Skip to content

Bump the composer group across 1 directory with 9 updates - #2

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5f58fe8e14
Closed

Bump the composer group across 1 directory with 9 updates#2
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/composer-5f58fe8e14

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown

Bumps the composer group with 6 updates in the / directory:

Package From To
guzzlehttp/guzzle 7.7.0 7.15.1
league/commonmark 2.4.0 2.8.3
nesbot/carbon 2.68.1 2.73.0
psy/psysh 0.11.19 0.11.23
symfony/http-foundation 6.3.1 6.4.43
symfony/mailer 6.3.0 6.4.43

Updates guzzlehttp/guzzle from 7.7.0 to 7.15.1

Release notes

Sourced from guzzlehttp/guzzle's releases.

7.15.1

Security

7.15.0

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2

Security

7.14.1

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.12.5

Fixed

... (truncated)

Changelog

Sourced from guzzlehttp/guzzle's changelog.

7.15.1 - 2026-07-18

Security

7.15.0 - 2026-07-17

Added

  • Added Multiplexing::NONE support as a client, cURL multi handler, and conditional request option

Changed

  • Adjusted guzzlehttp/psr7 version constraint to ^2.13
  • Use locale-independent ASCII folding for all case normalization and comparison
  • Bound cURL upload reads to the declared Content-Length
  • Sanitize the cURL error text exposed through exception handler context
  • Fail closed when a named cURL multi connection cap cannot be applied
  • Reject the request-level CURLOPT_SHARE cURL option when named connection caps are configured
  • Strengthen old-libcurl SOCKS isolation for raw CURLOPT_PRE_PROXY and opaque share handles
  • Isolate HTTP proxy tunnels from opaque shared connection caches
  • Trigger runtime deprecations for previously deprecated functionality in 7.1.0

Deprecated

  • Deprecated Utils::jsonDecode() and Utils::jsonEncode() in favor of native JSON functions
  • Deprecated passing CURLMOPT_PIPELINING in the cURL multi handler options array
  • Deprecated passing CURLOPT_PROXYHEADER without cURL proxy header separation support

Fixed

  • Defer cURL requests created from multi callbacks until native execution unwinds
  • Fail synchronous waits from native cURL callbacks promptly instead of self-deadlocking
  • Guard cURL multi handle removal against progress callbacks re-entering the handler
  • Scope promise waits on the cURL multi handler to the awaited transfer
  • Strip Content-Length and Transfer-Encoding when redirects discard the request body
  • Stop re-applying the delay request option to followed redirects

7.14.2 - 2026-07-14

Security

... (truncated)

Commits

Updates guzzlehttp/psr7 from 2.5.0 to 2.13.0

Release notes

Sourced from guzzlehttp/psr7's releases.

2.13.0

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.4

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

2.12.3

Security

2.12.2

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1

Security

2.12.0

Deprecated

  • Deprecated non-finite float values in Query::build() that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-finite float multipart contents that guzzlehttp/psr7 3.0 rejects
  • Deprecated non-string scalar bodies in Utils::streamFor(); cast them to a string for 3.0
  • Deprecated non-string Uri::withQueryValues() values; cast them to a string for 3.0

2.11.1

Fixed

  • Fixed non-finite float values emitting coercion warnings on PHP 8.5

2.11.0

Changed

  • Changed Utils::modifyRequest() to reject conflicting URI and Host header changes in the same call
  • Changed Header::parse() to split semicolon-separated parameters without repeated regular expression lookaheads

... (truncated)

Changelog

Sourced from guzzlehttp/psr7's changelog.

2.13.0 - 2026-07-16

Added

  • Add Utils:: asciiToLower, asciiToUpper, asciiUcFirst, caselessEquals, caselessContains

Changed

  • Use locale-independent ASCII case folding everywhere case is normalized
  • Trigger a runtime deprecation for previously deprecated functionality in 2.3.0

2.12.5 - 2026-07-13

Fixed

  • Compare header names and hosts with locale-independent ASCII lowercasing
  • Compare hosts without locale sensitivity when detecting cross-origin redirects

2.12.4 - 2026-07-08

Changed

  • Pass explicit trim characters ahead of the PHP 8.6 trim default change

Fixed

  • Anchor server port and response start-line patterns to the true end of input
  • Treat host-less origin-form request targets starting with // as paths in Message::parseRequest()
  • Reject raw DEL bytes in bracketed IP-literal hosts instead of parsing a mutated host
  • Reject invalid bytes after a bracketed IP-literal host instead of reparsing a different host

2.12.3 - 2026-06-23

Security

2.12.2 - 2026-06-23

Fixed

  • Report URI parsing, filtering, and normalization PCRE failures explicitly
  • Report HTTP message parser PCRE failures explicitly
  • Fail closed when PCRE validation fails for request targets and hosts

2.12.1 - 2026-06-18

Security

... (truncated)

Commits
  • dad8962 Release 2.13.0
  • 1bc4f53 Trigger a runtime deprecation for Header::normalize() (#866)
  • a1372ea Add tests locking in no-file upload handling (#856)
  • d9561d1 Merge branch '2.12' into 2.13
  • 9365d57 Release 2.12.5
  • b82bac4 Add caseless comparison and asciiUcFirst helpers (#854)
  • 2cf293e Merge branch '2.12' into 2.13
  • c685419 Fold cross-origin host comparison without locale sensitivity (#852)
  • 226b5b3 Add locale-independent ASCII case folding helpers (#850)
  • 1acfa28 Use locale-independent ASCII folding for header and host names (#849)
  • Additional commits viewable in compare view

Updates league/commonmark from 2.4.0 to 2.8.3

Release notes

Sourced from league/commonmark's releases.

2.8.3

What's Changed

Fixed

  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

Full Changelog: thephpleague/commonmark@2.8.2...2.8.3

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

  • Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: thephpleague/commonmark@2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

  • Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
  • Fixed PHP 8.5 deprecation (#1107)

New Contributors

Full Changelog: thephpleague/commonmark@2.8.0...2.8.1

2.8.0

What's Changed

Added

  • Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

  • Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

New Contributors

Full Changelog: thephpleague/commonmark@2.7.1...2.8.0

2.7.1

Notable Changes

... (truncated)

Changelog

Sourced from league/commonmark's changelog.

[2.8.3] - 2026-07-12

Fixed

  • Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
  • Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

[2.8.2] - 2026-03-19

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

  • Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

[2.8.1] - 2026-03-05

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

  • Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
  • Fixed PHP 8.5 deprecation (#1107)

[2.8.0] - 2025-11-26

Added

  • Added a new HighlightExtension for marking important text using == syntax (#1100)

Fixed

  • Fixed AutolinkExtension incorrectly matching URLs after invalid www. prefix (#1095, #1103)

[2.7.1] - 2025-07-20

Changed

  • Optimized several regular expressions in RegexHelper to improve performance (#674, #1086)

Fixed

  • EmbedProcessor no longer calls updateEmbeds() when there are no embeds to update (#1081)
  • Fixed missing benchmark.php CSV path validation for non-existent files (#1068, #1085)

[2.7.0] - 2025-05-05

This is a security release to address a potential cross-site scripting (XSS) vulnerability when using the AttributesExtension with untrusted user input.

Added

  • Added attributes/allow config option to specify which attributes users are allowed to set on elements (default allows virtually all attributes)

Changed

  • The AttributesExtension blocks all attributes starting with on unless explicitly allowed via the attributes/allow config option
  • The allow_unsafe_links option is now respected by the AttributesExtension when users specify href and src attributes

[2.6.2] - 2025-04-18

... (truncated)

Commits
  • 1902f60 Prepare for 2.8.3 release
  • 171f927 Update changelog
  • 51b529f Fix tab handling in fenced code blocks (#1130)
  • cfb11ec Fix over-blocking of safe URLs by the unsafe link filter (#1131)
  • fb59dbc Strengthen unsafe link and image renderer test assertions (#1129)
  • 4d0b5b1 Fix typos and broken formatting in the 2.x docs (#1128)
  • 73d4f1f Add Anthropic to the list of sponsors
  • 0faf9ee Merge pull request #1125 from thephpleague/fix/markdownlint-md060
  • a85b4ad Fetch full git history for the Markdownlint job
  • e6dc715 Fix Markdownlint CI job by not overriding DEFAULT_BRANCH
  • Additional commits viewable in compare view

Updates nesbot/carbon from 2.68.1 to 2.73.0

Release notes

Sourced from nesbot/carbon's releases.

2.73.0

Complete commits list: briannesbitt/Carbon@2.72.6...2.73.0

Summary:

2.72.6

Complete commits list: CarbonPHP/carbon@2.72.5...2.72.6

Summary:

  • Validate locale earlier
Commits
  • 9228ce9 Merge pull request #13 from thecaliskan/2.x
  • 142f0f5 changed CS rule
  • dc27804 changed CS rule
  • 8910c51 changed expected result for PHP 8.4
  • d1e695f Added PHP 8.3 and PHP 8.4 test for laravel and removed PHP 8.4 lowest test ma...
  • 5dca8dc Fixes for PHP 8.4
  • 8c3e607 Fixes for implicit nullability deprecation
  • 5f4c750 upgraded phpunit version on tests
  • a4932f3 Fixed CS
  • d6f5afb Added PHP 8.4 support
  • Additional commits viewable in compare view

Updates psy/psysh from 0.11.19 to 0.11.23

Release notes

Sourced from psy/psysh's releases.

PsySH v0.11.23

  • Fixed CWD configuration poisoning vulnerability (CVE-2026-25129). Backported Restricted Mode from v0.12. PsySH now requires explicit trust before loading local config (.psysh.php), local PsySH binaries, or Composer autoloads from untrusted projects. Configure with trustProject config option, --trust-project / --no-trust-project CLI flags, or PSYSH_TRUST_PROJECT env var.

PsySH v0.11.22

  • Fix Sudo static property manipulation in PHP 8.3.

PsySH v0.11.21

Made a bunch of behind the scenes fixes, that you probably won't even notice. Specifically:

  • Ensure that parse errors show the original message, not "unexpected EOF" (unless that was the original error).
  • Prettier output for Symfony Console exceptions.
  • Improve argument parsing for timeit command.
  • Remove very deprecated Symfony TableHelper fallback (it's been unsupported by our oldest supported Console version for years).
  • A bunch of static analysis improvements.

PsySH v0.11.20

  • Fix undefined array key (when argv doesn't exist) in userland readline implementation (Thanks @​BafS!)
Commits

Updates symfony/http-foundation from 6.3.1 to 6.4.43

Release notes

Sourced from symfony/http-foundation's releases.

v6.4.43

Changelog (symfony/http-foundation@v6.4.42...v6.4.43)

v6.4.42

Changelog (symfony/http-foundation@v6.4.41...v6.4.42)

v6.4.41

Changelog (symfony/http-foundation@v6.4.35...v6.4.41)

v6.4.35

Changelog (symfony/http-foundation@v6.4.34...v6.4.35)

v6.4.34

Changelog (symfony/http-foundation@v6.4.33...v6.4.34)

v6.4.33

Changelog (symfony/http-foundation@v6.4.32...v6.4.33)

v6.4.32

Changelog (symfony/http-foundation@v6.4.31...v6.4.32)

v6.4.31

Changelog (symfony/http-foundation@v6.4.30...v6.4.31)

... (truncated)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.2

  • Deprecate not passing an expiry to UriSigner::sign()
  • Add the $defaultExpiration argument to UriSigner::__construct()
  • Add argument $version to UriSigner::sign(), UriSigner::check(), UriSigner::checkRequest(), and UriSigner::verify() to bind a signed URI to a state token, folded into the signature

8.1

  • Add BinaryFileResponse::shouldDeleteFileAfterSend()
  • Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead
  • Add SessionHasFlashMessage test constraint
  • Response::__construct() now accepts a ResponseHeaderBag as its third argument
  • ParameterBag::getInt() and ParameterBag::getBoolean() now throw UnexpectedValueException instead of silently returning 0/false when the value cannot be converted

8.0

  • Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
  • Add argument $subtypeFallback to Request::getFormat()
  • Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
  • Trigger PHP warning when using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
  • Add argument $partitioned to ResponseHeaderBag::clearCookie()
  • Add argument $expiration to UriSigner::sign()
  • Remove Request::get(), use properties ->attributes, query or request directly instead
  • Remove accepting null $format argument to Request::setFormat()

7.4

  • Add #[WithHttpStatus] to define status codes: 404 for SignedUriException and 403 for ExpiredSignedUriException
  • Add support for the QUERY HTTP method
  • Add support for structured MIME suffix
  • Add Request::set/getAllowedHttpMethodOverride() to list which HTTP methods can be overridden
  • Deprecate using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Deprecate method Request::get(), use properties ->attributes, query or request directly instead
  • Make Request::createFromGlobals() parse the body of PUT, DELETE, PATCH and QUERY requests
  • Deprecate HTTP method override for methods GET, HEAD, CONNECT and TRACE; it will be ignored in Symfony 8.0
  • Deprecate accepting null $format argument to Request::setFormat()

7.3

  • Add support for iterable of string in StreamedResponse
  • Add EventStreamResponse and ServerEvent classes to streamline server event streaming

... (truncated)

Commits
  • ea0c801 bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path ...
  • 464d13c [HttpFoundation] Fix TypeError in UriSigner when the hash parameter is not a ...
  • eb5b7f9 [HttpFoundation] Reject reserved characters in the cookie path and domain
  • f34d2dd [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical I...
  • 5ef978b [HttpFoundation] Add RFC2544 and RFC5180 IP Benchmarking to IpUtils::PRIVATE_...
  • 269f3bd [HttpFoundation] Add RFC5737 and RFC3849 IPs to IpUtils::PRIVATE_SUBNETS
  • 0ff8570 Update src/Symfony/Component/HttpFoundation/UrlHelper.php
  • 33c94a3 Fix Absolute URL generation for tel:, mailto:, ... URLs to be ignored by URLH...
  • 23dcf8e Restore compat with DBAL v4.x
  • 41a0b1a Unsafe unserialize phpstan rule
  • Additional commits viewable in compare view

Updates symfony/mailer from 6.3.0 to 6.4.43

Release notes

Sourced from symfony/mailer's releases.

v6.4.43

Changelog (symfony/mailer@v6.4.40...v6.4.43)

  • bug #64985 Fix fatal TypeError when sending a RawMessage via an API transport (@​Baylox)
  • bug #64710 Reject control characters in SmtpTransport::setLocalDomain() (@​iliaal)

v6.4.40

Changelog (symfony/mailer@v6.4.31...v6.4.40)

v6.4.34

Changelog (symfony/mailer@v6.4.33...v6.4.34)

  • bug #63278 Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (@​mwijngaard)

v6.4.31

Changelog (symfony/mailer@v6.4.30...v6.4.31)

v6.4.27

Changelog (symfony/mailer@v6.4.26...v6.4.27)

v6.4.26

Changelog (symfony/mailer@v6.4.25...v6.4.26)

v6.4.25

Changelog (symfony/mailer@v6.4.24...v6.4.25)

v6.4.24

Changelog (symfony/mailer@v6.4.23...v6.4.24)

v6.4.23

Changelog (symfony/mailer@v6.4.22...v6.4.23)

... (truncated)

Changelog

Sourced from symfony/mailer's changelog.

CHANGELOG

8.2

  • Reorder EsmtpTransport authenticators to prefer PLAIN over obsolete LOGIN

8.0

  • Remove TransportFactoryTestCase, extend AbstractTransportFactoryTestCase instead

7.4

  • Add logger (constructor) property to RoundRobinTransport

7.3

  • Add DSN param retry_period to override default email transport retry period
  • Add Dsn::getBooleanOption()
  • Add DSN param source_ip to allow binding to a (specific) IPv4 or IPv6 address.
  • Add DSN param require_tls to enforce use of TLS/STARTTLS
  • Add DkimSignedMessageListener, SmimeEncryptedMessageListener, and SmimeSignedMessageListener

7.2

  • Deprecate TransportFactoryTestCase, extend AbstractTransportFactoryTestCase instead

    The testIncompleteDsnException() test is no longer provided by default. If you make use of it by implementing the incompleteDsnProvider() data providers, you now need to use the IncompleteDsnTestTrait.

  • Make TransportFactoryTestCase compatible with PHPUnit 10+

  • Support unicode email addresses such as "dømi@dømi.example"

7.1

  • Dispatch Postmark's "406 - Inactive recipient" API error code as a PostmarkDeliveryEvent instead of throwing an exception
  • Add DSN param auto_tls to disable automatic STARTTLS
  • Add support for allowing some users even if recipients is defined in EnvelopeListener

7.0

  • Remove the OhMySmtp bridge in favor of the MailPace bridge

... (truncated)

Commits
  • 2a38092 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport
  • 0df4eb9 [Mailer] Reject control characters in SmtpTransport::setLocalDomain()
  • bc77a62 Drop PR warning and auto-closing on subtree splits
  • 94fd44f Merge branch '5.4' into 6.4
  • 5b5385b [Mailer] Add end-of-options separator before recipients in SendmailTransport;...
  • 602519c PHP CS Fixer: backports changes toward 6.4 branch
  • a2918c6 CS fixes - native_function_invocation & static_lambda
  • d56a83b [CS] Back config from 8.1 and apply heredoc_indentation rule
  • 01b846f [Mailer] Clarify the purpose of SentMessage's "message id" concept
  • 8835f93 do not use PHPUnit mock objects without configured expectations
  • Additional commits viewable in compare view

Updates symfony/mime from 6.3.0 to 6.4.43

Release notes

Sourced from symfony/mime's releases.

v6.4.43

Changelog (symfony/mime@v6.4.41...v6.4.43)

v6.4.41

Changelog (symfony/mime@v6.4.40...v6.4.41)

v6.4.40

Changelog (symfony/mime@v6.4.37...v6.4.40)

v6.4.37

Changelog (symfony/mime@v6.4.36...v6.4.37)

v6.4.36

Changelog (symfony/mime@v6.4.35...v6.4.36)

v6.4.35

Changelog (symfony/mime@v6.4.34...v6.4.35)

v6.4.34

Changelog (symfony/mime@v6.4.33...v6.4.34)

  • no significant changes

v6.4.32

Changelog (symfony/mime@v6.4.31...v6.4.32)

  • no significant changes

v6.4.30

Changelog (symfony/mime@v6.4.29...v6.4.30)

  • no significant changes

v6.4.26

Changelog (symfony/mime@v6.4.25...v6.4.26)

... (truncated)

Commits
  • 38421e1 [HttpKernel][Mime][Serializer] Scope the new regression tests to the componen...
  • 11f670c [Serializer] Check the denormalized class is a Mime part in MimeMessageNormal...
  • 34ed849 [Mime] Fix dropped whitespace between multiple encoded words
  • 4f0be2e Drop PR warning and auto-closing on subtree splits
  • 5575d37 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
  • 7ccfb0c Merge branch '5.4' into 6.4
  • 8f89d3a [Mime] Reject email addresses containing line breaks in Address
  • f2f05cb [Mime] Fix transient test
  • 330077b bug #64047 [Mime] Preserve inline part filename instead of overwriting it wit...
  • 4c7099f [Mime] Preserve inline part filename instead of overwriting it with the Conte...
  • Additional commits viewable in compare view

Updates symfony/polyfill-intl-idn from 1.27.0 to 1.38.1

Release notes

Sourced from symfony/polyfill-intl-idn's releases.

v1.38.1

Changelog (symfony/polyfill-intl-idn@v1.31.0...v1.38.1)

v1.37.0

Changelog (symfony/polyfill-intl-idn@v1.36.0...v1.37.0)

  • no significant changes

v1.36.0

Changelog (symfony/polyfill-intl-idn@v1.35.0...v1.36.0)

  • no significant changes

v1.35.0

Changelog (symfony/polyfill-intl-idn@v1.34.0...v1.35.0)

  • no significant changes

v1.34.0

Changelog (symfony/polyfill-intl-idn@v1.33.0...v1.34.0)

  • no significant changes
Commits
  • dc21118 [Intl][Idn] Reject xn-- labels whose Punycode payload decodes to ASCII-only
  • 9614ac4 Give testing some love
  • c36586d Bump to PHP 7.2, stick to phpunit 8.5
  • a6e83bd Revert "minor #477 Auto-close PRs on subtree-splits (kbond)"
  • 872bf45 Auto-close PRs on subtree-splits
  • 412b0a6 Conform to IDNA version 15.1.0 revision 31
  • a287ed7 Remove branch-alias from composer.json
  • ecaafce feature #334 [PHP 8.1] Add CURLStringFile polyfill (Ayesh, nicolas-grekas)
  • b5b0079 CS fix
  • 5a42f2d Bump for 1.28
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's maj...

Description has been truncated

@dependabot
Bump the composer group across 1 directory with 9 updates
4219efe 
Bumps the composer group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [guzzlehttp/guzzle](https://github.com/guzzle/guzzle) | `7.7.0` | `7.15.1` |
| [league/commonmark](https://github.com/thephpleague/commonmark) | `2.4.0` | `2.8.3` |
| [nesbot/carbon](https://github.com/CarbonPHP/carbon) | `2.68.1` | `2.73.0` |
| [psy/psysh](https://github.com/bobthecow/psysh) | `0.11.19` | `0.11.23` |
| [symfony/http-foundation](https://github.com/symfony/http-foundation) | `6.3.1` | `6.4.43` |
| [symfony/mailer](https://github.com/symfony/mailer) | `6.3.0` | `6.4.43` |



Updates `guzzlehttp/guzzle` from 7.7.0 to 7.15.1
- [Release notes](https://github.com/guzzle/guzzle/releases)
- [Changelog](https://github.com/guzzle/guzzle/blob/8.0/CHANGELOG.md)
- [Commits](guzzle/guzzle@7.7.0...7.15.1)

Updates `guzzlehttp/psr7` from 2.5.0 to 2.13.0
- [Release notes](https://github.com/guzzle/psr7/releases)
- [Changelog](https://github.com/guzzle/psr7/blob/3.0/CHANGELOG.md)
- [Commits](guzzle/psr7@2.5.0...2.13.0)

Updates `league/commonmark` from 2.4.0 to 2.8.3
- [Release notes](https://github.com/thephpleague/commonmark/releases)
- [Changelog](https://github.com/thephpleague/commonmark/blob/2.8/CHANGELOG.md)
- [Commits](thephpleague/commonmark@2.4.0...2.8.3)

Updates `nesbot/carbon` from 2.68.1 to 2.73.0
- [Release notes](https://github.com/CarbonPHP/carbon/releases)
- [Commits](CarbonPHP/carbon@2.68.1...2.73.0)

Updates `psy/psysh` from 0.11.19 to 0.11.23
- [Release notes](https://github.com/bobthecow/psysh/releases)
- [Commits](bobthecow/psysh@v0.11.19...v0.11.23)

Updates `symfony/http-foundation` from 6.3.1 to 6.4.43
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/8.2/CHANGELOG.md)
- [Commits](symfony/http-foundation@v6.3.1...v6.4.43)

Updates `symfony/mailer` from 6.3.0 to 6.4.43
- [Release notes](https://github.com/symfony/mailer/releases)
- [Changelog](https://github.com/symfony/mailer/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mailer@v6.3.0...v6.4.43)

Updates `symfony/mime` from 6.3.0 to 6.4.43
- [Release notes](https://github.com/symfony/mime/releases)
- [Changelog](https://github.com/symfony/mime/blob/8.2/CHANGELOG.md)
- [Commits](symfony/mime@v6.3.0...v6.4.43)

Updates `symfony/polyfill-intl-idn` from 1.27.0 to 1.38.1
- [Release notes](https://github.com/symfony/polyfill-intl-idn/releases)
- [Commits](symfony/polyfill-intl-idn@v1.27.0...v1.38.1)

---
updated-dependencies:
- dependency-name: guzzlehttp/guzzle
  dependency-version: 7.15.1
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: guzzlehttp/psr7
  dependency-version: 2.13.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: league/commonmark
  dependency-version: 2.8.3
  dependency-type: indirect
  dependency-group: composer
- dependency-name: nesbot/carbon
  dependency-version: 2.73.0
  dependency-type: indirect
  dependency-group: composer
- dependency-name: psy/psysh
  dependency-version: 0.11.23
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/http-foundation
  dependency-version: 6.4.43
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/mailer
  dependency-version: 6.4.43
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/mime
  dependency-version: 6.4.43
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/polyfill-intl-idn
  dependency-version: 1.38.1
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Aug 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 1, 2026

Copy link
Copy Markdown
Author

Superseded by #3.

@dependabot dependabot Bot closed this Aug 1, 2026
@dependabot
dependabot Bot deleted the dependabot/composer/composer-5f58fe8e14 branch August 1, 2026 17:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants