Bump the composer group across 1 directory with 7 updates

[dependabot]

Bumps the composer group with 7 updates in the / directory:

Package	From	To
composer/composer	2.9.5	2.10.2
google/protobuf	4.33.5	4.33.6
league/commonmark	2.8.0	2.8.3
robrichards/xmlseclibs	3.1.4	3.1.5
symfony/cache	7.4.5	7.4.14
symfony/routing	7.4.4	7.4.13
symfony/yaml	7.4.1	7.4.14

Updates composer/composer from 2.9.5 to 2.10.2

Release notes

Sourced from composer/composer's releases.

2.10.2

• Security: Validate package names (GHSA-499r-g7pc-vmp9 / CVE-2026-59948)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx / CVE-2026-59946)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3 / CVE-2026-59947)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

Full Changelog: composer/composer@2.10.1...2.10.2

2.10.1

• Security: Fixed shell escaping when opening an editor (#12903)
• Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
• Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
• Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
• Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
• Fixed warnings from Composer repositories being printed twice in some cases (#12907)

Full Changelog: composer/composer@2.10.0...2.10.1

2.10.0

Read the Composer 2.10 Release Announcement for more details on the release highlights.

Full Changelog

• BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
• BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
• Security: Added dependency policies to block package versions where malware was detected on update/install or report it with audit (#12786)
• Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
• Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
• Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)
• Added --strict-psr-autoloader flag to install and update commands (#12647)
• Added source-fallback config option to disable or enable source fallback on download failure (#12698)
• Added --require parameter to create-project to add new packages to the project as it gets installed (#12738)
• Optimized plugin autoloading by avoiding regenerating classmaps for every package per plugin (#12696)
• Optimized PoolOptimizer memory usage (#12783)
• Optimized classmap dumping performance
• Deprecated most of the audit config in favor of the new policy one (#12804, see #12786 for the RFC and upgrade docs)
• Fixed update --bump-after-update to only bump packages that actually were updated (#12733)
• Fixed GitHub API authentication errors not being visible to the user (#12737)

... (truncated)

Changelog

Sourced from composer/composer's changelog.

[2.10.2] 2026-07-01

• Security: Validate package names (GHSA-499r-g7pc-vmp9)
• Security: Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)
• Security: Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)
• Security: Only follow HTTP redirects from HTTP responses (#12948)
• Security: Prevent phar metadata unserialization on unsafe PHP versions (#12946)
• Security: Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)
• Added warning output in self-update command when using a soon-to-be EOL version (#12920)
• Added download retry when a GitHub codeload URL returns a 400 (#12962)
• Fixed audit command to output the audit result to stdout (#12904)
• Fixed backspace characters being output to non-decorated output (#12925)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)
• Fixed provider packages hiding suggestions for the package they provide themselves (#12933)
• Fixed security advisory blocking causing issues with xdebug enabled (#12935)

[2.10.1] 2026-06-04

• Security: Fixed shell escaping when opening an editor (#12903)
• Security: Verify backup phar signature before restoring it when using self-update --rollback (#12918)
• Fixed source-fallback also disabling fallbacks to dist install when source is the preferred install method (#12888)
• Fixed source -> dist package updates wiping the .git dir without checking for local changes first (#12912)
• Fixed GitHub token prompt happening multiple times on parallel auth failures (#12913)
• Fixed warnings from Composer repositories being printed twice in some cases (#12907)

[2.10.0] 2026-05-28

• BC Break / Security: Disabled automatic fallback to source checkout if dist/zip install fails, we have introduced a new source-fallback config option as a temporary way to restore the old behavior, but if you need this talk to us as we plan to remove it entirely in 2.11 (#12885)
• BC Break: Minor break for audit consumers, the exit code is now always 0 (success) or 1 if anything failed the audit (#12881)
• Security: Hardened output filtering of URLs to reduce chances of token leaks (#12882, #12886)
• Security: Fixed handling of uppercase schemes in URL validation that might have allowed https requirement bypass (#12884)
• Fixed audit command returning a success code when the vendor dir was not present (#12880)

[2.10.0-RC2] 2026-05-20

• Since 2.10.0-RC1, fixes in 2.9.6 - 2.9.8, many of which security relevant, are also included
• Since 2.10.0-RC1 a lot of the new filter list config format was modified - see #12786 for the latest state of this new feature
• Added a new policy config block to control all security related update/install/audit policies. This replaces and deprecates most of the audit config (#12804 for implementation, #12786 for RFC/upgrade docs)
• Enabled blocking of malware packages at install time by default
• Fixed --no-plugins handling regression (#12789)
• Fixed regression in startup performance when many scripts are defined (#12832)
• Improved classmap dumping performance

[2.10.0-RC1] 2026-04-01

• Security: Added filter lists to block package versions where malware was detected on update or report it with audit (#12786)
• Security: Fixed git credentials remaining in git mirror .git/config after clone or update failed (2bcbfc3d)
• Security: Fixed usage of insecure 3DES ciphers when ext-curl is missing (5e71d77e)
• Security: Enforce allow-plugins even in non-interactive mode for very old pre-2.2 lock files (#12764)
• Added support for temporary --with constraints with wildcards in the package name for the update command (#12658)

... (truncated)

Commits

• 8d4439f Release 2.10.2
• 79d92f0 Update changelog
• 8887ad7 Merge commit from fork
• 502c6c4 Merge commit from fork
• 145e74d Update deps
• e42b4f1 Retry downloads failing with HTTP 400 on a fresh connection (#12962)
• 8c3eba8 Add basic command level telemetry (#12952)
• c5f92a0 Bump actions/checkout from 6.0.3 to 7.0.0 (#12949)
• b7c4e39 Sanitize JSON parse errors in Http\Response to avoid leaking response bodies ...
• 6665153 Add VersionsTest for self update behavior
• Additional commits viewable in compare view

Updates google/protobuf from 4.33.5 to 4.33.6

Commits

• 84b008c 4.33.6 sync
• 1debe45 5.34.0 sync
• 3f6644d 5.34.0RC2 sync
• 6fd2d13 4.29.6 sync
• See full diff in compare view

Updates league/commonmark from 2.8.0 to 2.8.3

Release notes

Sourced from league/commonmark's releases.

2.8.3

What's Changed

Fixed

• Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
• Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

Full Changelog: thephpleague/commonmark@2.8.2...2.8.3

2.8.2

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

Full Changelog: thephpleague/commonmark@2.8.1...2.8.2

2.8.1

What's Changed

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

New Contributors

• @​Kocal made their first contribution in thephpleague/commonmark#1106
• @​freost made their first contribution in thephpleague/commonmark#1107

Full Changelog: thephpleague/commonmark@2.8.0...2.8.1

Changelog

Sourced from league/commonmark's changelog.

[2.8.3] - 2026-07-12

Fixed

• Fixed tab-indented fenced code blocks inside list items losing the first character of each line and having their info string mangled (#981, #1130)
• Fixed the unsafe link filter incorrectly blocking safe URLs containing vbscript:, file:, or data: anywhere after the start (#1131)

[2.8.2] - 2026-03-19

This is a security release to address an issue where the allowed_domains setting for the Embed extension can be bypassed, resulting in a possible SSRF and XSS vulnerabilities.

Fixed

• Fixed DomainFilteringAdapter hostname boundary bypass where domains like youtube.com.evil could match an allowlist entry for youtube.com (GHSA-hh8v-hgvp-g3f5)

[2.8.1] - 2026-03-05

This is a security release to address an issue where DisallowedRawHtml can be bypassed, resulting in a possible cross-site scripting (XSS) vulnerability.

Fixed

• Fixed DisallowedRawHtmlRenderer not blocking raw HTML tags with trailing ASCII whitespace (GHSA-4v6x-c7xx-hw9f)
• Fixed PHP 8.5 deprecation (#1107)

Commits

• 1902f60 Prepare for 2.8.3 release
• 171f927 Update changelog
• 51b529f Fix tab handling in fenced code blocks (#1130)
• cfb11ec Fix over-blocking of safe URLs by the unsafe link filter (#1131)
• fb59dbc Strengthen unsafe link and image renderer test assertions (#1129)
• 4d0b5b1 Fix typos and broken formatting in the 2.x docs (#1128)
• 73d4f1f Add Anthropic to the list of sponsors
• 0faf9ee Merge pull request #1125 from thephpleague/fix/markdownlint-md060
• a85b4ad Fetch full git history for the Markdownlint job
• e6dc715 Fix Markdownlint CI job by not overriding DEFAULT_BRANCH
• Additional commits viewable in compare view

Updates robrichards/xmlseclibs from 3.1.4 to 3.1.5

Release notes

Sourced from robrichards/xmlseclibs's releases.

3.1.5

Validate AES-GCM Authentication Tag

Changelog

Sourced from robrichards/xmlseclibs's changelog.

xmlseclibs.php ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 24, Jul 2026, 4.0.0-beta1 Security Improvements:

• Harden add509Cert() URL fetching against SSRF: only http/https by default (file:// requires options['allow_file_scheme']); resolve the host and reject loopback/private/link-local/reserved/CGNAT addresses; disable HTTP redirects
• Reject a DOCTYPE in decrypted XML (defense against entity-expansion / XXE in attacker-crafted encrypted content)
• Reject a DOCTYPE in documents being signature-verified (locateSignature). Closes the entity-reference signature bypass where an Id="&e;" attribute is resolved by getAttribute() but invisible to the XPath reference lookup (libxml2 xmlXPathNodeValHash bug, the CVE-2025-23369 root cause), letting verify() validate a different node than the application reads. Opt out with XMLSecurityDSig::$forbidDoctype = false
• Deny RSA-1.5 (PKCS#1 v1.5) key transport on decryption by default (Bleichenbacher / XML-Encryption backward-compatibility attack); opt in via XMLSecEnc::$allowRSA15KeyTransport. Add optional key-transport / data algorithm allowlists ($allowedKeyAlgorithms / $allowedDataAlgorithms, with DEFAULT_KEY_ALGORITHMS / DEFAULT_DATA_ALGORITHMS presets)
• Use a single generic "Failure decrypting Data" error for all decryption failures (bad padding, cipher error, failed RSA unwrap) so callers cannot build a CBC padding oracle from distinguishable errors
• Add verifyDocument(): safe-by-default signature verification that requires a caller-pinned key (never trusts KeyInfo), enforces a SignatureMethod/DigestMethod algorithm allowlist, fails closed on unvalidated references, and returns the validated node set. New $allowedSignatureAlgorithms / $allowedDigestAlgorithms properties (default strong: SHA-256+ digests, RSA-SHA-256+/PSS signatures); the low-level verify()/validateReference() primitives remain unrestricted for backward compatibility unless these properties are set (except the SignatureMethod/key-algorithm binding, which is always enforced -- see below).
• Reject asymmetric key material (X.509 certificate / PEM public key) being loaded as an HMAC key; prevents signature key/algorithm confusion forgery
• verify() now always binds the document's SignatureMethod to the algorithm of the supplied key (previously only when $allowedSignatureAlgorithms was set), so a mismatch is rejected even on the low-level path. Blocks algorithm substitution / key confusion (e.g. downgrading an RSA signature to hmac-sha1 so a public key is used as the HMAC secret)
• Bound EncryptedKey / RetrievalMethod resolution depth (prevents recursive key-reference DoS / memory exhaustion)
• Reject XPath (REC-xpath-19991116) Transforms during verification by default. The transform evaluates a document-supplied XPath expression in validateReference() before any crypto runs, so a crafted expression is a pre-auth CPU denial-of-service; the expression is arbitrary XPath by design and cannot be sanitized. SAML / WS-Security do not use XPath transforms. Opt in with XMLSecurityDSig::$allowXPathTransforms = true. Signing is unaffected
• Cap XPath transforms (max 5) and namespaces per XPath transform (max 20); overridable via $maxXPathTransforms / $maxXPathNamespaces
• Fail closed on unresolved, external, and duplicate-Id Reference URIs
• Reject unknown CanonicalizationMethod algorithms

... (truncated)

Commits

• 03062be Merge commit from fork
• See full diff in compare view

Updates symfony/cache from 7.4.5 to 7.4.14

Release notes

Sourced from symfony/cache's releases.

v7.4.14

Changelog (symfony/cache@v7.4.13...v7.4.14)

• bug #64648 Ensure RelayProxy compatibility with Relay extension 0.30.0 (@​nicolas-grekas)
• bug #64645 Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@​Amoifr)
• bug #64617 Restore compat with DBAL 4.5 (@​nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@​nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@​jack-worman)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@​nicolas-grekas)

v7.4.13

Changelog (symfony/cache@v7.4.12...v7.4.13)

• bug #64330 Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (@​signor-pedro)
• bug #64336 Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (@​nicolas-grekas)

v7.4.12

Changelog (symfony/cache@v7.4.10...v7.4.12)

• security #cve-2026-45073 Validate the prefix given to AbstractAdapter::clear() (@​nicolas-grekas)

v7.4.10

Changelog (symfony/cache@v7.4.9...v7.4.10)

• bug #64122 Ensure compatibility with Relay extension 0.22.0 (@​nicolas-grekas)

v7.4.9

Changelog (symfony/cache@v7.4.8...v7.4.9)

• bug #64060 Normalize default_lifetime for pools wrapped by ChainAdapter (@​ostrolucky)
• bug #63964 Ensure internal state is cleared in TagAwareAdapter::reset() … (@​KevinMartinsDev)
• bug #63860 Fix Psr16Cache::getMultiple() returning wrapper values when using TTL (@​nicolas-grekas)

v7.4.8

Changelog (symfony/cache@v7.4.7...v7.4.8)

• bug #63818 Ensure compatibility with Relay extension 0.21.0 (@​lyrixx)
• bug #63747 Fix Psr16Cache::getMultiple() returning ValueWrapper with TagAwareAdapter (@​pcescon)
• bug #63736 Fix undefined array key when tag save fails in AbstractTagAwareAdapter (@​pcescon)
• bug #63655 Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (@​guillaumeVDP)

v7.4.7

Changelog (symfony/cache@v7.4.6...v7.4.7)

• bug #63592 Add timeout and slot eviction to LockRegistry stampede prevention (@​nicolas-grekas)

v7.4.6

Changelog (symfony/cache@v7.4.5...v7.4.6)

• bug #63437 Wrap DoctrineDbalAdapter::doSave() in savepoint to prevent transaction poisoning (@​lacatoire)

... (truncated)

Commits

• 9adfcb2 Merge branch '6.4' into 7.4
• 704edf2 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0
• 0f7dc34 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0
• 82698be Restore compat with DBAL v4.x
• da9142e Migrate table definitions to DBAL's TableEditor API
• 9b4976b Merge branch '6.4' into 7.4
• 654e10f Unsafe unserialize phpstan rule
• 1bb79da Merge branch '6.4' into 7.4
• 2a639ad Drop PR warning and auto-closing on subtree splits
• dad10dd Migrate configureSchema() to DBAL's editor API
• Additional commits viewable in compare view

Updates symfony/routing from 7.4.4 to 7.4.13

Release notes

Sourced from symfony/routing's releases.

v7.4.13

Changelog (symfony/routing@v7.4.12...v7.4.13)

• security #cve-2026-48784 Fix dot-segment encoding for chained "../" and "./" in generated URLs (@​nicolas-grekas)
• bug #64343 Harden __unserialize against __toString trampolines (@​nicolas-grekas)

v7.4.12

Changelog (symfony/routing@v7.4.9...v7.4.12)

• security #cve-2026-45065 Fix regex alternation anchoring in UrlGenerator requirement validation (@​alexandre-daubois)

v7.4.9

Changelog (symfony/routing@v7.4.6...v7.4.9)

• bug #63981 Honor the Request's method in UrlMatcher::matchRequest() (@​ousamabenyounes)

v7.4.8

Changelog (symfony/routing@v7.4.7...v7.4.8)

• no significant changes

v7.4.6

Changelog (symfony/routing@v7.4.5...v7.4.6)

• bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@​NeilPeyssard)
• bug #60662 assign attribute aliases to localized route if applicable (@​alcohol)

Commits

• 3a16217 Merge branch '6.4' into 7.4
• af04c79 Merge branch '5.4' into 6.4
• e6f3f03 Fix tests and merge resolution after merging 6.4 into 7.4
• 5156fe8 Merge branch '6.4' into 7.4
• be4ce34 [Routing][RateLimiter][Mime][Security] Harden __unserialize against __toStrin...
• f4ca0c5 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs
• 3b04a5e Merge branch '6.4' into 7.4
• 0cd0d2f Merge branch '5.4' into 6.4
• 287771d [7.4] Remove usages of named arguments in tests
• 453501c Merge branch '6.4' into 7.4
• Additional commits viewable in compare view

Updates symfony/yaml from 7.4.1 to 7.4.14

Release notes

Sourced from symfony/yaml's releases.

v7.4.14

Changelog (symfony/yaml@v7.4.13...v7.4.14)

• minor #64476 Unsafe unserialize phpstan rule (@​jack-worman)
• bug #64388 Fix parsing inline anchored values (@​nicolas-grekas)

v7.4.13

Changelog (symfony/yaml@v7.4.12...v7.4.13)

• bug #64316 Allow trailing newlines after the end-of-document marker (@​nicolas-grekas)

v7.4.12

Changelog (symfony/yaml@v7.4.11...v7.4.12)

• security #cve-2026-45305 Harden the Parser::cleanup() regexes against catastrophic backtracking (@​nicolas-grekas)
• security #cve-2026-45304 Bound collection-alias resolution in the parser (@​nicolas-grekas)
• security #cve-2026-45133 Bound recursion depth in the parser (@​nicolas-grekas)

v7.4.11

Changelog (symfony/yaml@v7.4.10...v7.4.11)

• bug #64196 Reject non-stringables when using "!!binary" (@​nicolas-grekas)

v7.4.10

Changelog (symfony/yaml@v7.4.6...v7.4.10)

• bug #64119 fix flow collection drops &anchor and !!str &anchor items (@​ousamabenyounes)

v7.4.8

Changelog (symfony/yaml@v7.4.7...v7.4.8)

• no significant changes

v7.4.6

Changelog (symfony/yaml@v7.4.5...v7.4.6)

• bug #57292 Fix parsing nested mappings in sequences (@​HypeMC)

Commits

• f8f3286 Merge branch '6.4' into 7.4
• 989dfb7 Unsafe unserialize phpstan rule
• ba20d82 Merge branch '6.4' into 7.4
• 907f845 Drop PR warning and auto-closing on subtree splits
• 551ad89 [Yaml] Replace @​dataProvider annotation with #[DataProvider] attribute in Inl...
• a824382 Merge branch '6.4' into 7.4
• 9bb6ebd [Yaml] Fix parsing inline anchored values
• a7ec3b1 Merge branch '6.4' into 7.4
• e8fdf34 CS fix
• 4b5658c Merge branch '6.4' into 7.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.