fix(deps): update dependency symfony/validator to 6.4.* [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
symfony/validator (source)	6.2.* -> 6.4.*

GitHub Vulnerability Alerts

CVE-2024-50343

Description

It is possible to trick a Validator configured with a regular expression using the $ metacharacters, with an input ending with \n.

Resolution

Symfony now uses the D regex modifier to match the entire input.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Offscript for reporting the issue and Alexandre Daubois for providing the fix.

---

Release Notes

symfony/validator (symfony/validator)

v6.4.11

Compare Source

Changelog (symfony/validator@v6.4.10...v6.4.11)

• bug symfony/symfony#58127 [Validator] synchronize IBAN formats (@​xabbuh)
• bug symfony/symfony#57984 [Validator] Add D regex modifier in relevant validators (@​alexandre-daubois)
• bug symfony/symfony#57925 [Validator] reset the validation context after validating nested constraints (@​xabbuh)
• bug symfony/symfony#57905 [Validator] allow more unicode characters in URL paths (@​xabbuh)

v6.4.10

Compare Source

Changelog (symfony/validator@v6.4.9...v6.4.10)

• bug symfony/symfony#57812 [Validator] treat uninitialized properties referenced by property paths as null (@​xabbuh)

v6.4.9

Compare Source

Changelog (symfony/validator@v6.4.8...v6.4.9)

• bug symfony/symfony#57213 [Validator] [UniqueValidator] Use correct variable as parameter in (custom) error message (@​seho-nl, Sebastien Hoek)

v6.4.8

Compare Source

Changelog (symfony/validator@v6.4.7...v6.4.8)

• bug symfony/symfony#57275 Fix autoload configs to avoid warnings when building optimized autoloaders (@​Seldaek)
• bug symfony/symfony#54924 [Validator] IBAN Check digits should always between 2 and 98 (@​karstennilsen)
• bug symfony/symfony#54834 [Validator] Check Locale class existence before using it (@​alexandre-daubois)
• bug symfony/symfony#54758 [Validator] handle edge cases when constructing constraints with named arguments (@​xabbuh)
• bug symfony/symfony#54760 [Validator] handle union and intersection types for cascaded validations (@​xabbuh)

v6.4.7

Compare Source

Changelog (symfony/validator@v6.4.6...v6.4.7)

• bug symfony/symfony#54750 [Validator] detect wrong usages of minMessage/maxMessage in options (@​xabbuh)
• bug symfony/symfony#54751 [Validator]  detect wrong e-mail validation modes (@​xabbuh)
• bug symfony/symfony#54487 [Validator] Accept Stringable in ExecutionContext::build/addViolation() (@​alexandre-daubois)

v6.4.6

Compare Source

Changelog (symfony/validator@v6.4.5...v6.4.6)

• bug symfony/symfony#54191 [Validator] add missing invalid extension error entry (@​xabbuh)
• bug symfony/symfony#54219 [Validator] Allow BICs’ first four characters to be digits (@​MatTheCat)
• bug symfony/symfony#54137 [Validator] UniqueValidator - normalize before reducing keys (@​Brajk19)

v6.4.4

Compare Source

Changelog (symfony/validator@v6.4.3...v6.4.4)

• bug symfony/symfony#53755 [Validator] Fix fields without constraints in Collection (@​xabbuh, @​HypeMC)

v6.4.3

Compare Source

Changelog (symfony/validator@v6.4.2...v6.4.3)

• bug symfony/symfony#53620 [Validator] Fix option filenameMaxLength to the File constraint (Image) (@​mindaugasvcs)
• bug symfony/symfony#53383 [Validator] re-allow an empty list of fields (@​xabbuh)
• bug symfony/symfony#53350 [Validator] fix the exception being thrown (@​xabbuh)

v6.4.2

Compare Source

Changelog (symfony/validator@v6.4.1...v6.4.2)

• bug symfony/symfony#52406 [Validator] Fix Constraints\Email::ERROR_NAMES (@​mathroc)
• bug symfony/symfony#53133 [Validator] Fix using known option names as field names (@​HypeMC)
• bug symfony/symfony#52996 [Validator] add missing translation (@​xabbuh)
• bug symfony/symfony#52935 [Validator] Missing translations for Slovak (sk) #​51954 (Jan Vernarsky)
• bug symfony/symfony#52867 [Validator] Only trigger deprecation when Validator annotations are used (@​HypeMC)

v6.4.0

Compare Source

Changelog (symfony/validator@v6.4.0-RC2...v6.4.0)

• no significant changes

v6.3.12

Compare Source

Changelog (symfony/validator@v6.3.11...v6.3.12)

• bug symfony/symfony#53383 [Validator] re-allow an empty list of fields (@​xabbuh)
• bug symfony/symfony#53350 [Validator] fix the exception being thrown (@​xabbuh)

v6.3.11

Compare Source

Changelog (symfony/validator@v6.3.10...v6.3.11)

• bug symfony/symfony#52406 [Validator] Fix Constraints\Email::ERROR_NAMES (@​mathroc)
• bug symfony/symfony#53133 [Validator] Fix using known option names as field names (@​HypeMC)
• bug symfony/symfony#52996 [Validator] add missing translation (@​xabbuh)
• bug symfony/symfony#52935 [Validator] Missing translations for Slovak (sk) #​51954 (Jan Vernarsky)

v6.3.9

Compare Source

Changelog (symfony/validator@v6.3.8...v6.3.9)

• no significant changes

v6.3.8

Compare Source

Changelog (symfony/validator@v6.3.7...v6.3.8)

• no significant changes

v6.3.7

Compare Source

Changelog (symfony/validator@v6.3.6...v6.3.7)

• no significant changes

v6.3.6

Compare Source

Changelog (symfony/validator@v6.3.5...v6.3.6)

• bug symfony/symfony#52194 [Validator] Handle null case (@​OskarStark)

v6.3.5

Compare Source

Changelog (symfony/validator@v6.3.4...v6.3.5)

• bug symfony/symfony#51726 [Validator] NoSuspiciousCharacters custom error messages fix (@​bam1to)

v6.3.4

Compare Source

Changelog (symfony/validator@v6.3.3...v6.3.4)

• bug symfony/symfony#48840 [Validator] Dump Valid constraints on debug command (@​macintoshplus)

v6.3.2

Compare Source

Changelog (symfony/validator@v6.3.1...v6.3.2)

• bug symfony/symfony#50788 [Validator] Fix regression with class metadatada on parent classes (@​rmikalkenas)

v6.3.1

Compare Source

Changelog (symfony/validator@v6.3.0...v6.3.1)

• bug symfony/symfony#50654 [Validator] Add the message option to the PasswordStrength constraint (@​alexandre-daubois)
• bug symfony/symfony#50540 [Validator] GH-50526: Reverting ExecutionContextInterface void return types in favor of docblock annotations. (@​upchuk)
• bug symfony/symfony#50524 Fix Doctrine deprecations (@​nicolas-grekas)
• bug symfony/symfony#50539 [Validator] Remove internal from methods on non-internal interfaces (@​wouterj)

v6.3.0

Compare Source

Changelog (symfony/validator@v6.3.0-RC2...v6.3.0)

• no significant changes

v6.2.13

Compare Source

Changelog (symfony/validator@v6.2.12...v6.2.13)

• bug symfony/symfony#50788 [Validator] Fix regression with class metadatada on parent classes (@​rmikalkenas)

v6.2.12

Compare Source

v6.2.11

Compare Source

Changelog (symfony/validator@v6.2.10...v6.2.11)

• bug symfony/symfony#49063 [Messenger] Respect isRetryable decision of the retry strategy for re-delivery (@​FlyingDR)
• bug symfony/symfony#49557 [PropertyInfo] Fix phpDocExtractor nullable array value type (@​fabpot)

v6.2.10

Compare Source

Changelog (symfony/validator@v6.2.9...v6.2.10)

• bug symfony/symfony#50115 [FrameworkBundle] Make service edges unique (@​rmikalkenas)
• bug symfony/symfony#50040 [Translation] Crowdin Bridge: Fix locale vs LanguageId (@​Peter Culka)
• bug symfony/symfony#50017 [Validator] Fix support of Enum to ConstraintValidator::formatValue (@​PhoneixS)
• bug symfony/symfony#48886 [Console] Fix computing column width containing multibyte chars (@​cay89)
• bug symfony/symfony#47505 [Mime] Form field values with integer keys not resolved correctly (@​claudiu-cristea)
• bug symfony/symfony#48837 [Messenger] [Redis] Fixed problem where worker stops handling messages on first empty message (@​jvmanji)
• bug symfony/symfony#49317 [Messenger] Fix warning message on failed messenger show command (@​gstapinato)
• bug symfony/symfony#49992 [Mailer] [Mailjet] Use body MessageID instead of X-MJ-Request-GUID (@​Starfox64)
• bug symfony/symfony#48972 [HttpFoundation] Fix memory limit problems in BinaryFileResponse (@​glady)
• bug symfony/symfony#49009 [Form] Cast choices value callback result to string (@​Matth--)
• bug symfony/symfony#49537 [Serializer] Unexpected value should throw UnexpectedValueException (@​ThomasTr)
• bug symfony/symfony#49581 Avoid leading .. for temporary files from Filesystem recursive remove (@​giosh94mhz)
• bug symfony/symfony#50004 [HttpClient] fix proxied redirects in curl client (@​matthi4s)
• bug symfony/symfony#50008 [Intl] Update the ICU data to 73.1 (@​jderusse)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: apps/composer.lock

Command failed: composer update symfony/validator:6.4.11 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - symfony/translation is locked to version v6.2.8 and an update of this package was not requested.
    - Root composer.json requires symfony/validator 6.4.* -> satisfiable by symfony/validator[v6.4.11].
    - symfony/validator v6.4.11 conflicts with symfony/translation <5.4.35|>=6.0,<6.3.12|>=6.4,<6.4.3|>=7.0,<7.0.3.

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.