build(deps): bump symfony/config from 7.1.1 to 7.4.9 by dependabot[bot] · Pull Request #231 · codacy/codacy-phpmd

dependabot · 2026-05-04T13:46:20Z

Bumps symfony/config from 7.1.1 to 7.4.9.

Release notes

Sourced from symfony/config's releases.

v7.4.9

Changelog (symfony/config@v7.4.6...v7.4.9)

bug #64042 Fix array-shape generator dropping alternative types on nested PrototypedArrayNode (@Amoifr)

bug #64045 Allow env placeholders in NumericNode min/max checks (@ousamabenyounes)

v7.4.8

Changelog (symfony/config@v7.4.7...v7.4.8)

no significant changes

v7.4.7

Changelog (symfony/config@v7.4.6...v7.4.7)

no significant changes

v7.4.6

Changelog (symfony/config@v7.4.5...v7.4.6)

bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@NeilPeyssard)

bug #63478 Fix ArrayShapeGenerator required keys with deep merging (@lacatoire)

bug #63450 Fix missing resource tracking for type extensions in FormPass (@ranpafin)

v7.4.4

Changelog (symfony/config@v7.4.3...v7.4.4)

bug #63053 add back missing enabled key in normalization step (xabbuh)

bug #63002 Fix merging node that canBeDisable()/canBeEnabled() (nicolas-grekas)

bug #62920 Allow ParamConfigurator in ParametersConfig (@jack-worman)

v7.4.3

Changelog (symfony/config@v7.4.2...v7.4.3)

bug symfony/symfony#62818 [Config][FrameworkBundle] Allow using ParamConfigurator with every configurable value (@jack-worman)

v7.4.1

Changelog (symfony/config@v7.4.0...v7.4.1)

bug symfony/symfony#62563 [Config] Fix array shape generation for backed enums (@OskarStark)

v7.4.0

Changelog (symfony/config@v7.4.0-RC3...v7.4.0)

bug symfony/symfony#62474 [Config] Fix nullable EnumNode with BackedEnum (@yoeunes)

v7.4.0-RC1

Changelog (symfony/config@v7.4.0-BETA2...v7.4.0-RC1)

no significant changes

... (truncated)

Changelog

Sourced from symfony/config's changelog.

CHANGELOG

8.0

Remove support for accessing the internal scope of the loader in PHP config files, use only its public API instead

Add argument $singular to NodeBuilder::arrayNode()

Add argument $info to ArrayNodeDefinition::canBeDisabled() and canBeEnabled()

Ensure configuration nodes do not have both isRequired() and defaultValue()

Remove generation of fluent methods in config builders

7.4

Add TagAwareAdapterInterface to NullAdapter

Add argument $singular to NodeBuilder::arrayNode() to decouple plurals/singulars from XML

Add support for defaultNull() on ArrayNodeDefinition

Add ArrayNodeDefinition::acceptAndWrap() to list alternative types that should be accepted and wrapped in an array

Add array-shapes to generated config builders

Deprecate accessing the internal scope of the loader in PHP config files, use only its public API instead

Deprecate setting a default value to a node that is required, and vice versa

Deprecate fluent config builders, return PHP arrays from your config instead

7.3

Add ExprBuilder::ifFalse()

Add support for info on ArrayNodeDefinition::canBeEnabled() and ArrayNodeDefinition::canBeDisabled()

Allow using an enum FQCN with EnumNode

Add NodeDefinition::docUrl()

7.2

Add #[WhenNot] attribute to prevent service from being registered in a specific environment

Generate a meta file in JSON format for resource tracking

Add SkippingResourceChecker

Add support for defaultNull() on BooleanNodeDefinition

Add StringNode and StringNodeDefinition

Add ArrayNodeDefinition::stringPrototype() method

Add NodeBuilder::stringNode() method

7.1

Allow custom meta location in ResourceCheckerConfigCache

Allow custom meta location in ConfigCache

7.0

... (truncated)

Commits

d4a277b bug #64042 [Config] Fix array-shape generator dropping alternative types on n...
f862717 Merge branch '6.4' into 7.4
ee615e8 [Config] Allow env placeholders in NumericNode min/max checks
a6b76b8 [Config] Fix array-shape generator dropping alternative types on nested Proto...
c9d41a3 Update XSD references in phpunit.xml.dist files
7d70f85 Merge branch '6.4' into 7.4
a3e8d1f More CS fixes
212a160 Merge branch '6.4' into 7.4
41dfcd0 CS fixes - native_function_invocation & static_lambda
6ba5210 [CS] Back config from 8.1 and apply heredoc_indentation rule
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [symfony/config](https://github.com/symfony/config) from 7.1.1 to 7.4.9. - [Release notes](https://github.com/symfony/config/releases) - [Changelog](https://github.com/symfony/config/blob/8.1/CHANGELOG.md) - [Commits](symfony/config@v7.1.1...v7.4.9) --- updated-dependencies: - dependency-name: symfony/config dependency-version: 7.4.9 dependency-type: indirect update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

codacy-production · 2026-05-04T13:48:00Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity

Metric Results

Complexity 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

This PR cannot be merged in its current state due to major integrity issues with the composer.lock file. The file references Symfony component versions (v7.4.9) that do not currently exist in the official PHP registry and contains package timestamps set in the year 2026. These anomalies indicate a corrupted lock file generation process.

While Codacy reports the PR is up to standards, the functional analysis reveals a medium-risk dependency change: symfony/polyfill-mbstring now requires the ext-iconv PHP extension. You must ensure this extension is present in your CI and production environments to avoid runtime failures.

About this PR

The package timestamps in composer.lock (e.g., lines 480, 697, 780, 865) are set to April 2026. This anomaly suggests the lock file was not generated by a standard composer update command in a valid environment.

Test suggestions

Verify that symfony/config version is locked to v7.4.9 in composer.lock
Verify that symfony/filesystem version is locked to v7.4.9
Verify that symfony/config dev dependencies now allow Symfony 8.0 components

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-04T13:49:33Z

        {
            "name": "symfony/config",
-            "version": "v7.1.1",
+            "version": "v7.4.9",


_{🔴 HIGH RISK}

The composer.lock file contains non-existent versions (e.g., v7.4.9 for Symfony components) and future timestamps (April 2026). These versions are not available on the official registry, which will cause the build to fail. Regenerate the composer.lock file using composer update to pull valid stable versions from the official repository.

codacy-production · 2026-05-04T13:49:33Z

            },
            "require": {
-                "php": ">=7.1"
+                "ext-iconv": "*",


_{🟡 MEDIUM RISK}

This update introduces a hard requirement for the ext-iconv extension via the symfony/polyfill-mbstring package. Systems lacking the iconv PHP extension will encounter installation or runtime errors. Verify that the iconv PHP extension is enabled in the CI/CD and production environments.

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels May 4, 2026

codacy-production Bot reviewed May 4, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump symfony/config from 7.1.1 to 7.4.9#231

build(deps): bump symfony/config from 7.1.1 to 7.4.9#231
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/composer/symfony/config-7.4.9

dependabot Bot commented on behalf of github May 4, 2026

Uh oh!

codacy-production Bot commented May 4, 2026

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot May 4, 2026

Uh oh!

codacy-production Bot May 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github May 4, 2026

v7.4.9

v7.4.8

v7.4.7

v7.4.6

v7.4.4

v7.4.3

v7.4.1

v7.4.0

v7.4.0-RC1

CHANGELOG

8.0

7.4

7.3

7.2

7.1

Uh oh!

codacy-production Bot commented May 4, 2026

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants