[META] Update core PHP dependencies

Created #2899106: Ensure all minor versions in composer.json match composer.lock to track discrepancies between core/composer.json (and /composer.json) and composer.lock.

A bit related: #2887000: composer.json does not constrain Symfony components to minor and patch versions that are compatible with Drupal and #2882826: Constrain symfony/phpunit-bridge to 3.2.*

Somewhat more related: #2867960: Merge Component composer.json files to account for them during build and #2876669: Fix dependency version requirement declarations in components

And super-duper related: #2874198: Create and run dependency regression tests for core

I think we should move this issue back to 8.4.x, but I'll let someone else be brave. :-)

Per #2842431-176: [policy] Remove PHP 5.5, 5.6 support in Drupal 8.7, Drupal will continue to need to pass tests on PHP 5.5 for another 15 months. I'm curious what that means for Symfony CMF routing and Zend Feed. Should we stay on the old versions for that duration? Or is it possible to update to the new versions (that require 5.6) and override/extend the classes/methods that break on 5.5? Should we open dedicated child issues for each of those two libraries in order to discuss/evaluate what to do for each one?

Oh! I didn't know that. Pardon me.

Today when I look at

composer outdated -D

I see a missing issue

symfony/polyfill-iconv v1.6.0 v1.7.0 Symfony polyfill for the Iconv extension

updated issue summary

#2941845: Update symfony/polyfill-iconv 1.6. to 1.7.0

This issue is an ongoing one and is targeting Drupal 8, so I opened #3009213: [META] Update / reconsider PHP dependencies for Drupal 9 to track all the child issue to perform updates for Drupal 9. Some of them will be possible in Drupal 8 especially in light on PHP 5.5 and 5.6 support dropped in Drupal 8 (https://www.drupal.org/node/2938726).

Things look much better today

composer outdated -D

doctrine/annotations         v1.2.7  v1.6.0   Docblock Annotations Parser
egulias/email-validator      1.2.15  2.1.6    A library for validating emails
masterminds/html5            2.3.0   2.3.1    An HTML5 parser and serializer.
paragonie/random_compat      v2.0.17 v9.99.99 PHP 5.x polyfill for random_bytes() and random_int() from PHP 7
symfony-cmf/routing          1.4.1   2.1.0    Extends the Symfony2 routing component for dynamic routes and chaining several routers
symfony/console              v3.4.17 v4.1.6   Symfony Console Component
symfony/dependency-injection v3.4.17 v4.1.6   Symfony DependencyInjection Component
symfony/event-dispatcher     v3.4.17 v4.1.6   Symfony EventDispatcher Component
symfony/http-foundation      v3.4.17 v4.1.6   Symfony HttpFoundation Component
symfony/http-kernel          v3.4.17 v4.1.6   Symfony HttpKernel Component
symfony/process              v3.4.17 v4.1.6   Symfony Process Component
symfony/routing              v3.4.17 v4.1.6   Symfony Routing Component
symfony/serializer           v3.4.17 v4.1.6   Symfony Serializer Component
symfony/translation          v3.4.17 v4.1.6   Symfony Translation Component
symfony/validator            v3.4.17 v4.1.6   Symfony Validator Component
symfony/yaml                 v3.4.17 v4.1.6   Symfony Yaml Component
twig/twig                    v1.35.4 v2.5.0   Twig, the flexible, fast, and secure template language for PHP
zendframework/zend-diactoros 1.8.6   2.0.0    PSR HTTP Message implementations

Useful sources of information...

Should we retitle this issue to "Update PHP dependencies for 8.9.x" or would it be better to open a new issue for that like we did for #3048569: Update PHP dependencies for 8.7.x? Per #3091418-26: Update composer dependencies on 9.0.x following PHP 7.2 requirement, I think we should get our dependencies up to date on 8.9 before starting to diverge on 9.0.