[dependabot]

Bumps symfony/routing from 7.2.3 to 7.4.18.

Release notes

Sourced from symfony/routing's releases.

v7.4.18

Changelog (symfony/routing@v7.4.17...v7.4.18)

• bug #65728 Fix matching the "0" URL (@​cs278)

v7.4.17

Changelog (symfony/routing@v7.4.15...v7.4.17)

• bug #65367 Fix PHP 8.6 deprecations (@​nicolas-grekas)

v7.4.15

Changelog (symfony/routing@v7.4.13...v7.4.15)

• bug #64727 Detect circular references in object route parameters (@​Amoifr)

v7.4.13

Changelog (symfony/routing@v7.4.12...v7.4.13)

• security #cve-2026-48784 Fix dot-segment encoding for chained "../" and "./" in generated URLs (@​nicolas-grekas)
• bug #64343 Harden __unserialize against __toString trampolines (@​nicolas-grekas)

v7.4.12

Changelog (symfony/routing@v7.4.9...v7.4.12)

• security #cve-2026-45065 Fix regex alternation anchoring in UrlGenerator requirement validation (@​alexandre-daubois)

v7.4.9

Changelog (symfony/routing@v7.4.6...v7.4.9)

• bug #63981 Honor the Request's method in UrlMatcher::matchRequest() (@​ousamabenyounes)

v7.4.8

Changelog (symfony/routing@v7.4.7...v7.4.8)

• no significant changes

v7.4.6

Changelog (symfony/routing@v7.4.5...v7.4.6)

• bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@​NeilPeyssard)
• bug #60662 assign attribute aliases to localized route if applicable (@​alcohol)

v7.4.4

Changelog (symfony/routing@v7.4.3...v7.4.4)

• no significant changes

v7.4.3

Changelog (symfony/routing@v7.4.2...v7.4.3)

... (truncated)

Changelog

Sourced from symfony/routing's changelog.

CHANGELOG

8.2

• Add RouterBundle, which provides the router configuration and the services previously provided by FrameworkBundle under framework.router
• Add the #[AsRouteLoader] attribute, which replaces FrameworkBundle's RouteLoaderInterface
• Add Command\RouterMatchCommand, which FrameworkBundle used to provide
• Add DependencyInjection\Router and Attribute\AsRoutingConditionService, which FrameworkBundle used to provide; the attribute no longer extends AutoconfigureTag, so it tags only the classes that carry it, not their subclasses
• Add CacheWarmer\RouterCacheWarmer, Controller\RedirectController, Loader\AttributeRouteControllerLoader, Loader\DelegatingLoader and Matcher\RedirectableCompiledUrlMatcher, which FrameworkBundle used to provide
• Add a firewall option to route definitions, exposed as the _firewall route default
• Allow defining default query parameters with the _query route default
• Add RequestContext::runWith() to generate and match URLs for another host, scheme or base URL without leaking the change
• Add Route::addCondition(), RouteCollection::addCondition() and the add_condition import key to combine a condition with the existing ones

8.1

• Add a $trailingSlashOnRoot argument to CollectionConfigurator::prefix() to allow disabling the trailing slash on root routes

8.0

• Remove support for accessing the internal scope of the loader in PHP config files, use only its public API instead
• Providing a non-array _query parameter to UrlGenerator causes an InvalidParameterException
• Remove the protected AttributeClassLoader::$routeAnnotationClass property and the setRouteAnnotationClass() method, use AttributeClassLoader::setRouteAttributeClass() instead
• Remove class aliases in the Annotation namespace, use attributes instead
• Remove getters and setters in attribute classes in favor of public properties
• Remove support for the XML configuration format

7.4

• Add AttributeServicesLoader and RoutingControllerPass to auto-register routes from attributes on services
• Allow query-specific parameters in UrlGenerator using _query
• Add support of multiple env names in the Symfony\Component\Routing\Attribute\Route attribute
• Add argument $parameters to RequestContext's constructor
• Handle declaring routes using PHP arrays that follow the same shape as corresponding yaml files
• Add RoutesReference to help writing PHP configs using yaml-like array-shapes
• Deprecate class aliases in the Annotation namespace, use attributes instead
• Deprecate getters and setters in attribute classes in favor of public properties
• Deprecate accessing the internal scope of the loader in PHP config files, use only its public API instead
• Deprecate XML configuration format, use YAML, PHP or attributes instead

7.3

• Allow aliases and deprecations in #[Route] attribute
• Add the Requirement::MONGODB_ID constant to validate MongoDB ObjectIDs in hexadecimal format

... (truncated)

Commits

• ddd5589 Merge branch '6.4' into 7.4
• 6fe2ed5 [BrowserKit][HttpClient][Routing] Don't pass objects to http_build_query()
• 435dbb3 Check arrays and bools directly instead of comparing them to count()/true/fal...
• a782eb5 Merge branch '6.4' into 7.4
• 70d01e5 Check arrays and bools directly instead of comparing them to count()/true/fal...
• 80c0a93 Merge branch '6.4' into 7.4
• f8dedd4 [Routing] Detect circular references in object route parameters
• edc6193 Merge branch '6.4' into 7.4
• fc5e83c Drop PR warning and auto-closing on subtree splits
• 3a16217 Merge branch '6.4' into 7.4
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Superseded by #23.