[dependabot]

Bumps symfony/http-foundation from 7.3.4 to 7.4.22.

Release notes

Sourced from symfony/http-foundation's releases.

v7.4.22

Changelog (symfony/http-foundation@v7.4.21...v7.4.22)

• bug #67504 Ignore malformed and multiple ranges in BinaryFileResponse (@​jack-worman)
• bug #67501 Don't reject suffix ranges longer than the file in BinaryFileResponse (@​jack-worman)
• bug #67496 Match whole subtags in Request::getPreferredLanguage() (@​nicolas-grekas)
• bug #67296 Handle filter failures in array values (@​nicolas-grekas)
• bug #67345 Fix cookie names and header parsing (@​nicolas-grekas)
• bug #67126 Fix MigratingSessionHandler sending needless cookies to delete empty sessions (@​nicolas-grekas)
• bug #67123 Destroy empty sessions in updateTimestamp() of the Redis, Memcached, MongoDb and Pdo session handlers (@​PhilETaylor)
• bug #67125 Don't marshall empty session data in MarshallingSessionHandler (@​nicolas-grekas)
• bug #67059 Don't announce a Content-Length on non-successful BinaryFileResponse (@​lazerg)
• bug #67060 Register the session shutdown function only once in NativeSessionStorage (@​lazerg)

[SECURITY] Security release

v7.4.21

Changelog (symfony/http-foundation@v7.4.20...v7.4.21)

• bug #66694 Don't warn about request input keys nested too deeply (@​logosur)
• bug #66623 Send the RFC 10036 Incremental header from EventStreamResponse (@​nicolas-grekas)
• bug #66513 Keep the session ID when the session handler fails to read (@​Firehed, @​nicolas-grekas)
• bug #66491 Fix HeaderUtils::split() when a separator is a whitespace character (@​nicolas-grekas)

v7.4.20

Changelog (symfony/http-foundation@v7.4.19...v7.4.20)

• bug #66251 Make session handlers non-serializable (@​mcdruid)
• bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@​nicolas-grekas)

v7.4.19

Changelog (symfony/http-foundation@v7.4.18...v7.4.19)

• bug #66048 Remove the ambiguity that makes HeaderUtils::split() backtrack (@​nicolas-grekas)
• bug #66023 Fix IpUtils::anonymize() for non-canonical IPv4-mapped addresses (@​GabeSilvaDev)
• minor #65836 Fix hitting the PCRE size limit with many trusted host patterns (@​nicolas-grekas)
• bug #65775 Match paths with the DOTALL modifier (@​nicolas-grekas)

v7.4.18

Changelog (symfony/http-foundation@v7.4.17...v7.4.18)

• bug #65753 Combine trusted host patterns into a single regexp (@​nicolas-grekas)
• bug #65743 Encode the path in the X-Accel-Redirect header (@​Athorcis)
• bug #65729 Reject reserved characters in the cookie path and domain (@​nicolas-grekas)
• bug #65741 Reject invalid paths (@​nicolas-grekas)
• bug #65725 Fix parsing hosts and schemes in URLs (@​nicolas-grekas)
• bug #65684 Do not unmarshall values that SodiumMarshaller cannot decrypt (@​nicolas-grekas)
• bug #65683 Allow-list the values of the "X-Sendfile-Type" header (@​nicolas-grekas)
• bug #65682 Ignore session ids that are not usable as file names in MockFileSessionStorage (@​nicolas-grekas)

... (truncated)

Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.2

• Add five not-globally-reachable ranges to IpUtils::PRIVATE_SUBNETS: 192.0.0.0/24, 192.88.99.0/24, 224.0.0.0/4, 100::/64 and ff00::/8
• Add Response::cacheControl() to set the targeted cache directives defined by RFC 9213, e.g. CDN-Cache-Control
• Deprecate not passing an expiry to UriSigner::sign()
• Add the $defaultExpiration argument to UriSigner::__construct()
• Add argument $version to UriSigner::sign(), UriSigner::check(), UriSigner::checkRequest(), and UriSigner::verify() to bind a signed URI to a state token
• Add ParameterBag::filterCallback() to filter a parameter value through a callback
• Reject a Cookie whose name uses the __Secure-/__Host- prefix when its attributes break the prefix contract
• Deprecate the Request::$trustedHosts property, it is never populated anymore
• Report the actual header value when the ResponseHeaderSame constraint fails
• Add ClearableSessionHandlerInterface for clearing all session data
• Add Request::getStructuredSuffixFormat() to resolve a mime type to the format of its structured syntax suffix, e.g. application/vnd.api+json to json
• Accept a list of secrets in UriSigner::__construct() to rotate them
• Allow passing a ResponseHeaderBag as the third argument of StreamedResponse::__construct()
• Add arguments $isolate and $debug to AttributeBag::__construct(), and $attributeBagFactory to SessionFactory::__construct()
• Deprecate saving changes made to session attributes without calling set() afterwards
• Accept the 308 status code in Response::isCacheable()
• Stop adding a default Cache-Control: no-cache, private header to 308 RedirectResponse instances
• Add argument $clock to MetadataBag::__construct()
• Add RedisSessionHandler::shutdown() to close lazy connections

8.1

• Add BinaryFileResponse::shouldDeleteFileAfterSend()
• Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead
• Add SessionHasFlashMessage test constraint
• Response::__construct() now accepts a ResponseHeaderBag as its third argument
• ParameterBag::getInt() and ParameterBag::getBoolean() now throw UnexpectedValueException instead of silently returning 0/false when the value cannot be converted

8.0

• Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
• Add argument $subtypeFallback to Request::getFormat()
• Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
• Trigger PHP warning when using Response::sendHeaders() after headers have already been sent; use a StreamedResponse instead
• Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
• Add argument $partitioned to ResponseHeaderBag::clearCookie()
• Add argument $expiration to UriSigner::sign()
• Remove Request::get(), use properties ->attributes, query or request directly instead
• Remove accepting null $format argument to Request::setFormat()

7.4

... (truncated)

Commits

• 63eda1d [HttpFoundation] Correct sendHeaders class in 7.4 changelog
• 816791b Merge branch '6.4' into 7.4
• aed9ac2 Fix-BinaryFileResponse-malformed-ranges
• 53c0f24 Fix-BinaryFileResponse-suffix-range
• 3fc0bc7 Merge branch '6.4' into 7.4
• fe7a6b6 [HttpFoundation] Match whole subtags in Request::getPreferredLanguage()
• b6dc6c7 [HttpFoundation] Parse the attributes of cookie headers like browsers do
• e3d7c6f tidy #67455 [HttpFoundation] Read numeric Expires attributes of cookie head...
• 8583b3e [HttpFoundation] Read numeric Expires attributes of cookie headers as timestamps
• 86b0cb4 [HttpFoundation] Fix FILTER_FORCE_ARRAY with FILTER_CALLBACK on old PHP v...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.