build(deps): bump symfony/http-kernel from 8.0.13 to 8.1.1

[dependabot]

Bumps symfony/http-kernel from 8.0.13 to 8.1.1.

Release notes

Sourced from symfony/http-kernel's releases.

v8.1.1

Changelog (symfony/http-kernel@v8.1.0...v8.1.1)

• data #64731 Release v8.1.1
• bug #64474 Allow leading zeros in int request attributes (@​ousamabenyounes)
• minor #64476 Unsafe unserialize phpstan rule (@​jack-worman)
• bug #64532 Restore null-on-invalid for nullable # controller args (@​ousamabenyounes, @​pokki-deploy)
• bug #64419 Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@​XananasX7)
• minor #64437 Add @template on ControllerAttributeEvent (@​lyrixx)
• bug #64449 Fix # being handled before # (@​nicolas-grekas)
• bug #64426 Fix TypeError in ResponseEvent when argument resolution throws (@​nicolas-grekas)

v8.1.0

Changelog (symfony/http-kernel@v8.1.0-RC1...v8.1.0)

• data #64399 Release v8.1.0
• bug #64102 Remove usage of Kernel::VERSION (@​fabpot)
• data #64374 Release v8.0.13
• data #64372 Release v7.4.13
• data #64371 Release v6.4.41

v8.1.0-RC1

Changelog (symfony/http-kernel@v8.1.0-BETA3...v8.1.0-RC1)

• data #64377 Release v8.1.0-RC1
• bug #64310 Check logs priority name for both WARNING and warning (@​MatTheCat)
• data #64306 Release v8.0.12
• data #64305 Release v7.4.12
• data #64302 Release v5.4.52

v8.1.0-BETA3

Changelog (symfony/http-kernel@v8.1.0-BETA2...v8.1.0-BETA3)

• data #64307 Release v8.1.0-BETA3
• data #64303 Release v6.4.40
• bug #64273 Various fixes and hardenings (@​nicolas-grekas)
• bug #64214 Preserve named-attribute override on Request/Session value resolvers (@​nicolas-grekas)
• security #cve-2026-45075 Fix HEAD requests bypassing methods filter in IsGranted, IsCsrfTokenValid and IsSignatureValid attributes (@​nicolas-grekas)
• data #64202 Release v8.0.11
• data #64201 Release v7.4.11
• data #64200 Release v6.4.39

v8.1.0-BETA2

Changelog (symfony/http-kernel@v8.1.0-BETA1...v8.1.0-BETA2)

• data #64203 Release v8.1.0-BETA2
• bug #64150 Use backend-handled request for terminate listeners in HttpCache (@​Toflar)
• data #64146 Release v6.4.38
• data #64145 Release v8.0.10
• data #64144 Release v7.4.10

... (truncated)

Changelog

Sourced from symfony/http-kernel's changelog.

CHANGELOG

8.2

• Add #[AsControllerAttributeListener] attribute to declare event listeners for controller attributes
• Add the $expiration argument to FragmentUriGenerator::__construct() and sign fragment URIs with a 5-year expiration by default
• Add hasDump() method to Profile to track profiles with dump

8.1

• Add setNonce() to DumpDataCollector to forward CSP nonces to every HtmlDumper it instantiates
• Add #[MapRequestHeader] to map a header from Request to a controller argument
• Add hasErrors() method to Profile to track profiles with errors (exceptions or error-level logs)
• Validate typed route parameters before calling controllers and return an HTTP error when an invalid value is provided
• Add ControllerAttributeEvent et al. to dispatch events named after controller attributes
• Add support for UploadedFile when using MapRequestPayload
• Add support for bundles as compiler pass
• Add support for SOURCE_DATE_EPOCH environment variable
• Add property $controllerMetadata to several kernel events to give listeners access to controller metadata
• Add Request attribute _controller_attributes to decouple controller attributes from their source code
• Return attributes as a flat list when using Controller[Arguments]Event::getAttributes('*')
• Pass request and args variables to Cache attribute expressions containing the Request object and controller arguments
• Allow using closures with the Cache attribute
• Allow setting a condition when the Cache attribute should be applied
• Add ControllerEvent::evaluate() et al. to help with evaluating expressions or closures in controller attributes
• Deprecate passing a non-flat list of attributes to Controller::setController()
• Deprecate the Symfony\Component\HttpKernel\DependencyInjection\Extension class, use the parent Symfony\Component\DependencyInjection\Extension\Extension class instead
• Allow using Expression or \Closure for validationGroups in #[MapRequestPayload] and #[MapQueryString]
• Deprecate passing a ControllerArgumentsEvent to the ViewEvent constructor; pass a ControllerArgumentsMetadata instead
• Support variadic argument with #[MapRequestPayload]
• Add #[Serialize] to serialize values returned by controllers
• Add argument $mapWhenEmpty to MapQueryString and MapRequestPayload for always attempting denormalization with empty query and request payload
• Deprecate Bundle::registerCommands(), use the #[AsCommand] attribute or the console.command service tag instead of overriding this method
• Deprecate BundleInterface, use the one from the DependencyInjection component instead
• Deprecate MergeExtensionConfigurationPass, use the one from the DependencyInjection component instead
• Deprecate FileLocator, use the one from the DependencyInjection component instead
• Add #[RateLimit] attribute to declaratively enforce rate limiting on controllers.
• Deprecate ServicesResetter, ServicesResetterInterface, and ResettableServicePass, use the ones from the DependencyInjection component instead

8.0

• Remove AddAnnotatedClassesToCachePass
• Remove Extension::getAnnotatedClassesToCompile() and Extension::addAnnotatedClassesToCompile()
• Remove Kernel::getAnnotatedClassesToCompile() and Kernel::setAnnotatedClassCache()
• Make ServicesResetter class final
• Add argument $logChannel to ErrorListener::logException()

... (truncated)

Commits

• 89d8d6e Update VERSION for 8.1.1
• cd716fd Merge branch '8.0' into 8.1
• ddb1f1d Merge branch '7.4' into 8.0
• 04b1d13 [Lock][Form][FrameworkBundle][Mailer][HttpKernel] Harden remaining unserializ...
• 2191fac Merge branch '6.4' into 7.4
• 6a7bf76 bug #64474 [HttpKernel] Allow leading zeros in int request attributes (ousama...
• 9f6e0b1 minor #64476 Unsafe unserialize phpstan rule (jack-worman)
• 772fc3e [HttpKernel] Allow leading zeros in int request attributes
• a2fe7b7 Unsafe unserialize phpstan rule
• 3386280 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] contr...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)