⬆️ 🔒 Bump symfony/http-foundation from 4.1.0 to 4.1.3

[dependabot-preview]

Bumps symfony/http-foundation from 4.1.0 to 4.1.3. This update includes security fixes.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

CVE-2018-14773: Remove support for legacy and risky HTTP headers

Affected versions: >=2.0.0, <2.1.0; >=2.1.0, <2.2.0; >=2.2.0, <2.3.0; >=2.3.0, <2.4.0; >=2.4.0, <2.5.0; >=2.5.0, <2.6.0; >=2.6.0, <2.7.0; >=2.7.0, <2.7.49; >=2.8.0, <2.8.44; >=3.0.0, <3.1.0; >=3.1.0, <3.2.0; >=3.2.0, <3.3.0; >=3.3.0, <3.3.18; >=3.4.0, <3.4.14; >=4.0.0, <4.0.14; >=4.1.0, <4.1.3

Changelog

Sourced from symfony/http-foundation's changelog.

4.1.3

• [BC BREAK] Support for the IIS-only X_ORIGINAL_URL and X_REWRITE_URL
  HTTP headers has been dropped for security reasons.

Commits

• 7d93e35 Merge branch '4.0' into 4.1
• 7dc9f88 Merge branch '3.4' into 4.0
• 19a3267 Merge branch '2.8' into 3.4
• 10f660d [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRe...
• 5f10119 Merge branch '4.0' into 4.1
• e5a8475 Merge branch '3.4' into 4.0
• b00b9ce Merge branch '2.8' into 3.4
• 5034dad security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky...
• da12951 Merge branch '4.0' into 4.1
• e0e05e9 Merge branch '3.4' into 4.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.