1Merge branch '6.4' into 7.4Merge branch '5.4' into 6.4security #ghsa-xg2q-4rrq-657q [HttpFoundation] Split the private ranges usable as trusted proxies from the deny list of private subnets (nicolas-grekas)security #ghsa-xg2q-4rrq-657q [HttpFoundation] Add the list of private ranges usable as trusted proxies (nicolas-grekas)security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is listed in a MethodRequestMatcher (nicolas-grekas)security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher (nicolas-grekas)Merge branch '7.4' into 8.1Merge branch '6.4' into 7.4[HttpFoundation] Fix Request::getBaseUrl() for a percent-encoded or wrong-case script name after a prefixMerge branch '5.4' into 6.4[HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by the client[HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher[HttpFoundation] Don't use the script name as Request::getBaseUrl() when it's not in the URI pathMerge branch '7.4' into 8.1Merge branch '6.4' into 7.4Merge branch '5.4' into 6.4[HttpFoundation] Fix UrlHelper for fragments behind a trusted X-Forwarded-Prefix and for an empty path[HttpFoundation] Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment[HttpFoundation] Split the private ranges usable as trusted proxies from the deny list of private subnets[HttpFoundation] Add the list of private ranges usable as trusted proxies[HttpFoundation] Preserve the base URL for query and fragment referencesMerge branch '7.4' into 8.1Merge branch '6.4' into 7.4[HttpFoundation] Do not expose the DSN in the unsupported connection exception of SessionHandlerFactoryMerge branch '7.4' into 8.1Merge branch '6.4' into 7.4[HttpFoundation] Mark the DSN and options of SessionHandlerFactory as #[\SensitiveParameter]Merge branch '7.4' into 8.1Merge branch '6.4' into 7.4Reject trailing newlines in Content-Disposition fallbacks[HttpFoundation] Match HEAD requests when GET is listed in a MethodRequestMatcher[HttpFoundation] Correct sendHeaders class in 7.4 changelog