🚨 [Conductor] Security update symfony/http-foundation to v7.4.13

[private-packagist]

This PR was automatically generated by Conductor.

The PR contains the changes generated by running the following command:

composer update symfony/http-foundation:v7.4.13 --with-all-dependencies --minimal-changes

Changelog

symfony/http-foundation (Source: GitHub Releases))

v7.4.13

Changelog (v7.4.7...v7.4.13)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@​nicolas-grekas)

v7.4.8

Changelog (v7.4.7...v7.4.8)

• no significant changes

v7.4.7

Changelog (v7.4.6...v7.4.7)

• bug #​63603 Fix session cookie_lifetime not applied in mock session storage (@​nicolas-grekas)

v7.4.6

Changelog (v7.4.5...v7.4.6)

• bug #​63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@​nicolas-grekas)
• bug #​63319 BinaryFileResponse: always return 206 if Range is valid (@​Jimbolino)
• bug #​63262 Reject invalid paths (@​nicolas-grekas)
• bug #​54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@​ArmCyber)
• bug #​63230 fix engine declaration on mysql pdo table creations (@​tandev)

v7.4.5

Changelog (v7.4.4...v7.4.5)

• bug #​63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@​samy-mahmoudi)

v7.4.4

Changelog (v7.4.3...v7.4.4)

• bug #​63012 Fix double-prefixing of session keys when using redis/memcached (@​nicolas-grekas)

v7.4.3

Changelog (v7.4.2...v7.4.3)

• bug symfony/symfony#​62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@​nicolas-grekas)

v7.4.1

Changelog (v7.4.0...v7.4.1)

• bug symfony/symfony#​62663 [HttpFoundation] Improve logic in Request::createFromGlobals() (@​nicolas-grekas)

v7.4.0

Changelog (v7.4.0-RC3...v7.4.0)

• no significant changes

v7.4.0-RC1

Changelog (v7.4.0-BETA2...v7.4.0-RC1)

• bug symfony/symfony#​62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@​yoeunes)
• bug symfony/symfony#​62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (@​nicolas-grekas)

v7.4.0-BETA2

Changelog (v7.4.0-BETA1...v7.4.0-BETA2)

• bug symfony/symfony#​62246 [HttpFoundation] Allow Request::setFormat() to override predefined formats (@​longwave)

v7.4.0-BETA1

Changelog (v7.3.4...v7.4.0-BETA1)

• feature symfony/symfony#​61949 [HttpFoundation] Deprecate HTTP method override for methods GET, HEAD, CONNECT and TRACE (@​nicolas-grekas)
• feature symfony/symfony#​61979 [HttpFoundation] Add Request::set/getAllowedHttpMethodOverride() to list which HTTP methods can be overridden (@​nicolas-grekas)
• feature symfony/symfony#​61961 [HttpFoundation] Make Request::createFromGlobals() parse the body of PUT, DELETE, PATCH and QUERY requests (@​MatTheCat)
• feature symfony/symfony#​61948 [HttpFoundation] Deprecate Request::get() in favor of using properties ->attributes, query or request directly (@​nicolas-grekas)
• feature symfony/symfony#​60395 [HttpFoundation] Add #[IsSignatureValid] attribute (@​santysisi)
• feature symfony/symfony#​61267 [HttpFoundation] Add support for structured MIME suffix (@​Spomky)
• feature symfony/symfony#​61173 [HttpFoundation][HttpKernel][WebProfilerBundle] Add support for the QUERY HTTP method (@​alexandre-daubois)
• feature symfony/symfony#​61423 [Mime] Deprecate implementing __sleep/wakeup() on AbstractPart implementations (@​nicolas-grekas)
• feature symfony/symfony#​60876 [HttpFoundation] Deprecate using Request::sendHeaders() after headers have already been sent (@​nicolas-grekas)

v7.3.11

Changelog (v7.3.10...v7.3.11)

• bug #​63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@​samy-mahmoudi)

v7.3.10

Changelog (v7.3.9...v7.3.10)

• bug #​63012 Fix double-prefixing of session keys when using redis/memcached (@​nicolas-grekas)

v7.3.9

Changelog (v7.3.8...v7.3.9)

• bug symfony/symfony#​62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@​nicolas-grekas)

v7.3.8

Changelog (v7.3.7...v7.3.8)

• bug symfony/symfony#​62502 [HttpFoundation] Fix Expires response header for EventStream (@​4513)
• bug symfony/symfony#​62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@​yoeunes)

v7.3.7

Changelog (v7.3.6...v7.3.7)

• no significant changes

v7.3.6

Changelog (v7.3.5...v7.3.6)

• bug symfony/symfony#​62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (@​nicolas-grekas)
• bug symfony/symfony#​62246 [HttpFoundation] Allow Request::setFormat() to override predefined formats (@​longwave)

v7.3.5

Changelog (v7.3.4...v7.3.5)

• bug symfony/symfony#​62153 [HttpFoundation] Fix issue where ServerEvent with "0" data is not sent (@​santysisi)

v7.3.4

Changelog (v7.3.3...v7.3.4)

• bug symfony/symfony#​61766 Fix ord()-related PHP 8.5 deprecations (@​nicolas-grekas)
• bug symfony/symfony#​61585 [HttpFoundation][SQLSRV] Change column type from TEXT to STRING (@​Matt-PMCT)

v7.3.3

Changelog (v7.3.2...v7.3.3)

• no significant changes

v7.3.2

Changelog (v7.3.1...v7.3.2)

• no significant changes

v7.3.1

Changelog (v7.3.0...v7.3.1)

• bug symfony/symfony#​60875 [HttpFoundation] Revert " Emit PHP warning when Response::sendHeaders() is called while output has already been sent" (@​nicolas-grekas)
• bug symfony/symfony#​60547 [HttpFoundation] Fixed 'Via' header regex (@​thecaliskan)

v7.3.0

Changelog (v7.3.0-RC1...v7.3.0)

• no significant changes

v7.3.0-RC1

Changelog (v7.3.0-BETA2...v7.3.0-RC1)

• no significant changes

v7.3.0-BETA2

Changelog (v7.3.0-BETA1...v7.3.0-BETA2)

• no significant changes

v7.3.0-BETA1

Changelog (v7.2.6...v7.3.0-BETA1)

• feature symfony/symfony#​60102 [HttpFoundation] Add UriSigner::verify() that throws named exceptions (@​kbond)
• feature symfony/symfony#​60222 [FrameworkBundle][HttpFoundation] Add Clock support for UriSigner (@​kbond)
• feature symfony/symfony#​59869 [Cache] Add support for valkey: / valkeys: schemes (@​nicolas-grekas)
• feature symfony/symfony#​58743 [HttpFoundation] Streamlining server event streaming (@​yceruto)
• feature symfony/symfony#​59022 [HttpFoundation] Generate url-safe hashes for signed urls (@​valtzu)
• feature symfony/symfony#​59154 [HttpFoundation] Support iterable of string in StreamedResponse (@​mtarld)

v7.2.9

Changelog (v7.2.8...v7.2.9)

• no significant changes

v7.2.8

Changelog (v7.2.7...v7.2.8)

• bug symfony/symfony#​60547 [HttpFoundation] Fixed 'Via' header regex (@​thecaliskan)

v7.2.7

Changelog (v7.2.6...v7.2.7)

• bug symfony/symfony#​60292 [HttpFoundation] Encode path in X-Accel-Redirect header (@​Athorcis)

v7.2.6

Changelog (v7.2.5...v7.2.6)

• no significant changes

v7.2.5

Changelog (v7.2.4...v7.2.5)

• bug symfony/symfony#​60030 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] use Table::addPrimaryKeyConstraint() with Doctrine DBAL 4.3+ (@​xabbuh)

Task options

• Recreate commit - Conductor recreates the update commit and overwrites all additional changes made in this branch.
• Details
• Skip - Conductor won't attempt to update the dependency to this exact version again.
• All tasks
• Settings
• Docs

If you close the PR, the task will be skipped and Conductor will schedule the next task. Clicking the "Skip" button in the UI has the same effect. Conductor won't attempt to update the dependency to this exact version again but it will schedule updates to newer versions.

---

Powered by Private Packagist

[private-packagist]

composer.lock

Package changes

Package	Operation	From	To	About
symfony/http-foundation	upgrade	v7.2.3 ⚠️	v7.4.13 ✅	diff

---

Settings · Docs · Powered by Private Packagist

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.

[private-packagist]

The composer.lock diff comment has been updated to reflect new changes in this PR.