[turegjorup]

Update all dependencies in the current constraints, and fix the 18 security advisories. This is step 4 of the quarterly update.

Changes

• Run composer update --with-all-dependencies: 93 updates and 1 removal in composer.lock. Important updates:
  • Symfony 7.4.14 → 7.4.23 (security release, fixes all 18 advisories in composer audit)
  • API Platform 4.3.16 → 4.3.21
  • PHPUnit 13.2.4 → 13.4.6, PHP-CS-Fixer 3.95.12 → 3.95.28, Twig 3.28 → 3.30
• Regenerate config/reference.php (cache:clear).
• theseer/tokenizer is removed. The new phpunit/php-code-coverage does not use it.
• One transitive major version: ergebnis/agent-detector 1.2.0 → 2.0.0. friendsofphp/php-cs-fixer 3.95.28 requires it. It is only a dev tool.
• No downgrades.

Not in this PR:

• Rector (2.5.4), PHPStan (2.2.5) and the PHPStan extensions stay at their versions. Rector 2.8 has new rules that change code. They come in a separate PR (step 5).
• api-platform/core 4.4 needs a change of the ~4.3.0 constraint. It comes in a separate PR.

Why

The quarterly update brings all packages to the latest minor or patch version. composer audit reported 18 advisories in 11 Symfony packages.

Symfony 7.4.23 is still in the 7-day Composer cooldown (2 days and 15 hours left). All older 7.4 versions have advisories, so the update with the default cooldown cannot be resolved. Thus, I ran the update with a shorter cooldown for this command only:

docker compose exec -e 'COMPOSER_POLICY_COOLDOWN_PERIOD=4 days' phpfpm composer update --with-all-dependencies

The project files do not change the cooldown.

Checks

• composer audit: no advisories.
• PHPStan: no errors. Rector dry-run: no changes.
• PHP-CS-Fixer, twig-cs-fixer and composer normalize: no changes.
• PHPUnit with coverage on PHP 8.5.12, as in CI: all tests pass.
• public/spec.yaml: no change after task api:spec:export.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.39%. Comparing base (7136c17) to head (fc7e3ee).
⚠️ Report is 4 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop      #74   +/-   ##
==========================================
  Coverage      74.39%   74.39%           
  Complexity       264      264           
==========================================
  Files             30       30           
  Lines            738      738           
==========================================
  Hits             549      549           
  Misses           189      189           

Flag	Coverage Δ
unittests	74.39% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.