Update all non-major dependencies

[benjaminjonard]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@babel/preset-env (source)	7.29.2 → 7.29.5			devDependencies	patch
api-platform/core (source)	4.3.3 → 4.3.5			require	patch
crowdin/github-action	v2.16.0 → v2.16.2			action	patch
curlimages/curl	8.18.0 → 8.20.0			final	minor
doctrine/orm (source)	3.6.2 → 3.6.5			require	patch
doctrine/persistence (source)	4.1.1 → 4.2.0			require	minor
friendsofphp/php-cs-fixer	3.94.2 → 3.95.2			require-dev	minor
hotkeys-js (source)	4.0.2 → 4.0.4			dependencies	patch
igor-php/igor-php	^0.4.1 → ^0.6.0			require-dev	minor
intl-messageformat	11.2.0 → 11.2.6			dependencies	patch
justinrainbow/json-schema	6.7.2 → 6.8.2			require-dev	minor
maennchen/zipstream-php	3.2.1 → 3.2.2			require	patch
rector/rector (source)	2.3.9 → 2.4.3			require-dev	minor
symfony/asset (source)	8.0.6 → 8.0.8			require	patch
symfony/browser-kit (source)	8.0.4 → 8.0.8			require	patch
symfony/cache (source)	8.0.7 → 8.0.10			require	patch
symfony/console (source)	8.0.8 → 8.0.11			require	patch
symfony/css-selector (source)	8.0.6 → 8.0.9			require	patch
symfony/dependency-injection (source)	8.0.7 → 8.0.10			require	patch
symfony/dotenv (source)	8.0.7 → 8.0.11			require	patch
symfony/error-handler (source)	8.0.4 → 8.0.8			require	patch
symfony/event-dispatcher (source)	8.0.4 → 8.0.9			require	patch
symfony/expression-language (source)	8.0.4 → 8.0.8			require	patch
symfony/finder (source)	8.0.6 → 8.0.8			require	patch
symfony/form (source)	8.0.7 → 8.0.9			require	patch
symfony/framework-bundle (source)	8.0.7 → 8.0.11			require	patch
symfony/http-client (source)	8.0.7 → 8.0.9			require	patch
symfony/http-foundation (source)	8.0.7 → 8.0.8			require	patch
symfony/http-kernel (source)	8.0.7 → 8.0.11			require	patch
symfony/intl (source)	8.0.6 → 8.0.8			require	patch
symfony/mime (source)	8.0.7 → 8.0.9			require	patch
symfony/monolog-bundle (source)	4.0.1 → 4.0.2			require	patch
symfony/process (source)	8.0.8 → 8.0.11			require	patch
symfony/property-access (source)	8.0.4 → 8.0.8			require	patch
symfony/property-info (source)	8.0.7 → 8.0.8			require	patch
symfony/routing (source)	8.0.6 → 8.0.9			require	patch
symfony/runtime (source)	8.0.1 → 8.0.8			require	patch
symfony/security-bundle (source)	8.0.6 → 8.0.11			require	patch
symfony/security-core (source)	8.0.4 → 8.0.11			require	patch
symfony/security-http (source)	8.0.6 → 8.0.11			require	patch
symfony/serializer (source)	8.0.7 → 8.0.10			require	patch
symfony/stopwatch (source)	8.0.0 → 8.0.8			require-dev	patch
symfony/string (source)	8.0.6 → 8.0.11			require	patch
symfony/translation (source)	8.0.6 → 8.0.10			require	patch
symfony/twig-bridge (source)	8.0.7 → 8.0.8			require	patch
symfony/twig-bundle (source)	8.0.4 → 8.0.8			require	patch
symfony/uid (source)	8.0.4 → 8.0.9			require	patch
symfony/validator (source)	8.0.7 → 8.0.10			require	patch
symfony/var-dumper (source)	8.0.6 → 8.0.8			require-dev	patch
symfony/web-link (source)	8.0.4 → 8.0.8			require	patch
symfony/web-profiler-bundle (source)	8.0.7 → 8.0.11			require-dev	patch
symfony/yaml (source)	8.0.6 → 8.0.11			require	patch
twig/twig (source)	3.24.0 → 3.25.0			require	minor
webpack	5.105.4 → 5.106.2			devDependencies	minor
yarn (source)	4.13.0 → 4.14.1			packageManager	minor

---

Release Notes

babel/babel (@​babel/preset-env)

v7.29.5

Compare Source

v7.29.5 (2026-05-05)

🏠 Internal

• babel-preset-env
  • Update @babel/* dependencies

v7.29.3

Compare Source

v7.29.3 (2026-04-30)

👓 Spec Compliance

• babel-parser
  • #​17923 Support flow extends bound (@​JLHwung)

🐛 Bug Fix

• babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • #​17931 fix(decorators): replace super within all removed static elements (@​JLHwung)
• babel-register
  • #​17915 Fix thread synchronization issues in @babel/register (@​liuxingbaoyu)
• babel-compat-data, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-preset-env
  • #​17788 Add bugfix plugin for Safari array rest destructuring bug (@​JLHwung)

💅 Polish

• babel-parser
  • #​17782 Improve trailing comma comment handling (@​JLHwung)

📝 Documentation

• #​17847 Replace npmjs.com links with npmx.dev (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-helper-import-to-platform-api, babel-plugin-proposal-import-wasm-source, babel-plugin-transform-json-modules
  • #​17818 Load async Wasm and JSON imports in parallel (@​nicolo-ribaudo)

Committers: 4

• Babel Bot (@​babel-bot)
• Huáng Jùnliàng (@​JLHwung)
• Nicolò Ribaudo (@​nicolo-ribaudo)
• @​liuxingbaoyu

api-platform/core (api-platform/core)

v4.3.5

Compare Source

Bug fixes

• 78c4ddf02 fix(symfony): Symfony 8.1 compatibility (#​7955)
• 14d5e8279 fix(symfony): api_platform_iris loader misses item Gets and api_genid (#​7946)
• f88b9122f fix(hydra): emit hydra:next and hydra:previous on empty cursor-paginated collections (#​7961)
• 1721a7366 fix(mcp): jsonld schema handle oneOf and anyOf (#​7962)
• 03ca10c17 fix(mcp): add title support to Tool
• 30a8e9ef0 fix(laravel): inject missing dependencies into HydraSchemaFactory (#​7963)
• 173dc6631 fix(laravel): fall back to resource class when object is null in ResourceAccessChecker (#​7948)
• 445529519 fix(laravel): don't cache empty Eloquent attributes for missing table
• 67d7a3dc2 fix(laravel): use lowercase asc/desc for Eloquent orderBy
• 85f6269c3 fix(laravel): expose ReDoc/Scalar in docs footer

v4.3.4

Compare Source

Bug fixes

• 0160a72e1 fix(doctrine): IriFilter ignores custom ApiProperty identifier on ODM (#​7937)
• 37f248a45 fix(state): use exception message for user-facing violation when available (#​7894)
• 472ae3f22 fix(openapi): generate both singular and array parameter variants for filters (#​7906)
• 88ddc3680 fix(symfony): ensure ErrorListener is fully stateless to prevent stat… (#​7921)
• 90875fb46 fix: unnecessary nullable operator
• 967ff7925 fix(jsonapi): use parent-resolved class in denormalizeRelation
• 98112eab7 fix(symfony): api_platform_iris route loader for graphql-only setups (#​7934)
• 98f3d0f49 fix(symfony): security regression when ResourceAccessChecker is decorated (#​7896) (#​7897)
• ac374fcc4 fix(state): preserve Type message when expectedTypes is set (#​7935)
• cf80a82d5 fix(laravel): skip relation metadata for abstract Eloquent models (#​7933)
• d08eb7f44 fix: ResourceClassInfoTrait::isResourceClass() is always true (#​7924)
• e19154930 fix(validator): handle nested groups and group sequences (#​7914)
• fcfaf3844 fix(metadata): nested property filters fail to generate JOINs when relation target entity is not directly declared as ApiResource (#​7926)

crowdin/github-action (crowdin/github-action)

v2.16.2

Compare Source

What's Changed

• CLI 4.14.2 by @​andrii-bodnar

Full Changelog: crowdin/github-action@v2.16.1...v2.16.2

v2.16.1

Compare Source

What's Changed

• fix: restore original checkout after localization branch sync by @​andrii-bodnar in #​311

Full Changelog: crowdin/github-action@v2.16.0...v2.16.1

curl/curl-container (curlimages/curl)

v8.20.0

Compare Source

Changed

• bump to curl 8.20.0

v8.19.0

Compare Source

Changed

• bump to alpine 3.23.4

doctrine/orm (doctrine/orm)

v3.6.5

Compare Source

Release Notes for 3.6.5

3.6.x bugfix release (patch)

3.6.5

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

Bugfixes

• 12365: fix: allow findby strings thanks to @​vvaswani

v3.6.4

Compare Source

Release Notes for 3.6.4

3.6.x bugfix release (patch)

3.6.4

• Total issues resolved: 0
• Total pull requests resolved: 3
• Total contributors: 3

Bugfixes

• 12456: Fix collection order by behaviour in join with conditions in 3.6.x thanks to @​ofabel
• 12416: fix: Do not change readonly id when deleting (#​9538) thanks to @​robske110

Documentation

• 12444: docs: fix EntityManager transactional reference to wrapInTransaction thanks to @​mvanhorn

This release includes changes from https://github.com/doctrine/orm/releases/tag/2.20.11

v3.6.3

Compare Source

Release Notes for 3.6.3

3.6.x bugfix release (patch)

3.6.3

• Total issues resolved: 0
• Total pull requests resolved: 1
• Total contributors: 1

CI

• 12413: Group Doctrine workflow updates together thanks to @​greg0ire

This release also contains changes from https://github.com/doctrine/orm/releases/tag/2.20.10

doctrine/persistence (doctrine/persistence)

v4.2.0

Compare Source

Release Notes for 4.2.0

Feature release (minor)

4.2.0

• Total issues resolved: 0
• Total pull requests resolved: 8
• Total contributors: 3

Enhancement

• 486: Support ClassLocator in StaticPHPDriver thanks to @​GromNaN
• 458: Make AbstractManagerRegistry::$proxyInterfaceName nullable thanks to @​GromNaN
• 451: Add getFieldValue and setFieldValue to ClassMetadata interface thanks to @​GromNaN
• 450: Support closure returned by .php files in the PHPDriver thanks to @​GromNaN

Deprecations

• 489: Mark classes as soft final thanks to @​greg0ire
• 461: Deprecate ClassMetadataFactory::setMetadataFor() thanks to @​GromNaN

Improvement

• 495: Run Rector on src/ thanks to @​greg0ire

Static Analysis

• 499: findAll and findBy should return list thanks to @​stchr

v4.1.2

Compare Source

Release Notes for 4.1.2

4.1.2

• Total issues resolved: 0
• Total pull requests resolved: 4
• Total contributors: 3

CI

• 505: Group Doctrine workflow updates together thanks to @​greg0ire

Test Suite

• 493: Use Rector on tests thanks to @​greg0ire
• 488: Fix PHPUnit warning for mocks without expectation, use stubs instead thanks to @​GromNaN
• 477: Test with Symfony 8 thanks to @​loic425

This release also contains changes from 3.4.4

PHP-CS-Fixer/PHP-CS-Fixer (friendsofphp/php-cs-fixer)

v3.95.2

Compare Source

• fix: MethodArgumentSpaceFixer - avoid collapsing multi-line arguments (#​9559)
• fix: ModifierKeywordsFixer - do not break PHP syntax for closures in constant expressions (#​9596)
• fix: NoRedundantReadonlyPropertyFixer - fix TypeError when trait contains anonymous class (#​9457)
• fix: PhpUnitAttributesFixer - add missing handling of CoversMethod and naive handling of CoversTrait (#​9588)
• fix: TextReporter - always show summary footer (#​9595)
• deps: bump crate-ci/typos from 1.45.1 to 1.46.0 in /.github/workflows in the all group across 1 directory (#​9605)
• deps: bump ergebnis/composer-normalize from 2.50.0 to 2.51.0 in /dev-tools (#​9561)
• deps: bump phpstan/phpstan from 2.1.46 to 2.1.47 in /dev-tools in the phpstan group (#​9560)
• deps: bump phpstan/phpstan from 2.1.51 to 2.1.52 in /dev-tools in the phpstan group (#​9601)
• deps: bump PHPUnit patch versions (#​9593)
• deps: bump shipmonk/dead-code-detector from 1.0.0 to 1.1.0 in /dev-tools in the shipmonk group across 1 directory (#​9569)
• deps: bump the all group across 1 directory with 2 updates (#​9570)
• deps: bump the phpstan group across 1 directory with 2 updates (#​9608)
• deps: update facile-it/paraunit to ^2.11 (#​9589)
• deps: upgrade PHPUnit in GitHub Actions (#​9577)
• chore: .gitattributes - export-ignore for logo.md (#​9611)
• chore: .gitattributes - sort entries (#​9612)
• chore: Add CS commit to .git-blame-ignore-revs
• chore: Add CS commit to .git-blame-ignore-revs
• chore: add tests to PhpdocTagCasingFixerTest (#​9610)
• chore: cleanup AbstractFopenFlagFixer (#​9592)
• chore: cleanup BlankLineBetweenImportGroupsFixer (#​9562)
• chore: cleanup ControlStructureBracesFixer (#​9609)
• chore: cleanup NoExtraBlankLinesFixer (#​9567)
• chore: cleanup OrderedImportsFixer (#​9603)
• chore: cleanup PhpdocSingleLineVarSpacingFixer (#​9591)
• chore: cleanup PhpdocToReturnTypeFixer (#​9558)
• chore: CS - apply PhpUnitRequiresConstraintFixer from https://github.com/kubawerlos/php-cs-fixer-custom-fixers (#​9581)
• chore: CS - apply php_unit_attributes rule (#​9578)
• chore: ensure consistent @author name per email (#​9606)
• chore: fix wrong test Attribute (#​9586)
• chore: infection - define staticAnalysisTool (#​9607)
• chore: move Codecov config (#​9597)
• CI: move PHPUnit version management earlier to prevent composer installation phase to run 2 times (#​9587)
• CI: specify Codecov token (#​9556)
• CI: use Codecov for code coverage (#​9553)
• test: NoUnsetCastFixerTest - run any test on PHP >= 8 (#​9585)

v3.95.1

Compare Source

• chore: add tests for FinalInternalClassFixer (#​9547)
• chore: cleanup PhpdocToParamTypeFixer (#​9550)
• fix: MethodArgumentSpaceFixer - Do not collapse nested arguments when using ensure_single_line_for_single_argument option for on_multiline (#​9552)
• test: fix type after variable name in @param in PhpdocToParamTypeFixerTest (#​9549)

v3.95.0

Compare Source

• feat: Add option remove_existing_declaration to declare_strict_types fixer (#​9384)
• feat: Add exclude option to phpdoc_types rule (#​9479)
• feat: introduce 'list-rules' command (#​9512)
• feat: introduce NoWhitespaceInEmptyArrayFixer (#​8155)
• feat: Resolve to json format when AI_AGENT environment variable is set (#​9542)
• feat: @Symfony:risky - add void_return (#​9546)
• feat: GlobalNamespaceImportFixer - support first-class callable syntax (#​9484)
• feat: MethodArgumentSpaceFixer - add ensure_single_line_for_single_argument option for on_multiline (#​9504)
• feat: MultilinePromotedPropertiesFixer - turn multiline promoted properties into singleline when there are fewer than minimum_number_of_parameters (#​9501)
• feat: PhpdocLineSpanFixer - add function option (#​9439)
• feat: ReturnAssignmentFixer - skip variables with the named @var tags with new option skip_named_var_tags (#​9464)
• fix: ArrayPushFixer - do not stop fixing when array_push with 1 argument found (#​9508)
• fix: BinaryOperatorSpacesFixer - make it works correctly with multiple match cases (#​9470)
• fix: EchoTagSyntaxFixer - do not break syntax for single line comments (#​9506)
• fix: PhpUnitTestClassRequiresCoversFixer - do not add @coversNothing to anonymous classes (#​9481)
• fix: SimplifiedNullReturnFixer - do not remove null from property hook (#​9471)
• docs: extend docs about exit code (#​9526)
• docs: StaticLambdaFixer - document example how to prevent conversion (#​9502)
• DX: change default PHP_CS_FIXER_FAST_LINT_TEST_CASES=1 and run full linting of test cases only on highest and lowest PHP versions in CI (#​9448)
• chore: add missing test for SetTypeToCastFixer (#​9518)
• chore: add test for NoMultipleStatementsPerLineFixer (#​9533)
• chore: add tests for BracesPositionFixer (#​9522)
• chore: add tests for PsrAutoloadingFixer (#​9541)
• chore: cleanup MagicConstantCasingFixer (#​9494)
• chore: cleanup NoNullPropertyInitializationFixer (#​9493)
• chore: cleanup ClassAttributesSeparationFixer (#​9545)
• chore: cleanup GeneralAttributeRemoveFixer (#​9520)
• chore: cleanup GlobalNamespaceImportFixerTest (#​9482)
• chore: cleanup NoTrailingCommaInSinglelineFixer (#​9537)
• chore: cleanup OrderedAttributesFixer (#​9521)
• chore: cleanup PhpUnitExpectationFixer (#​9505)
• chore: commands cleanup (#​9478)
• chore: ensure that regex TypeExpression::REGEX_TYPES does not have unnamed capturing group (#​9514)
• chore: exclude logo.png and composer-dependency-analyser.php from Composer export (#​9516)
• chore: group dependabot updates for Docker and GitHub Actions (#​9535)
• chore: improve AbstractPhpUnitFixer (#​9519)
• chore: improve ArrayPushFixer (#​9515)
• chore: update FunctionsAnalyzer (#​9483)
• chore: MbStrFunctionsFixer - remove the never true condition (#​9509)
• chore: ModernizeStrposFixer - remove the never true conditions (#​9510)
• chore: NoAliasFunctionsFixer - cleanup invalid set handling (#​9511)
• CI: add failOnDeprecation="true" to PHPUnit config (#​8935)
• CI: cleanup jobs (#​9449)
• CI: configure Dependabot for composite actions (#​9529)
• CI: do not run issue_8828_c.test on macOS for now (#​9528)
• CI: fix Dependabot paths (#​9530)
• CI: more of ubuntu-slim (#​9450)
• CI: move spelling checks to dedicated workflow (#​9451)
• deps: bump actions/cache from 4 to 5 in /.github/composite-actions/install-composer-deps (#​9531)
• deps: bump actions/github-script from 8 to 9 in /.github/composite-actions/setup-php-with-composer-deps (#​9544)
• deps: bump crate-ci/typos from 1.43.5 to 1.44.0 (#​9476)
• deps: bump crate-ci/typos from 1.44.0 to 1.45.0 (#​9523)
• deps: bump docker/build-push-action from 6 to 7 (#​9486)
• deps: bump docker/login-action from 3 to 4 (#​9477)
• deps: bump docker/metadata-action from 5 to 6 (#​9474)
• deps: bump docker/setup-buildx-action from 3 to 4 (#​9475)
• deps: bump docker/setup-qemu-action from 3 to 4 (#​9472)
• deps: bump nick-invision/retry from 3 to 4 (#​9491)
• deps: bump nick-invision/retry from 3 to 4 in /.github/composite-actions/install-composer-deps (#​9532)
• deps: bump phpstan/phpstan from 2.1.40 to 2.1.42 in /dev-tools in the phpstan group (#​9490)
• deps: bump phpstan/phpstan from 2.1.42 to 2.1.44 in /dev-tools in the phpstan group (#​9503)
• deps: bump phpstan/phpstan-symfony from 2.0.14 to 2.0.15 in /dev-tools in the phpstan group (#​9458)
• deps: bump shipmonk/dead-code-detector from 0.14.1 to 0.15.1 in /dev-tools in the shipmonk group (#​9473)
• deps: bump shipmonk/dead-code-detector from 0.15.1 to 1.0.0 in /dev-tools in the shipmonk group (#​9543)
• deps: update PHPStan (#​9452)
• deps: upgrade deps (#​9527)
• deps: upgrade PHPUnit patch versions (#​9455)
• refactor: ConfigurableFixerTemplateFixer - move handling example file from fixing logic to definition (#​9525)
• refactor: rename PhpdocTypesNoDuplicatesFixer to PhpdocNoDuplicateTypesFixer (#​9381)
• test: fix CI for Windows (#​9492)
• test: MethodArgumentSpaceFixer must run before NoTrailingCommaInSinglelineFixer (#​9507)
• test: use PhpUnitTestCaseStaticMethodCallsFixerTest::testInvalidConfiguration (#​9460)

jaywcjlove/hotkeys-js (hotkeys-js)

v4.0.4

Compare Source

Documentation v4.0.4: https://raw.githack.com/jaywcjlove/hotkeys/93f4073/index.html
Comparing Changes: jaywcjlove/hotkeys-js@v4.0.3...v4.0.4

npm i hotkeys-js@4.0.4

• 🐞 fix: normalize latin layout key matching and stabilize browser tests #​539 214d6c7

v4.0.3

Compare Source

Documentation v4.0.3: https://raw.githack.com/jaywcjlove/hotkeys/d13af7a/index.html
Comparing Changes: jaywcjlove/hotkeys-js@v4.0.3...v4.0.3

npm i hotkeys-js@4.0.3

• 🐞 fix: normalize latin layout key matching and stabilize browser tests #​539 214d6c7

igor-php/igor-php (igor-php/igor-php)

v0.6.0

Compare Source

Changelog

• 2471619 Feat/llm export enriched (#​26)
• a940df6 feat(reporter): llm output now exits with 0 even if findings are found

v0.5.0

Compare Source

Changelog

• 62b7a27 chore(conductor): Archive track 'Refactor the project structure to align with professional open-source Go project standards.'
• [2cfbb20](https://redirect.github.com/igor-php/igor-php/commit/2cfb

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.