Skip to content

Bump the composer group across 1 directory with 8 updates - #1705

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/api/composer-09dc31f740
Open

Bump the composer group across 1 directory with 8 updates#1705
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/composer/api/composer-09dc31f740

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 28, 2026

Copy link
Copy Markdown

Bumps the composer group with 6 updates in the /api directory:

Package From To
dompdf/dompdf 2.0.1 2.0.4
phpoffice/phpspreadsheet 1.29.0 1.30.4
onelogin/php-saml 4.0.0 4.3.1
symfony/http-foundation 5.3.14 5.4.50
symfony/process 5.3.12 5.4.51
twig/twig 3.4.3 3.11.3

Updates dompdf/dompdf from 2.0.1 to 2.0.4

Release notes

Sourced from dompdf/dompdf's releases.

Dompdf 2.0.4

Change highlights since 2.0.3

This release addresses the following announced vulnerability:

Vulnerability References Type Severity
Possible DoS caused by infinite recursion when validating SVG images GHSA-3qx2-6f78-w2j2 Resource Exhaustion Moderate

2.0.x highlights

  • Modifies callback and page_script/page_text handling
  • Switches the HTML5 parser to Masterminds/HTML5
  • Improves CSS property parsing and representation
  • Switches installed fonts and font metrics cache file format to JSON

View all changes since the previous release in the commit history.

We would like to extend our gratitude to the community members who helped make this release possible.

Requirements

Dompdf 2.0.4 requires the following:

  • PHP 7.1 or greater
  • html5-php v2.0.0 or greater
  • php-font-lib v0.5.4 or greater
  • php-svg-lib v0.3.3 or greater

Note that some dependencies may have further dependencies (notably php-svg-lib requires sabberworm/php-css-parser).

Additionally, the following are recommended for optimal use:

  • GD (for image processing)
  • allow_url_fopen set to true or the curl PHP extension (for retrieving stylesheets, images, etc via http)

For full requirements and recommendations see the requirements page on the wiki.

Download Instructions

The dompdf team recommends that you use Composer for easier dependency management.

If you're not yet using Composer you can download a packaged release of dompdf which includes all the files you need to use the library. Click the link labeled "dompdf_2-0-4.zip" for the packaged release. The download options labeled "Source code" are auto-generated by github and do not include all the dependencies.

Dompdf 2.0.3

This release addresses the following vulnerability:

Vulnerability References Type Severity
URI validation failure on SVG parsing [GHSA-56gj-mvh6-rp75][GHSA-56gj-mvh6-rp75], [CVE-2023-24813][CVE-2023-24813] Remote Code Execution Critical

... (truncated)

Commits
  • 093f2d9 Bump version to 2.0.4
  • 41cbac1 Improve SVG file reference recursion validation
  • e8d2d5e Bump version to 2.0.3
  • 95009ea Validate both bare and namespaced SVG image HREF attributes
  • 2a8a6b8 Resets version string to commit hash
  • ad4c631 Bump version to 2.0.2
  • 7558f07 SVG parsing - comparing the tag name in a case insensitive way
  • ae1ca4a Adds Security Advisory feature information
  • 68fabc5 Removes version info
  • f586c13 Fixed bug where svg polylines get automatically closed
  • Additional commits viewable in compare view

Updates phpoffice/phpspreadsheet from 1.29.0 to 1.30.4

Release notes

Sourced from phpoffice/phpspreadsheet's releases.

1.30.4

Fixed

  • Security patches.

1.30.3

Fixed

1.30.2

Changed

  • Evaluation of WEBSERVICE no longer requires external client, but will use oldCalculatedValue unless the request is for a domain in a user-supplied whitelist. Security-related backport of [PR #4751](PHPOffice/PhpSpreadsheet#4751)

Deprecated

  • Settings methods setHttpClient, unsetHttpClient, getHttpClient, and getRequestFactory are no longer used. No replacement.

Fixed

1.30.1

Functionally Frozen

  • Except for security changes, no further maintenance will be applied to this branch. You are encouraged to upgrade to a maintained branch as soon as possible. Maintained branches are master (preferred - version is 5.2.0 as of the date when this is being written), release390 (current version is 3.10.1), and release222 (2.4.1).
  • Of particular note is that this branch should not run under Php 8.5+, and will not be updated to avoid deprecation notices introduced with Php 8.5.

1.30.0

Breaking Changes

  • Images will be loaded from an external source (e.g. http://example.com/img.png) only if the reader is explicitly set to allow it via $reader->setAllowExternalImages(true). We do not believe that loading of external images is a widely used feature. This is a necessary change for security purposes. It unfortunately breaks Semantic Versioning for reasons described above; there is no way to start a new major version for this branch.

1.29.12

Added

  • Add to all readers the option to allow or forbid fetching external images. This is unconditionally allowed now. The default will be set to "allow", so no code changes are necessary. However, we are giving consideration to changing the default.[PR #4545](PHPOffice/PhpSpreadsheet#4545)

1.29.11

Changed

  • Allow php-cs-fixer to Handle Implicit Backslashes.

Added

... (truncated)

Changelog

Sourced from phpoffice/phpspreadsheet's changelog.

2026-04-19 - 1.30.4

Fixed

  • Security patches.

2026-04-09 - 1.30.3

Fixed

2026-01-10 - 1.30.2

Changed

  • Evaluation of WEBSERVICE no longer requires external client, but will use oldCalculatedValue unless the request is for a domain in a user-supplied whitelist. Security-related backport of [PR #4751](PHPOffice/PhpSpreadsheet#4751)

Deprecated

  • Settings methods setHttpClient, unsetHttpClient, getHttpClient, and getRequestFactory are no longer used. No replacement.

Fixed

2025-10-25 - 1.30.1

Functionally Frozen

  • Except for security changes, no further maintenance will be applied to this branch. You are encouraged to upgrade to a maintained branch as soon as possible. Maintained branches are master (preferred - version is 5.4.0 as of the date when this is being written), 3.10.x (current version is 3.10.3), and 2.4.x (2.4.3).
  • Of particular note is that this branch should not run under Php 8.5+, and will not be updated to avoid deprecation notices introduced with Php 8.5.

2025-08-10 - 1.30.0

Breaking Changes

  • Images will be loaded from an external source (e.g. http://example.com/img.png) only if the reader is explicitly set to allow it via $reader->setAllowExternalImages(true). We do not believe that loading of external images is a widely used feature. This is a necessary change for security purposes. It unfortunately breaks Semantic Versioning for reasons described above; there is no way to start a new major version for this branch.

2025-07-23 - 1.29.12

Added

  • Add to all readers the option to allow or forbid fetching external images. This is unconditionally allowed now. The default will be set to "allow", so no code changes are necessary. However, we are giving consideration to changing the default.[PR #4545](PHPOffice/PhpSpreadsheet#4545)

2025-06-22 - 1.29.11

... (truncated)

Commits

Updates onelogin/php-saml from 4.0.0 to 4.3.1

Release notes

Sourced from onelogin/php-saml's releases.

OneLogin's SAML PHP Toolkit v4.3.1

OneLogin's SAML PHP Toolkit v4.3.0

  • PHP 8.4 Compatibility via #600 and #607.
  • #619 Add Parameter checking on validateBinarySign, inspired on CVE-2025-27773
  • #603 Fix typo in ignoreValidUntil that breaks metadata. Add parameter to exclude validUntil on Settings getSPMetadata
  • #594 Add support for encrypted name id in encrypted assertion
  • Fix buildWithBaseURLPath. See #581
  • Doc fix typo
  • Remove Travis CI references

OneLogin's SAML PHP Toolkit v4.2.0

  • #586 IdPMetadataParser::parseRemoteXML - Add argument for setting whether to validate peer SSL certificate
  • #585 Declare conditional return types
  • #577 Allow empty NameID value when no strict or wantNameId is false
  • #570 Support X509 cert comments
  • #569 Add parameter to exclude validUntil on SP Metadata XML
  • #551 Fix compatibility with proxies that extends HTTP_X_FORWARDED_HOST
  • LogoutRequest and the LogoutResponse object to separate functions
  • Make Saml2\Auth can accept a param $spValidationOnly
  • Fix typos on readme.
  • #480 Fix typo on SPNameQualifier mismatch error message
  • Remove unbound version constraints on xmlseclibs
  • Update dependencies
  • Fix test payloads
  • Remove references to OneLogin.

OneLogin's SAML PHP Toolkit v4.1.0

  • Add pipe through for the $spValidationOnly setting in the Auth class.

OneLogin's SAML PHP Toolkit v4.0.1

  • Add compatibility with PHP 8.1
    • If null param are provided to trim or preg_match, when PHP 8.1 has deprecation errors enabled, php-saml will raise errors.
Changelog

Sourced from onelogin/php-saml's changelog.

v4.3.1

v4.3.0

  • PHP 8.4 Compatibility via #600 and #607.
  • #619 Add Parameter checking on validateBinarySign, inspired on CVE-2025-27773
  • #603 Fix typo in ignoreValidUntil that breaks metadata. Add a new parameter to exclude validUntil on Settings getSPMetadata
  • #594 Add support for encrypted name id in encrypted assertion
  • Fix buildWithBaseURLPath. See #581
  • Doc fix typo
  • Remove Travis CI references

v4.2.0

  • #586 IdPMetadataParser::parseRemoteXML - Add argument for setting whether to validate peer SSL certificate
  • #585 Declare conditional return types
  • #577 Allow empty NameID value when no strict or wantNameId is false
  • #570 Support X509 cert comments
  • #569 Add parameter to exclude validUntil on SP Metadata XML
  • #551 Fix compatibility with proxies that extends HTTP_X_FORWARDED_HOST
  • LogoutRequest and the LogoutResponse object to separate functions
  • Make Saml2\Auth can accept a param $spValidationOnly
  • Fix typos on readme.
  • #480 Fix typo on SPNameQualifier mismatch error message
  • Remove unbound version constraints on xmlseclibs
  • Update dependencies
  • Fix test payloads
  • Remove references to OneLogin.

v4.1.0

  • Add pipe through for the $spValidationOnly setting in the Auth class.

v4.0.1

  • Add compatibility with PHP 8.1
  • #487 Enable strict check on in_array method
  • Add warning about Open Redirect and Reply attacks
  • Add warning about the use of IdpMetadataParser class. If Metadata URLs are provided by 3rd parties, the URL inputs MUST be validated to avoid issues like SSRF
Commits
  • b009f16 Prepare release 4.3.1
  • bf0c0de Update xmlseclibs version requirement to 3.1.4 due CVE-2025-66475
  • 341215d Update CHANGELOG with missed entry
  • bf5efce Prepare release 4.3.0
  • ba244ae Fix buildWithBaseURLPath, See #581
  • 3b0fbb8 Merge pull request #619 from SAML-Toolkits/improve_validate_binary_sign
  • 74154db Add Parameter checking on validateBinarySign, inspired on CVE-2025-27773 fix....
  • 76236a6 Merge pull request #607 from SAML-Toolkits/php84_fix_test_warnings
  • 7516681 cleanup: remove Travis CI references
  • fa7621e Fix warnings found running php8.4 and PHPUnit 11.5.0
  • Additional commits viewable in compare view

Updates phenx/php-svg-lib from 0.3.4 to 0.5.4

Release notes

Sourced from phenx/php-svg-lib's releases.

Nattering Narwhal

What's Changed

Full Changelog: dompdf/php-svg-lib@0.5.3...0.5.4 Addressed Issues: https://github.com/dompdf/php-svg-lib/milestone/9?closed=1

Masticating Manatee

What's Changed

Full Changelog: dompdf/php-svg-lib@0.5.2...0.5.3 Addressed Issues: 0.5.3 milestone

Lounging Llama

Security release to address the following reported vulnerability:

Full Changelog: dompdf/php-svg-lib@0.5.1...0.5.2

Kickin' Koala

Security release to address the following reported vulnerabilities:

Jesting Jackal

  • Adds full support for non-user space length values (percent, unit values)
  • Improves processing of use elements
  • Improves path rendering and syntax support
  • Adds support for colors with alpha
  • Adds support for non-namespaced "href" attribute
  • Improves font parsing

See the 0.5.0 milestone for issues and PRs

Gracious thanks to the contributors who helped make this release possible.

Ignaminous Iguanga

  • Re-target base PHP support to 7.1
  • Skips rendering of indeterminate (return-to-origin) arc segments

Howling Hyena

  • Improves compatibility with PHP 8.1
    • Update Cpdf to latest version
    • Updates php-css-parser dependency to 8.4
Commits
  • 46b25da Update PathTest.php for PHPunit compatibility
  • 0e9dc9d Handle nested definition elements
  • 0e46722 Render a line for a path segment with a radius of zero
  • 964d9a9 Improve symbol element parsing
  • 3d6b248 Add method to apply element viewBox
  • 092e32c Improve use handling
  • bb2eee6 Update license property in composer.json
  • 519791c Update README links
  • 52d6776 Update .gitignore and .gitattributes
  • 720b707 Merge CPdf updated from Dompdf
  • Additional commits viewable in compare view

Updates robrichards/xmlseclibs from 3.1.1 to 3.1.5

Release notes

Sourced from robrichards/xmlseclibs's releases.

3.1.5

Validate AES-GCM Authentication Tag

3.1.4

fix canonicalization error

3.1.3

Removes BC breaking change

3.1.2

Add tab to list of whitespace values to remove from cert loadKey should check return value for openssl_get_privatekey Switch to GitHub actions Support OAEP (from unreleased 3.1.1)

Changelog

Sourced from robrichards/xmlseclibs's changelog.

xmlseclibs.php ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 12, Dec 2026, 3.1.5 Security:

  • Validate AES-GCM Authentication Tag (Sideni)

08, Dec 2025, 3.1.4 Security:

  • fix canonicalization bypass error (d0ge)

20, Nov 2024, 3.1.3 Bug Fixes:

  • remove loadKey check due to BC issues

20, Nov 2024, 3.1.2 Improvements:

  • Add tab to list of whitespace values to remove from cert. refs #252
  • loadKey should check return value for openssl_get_privatekey (sammarshallou)
  • Switch to GitHub actions (SharkMachine)

05, Sep 2020, 3.1.1 Features:

  • Support OAEP (iggyvolz)

Bug Fixes:

  • Fix AES128 (iggyvolz)

Improvements:

  • Fix tests for older PHP

22, Apr 2020, 3.1.0 Features:

  • Support AES-GCM. Requires PHP 7.1. (François Kooman)

Improvements:

  • Fix Travis tests for older PHP versions.
  • Use DOMElement interface to fix some IDEs reporting documentation errors

Bug Fixes:

  • FIX missing InclusiveNamespaces PrefixList from Java + Apache WSS4J. (njake)

06, Nov 2019, 3.0.4 Security Improvements:

  • Insure only a single SignedInfo element exists within a signature during verification. Refs CVE-2019-3465. Bug Fixes:
  • Fix variable casing.

15, Nov 2018, 3.0.3 Bug Fixes:

... (truncated)

Commits

Updates symfony/http-foundation from 5.3.14 to 5.4.50

Release notes

Sourced from symfony/http-foundation's releases.

v5.4.50

Changelog (symfony/http-foundation@v5.4.49...v5.4.50)

v5.4.48

Changelog (symfony/http-foundation@v5.4.47...v5.4.48)

v5.4.46

Changelog (symfony/http-foundation@v5.4.45...v5.4.46)

v5.4.45

Changelog (symfony/http-foundation@v5.4.44...v5.4.45)

v5.4.44

Changelog (symfony/http-foundation@v5.4.43...v5.4.44)

v5.4.42

Changelog (symfony/http-foundation@v5.4.41...v5.4.42)

v5.4.40

Changelog (symfony/http-foundation@v5.4.39...v5.4.40)

v5.4.39

Changelog (symfony/http-foundation@v5.4.38...v5.4.39)

v5.4.38

Changelog (symfony/http-foundation@v5.4.37...v5.4.38)

  • no significant changes
Changelog

Sourced from symfony/http-foundation's changelog.

CHANGELOG

8.1

  • Add BinaryFileResponse::shouldDeleteFileAfterSend()
  • Deprecate setting public properties of Request and Response objects directly; use setters or constructor arguments instead

8.0

  • Drop HTTP method override support for methods GET, HEAD, CONNECT and TRACE
  • Add argument $subtypeFallback to Request::getFormat()
  • Remove the following deprecated session options from NativeSessionStorage: referer_check, use_only_cookies, use_trans_sid, sid_length, sid_bits_per_character, trans_sid_hosts, trans_sid_tags
  • Trigger PHP warning when using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Add arguments $v4Bytes and $v6Bytes to IpUtils::anonymize()
  • Add argument $partitioned to ResponseHeaderBag::clearCookie()
  • Add argument $expiration to UriSigner::sign()
  • Remove Request::get(), use properties ->attributes, query or request directly instead
  • Remove accepting null $format argument to Request::setFormat()

7.4

  • Add #[WithHttpStatus] to define status codes: 404 for SignedUriException and 403 for ExpiredSignedUriException
  • Add support for the QUERY HTTP method
  • Add support for structured MIME suffix
  • Add Request::set/getAllowedHttpMethodOverride() to list which HTTP methods can be overridden
  • Deprecate using Request::sendHeaders() after headers have already been sent; use a StreamedResponse instead
  • Deprecate method Request::get(), use properties ->attributes, query or request directly instead
  • Make Request::createFromGlobals() parse the body of PUT, DELETE, PATCH and QUERY requests
  • Deprecate HTTP method override for methods GET, HEAD, CONNECT and TRACE; it will be ignored in Symfony 8.0
  • Deprecate accepting null $format argument to Request::setFormat()

7.3

  • Add support for iterable of string in StreamedResponse
  • Add EventStreamResponse and ServerEvent classes to streamline server event streaming
  • Add support for valkey: / valkeys: schemes for sessions
  • Request::getPreferredLanguage() now favors a more preferred language above exactly matching a locale
  • Allow UriSigner to use a ClockInterface
  • Add UriSigner::verify()

7.2

  • Add optional $requests parameter to RequestStack::__construct()
  • Add optional $v4Bytes and $v6Bytes parameters to IpUtils::anonymize()

... (truncated)

Commits
  • 1a0706e [HttpFoundation] Fix parsing pathinfo with no leading slash
  • 3f38b8a [HttpFoundation] Fix test
  • 897e8a2 [HttpFoundation] Revert risk change
  • 3280c9d Work around parse_url() bug (bis)
  • 168b77c security #cve-2024-50345 [HttpFoundation] Reject URIs that contain invalid ch...
  • 32310ff [HttpFoundation] Reject URIs that contain invalid characters
  • 38bd9bc [HttpFoundation] Remove invalid HTTP method from exception message
  • 3f38426 Ensure compatibility with mongodb v2
  • 35f7b4c session names must not be empty
  • e641edd ensure session storages are opened in tests before destroying them
  • Additional commits viewable in compare view

Updates symfony/process from 5.3.12 to 5.4.51

Release notes

Sourced from symfony/process's releases.

v5.4.51

Changelog (symfony/process@v5.4.50...v5.4.51)

v5.4.47

Changelog (symfony/process@v5.4.46...v5.4.47)

  • no significant changes

v5.4.46

Changelog (symfony/process@v5.4.45...v5.4.46)

v5.4.45

Changelog (symfony/process@v5.4.44...v5.4.45)

  • no significant changes

v5.4.44

Changelog (symfony/process@v5.4.43...v5.4.44)

v5.4.40

Changelog (symfony/process@v5.4.39...v5.4.40)

  • no significant changes

v5.4.39

Changelog (symfony/process@v5.4.38...v5.4.39)

  • no significant changes

v5.4.36

Changelog (symfony/process@v5.4.35...v5.4.36)

v5.4.35

Changelog (symfony/process@v5.4.34...v5.4.35)

v5.4.34

... (truncated)

Commits
  • 467bfc5 [Process] Fix escaping for MSYS on Windows
  • 5d1662f normalize paths to avoid failures if a path is referenced by different names
  • 0190687 [Process] Fix test
  • ee75984 security #cve-2024-51736 [Process] Use %PATH% before %CD% to load the shell o...
  • 05c2ccc [Process] Use %PATH% before %CD% to load the shell on Windows
  • d94dda5 [Process] Fix escaping /X arguments on Windows
  • 72baf6b fix the constant being used
  • 81e1a0c fix the path separator being used
  • d67303e minor #58747 [Process] fix the directory separator being used (xabbuh)
  • 5cdd400 minor #58746 [Process] Improve test cleanup by unlinking in a finally block...
  • Additional commits viewable in compare view

Updates twig/twig from 3.4.3 to 3.11.3

Changelog

Sourced from twig/twig's changelog.

3.11.3 (2024-11-07)

  • Fix an infinite recursion in the sandbox code

3.11.2 (2024-11-06)

  • [BC BREAK] Fix a security issue in the sandbox mode allowing an attacker to call attributes on Array-like objects They are now checked via the property policy
  • Fix a security issue in the sandbox mode allowing an attacker to be able to call toString() under some circumstances on an object even if the __toString() method is not allowed by the security policy

3.11.1 (2024-09-10)

  • Fix a security issue when an included sandboxed template has been loaded before without the sandbox context

3.11.0 (2024-08-08)

  • Add Twig\Cache\ChainCache and Twig\Cache\ReadOnlyFilesystemCache
  • Add the possibility to deprecate attributes and nodes on Node
  • Add the possibility to add a package and a version to the deprecated tag
  • Add the possibility to add a package for filter/function/test deprecations
  • Mark ConstantExpression as being @final
  • Add the find filter
  • Fix optimizer mode validation in OptimizerNodeVisitor
  • Add the possibility to yield from a generator in PrintNode
  • Add the shuffle filter
  • Add the singular and plural filters in StringExtension
  • Deprecate the second argument of Twig\Node\Expression\CallExpression::compileArguments()
  • Deprecate Twig\ExpressionParser\parseHashExpression() in favor of Twig\ExpressionParser::parseMappingExpression()
  • Deprecate Twig\ExpressionParser\parseArrayExpression() in favor of Twig\ExpressionParser::parseSequenceExpression()
  • Add sequence and mapping tests
  • Deprecate Twig\Node\Expression\NameExpression::isSimple() and Twig\Node\Expression\NameExpression::isSpecial()

3.10.3 (2024-05-16)

  • Fix missing ; in generated code

3.10.2 (2024-05-14)

  • Fix support for the deprecated escaper signature

3.10.1 (2024-05-12)

  • Fix BC break on escaper extension
  • Fix constant return type

3.10.0 (2024-05-11)

... (truncated)

Commits
  • 3b06600 Prepare the 3.11.3 release
  • dbd734a Update CHANGELOG
  • d3fc074 Improve detection of recursion
  • a0f7756 Fix recursion when arrays contain self-references in sandboxed mode
  • 5b580ec Fix code
  • 94612e7 Prepare the 3.11.2 release
  • 8b52782 Update CHANGELOG
  • ec39a9d Sandbox ArrayAccess and do sandbox checks before isset() checks
  • cafc608 Fix sandbox handling for __toString()
  • ff063af Prepare the 3.11.1 release
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the composer group across 1 directory with 8 updates
81c76da 
Bumps the composer group with 6 updates in the /api directory:

| Package | From | To |
| --- | --- | --- |
| [dompdf/dompdf](https://github.com/dompdf/dompdf) | `2.0.1` | `2.0.4` |
| [phpoffice/phpspreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) | `1.29.0` | `1.30.4` |
| [onelogin/php-saml](https://github.com/SAML-Toolkits/php-saml) | `4.0.0` | `4.3.1` |
| [symfony/http-foundation](https://github.com/symfony/http-foundation) | `5.3.14` | `5.4.50` |
| [symfony/process](https://github.com/symfony/process) | `5.3.12` | `5.4.51` |
| [twig/twig](https://github.com/twigphp/Twig) | `3.4.3` | `3.11.3` |



Updates `dompdf/dompdf` from 2.0.1 to 2.0.4
- [Release notes](https://github.com/dompdf/dompdf/releases)
- [Commits](dompdf/dompdf@v2.0.1...v2.0.4)

Updates `phpoffice/phpspreadsheet` from 1.29.0 to 1.30.4
- [Release notes](https://github.com/PHPOffice/PhpSpreadsheet/releases)
- [Changelog](https://github.com/PHPOffice/PhpSpreadsheet/blob/1.30.4/CHANGELOG.md)
- [Commits](PHPOffice/PhpSpreadsheet@1.29.0...1.30.4)

Updates `onelogin/php-saml` from 4.0.0 to 4.3.1
- [Release notes](https://github.com/SAML-Toolkits/php-saml/releases)
- [Changelog](https://github.com/SAML-Toolkits/php-saml/blob/4.3.1/CHANGELOG)
- [Commits](SAML-Toolkits/php-saml@4.0.0...4.3.1)

Updates `phenx/php-svg-lib` from 0.3.4 to 0.5.4
- [Release notes](https://github.com/dompdf/php-svg-lib/releases)
- [Commits](dompdf/php-svg-lib@0.3.4...0.5.4)

Updates `robrichards/xmlseclibs` from 3.1.1 to 3.1.5
- [Release notes](https://github.com/robrichards/xmlseclibs/releases)
- [Changelog](https://github.com/robrichards/xmlseclibs/blob/master/CHANGELOG.txt)
- [Commits](robrichards/xmlseclibs@3.1.1...3.1.5)

Updates `symfony/http-foundation` from 5.3.14 to 5.4.50
- [Release notes](https://github.com/symfony/http-foundation/releases)
- [Changelog](https://github.com/symfony/http-foundation/blob/8.1/CHANGELOG.md)
- [Commits](symfony/http-foundation@v5.3.14...v5.4.50)

Updates `symfony/process` from 5.3.12 to 5.4.51
- [Release notes](https://github.com/symfony/process/releases)
- [Changelog](https://github.com/symfony/process/blob/8.1/CHANGELOG.md)
- [Commits](symfony/process@v5.3.12...v5.4.51)

Updates `twig/twig` from 3.4.3 to 3.11.3
- [Release notes](https://github.com/twigphp/Twig/releases)
- [Changelog](https://github.com/twigphp/Twig/blob/v3.11.3/CHANGELOG)
- [Commits](twigphp/Twig@v3.4.3...v3.11.3)

---
updated-dependencies:
- dependency-name: dompdf/dompdf
  dependency-version: 2.0.4
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: phpoffice/phpspreadsheet
  dependency-version: 1.30.4
  dependency-type: direct:production
  dependency-group: composer
- dependency-name: onelogin/php-saml
  dependency-version: 4.3.1
  dependency-type: indirect
  dependency-group: composer
- dependency-name: phenx/php-svg-lib
  dependency-version: 0.5.4
  dependency-type: indirect
  dependency-group: composer
- dependency-name: robrichards/xmlseclibs
  dependency-version: 3.1.5
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/http-foundation
  dependency-version: 5.4.50
  dependency-type: indirect
  dependency-group: composer
- dependency-name: symfony/process
  dependency-version: 5.4.51
  dependency-type: indirect
  dependency-group: composer
- dependency-name: twig/twig
  dependency-version: 3.11.3
  dependency-type: indirect
  dependency-group: composer
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update php code labels Apr 28, 2026
@codacy-production

codacy-production Bot commented Apr 28, 2026

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results
Complexity 0
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file php Pull requests that update php code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants