update patch 1

vendor/symfony/http-foundation/Session/Storage/Handler/AbstractSessionHandler.php

@@ -32,7 +32,7 @@ abstract class AbstractSessionHandler implements \SessionHandlerInterface, \Sess
     {
         $this->sessionName = $sessionName;
         if (!headers_sent() && !\ini_get('session.cache_limiter') && '0' !== \ini_get('session.cache_limiter')) {
-            header(sprintf('Cache-Control: max-age=%d, private, must-revalidate', 60 * (int) \ini_get('session.cache_expire')));
+            header(\sprintf('Cache-Control: max-age=%d, private, must-revalidate', 60 * (int) \ini_get('session.cache_expire')));
         }
 
         return true;
@@ -88,7 +88,7 @@ abstract class AbstractSessionHandler implements \SessionHandlerInterface, \Sess
     {
         if (!headers_sent() && filter_var(\ini_get('session.use_cookies'), \FILTER_VALIDATE_BOOL)) {
             if (!isset($this->sessionName)) {
-                throw new \LogicException(sprintf('Session name cannot be empty, did you forget to call "parent::open()" in "%s"?.', static::class));
+                throw new \LogicException(\sprintf('Session name cannot be empty, did you forget to call "parent::open()" in "%s"?.', static::class));
             }
             $cookie = SessionUtils::popSessionCookie($this->sessionName, $sessionId);
 

vendor/symfony/http-foundation/Session/Storage/Handler/IdentityMarshaller.php

@@ -22,7 +22,7 @@ class IdentityMarshaller implements MarshallerInterface
     {
         foreach ($values as $key => $value) {
             if (!\is_string($value)) {
-                throw new \LogicException(sprintf('%s accepts only string as data.', __METHOD__));
+                throw new \LogicException(\sprintf('%s accepts only string as data.', __METHOD__));
             }
         }
 

vendor/symfony/http-foundation/Session/Storage/Handler/MarshallingSessionHandler.php

@@ -18,13 +18,10 @@ use Symfony\Component\Cache\Marshaller\MarshallerInterface;
  */
 class MarshallingSessionHandler implements \SessionHandlerInterface, \SessionUpdateTimestampHandlerInterface
 {
-    private AbstractSessionHandler $handler;
-    private MarshallerInterface $marshaller;
-
-    public function __construct(AbstractSessionHandler $handler, MarshallerInterface $marshaller)
-    {
-        $this->handler = $handler;
-        $this->marshaller = $marshaller;
+    public function __construct(
+        private AbstractSessionHandler $handler,
+        private MarshallerInterface $marshaller,
+    ) {
     }
 
     public function open(string $savePath, string $name): bool

vendor/symfony/http-foundation/Session/Storage/Handler/MemcachedSessionHandler.php

@@ -21,8 +21,6 @@ namespace Symfony\Component\HttpFoundation\Session\Storage\Handler;
  */
 class MemcachedSessionHandler extends AbstractSessionHandler
 {
-    private \Memcached $memcached;
-
     /**
      * Time to live in seconds.
      */
@@ -42,12 +40,12 @@ class MemcachedSessionHandler extends AbstractSessionHandler
      *
      * @throws \InvalidArgumentException When unsupported options are passed
      */
-    public function __construct(\Memcached $memcached, array $options = [])
-    {
-        $this->memcached = $memcached;
-
+    public function __construct(
+        private \Memcached $memcached,
+        array $options = [],
+    ) {
         if ($diff = array_diff(array_keys($options), ['prefix', 'expiretime', 'ttl'])) {
-            throw new \InvalidArgumentException(sprintf('The following options are not supported "%s".', implode(', ', $diff)));
+            throw new \InvalidArgumentException(\sprintf('The following options are not supported "%s".', implode(', ', $diff)));
         }
 
         $this->ttl = $options['expiretime'] ?? $options['ttl'] ?? null;

vendor/symfony/http-foundation/Session/Storage/Handler/NativeFileSessionHandler.php

@@ -34,7 +34,7 @@ class NativeFileSessionHandler extends \SessionHandler
 
         if ($count = substr_count($savePath, ';')) {
             if ($count > 2) {
-                throw new \InvalidArgumentException(sprintf('Invalid argument $savePath \'%s\'.', $savePath));
+                throw new \InvalidArgumentException(\sprintf('Invalid argument $savePath \'%s\'.', $savePath));
             }
 
             // characters after last ';' are the path
@@ -42,7 +42,7 @@ class NativeFileSessionHandler extends \SessionHandler
         }
 
         if ($baseDir && !is_dir($baseDir) && !@mkdir($baseDir, 0777, true) && !is_dir($baseDir)) {
-            throw new \RuntimeException(sprintf('Session Storage was not able to create directory "%s".', $baseDir));
+            throw new \RuntimeException(\sprintf('Session Storage was not able to create directory "%s".', $baseDir));
         }
 
         if ($savePath !== \ini_get('session.save_path')) {

vendor/symfony/http-foundation/Session/Storage/Handler/PdoSessionHandler.php

@@ -155,7 +155,7 @@ class PdoSessionHandler extends AbstractSessionHandler
     {
         if ($pdoOrDsn instanceof \PDO) {
             if (\PDO::ERRMODE_EXCEPTION !== $pdoOrDsn->getAttribute(\PDO::ATTR_ERRMODE)) {
-                throw new \InvalidArgumentException(sprintf('"%s" requires PDO error mode attribute be set to throw Exceptions (i.e. $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION)).', __CLASS__));
+                throw new \InvalidArgumentException(\sprintf('"%s" requires PDO error mode attribute be set to throw Exceptions (i.e. $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION)).', __CLASS__));
             }
 
             $this->pdo = $pdoOrDsn;
@@ -222,7 +222,7 @@ class PdoSessionHandler extends AbstractSessionHandler
                 $table->addColumn($this->timeCol, Types::INTEGER)->setUnsigned(true)->setNotnull(true);
                 break;
             default:
-                throw new \DomainException(sprintf('Creating the session table is currently not implemented for PDO driver "%s".', $this->driver));
+                throw new \DomainException(\sprintf('Creating the session table is currently not implemented for PDO driver "%s".', $this->driver));
         }
         $table->setPrimaryKey([$this->idCol]);
         $table->addIndex([$this->lifetimeCol], $this->lifetimeCol.'_idx');
@@ -255,7 +255,7 @@ class PdoSessionHandler extends AbstractSessionHandler
             'pgsql' => "CREATE TABLE $this->table ($this->idCol VARCHAR(128) NOT NULL PRIMARY KEY, $this->dataCol BYTEA NOT NULL, $this->lifetimeCol INTEGER NOT NULL, $this->timeCol INTEGER NOT NULL)",
             'oci' => "CREATE TABLE $this->table ($this->idCol VARCHAR2(128) NOT NULL PRIMARY KEY, $this->dataCol BLOB NOT NULL, $this->lifetimeCol INTEGER NOT NULL, $this->timeCol INTEGER NOT NULL)",
             'sqlsrv' => "CREATE TABLE $this->table ($this->idCol VARCHAR(128) NOT NULL PRIMARY KEY, $this->dataCol VARBINARY(MAX) NOT NULL, $this->lifetimeCol INTEGER NOT NULL, $this->timeCol INTEGER NOT NULL)",
-            default => throw new \DomainException(sprintf('Creating the session table is currently not implemented for PDO driver "%s".', $this->driver)),
+            default => throw new \DomainException(\sprintf('Creating the session table is currently not implemented for PDO driver "%s".', $this->driver)),
         };
 
         try {
@@ -536,7 +536,7 @@ class PdoSessionHandler extends AbstractSessionHandler
                 return $dsn;
 
             default:
-                throw new \InvalidArgumentException(sprintf('The scheme "%s" is not supported by the PdoSessionHandler URL configuration. Pass a PDO DSN directly.', $params['scheme']));
+                throw new \InvalidArgumentException(\sprintf('The scheme "%s" is not supported by the PdoSessionHandler URL configuration. Pass a PDO DSN directly.', $params['scheme']));
         }
     }
 
@@ -732,7 +732,7 @@ class PdoSessionHandler extends AbstractSessionHandler
             case 'sqlite':
                 throw new \DomainException('SQLite does not support advisory locks.');
             default:
-                throw new \DomainException(sprintf('Advisory locks are currently not implemented for PDO driver "%s".', $this->driver));
+                throw new \DomainException(\sprintf('Advisory locks are currently not implemented for PDO driver "%s".', $this->driver));
         }
     }
 
@@ -774,7 +774,7 @@ class PdoSessionHandler extends AbstractSessionHandler
                     // we already locked when starting transaction
                     break;
                 default:
-                    throw new \DomainException(sprintf('Transactional locks are currently not implemented for PDO driver "%s".', $this->driver));
+                    throw new \DomainException(\sprintf('Transactional locks are currently not implemented for PDO driver "%s".', $this->driver));
             }
         }
 

vendor/symfony/http-foundation/Session/Storage/Handler/RedisSessionHandler.php

@@ -44,7 +44,7 @@ class RedisSessionHandler extends AbstractSessionHandler
         array $options = [],
     ) {
         if ($diff = array_diff(array_keys($options), ['prefix', 'ttl'])) {
-            throw new \InvalidArgumentException(sprintf('The following options are not supported "%s".', implode(', ', $diff)));
+            throw new \InvalidArgumentException(\sprintf('The following options are not supported "%s".', implode(', ', $diff)));
         }
 
         $this->prefix = $options['prefix'] ?? 'sf_s';

vendor/symfony/http-foundation/Session/Storage/Handler/SessionHandlerFactory.php

@@ -49,7 +49,7 @@ class SessionHandlerFactory
                 return new PdoSessionHandler($connection);
 
             case !\is_string($connection):
-                throw new \InvalidArgumentException(sprintf('Unsupported Connection: "%s".', get_debug_type($connection)));
+                throw new \InvalidArgumentException(\sprintf('Unsupported Connection: "%s".', get_debug_type($connection)));
             case str_starts_with($connection, 'file://'):
                 $savePath = substr($connection, 7);
 
@@ -90,6 +90,6 @@ class SessionHandlerFactory
                 return new PdoSessionHandler($connection, $options);
         }
 
-        throw new \InvalidArgumentException(sprintf('Unsupported Connection: "%s".', $connection));
+        throw new \InvalidArgumentException(\sprintf('Unsupported Connection: "%s".', $connection));
     }
 }

vendor/symfony/http-foundation/Session/Storage/Handler/StrictSessionHandler.php

@@ -18,16 +18,14 @@ namespace Symfony\Component\HttpFoundation\Session\Storage\Handler;
  */
 class StrictSessionHandler extends AbstractSessionHandler
 {
-    private \SessionHandlerInterface $handler;
     private bool $doDestroy;
 
-    public function __construct(\SessionHandlerInterface $handler)
-    {
+    public function __construct(
+        private \SessionHandlerInterface $handler,
+    ) {
         if ($handler instanceof \SessionUpdateTimestampHandlerInterface) {
-            throw new \LogicException(sprintf('"%s" is already an instance of "SessionUpdateTimestampHandlerInterface", you cannot wrap it with "%s".', get_debug_type($handler), self::class));
+            throw new \LogicException(\sprintf('"%s" is already an instance of "SessionUpdateTimestampHandlerInterface", you cannot wrap it with "%s".', get_debug_type($handler), self::class));
         }
-
-        $this->handler = $handler;
     }
 
     /**

vendor/symfony/http-foundation/Session/Storage/MetadataBag.php

@@ -29,18 +29,16 @@ class MetadataBag implements SessionBagInterface
     protected array $meta = [self::CREATED => 0, self::UPDATED => 0, self::LIFETIME => 0];
 
     private string $name = '__metadata';
-    private string $storageKey;
     private int $lastUsed;
-    private int $updateThreshold;
 
     /**
      * @param string $storageKey      The key used to store bag in the session
      * @param int    $updateThreshold The time to wait between two UPDATED updates
      */
-    public function __construct(string $storageKey = '_sf2_meta', int $updateThreshold = 0)
-    {
-        $this->storageKey = $storageKey;
-        $this->updateThreshold = $updateThreshold;
+    public function __construct(
+        private string $storageKey = '_sf2_meta',
+        private int $updateThreshold = 0,
+    ) {
     }
 
     public function initialize(array &$array): void

vendor/symfony/http-foundation/Session/Storage/MockArraySessionStorage.php

@@ -28,7 +28,6 @@ use Symfony\Component\HttpFoundation\Session\SessionBagInterface;
 class MockArraySessionStorage implements SessionStorageInterface
 {
     protected string $id = '';
-    protected string $name;
     protected bool $started = false;
     protected bool $closed = false;
     protected array $data = [];
@@ -39,9 +38,10 @@ class MockArraySessionStorage implements SessionStorageInterface
      */
     protected array $bags = [];
 
-    public function __construct(string $name = 'MOCKSESSID', ?MetadataBag $metaBag = null)
-    {
-        $this->name = $name;
+    public function __construct(
+        protected string $name = 'MOCKSESSID',
+        ?MetadataBag $metaBag = null,
+    ) {
         $this->setMetadataBag($metaBag);
     }
 
@@ -133,7 +133,7 @@ class MockArraySessionStorage implements SessionStorageInterface
     public function getBag(string $name): SessionBagInterface
     {
         if (!isset($this->bags[$name])) {
-            throw new \InvalidArgumentException(sprintf('The SessionBagInterface "%s" is not registered.', $name));
+            throw new \InvalidArgumentException(\sprintf('The SessionBagInterface "%s" is not registered.', $name));
         }
 
         if (!$this->started) {

vendor/symfony/http-foundation/Session/Storage/MockFileSessionStorage.php

@@ -35,7 +35,7 @@ class MockFileSessionStorage extends MockArraySessionStorage
         $savePath ??= sys_get_temp_dir();
 
         if (!is_dir($savePath) && !@mkdir($savePath, 0777, true) && !is_dir($savePath)) {
-            throw new \RuntimeException(sprintf('Session Storage was not able to create directory "%s".', $savePath));
+            throw new \RuntimeException(\sprintf('Session Storage was not able to create directory "%s".', $savePath));
         }
 
         $this->savePath = $savePath;

vendor/symfony/http-foundation/Session/Storage/MockFileSessionStorageFactory.php

@@ -21,18 +21,14 @@ class_exists(MockFileSessionStorage::class);
  */
 class MockFileSessionStorageFactory implements SessionStorageFactoryInterface
 {
-    private ?string $savePath;
-    private string $name;
-    private ?MetadataBag $metaBag;
-
     /**
      * @see MockFileSessionStorage constructor.
      */
-    public function __construct(?string $savePath = null, string $name = 'MOCKSESSID', ?MetadataBag $metaBag = null)
-    {
-        $this->savePath = $savePath;
-        $this->name = $name;
-        $this->metaBag = $metaBag;
+    public function __construct(
+        private ?string $savePath = null,
+        private string $name = 'MOCKSESSID',
+        private ?MetadataBag $metaBag = null,
+    ) {
     }
 
     public function createStorage(?Request $request): SessionStorageInterface

vendor/symfony/http-foundation/Session/Storage/NativeSessionStorage.php

@@ -62,16 +62,16 @@ class NativeSessionStorage implements SessionStorageInterface
      * gc_probability, "1"
      * lazy_write, "1"
      * name, "PHPSESSID"
-     * referer_check, ""
+     * referer_check, "" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
      * serialize_handler, "php"
      * use_strict_mode, "1"
      * use_cookies, "1"
-     * use_only_cookies, "1"
-     * use_trans_sid, "0"
-     * sid_length, "32"
-     * sid_bits_per_character, "5"
-     * trans_sid_hosts, $_SERVER['HTTP_HOST']
-     * trans_sid_tags, "a=href,area=href,frame=src,form="
+     * use_only_cookies, "1" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
+     * use_trans_sid, "0" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
+     * sid_length, "32" (@deprecated since Symfony 7.2, to be removed in 8.0)
+     * sid_bits_per_character, "5" (@deprecated since Symfony 7.2, to be removed in 8.0)
+     * trans_sid_hosts, $_SERVER['HTTP_HOST'] (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
+     * trans_sid_tags, "a=href,area=href,frame=src,form=" (deprecated since Symfony 7.2, to be removed in Symfony 8.0)
      */
     public function __construct(array $options = [], AbstractProxy|\SessionHandlerInterface|null $handler = null, ?MetadataBag $metaBag = null)
     {
@@ -113,7 +113,7 @@ class NativeSessionStorage implements SessionStorageInterface
         }
 
         if (filter_var(\ini_get('session.use_cookies'), \FILTER_VALIDATE_BOOL) && headers_sent($file, $line)) {
-            throw new \RuntimeException(sprintf('Failed to start the session because headers have already been sent by "%s" at line %d.', $file, $line));
+            throw new \RuntimeException(\sprintf('Failed to start the session because headers have already been sent by "%s" at line %d.', $file, $line));
         }
 
         $sessionId = $_COOKIE[session_name()] ?? null;
@@ -126,8 +126,8 @@ class NativeSessionStorage implements SessionStorageInterface
          * See https://www.php.net/manual/en/session.configuration.php#ini.session.sid-bits-per-character.
          * Allowed values are integers such as:
          * - 4 for range `a-f0-9`
-         * - 5 for range `a-v0-9`
-         * - 6 for range `a-zA-Z0-9,-`
+         * - 5 for range `a-v0-9` (@deprecated since Symfony 7.2, it will default to 4 and the option will be ignored in Symfony 8.0)
+         * - 6 for range `a-zA-Z0-9,-` (@deprecated since Symfony 7.2, it will default to 4 and the option will be ignored in Symfony 8.0)
          *
          * ---------- Part 2
          *
@@ -139,6 +139,8 @@ class NativeSessionStorage implements SessionStorageInterface
          * - The length of Windows and Linux filenames is limited to 255 bytes. Then the max must not exceed 255.
          * - The session filename prefix is `sess_`, a 5 bytes string. Then the max must not exceed 255 - 5 = 250.
          *
+         * This is @deprecated since Symfony 7.2, the sid length will default to 32 and the option will be ignored in Symfony 8.0.
+         *
          * ---------- Conclusion
          *
          * The parts 1 and 2 prevent the warning below:
@@ -224,7 +226,7 @@ class NativeSessionStorage implements SessionStorageInterface
         $previousHandler = set_error_handler(function ($type, $msg, $file, $line) use (&$previousHandler) {
             if (\E_WARNING === $type && str_starts_with($msg, 'session_write_close():')) {
                 $handler = $this->saveHandler instanceof SessionHandlerProxy ? $this->saveHandler->getHandler() : $this->saveHandler;
-                $msg = sprintf('session_write_close(): Failed to write session data with "%s" handler', $handler::class);
+                $msg = \sprintf('session_write_close(): Failed to write session data with "%s" handler', $handler::class);
             }
 
             return $previousHandler ? $previousHandler($type, $msg, $file, $line) : false;
@@ -271,7 +273,7 @@ class NativeSessionStorage implements SessionStorageInterface
     public function getBag(string $name): SessionBagInterface
     {
         if (!isset($this->bags[$name])) {
-            throw new \InvalidArgumentException(sprintf('The SessionBagInterface "%s" is not registered.', $name));
+            throw new \InvalidArgumentException(\sprintf('The SessionBagInterface "%s" is not registered.', $name));
         }
 
         if (!$this->started && $this->saveHandler->isActive()) {
@@ -328,6 +330,10 @@ class NativeSessionStorage implements SessionStorageInterface
         ]);
 
         foreach ($options as $key => $value) {
+            if (\in_array($key, ['referer_check', 'use_only_cookies', 'use_trans_sid', 'trans_sid_hosts', 'trans_sid_tags', 'sid_length', 'sid_bits_per_character'], true)) {
+                trigger_deprecation('symfony/http-foundation', '7.2', 'NativeSessionStorage\'s "%s" option is deprecated and will be ignored in Symfony 8.0.', $key);
+            }
+
             if (isset($validOptions[$key])) {
                 if ('cookie_secure' === $key && 'auto' === $value) {
                     continue;

vendor/symfony/http-foundation/Session/Storage/NativeSessionStorageFactory.php

@@ -22,20 +22,15 @@ class_exists(NativeSessionStorage::class);
  */
 class NativeSessionStorageFactory implements SessionStorageFactoryInterface
 {
-    private array $options;
-    private AbstractProxy|\SessionHandlerInterface|null $handler;
-    private ?MetadataBag $metaBag;
-    private bool $secure;
-
     /**
      * @see NativeSessionStorage constructor.
      */
-    public function __construct(array $options = [], AbstractProxy|\SessionHandlerInterface|null $handler = null, ?MetadataBag $metaBag = null, bool $secure = false)
-    {
-        $this->options = $options;
-        $this->handler = $handler;
-        $this->metaBag = $metaBag;
-        $this->secure = $secure;
+    public function __construct(
+        private array $options = [],
+        private AbstractProxy|\SessionHandlerInterface|null $handler = null,
+        private ?MetadataBag $metaBag = null,
+        private bool $secure = false,
+    ) {
     }
 
     public function createStorage(?Request $request): SessionStorageInterface

vendor/symfony/http-foundation/Session/Storage/PhpBridgeSessionStorageFactory.php

@@ -22,15 +22,11 @@ class_exists(PhpBridgeSessionStorage::class);
  */
 class PhpBridgeSessionStorageFactory implements SessionStorageFactoryInterface
 {
-    private AbstractProxy|\SessionHandlerInterface|null $handler;
-    private ?MetadataBag $metaBag;
-    private bool $secure;
-
-    public function __construct(AbstractProxy|\SessionHandlerInterface|null $handler = null, ?MetadataBag $metaBag = null, bool $secure = false)
-    {
-        $this->handler = $handler;
-        $this->metaBag = $metaBag;
-        $this->secure = $secure;
+    public function __construct(
+        private AbstractProxy|\SessionHandlerInterface|null $handler = null,
+        private ?MetadataBag $metaBag = null,
+        private bool $secure = false,
+    ) {
     }
 
     public function createStorage(?Request $request): SessionStorageInterface

vendor/symfony/http-foundation/Session/Storage/Proxy/SessionHandlerProxy.php

@@ -18,11 +18,9 @@ use Symfony\Component\HttpFoundation\Session\Storage\Handler\StrictSessionHandle
  */
 class SessionHandlerProxy extends AbstractProxy implements \SessionHandlerInterface, \SessionUpdateTimestampHandlerInterface
 {
-    protected \SessionHandlerInterface $handler;
-
-    public function __construct(\SessionHandlerInterface $handler)
-    {
-        $this->handler = $handler;
+    public function __construct(
+        protected \SessionHandlerInterface $handler,
+    ) {
         $this->wrapper = $handler instanceof \SessionHandler;
         $this->saveHandlerName = $this->wrapper || ($handler instanceof StrictSessionHandler && $handler->isWrapper()) ? \ini_get('session.save_handler') : 'user';
     }