Update dependency symfony/process to v6.4.33 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
symfony/process (source)	6.4.26 → 6.4.33

GitHub Vulnerability Alerts

CVE-2026-24739

Summary

The Symfony Process component did not correctly treat some characters (notably =) as “special” when escaping arguments on Windows. When PHP is executed from an MSYS2-based environment (e.g. Git Bash) and Symfony Process spawns native Windows executables, MSYS2’s argument/path conversion can mishandle unquoted arguments containing these characters.

This can cause the spawned process to receive corrupted/truncated arguments compared to what Symfony intended.

Impact

If an application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands (e.g. rmdir, del, etc.) with a path argument containing =, the MSYS2 conversion layer may alter the argument at runtime. In affected setups this can result in operations being performed on an unintended path, up to and including deletion of the contents of a broader directory or drive.

The issue is particularly relevant when untrusted input can influence process arguments (directly or indirectly, e.g. via repository paths, extracted archive paths, temporary directories, or user-controlled configuration).

Resolution

Upgrade to a Symfony release that includes the fix from symfony/symfony#63164 (which updates Windows argument escaping to ensure arguments containing = and other MSYS2-sensitive characters are properly quoted/escaped).
The patch for branch 5.4 is available at symfony/symfony@ec154f6

Workarounds / Mitigations

Avoid running PHP/your tooling from MSYS2-based shells on Windows; prefer cmd.exe or PowerShell for workflows that spawn native executables.
Avoid passing paths containing = (and similar MSYS2-sensitive characters) to Symfony Process when operating under Git Bash/MSYS2.
Where applicable, configure MSYS2 to disable or restrict argument conversion (e.g. via MSYS2_ARG_CONV_EXCL), understanding this may affect other tooling behavior.

---

Release Notes

symfony/process (symfony/process)

v6.4.33

Compare Source

Changelog (symfony/process@v6.4.32...v6.4.33)

• security #cve-2026-24739 Fix escaping for MSYS on Windows (nicolas-grekas)
• bug #​63164 Fix escaping for MSYS on Windows (@​nicolas-grekas)

v6.4.32

Compare Source

v6.4.31

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone America/New_York.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer install --ignore-platform-req=ext-* --ignore-platform-req=lib-* --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Your lock file does not contain a compatible set of packages. Please run composer update.

  Problem 1
    - laminas/laminas-code is locked to version 4.16.0 and an update of this package was not requested.
    - laminas/laminas-code 4.16.0 requires php ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 -> your php version (8.5.2) does not satisfy that requirement.
  Problem 2
    - league/oauth2-client is locked to version 2.8.1 and an update of this package was not requested.
    - league/oauth2-client 2.8.1 requires php ^7.1 || >=8.0.0 <8.5.0 -> your php version (8.5.2) does not satisfy that requirement.
  Problem 3
    - nette/schema is locked to version v1.3.2 and an update of this package was not requested.
    - nette/schema v1.3.2 requires php 8.1 - 8.4 -> your php version (8.5.2) does not satisfy that requirement.
  Problem 4
    - nette/utils is locked to version v4.0.7 and an update of this package was not requested.
    - nette/utils v4.0.7 requires php 8.0 - 8.4 -> your php version (8.5.2) does not satisfy that requirement.
  Problem 5
    - basvandorst/stravaphp is locked to version 2.0.0 and an update of this package was not requested.
    - basvandorst/stravaphp 2.0.0 requires league/oauth2-client ~2.3 -> satisfiable by league/oauth2-client[2.8.1].
    - league/oauth2-client 2.8.1 requires php ^7.1 || >=8.0.0 <8.5.0 -> your php version (8.5.2) does not satisfy that requirement.