Update to Symfony 6.3

https://github.com/symfony/symfony/releases/tag/v6.3.0

All green

Committed/pushed to 11.x and 10.1.x, thanks!

📌 PHP Fatal error: Declaration of Drupal\Core\TypedData\Validation\ExecutionContext Closed: duplicate

Are these changes also gonna pushed into Drupal 10.0.x branch?

@ankitv18 no that will stay on Symfony 6.2, and then 10.0.x goes out of support the end of this year.

Is there a reason why 10.0.0 is supposed to stay on Symfony 6.2?
The current requirement in 10.0.x also allows 6.3 to install.
Shouldn't we backport or lock the version to 6.2 then?

Does that occur with the core-recommend package at 10.0.*?

Shouldn't we backport or lock the version to 6.2 then?

Yes, we should. core-recommended package should not be used to obscure wrong dependency ranges.
Not sure which way is better. Drupal 10.0 is not compatible with Symfony 6.3 and Drupal 10.1.0 is not released yet. So right now we have no stable Drupal release compatible with Symfony 6.3.

no that will stay on Symfony 6.2, and then 10.0.x goes out of support the end of this year

And Symfony 6.2 will go out of suport next month which means for Drupal 10.0 will use unsupported Symfony version for a few month.

@Chi we have an arrangement with the Symfony project that two Drupal core committers are on their security team. If any components in a Symfony minor release that Drupal core still depends on have a security advisory issued, then we will work with them to get the fix backported to the branch we're using and they'll issue a 'bonus' release for it. This doesn't apply to components we don't use.

It is a bit obscure, but it is what we settled on - they didn't want to support their own minor releases for 13 months, we didn't want to update to their minor releases in our patch releases, we didn't want to be out of security support for six months on a permanent basis.

Re #16. Makes sense.
We still need to lock Drupal 10.0 on Symfony 6.2 in composer.json.

We still need to lock Drupal 10.0 on Symfony 6.2 in composer.json.

📌 Lock Drupal 10.0 on symfony/serializer and symfony/validator 6.2 Fixed , putting this one back to status Fixed, since there's nothing more to do here.

Automatically closed - issue fixed for 2 weeks with no activity.