diff -Nru symfony-6.4.21+dfsg/.agents/skills/symfony-merge-up/SKILL.md symfony-6.4.40+dfsg/.agents/skills/symfony-merge-up/SKILL.md --- symfony-6.4.21+dfsg/.agents/skills/symfony-merge-up/SKILL.md 1970-01-01 01:00:00.000000000 +0100 +++ symfony-6.4.40+dfsg/.agents/skills/symfony-merge-up/SKILL.md 2026-05-20 10:56:49.000000000 +0200 @@ -0,0 +1,207 @@ +--- +name: symfony-merge-up +description: > + Cascade-merge maintained Symfony branches from oldest to newest (e.g. + 6.4 → 7.4 → 8.0 → 8.1). Use when the user says "merge branches", + "merge up", "cascade merge", "sync branches", or "update branches". +--- + +# Symfony Branch Cascade Merge + +Merges each maintained branch into the next one, from oldest to newest. + +## Progress checklist + +- [ ] Step 0: Pre-flight checks +- [ ] Step 1: Fetch maintained branches and pull them +- [ ] Step 2: Cascade merge loop + +--- + +## Confirmation rule + +Whenever the skill says **"Wait for confirmation"**, treat anything other than an +explicit affirmative as **no**: stop and ask the user how they want to proceed. + +--- + +## Step 0 — Pre-flight checks + +```bash +git status --porcelain --untracked-files=no +``` + +If any output, **stop**: +> "The working tree is not clean. Please commit or stash your changes first." + +--- + +## Step 1 — Fetch maintained branches and pull them + +### 1a. Get the branch list + +```bash +curl -s https://symfony.com/releases.json +``` + +Read `maintained_versions`. It is already sorted oldest → newest (e.g. +`["6.4", "7.4", "8.0", "8.1"]`). Store as `BRANCHES`. + +### 1b. Pull every branch + +For each branch in `BRANCHES`: + +```bash +git checkout +git pull --ff-only origin +``` + +Using `--ff-only` ensures local branches haven't diverged from origin. If the +pull fails, **stop** and report the error. + +--- + +## Step 2 — Cascade merge loop + +For each consecutive pair `(SOURCE, TARGET)` in `BRANCHES`: + +### 2a. Merge + +```bash +git checkout +composer up +git merge +``` + +Three outcomes are possible: + +- **Already up-to-date:** print "✓ `` already up-to-date with ``" + and skip to the next pair. +- **Clean merge (no conflicts):** git creates the merge commit automatically. + Proceed directly to step 2c. +- **Conflicts:** proceed to step 2b. + +### 2b. Resolve conflicts (only when git reports conflicts) + +List conflicts: + +```bash +git diff --name-only --diff-filter=U +``` + +Read each conflicted file, resolve it, then `git add` it. When all are resolved: + +```bash +git commit --no-edit +``` + +#### Conflict resolution rules + +| File pattern | Strategy | +|---|---| +| `CHANGELOG*.md` | Keep entries from both sides; newer branch entries on top | +| Version constants, `composer.json` branch aliases | Keep the TARGET branch value | +| Code files | Merge logically based on context; when unsure, ask the user | + +#### Legacy tests across major versions + +When merging from one major version to the next (e.g. 6.4 → 7.0), remove test +methods marked with `@group legacy` or `#[Group('legacy')]`. The deprecations +they cover have been removed in the new major version, so the tests are no +longer relevant. + +After resolving, show `git diff HEAD~1` (first parent of the merge commit, i.e. +the previous TARGET state) and wait for the user to confirm the resolution looks +correct before proceeding. + +### 2c. Run tests for affected components + +Extract component, bridge, and bundle names from changed files: + +```bash +git diff --name-only HEAD~1..HEAD +``` + +Paths look like `src/Symfony/{Component,Bridge,Bundle}//...`. Deduplicate, +then run tests for each: + +```bash +./phpunit src/Symfony/Component/ +./phpunit src/Symfony/Bridge/ +./phpunit src/Symfony/Bundle/ +``` + +For files under `src/Symfony/Contracts/`, run the single shared test suite: + +```bash +./phpunit src/Symfony/Contracts +``` + +Ignore files outside these directories (root configs, `.github/`, etc.): they +don't have component-level test suites. + +If tests fail or report PHPUnit deprecations (the PHPUnit version may differ +between branches), first check whether the failure is pre-existing: run the same +test on the TARGET branch before the merge (`git stash && git checkout HEAD~1` +or check CI). Only fix failures introduced by the merge: +1. Analyze and fix the code, including any PHPUnit deprecation notices. +2. Commit the fix: `[] Fix merge conflict resolution`. +3. Re-run failing tests until green and deprecation-free. + +Report any pre-existing failures to the user without attempting to fix them. + +### 2d. Ask for confirmation before pushing + +Show: + +``` +Merge: → +Affected: +Tests: all passing + +Commits since origin/: +git log --oneline origin/.. + +Ready to push? (yes / no) +``` + +**Wait for confirmation.** The user may make changes themselves before confirming. + +### 2e. Push and continue + +```bash +git push origin +``` + +If the push fails, **stop** and report the error. + +Print "✓ `` → `` done." and continue to the next pair. + +--- + +## Final summary + +``` +All merges complete: + 6.4 → 7.4 ✓ + 7.4 → 8.0 ✓ + 8.0 → 8.1 ✓ +``` + +--- + +## Gotchas + +- `CHANGELOG.md` conflicts are the most common; entries must be kept from both + sides, never dropped. +- A merge can introduce test failures even without conflicts, because behavior + from the older branch may be incompatible with newer code. Always run tests. +- Some components have slow test suites. Only run tests for components with + changed files, not the entire project. + +## Error handling + +- **Never** force-push or rewrite history. +- **Never** use `--no-verify` on commits. +- **Never** auto-recover from a failed `git push` or `git pull`. Stop and hand + control back to the user. diff -Nru symfony-6.4.21+dfsg/CHANGELOG-6.4.md symfony-6.4.40+dfsg/CHANGELOG-6.4.md --- symfony-6.4.21+dfsg/CHANGELOG-6.4.md 2025-05-02 10:46:49.000000000 +0200 +++ symfony-6.4.40+dfsg/CHANGELOG-6.4.md 2026-05-20 10:56:49.000000000 +0200 @@ -7,6 +7,551 @@ To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v6.4.0...v6.4.1 +* 6.4.40 (2026-05-20) + + * security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas) + * security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas) + * security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas) + * security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois) + * security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas) + * security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas) + * security #cve-2026-45066 [HtmlSanitizer] Fix `allowLinkHosts`/`allowMediaHosts` bypass via URL parser differentials and `` misclassification (alexandre-daubois) + * security #cve-2026-45069 [Security] Add missing claims in `OidcTokenHandler` (alexandre-daubois) + * bug #64258 [DomCrawler] Fix `ChoiceFormField::addChoice()` clobbering values on multi-selects (nicolas-grekas) + * bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas) + * security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas) + * security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas) + * security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas) + * security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse` (alexandre-daubois) + * security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois) + * security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois) + * security #cve-2026-45065 [Routing] Fix regex alternation anchoring in `UrlGenerator` requirement validation (alexandre-daubois) + * security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois) + * security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas) + * security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas) + +* 6.4.39 (2026-05-13) + + * bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu) + * bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes) + * bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas) + * bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas) + * bug #64191 [Inflector][String] Fixed singularize `traces` > `trace` (ruudk) + * bug #64193 [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage (alexandre-daubois) + * bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85) + * bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes) + * bug #64182 [Console] Fix signal handler scoping (jpollard3) + * bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes) + * bug #64058 [Process] Ignore array env values before proc_open (dionisvl) + * bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas) + * bug #64176 [Console] Make `ConsoleSectionOutput::overwrite()` atomic to fix sections + ProgressIndicator clear (Amoifr) + * bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes) + * bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes) + * bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar) + * bug #64172 [WebProfilerBundle] Don’t try to access `RawMessage::$headers` (MatTheCat) + * bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland) + +* 6.4.38 (2026-05-06) + + * bug #63761 [Scheduler] Fix checkpoint state expiring when cache has default TTL (Amoifr) + * bug #64138 [Translation] Fix `TranslationPushCommand::getDomainsFromTranslatorBag` (MatTheCat) + * bug #63757 [Messenger][AmazonSqs] Do not override queue-level DelaySeconds when no DelayStamp is set (psantus) + * bug #64122 [Cache] Ensure compatibility with Relay extension 0.22.0 (nicolas-grekas) + * bug #64119 [Yaml] fix flow collection drops `&anchor` and `!!str &anchor` items (ousamabenyounes) + * bug #64086 [Messenger] Move `--time-limit` handling to Worker for proper capping with `--sleep` (Toflar) + * bug #64100 [Translation] URL-encode tmp path in XliffUtils::shouldEnableEntityLoader (ousamabenyounes) + * bug #64095 [RateLimiter] Carry over reserved tokens past fixed window resets (ousamabenyounes) + * bug #64099 [Ldap] Cast `default_socket_timeout` to `int` (ousamabenyounes) + +* 6.4.37 (2026-05-01) + + * bug #64090 [DependencyInjection] Reject circular references through a factory builder's setup (nicolas-grekas) + * bug #64083 [Messenger] Alias the AMQP "user" connection option to "login" (lacatoire) + * bug #64084 [Messenger] Do not sleep after worker is stopped during idle cycle (Toflar) + * bug #64067 [Serializer] Move type-mismatch and uninitialized-property handling into concrete normalizers (ousamabenyounes) + * bug #64065 [Notifier][Ntfy] Fix Basic auth header by keeping base64 padding (ousamabenyounes) + * bug #64045 [Config] Allow env placeholders in NumericNode min/max checks (ousamabenyounes) + * bug #64047 [Mime] Preserve inline part filename instead of overwriting it with the Content-ID (ousamabenyounes) + * bug #64044 [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType() (ousamabenyounes) + * bug #64030 [MonologBridge] Guard against re-entrant calls in AbstractTokenProcessor (ousamabenyounes) + * bug #64060 [Cache] Normalize default_lifetime for pools wrapped by ChainAdapter (ostrolucky) + * bug #63996 [RateLimiter] Keep token bucket alive while reservation debt is unpaid (ousamabenyounes) + * bug #63975 [Lock] Avoid aborting outer PostgreSQL transaction on lock contention (lacatoire) + * bug #64046 [HttpClient] Don't share CURL_LOCK_DATA_CONNECT to honor max_host_connections (ousamabenyounes) + * bug #64036 [Validator] fix mapping properties using property hooks (mrossard) + * bug #64024 [AssetMapper] Allow spaces in version constraints (MatTheCat) + * bug #64020 [Dotenv] Strip NUL byte placeholder from values passed to `putenv()` (alexandre-daubois) + * bug #63982 [Messenger] Respect SentToFailureTransportStamp when failure transports are configured (ousamabenyounes) + * bug #63990 [Messenger] Do not apply --max to --stats unless explicitly set (ousamabenyounes) + * bug #63979 [Serializer] Capture constructor TypeError when collecting denormalization errors (lacatoire) + * bug #64006 [DependencyInjection] Fix hidden dependency on symfony/config in PhpDumper (GromNaN) + * bug #63981 [Routing] Honor the Request's method in UrlMatcher::matchRequest() (ousamabenyounes) + * bug #63980 [DependencyInjection] Log every build parameter removed during compilation (ousamabenyounes) + * bug #63974 [Serializer] Make `BackedEnumNormalizer` unconditionally return `null` on invalid value if `allow_invalid_values` is set (MatTheCat) + * bug #63964 [Cache] Ensure internal state is cleared in TagAwareAdapter::reset() … (KevinMartinsDev) + * bug #63955 [Dotenv] Fix variable corruption when loading env more than once (nicolas-grekas) + * bug #63959 [VarExporter] Don't warn for __sleep()-listed uninitialized declared properties (nicolas-grekas) + * bug #63952 [Scheduler] Respect `console.command` DI tag `command` attribute (nicolas-grekas) + * bug #63951 [DependencyInjection] Fix autowiring nullable intersection types (HypeMC) + * bug #63938 [Workflow] Fix HTML escaping in `GraphvizDumper` labels (alexandre-daubois) + * bug #63909 [Filesystem] Fix Path methods replacing backslashes on UNIX (Amoifr) + * bug #63922 [DependencyInjection] Fix excludeSelf not applied when using AutowireLocator (GromNaN) + * bug #63894 [Dotenv] Fix self-referencing variable resolution with suffix/prefix (Amoifr) + * bug #63883 [Serializer] Fix getAllowedAttributes() when groups contain wildcard '*' (takashiraki) + * bug #63876 [DependencyInjection] Fix instanceof autoconfiguration for anonymous classes (jlabedo) + * bug #63860 [Cache] Fix Psr16Cache::getMultiple() returning wrapper values when using TTL (nicolas-grekas) + * bug #63859 [Console] Fix shell completion when SHELL_VERBOSITY=-1 (nicolas-grekas) + * bug #63847 [EventDispatcher] Fix TraceableEventDispatcher when reset during dispatch (aschempp) + * data #63849 Remove needs-review flag for Afrikaans (af) (payene) + +* 6.4.36 (2026-03-31) + + * bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (nicolas-grekas) + * bug #63817 [Serializer] Fix denormalization of nested array with key types (mtarld) + * bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (lyrixx) + * bug #63806 [Ldap] Make the Adapter resettable (kira0269, nicolas-grekas) + * bug #63720 [MonologBridge] Fix `ConsoleHandler` losing output after nested command terminates (mp3000mp) + * bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (wazum) + * bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (pcescon) + * bug #63683 [TwigBridge] Fix image method to use DataPart content ID (pavelwitassek) + * bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (sn3mdev) + * bug #63747 [Cache] Fix `Psr16Cache::getMultiple()` returning `ValueWrapper` with `TagAwareAdapter` (pcescon) + * bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (pcescon) + * bug #63777 [FrameworkBundle] Fix setting `router.request_context.base_url` when option `default_uri` is defined (nicolas-grekas) + * bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (LachlanArthur) + * bug #63726 [HttpClient] Unset push response content when the push handler is released (sakozoko) + * bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (pcescon) + * bug #63724 [HttpKernel] Fix allowing invalid `#[Autowire]` references in controller arguments (valtzu) + * bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (shyim) + * bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (nicolas-grekas) + * bug #63676 [HttpKernel] Reset router locale to default when finishing main request (guillaumeVDP) + * bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (andyexeter) + * bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (guillaumeVDP) + * bug #63656 [Form] Fix typed property initialization in ValidatorExtension (SeverinGloeckle) + * bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (wazum) + * bug #63639 [ErrorHandler] "`@method`" deprecation notices are missing when interface inheritance is used (mpdude) + * bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (nicolas-grekas) + * bug #63629 Fix deprecation notices for "`@method`" annotations and classes with `__call()` (mpdude) + * bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (nicolas-grekas) + +* 6.4.35 (2026-03-06) + + * bug #63604 [Console] Fix `ApplicationTester` ignoring `interactive` and `verbosity` options when `SHELL_VERBOSITY` is set (nicolas-grekas) + * bug #63602 [Serializer] Fix denormalization of magic `__set` properties (nicolas-grekas) + * bug #63603 [HttpFoundation] Fix session cookie_lifetime not applied in mock session storage (nicolas-grekas) + * bug #63598 [UrlSanitizer] Add 'sms' to hostless schemes (hivokas) + * bug #63592 [Cache] Add timeout and slot eviction to LockRegistry stampede prevention (nicolas-grekas) + * bug #63570 [Console] Fix OUTPUT_RAW corrupting binary content on Windows (guillaumeVDP) + * bug #63584 [Mime] Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (nicolas-grekas) + * bug #63574 [FrameworkBundle] Fix stale container after reboot in KernelTestCase (nicolas-grekas) + * bug #63572 [Form] Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (nicolas-grekas) + * bug #63568 [TwigBridge] Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (nicolas-grekas) + * bug #63555 [HttpKernel] Fix int-to-float coercion for JSON #[MapRequestPayload] with pre-parsed array data (eyupcanakman) + * bug #63559 [Messenger] Flush batch handlers after inactivity timeout when worker is busy (nicolas-grekas) + * bug #63523 [Mailer][Mailjet] Fix inline attachments with custom Content-ID (99Vicky) + * bug #63550 [RateLimiter] Prevent negative token from causing integer underflow (jhogervorst) + * bug #63526 [WebProfilerBundle] Fix Symfony web debug toolbar not being displayed (zoglo) + * bug #63500 [PhpUnitBridge] Consider PSR-0/PSR-4 fallback dirs when building paths (mpdude) + * bug #63533 [DebugBundle] gracefully handle the kernel.runtime_mode.web parameter missing (xabbuh) + * bug #63534 [Validator] Regex bypass when match is false with too big input (vincent4vx) + * bug #63496 [Dotenv] Defer variable and command expansion to account for overrides from subsequent .env files (nicolas-grekas) + * bug #63506 [DependencyInjection] Fix `TypeError` when using a custom container base class with typed `$parameterBag` (nicolas-grekas) + +* 6.4.34 (2026-02-26) + + * bug #63492 [RateLimiter] Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (ERuban) + * bug #63491 [RateLimiter] Fix `retryAfter` when consuming exactly all remaining tokens in `SlidingWindow` (ERuban) + * bug #52413 [RateLimiter] Fix reservations outside the second fixed window (SanderSander) + * bug #57392 [Serializer][Validator] Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (antten) + * bug #54236 [Config][Routing] Fix exclude option being ignored for non-glob and PSR-4 resources (NeilPeyssard) + * bug #47424 [Filesystem] makePathRelative with existing files, remove ending / (Petar Marjanovic) + * bug #52083 [Messenger][Amqp] Don't use retry routing key when sending to failure transport (Fabien Perroquin) + * bug #63275 [Messenger] Fix re-sending failed messages to a different failure transport (bartholdbos) + * bug #63473 [DependencyInjection] Fix PriorityTaggedServiceTrait not discovering `#[AsTaggedItem]` on decorated services (lacatoire) + * bug #63472 [TwigBridge] Fix Bootstrap 4 form errors rendered inside `