Right now there are some security updates for Symfony:
curl -sS https://get.symfony.com/cli/installer | bash echo y | ~/.symfony/bin/symfony self:update ~/.symfony/bin/symfony security:check Symfony Security Check Report ============================= 2 packages have known vulnerabilities. symfony/cache (v4.1.6) ---------------------- * [CVE-2019-10912][]: Prevent destructors with side-effects from being unserialized symfony/phpunit-bridge (v3.4.22) -------------------------------- * [CVE-2019-10912][]: Prevent destructors with side-effects from being unserialized [CVE-2019-10912]: https://symfony.com/cve-2019-10912 [CVE-2019-10912]: https://symfony.com/cve-2019-10912 Note that this checker can only detect vulnerabilities that are referenced in the security advisories database. Execute this command regularly to check the newly discovered vulnerabilities. These can be easily updated:
composer update symfony/cache symfony/phpunit-bridge --with-dependencies The question is, should we do these dependency updates ourselves or wait for the next Drupal core release that includes them?
For example, I’m thinking about a scenario where we would update a Symfony package that is a Drupal core dependency and something would go wrong with the update because the updated dependency hasn’t been fully tested with Drupal.
