Update dependency symfony/process to v8 by renovate[bot] · Pull Request #75 · mezzio/mezzio-tooling

security symfony/symfony#cve-2024-51736 [Process] Use PATH before CD to load the shell on Windows (@nicolas-grekas)
bug symfony/symfony#58752 [Process] Fix escaping /X arguments on Windows (@nicolas-grekas)
bug symfony/symfony#58735 [Process] Return built-in cmd.exe commands directly in ExecutableFinder (@Seldaek)
bug symfony/symfony#58723 [Process] Properly deal with not-found executables on Windows (@nicolas-grekas)
bug symfony/symfony#58711 [Process] Fix handling empty path found in the PATH env var with ExecutableFinder (@nicolas-grekas)

`v7.1.6`

Compare Source

Changelog (symfony/process@v7.1.5...v7.1.6)

no significant changes

`v7.1.5`

Compare Source

Changelog (symfony/process@v7.1.4...v7.1.5)

bug symfony/symfony#58291 [Process] Fix finding executables independently of open_basedir (@BlackbitDevs)
bug symfony/symfony#58195 [Process] Fix the removal of host-specific configuration when managing the ini settings in PhpSubprocess (@M-arcus)
bug symfony/symfony#58189 [Process] Fix backwards compatibility for invalid commands (@ausi)

`v7.1.3`

Compare Source

Changelog (symfony/process@v7.1.2...v7.1.3)

no significant changes

`v7.1.1`

Compare Source

Changelog (symfony/process@v7.1.0...v7.1.1)

no significant changes

`v7.1.0`

Compare Source

Changelog (symfony/process@v7.1.0-RC1...v7.1.0)

no significant changes

`v7.0.8`

Compare Source

Changelog (symfony/process@v7.0.7...v7.0.8)

bug symfony/symfony#54863 [Process] Return false when open_basedir prevents access to /dev/tty (@mjauvin)

`v7.0.7`

Compare Source

Changelog (symfony/process@v7.0.6...v7.0.7)

no significant changes

`v7.0.4`

Compare Source

Changelog (symfony/process@v7.0.3...v7.0.4)

bug symfony/symfony#54006 [Process] Fix the command -v exception (@kayw-geek)
bug symfony/symfony#53821 [Process] Fix Inconsistent Exit Status in proc_get_status for PHP Versions Below 8.3 (@Luc45)

`v7.0.3`

Compare Source

Changelog (symfony/process@v7.0.2...v7.0.3)

bug symfony/symfony#53481 [Process] Fix executable finder when the command starts with a dash (@kayw-geek)

`v7.0.2`

Compare Source

Changelog (symfony/process@v7.0.1...v7.0.2)

bug symfony/symfony#52864 [HttpClient][Mailer][Process] always pass microseconds to usleep as integers (@xabbuh)

`v7.0.0`

Compare Source

Changelog (symfony/process@v7.0.0-RC2...v7.0.0)

no significant changes

Configuration

📅 Schedule: (in timezone UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

Read more information about the use of Renovate Bot within Laminas.

renovate · 2025-11-27T11:42:05Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update symfony/process:8.1.0 --with-dependencies --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires symfony/process ^6.0.11 || ^8.0.0 -> satisfiable by symfony/process[v8.1.0].
    - symfony/process v8.1.0 requires php >=8.4.1 -> your php version (8.1.99; overridden via config.platform, actual: 8.1.34) does not satisfy that requirement.

s-kond · 2026-02-02T12:31:19Z

Any chance that this will be updated soon?
symfony/process has a security issue in versions from including (>=) 6.0.0 and before (<) 6.4.14

see: CVE-2024-51736

so it would be great if we could update it - any effort in this regard is highly appreciated!

froschdesign · 2026-02-02T12:52:20Z

@s-kond
This automatic pull request wants to use version 8 of symfony/process, but this does not match the package's dependencies. Therefore, a pull request must be created to update to a version of symfony/process that is not affected by the security issue and supports PHP 8.2 and higher.
Thank you for reporting this! 👍🏻

froschdesign · 2026-02-02T14:45:46Z

@s-kond
I have rechecked the versions of symfony/process and there are two releases for version 6 that fix security issues:

6.4.14: security symfony/symfony#GHSA-qq5c-677p-737q [Process] Use PATH before CD to load the shell on Windows
6.4.33: security #GHSA-r39x-jcww-82v6 Fix escaping for MSYS on Windows

This package uses the ^ operator so the latest available version with the fixes will be installed: https://github.com/mezzio/mezzio-tooling/actions/runs/21577892721/job/62169123191?pr=75#step:3:240
And Composer warns you when a version is affected by security advisories.

s-kond · 2026-02-03T08:15:04Z

@froschdesign
Thanks for the quick response! You're right, updating symfony/process to 6.4.33 should suffice (and satisfies "composer audit"), thanks for pointing out, I overlooked that 👍

| datasource | package | from | to | | ---------- | --------------- | ------ | ----- | | packagist | symfony/process | 6.4.41 | 8.1.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot added the renovate label Nov 27, 2025

renovate Bot force-pushed the renovate/symfony-process-8.x branch from 1f827d9 to 642e017 Compare December 22, 2025 05:29

renovate Bot force-pushed the renovate/symfony-process-8.x branch from 642e017 to e77222e Compare January 5, 2026 06:39

renovate Bot force-pushed the renovate/symfony-process-8.x branch from e77222e to 1b9e8f0 Compare January 26, 2026 05:44

renovate Bot changed the title ~~Update dependency symfony/process to v8~~ Update dependency symfony/process to v8 - autoclosed Jan 29, 2026

renovate Bot closed this Jan 29, 2026

renovate Bot deleted the renovate/symfony-process-8.x branch January 29, 2026 01:53

renovate Bot changed the title ~~Update dependency symfony/process to v8 - autoclosed~~ Update dependency symfony/process to v8 Feb 2, 2026

renovate Bot reopened this Feb 2, 2026

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from 1b9e8f0 to df83d72 Compare February 2, 2026 04:55

renovate Bot force-pushed the renovate/symfony-process-8.x branch from df83d72 to 6fdc1e3 Compare February 9, 2026 04:30

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from c1821fc to 9e684c6 Compare March 9, 2026 06:05

renovate Bot force-pushed the renovate/symfony-process-8.x branch from 9e684c6 to 71868c7 Compare April 6, 2026 04:45

renovate Bot force-pushed the renovate/symfony-process-8.x branch from 71868c7 to bcb7dee Compare April 13, 2026 05:39

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from fda1f7f to b5417ab Compare April 27, 2026 04:48

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from c86dc89 to bc59a63 Compare May 11, 2026 04:48

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from ea809c1 to 6c77853 Compare May 18, 2026 07:33

renovate Bot force-pushed the renovate/symfony-process-8.x branch 2 times, most recently from 1d16519 to cb93e6a Compare June 15, 2026 05:51

renovate Bot force-pushed the renovate/symfony-process-8.x branch from cb93e6a to f6b84c4 Compare June 29, 2026 07:49

Update dependency symfony/process to v8

d205dcc

| datasource | package | from | to | | ---------- | --------------- | ------ | ----- | | packagist | symfony/process | 6.4.41 | 8.1.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/symfony-process-8.x branch from f6b84c4 to d205dcc Compare June 30, 2026 15:20

renovate Bot changed the base branch from 2.13.x to 2.14.x June 30, 2026 15:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Update dependency symfony/process to v8#75

Update dependency symfony/process to v8#75
renovate[bot] wants to merge 1 commit into
2.14.xfrom
renovate/symfony-process-8.x

renovate Bot commented Nov 27, 2025 •

edited

Loading

Uh oh!

renovate Bot commented Nov 27, 2025 •

edited

Loading

Uh oh!

s-kond commented Feb 2, 2026

Uh oh!

froschdesign commented Feb 2, 2026

Uh oh!

froschdesign commented Feb 2, 2026

Uh oh!

s-kond commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Configuration

Uh oh!

renovate Bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: composer.lock

Uh oh!

s-kond commented Feb 2, 2026

Uh oh!

froschdesign commented Feb 2, 2026

Uh oh!

froschdesign commented Feb 2, 2026

Uh oh!

s-kond commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Nov 27, 2025 •

edited

Loading

renovate Bot commented Nov 27, 2025 •

edited

Loading