From bdf149a164f58c9f2990287ce372763ea7332fb5 Mon Sep 17 00:00:00 2001 From: rebecca-natterer Date: Thu, 15 Oct 2026 18:45:09 +0200 Subject: [PATCH] Require patched Symfony ExpressionLanguage releases --- CHANGELOG.md | 4 ++++ composer.json | 2 +- docs/dependency-injection.md | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e85d89..0860511 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) where applicable. +## Unreleased + +- Require Symfony ExpressionLanguage 8.1.9 or newer to exclude releases affected by CVE-2026-109449. + ## 1.1.8 — 2026-10-09 - Require maintained Symfony Routing and YAML 8.1 or newer, excluding the vulnerable 8.0 releases covered by the May 2026 advisories. diff --git a/composer.json b/composer.json index 3a75406..2b2f8e7 100644 --- a/composer.json +++ b/composer.json @@ -22,7 +22,7 @@ "symfony/clock": "^8.0", "symfony/dependency-injection": "^8.1.8", "symfony/event-dispatcher": "^8.0", - "symfony/expression-language": "^8.0", + "symfony/expression-language": "^8.1.9", "symfony/filesystem": "^8.0", "symfony/http-foundation": "^8.1", "symfony/http-kernel": "^8.1", diff --git a/docs/dependency-injection.md b/docs/dependency-injection.md index 19cef1b..9dd30e7 100644 --- a/docs/dependency-injection.md +++ b/docs/dependency-injection.md @@ -18,7 +18,7 @@ build, configure, dump, and run the container: "symfony/clock": "^8.0", "symfony/dependency-injection": "^8.1.8", "symfony/event-dispatcher": "^8.0", - "symfony/expression-language": "^8.0", + "symfony/expression-language": "^8.1.9", "symfony/filesystem": "^8.0", "symfony/service-contracts": "^3.6", "symfony/yaml": "^8.1"