From 766ead2b9f85bd97b2081fa040cf937c91d3173b Mon Sep 17 00:00:00 2001 From: Kay Joosten Date: Mon, 12 Oct 2026 11:42:03 +0200 Subject: [PATCH] Widen webmozart/assert constraint to allow ^2.0 # If applied, this commit will allow consumers of this bundle to # upgrade webmozart/assert to version 2.x without a dependency conflict. # Why is this change needed? Prior to this change, the hard pin on webmozart/assert ^1.10 blocked downstream projects (e.g. OpenConext-engineblock) from upgrading simplesamlphp/assert and simplesamlphp/saml2-legacy, both of which require webmozart/assert ~2.1 or ^2.0, holding back security fixes further down the dependency tree. # How does it address the issue? This change widens the constraint to ^1.10|^2.0. The bundle only uses Assert::stringNotEmpty(), which is unchanged between major versions, so no source changes are required. Verified with the full local test suite (docheader, phpcs, phpcpd, phpunit, phpmd) against both the previous and the new webmozart/assert version. # Provide links to any relevant tickets, articles or other resources Related to OpenConext/OpenConext-engineblock#2048 --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index 8d94053..4a67ef2 100644 --- a/composer.json +++ b/composer.json @@ -11,7 +11,7 @@ "endroid/installer": "^1.4", "symfony/dependency-injection": "^6.3|^7.0", "symfony/framework-bundle": "^6.3|^7.0", - "webmozart/assert": "^1.10" + "webmozart/assert": "^1.10|^2.0" }, "require-dev": { "php-parallel-lint/php-parallel-lint": "^1.3",