Update Symfony routing and http-foundation versions

Looks like a sea of green MRs. Will try to review once I get to my desk.

Note, updating symfony is not enough to fix CVE-2026-48784, Drupal has its own UrlGenerator #3592341: Fix dot-segment encoding for chained "../" and "./" in generated URLs.

I tested locally on all of the following branches:

• main
• 11.x
• 11.4.x
• 11.3.x
• 11.2.x
• 10.5.x

In each case, a fresh git pull; composer install; composer audit resulted in:

Found 2 security vulnerability advisories affecting 2 packages:
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/http-foundation                                                          |
| Severity          |                                                                                  |
| Advisory ID       | PKSA-y6py-qpv1-h52p                                                              |
| CVE               | CVE-2026-48736                                                                   |
| Title             | CVE-2026-48736: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4,      |
|                   | NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient       |
| URL               | https://symfony.com/cve-2026-48736                                               |
| Affected versions | >=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7. |
|                   | 4.0,<7.4.13|>=8.0.0,<8.0.13                                                      |
| Reported at       | 2026-05-26T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+
+-------------------+----------------------------------------------------------------------------------+
| Package           | symfony/routing                                                                  |
| Severity          |                                                                                  |
| Advisory ID       | PKSA-bf7t-jnpz-492k                                                              |
| CVE               | CVE-2026-48784                                                                   |
| Title             | CVE-2026-48784: UrlGenerator Dot-Segment Encoding Skips Every Other Chained      |
|                   | `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization   |
| URL               | https://symfony.com/cve-2026-48784                                               |
| Affected versions | >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2 |
|                   | .0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,< |
|                   | 6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3. |
|                   | 0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13                                 |
| Reported at       | 2026-05-26T08:00:00+00:00                                                        |
+-------------------+----------------------------------------------------------------------------------+

After checking out the corresponding branch from the fork repo, another composer install; composer audit gives:

No security vulnerability advisories found.

2 things prevent me from RTBC'ing:

1. We need the MR for 10.6.x.
2. composer/Metapackage/PinnedDevDependencies/composer.json is only updated in the MR for 10.5.x. However, on all the 11.* branches, that file is still pinning "symfony/polyfill-php84": "~v1.37.0", but we bump that version to "v1.38.1" in 10.5.x. Presumably we need that everywhere. Copy/paste failed myself. Everything is cool. The polyfills are gone from PinnedDevDependencies in the 11.* branches.

Argh, I copy/paste/failed myself. Edited previous comment to clarify. Only awaiting 10.6.x MR, then this is RTBC.

Did the same test on 10.6.x. Same 2 vulnerabilities before. After checking out 3592421-update-symfony-versions-10.6.x and running composer install, composer audit is happy. MR diff looks good. Given the bot is happy everywhere else, and the changes are functionally equivalent, the only way I see the pipeline failing is a random fail. Being bold, and moving to RTBC.

Thanks!
-Derek

Bumping to major (at least) and tagging for Security since the change is to resolve CVEs.

It looks like the issue from last week #3591179: Update main and 11.x to latest Twig and Symfony versions changed core/composer.json and various other composer.json files in addition to the one in composer/Metapackage/CoreRecommended. I used this command to compile a CSV containing a list of symfony dependencies defined in various composer.json files.

git grep -h -o 'symfony/[^"]*' **/composer.json | uniq > /tmp/symfony-dependencies.txt
while read DEP; do git grep $DEP **/composer.json |tr ':' ','; done < /tmp/symfony-dependencies.txt > /tmp/symfony-dependencies.csv

Not super efficient, but it does what it should. Using the spreadsheet I can see that symfony/http-kernel is at a different patch level in composer/Metapackage/CoreRecommended/composer.json vs. core/composer.json:

composer/Metapackage/CoreRecommended/composer.json	symfony/http-kernel	~v8.0.13
core/composer.json	symfony/http-kernel	^8.0.12

@znerol that's fine. We only bump the minimum dependency when there is a security release. So 8.0.12 is still secure, but we have locked to 8.0.13 in the lockfile so ~8.0.13 is in core recommended, because we didn't test with 8.0.12 explicitly.

Re-reviewed and retested everywhere. Smaller diff now that we're only updating those 2 symfony packages, not every Symfony thing with a new release. All looks good to me. Ship it. 😅

Thanks!
-Derek

Thanks @godotislate, tested all MRs and looked at the diffs/stats. I think its all okay now.

Committed/pushed to all branches, thanks!

The 11.x MR cherry-picked to 11.4.x so I did that one as a cherry-pick.