chore(deps): bump the php-deps group across 1 directory with 4 updates

[dependabot]

Bumps the php-deps group with 4 updates in the /legacy directory: symfony/filesystem, symfony/process, phpunit/phpunit and rector/rector.

Updates symfony/filesystem from 7.4.18 to 7.4.21

Release notes

Sourced from symfony/filesystem's releases.

v7.4.21

Changelog (symfony/filesystem@v7.4.18...v7.4.21)

• bug #66663 Fix touch() with zero timestamp (@​ephpicman)

Commits

• fd0e346 Merge branch '6.4' into 7.4
• e3ff48b [Filesystem] Fix touch() with zero timestamp
• See full diff in compare view

Updates symfony/process from 7.4.19 to 7.4.21

Release notes

Sourced from symfony/process's releases.

v7.4.21

Changelog (symfony/process@v7.4.19...v7.4.21)

• bug #66696 Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed env vars (@​KalimeroMK)
• bug #66620 Fix waitUntil() missing output read by its own status updates (@​KalimeroMK)

Commits

• e5247f4 Merge branch '6.4' into 7.4
• 2a0cb83 [Process] Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed ...
• 7a2ee8f Merge branch '6.4' into 7.4
• 96b3de8 [Process] Fix flaky testWaitUntilCallbackIsNotCalledAnymoreAfterItThrew
• 70beda1 Merge branch '6.4' into 7.4
• ab9f596 [Process] Fix flaky testIteratorOutput on Windows
• 18b7af8 Merge branch '6.4' into 7.4
• 004a18f [Process] Fix waitUntil() missing output read by its own status updates
• 016e321 Merge branch '6.4' into 7.4
• 20597aa [Process] Fix flaky tests on slow Windows runners
• Additional commits viewable in compare view

Updates phpunit/phpunit from 11.5.56 to 11.5.57

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 11.5.57

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

---

Learn how to install or update PHPUnit 11.5 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[11.5.57] - 2026-10-05

Changed

• The Software Bill of Materials (SBOM) embedded in the PHAR now uses CycloneDX 1.7 and provides the NTIA minimum elements as well as the data fields that BSI TR-03183-2 (version 2.1.0) requires for logical and identified components, including component creators, original, distribution and effective licences, source code URIs, and the PHP runtime and its extensions as external components

Commits

• 36b75bf Prepare release
• 43b38ce Merge branch '10.5' into 11.5
• 747c988 Prepare release
• a7d6e8b Merge branch '9.6' into 10.5
• 8b5f757 Prepare release
• d2e3381 Merge branch '8.5' into 9.6
• 951b085 Prepare release
• e38ba4c Merge branch '10.5' into 11.5
• 9063826 Fix CS/WS issues
• 5cd65bb Merge branch '10.5' into 11.5
• Additional commits viewable in compare view

Updates rector/rector from 2.6.7 to 2.7.0

Release notes

Sourced from rector/rector's releases.

Released Rector 2.7

New Rules ✨

• Add TernaryToNullsafeCoalesceRector (#8499)
• Add BoolReturnTypeFromBooleanConstAndStrictReturnsRector for mixed const + strict bool returns (#8498)
• Add ConstructorReadonlyAssignToDefaultRector for readonly property defaults (#8502)
• Add RemoveOverriddenAssignBeforeIfElseRector (#8505)

Performance Improvements 🚀

• Cache class-like name resolution per file version in ShortNameResolver, so name import no longer rescans the whole file for every name - up to ~24 % fewer CPU instructions on large projects (#8524)
• Cache dry-run files whose FileDiff has no content change (#8523)
• Key the file cache on project-relative paths, so a cache survives a change of checkout (#8490)
• Use FileSystem::writeAtomic() in FileCacheStorage to avoid partial cache reads on parallel runs (#8520)
• Terminate timed-out and unconnected workers (#8522)
• Fix silently skipped files when the only worker is respawned (#8521)
• Give the worker the same NDJSON frame limit as the main process (#8489)
• Bump to PHPStan 2.3

Bugfixes 🐛

• RenamePropertyRector: rename the property both in the trait and in the class property itself (#8518)
• RenameClassRector: throw on same old and new class in the configuration (#8515)
• ScalarParamTypeByMethodCallTypeRector: skip string param inference to avoid unsafe scalar coercion (#8514)
• RepeatedAndNotEqualToNotInArrayRector / RepeatedOrEqualToInArrayRector: skip short-circuit dependent values (#8516)
• SeparateMultiUseImportsRector: keep trait use adaptations (#8510)
• Privatize*Rector: drop the final flag when changing protected to private, since private final is forbidden on PHP 8.4 (#8509)
• AddNameToBooleanArgumentRector / AddNameToNullArgumentRector: skip callees marked @no-named-arguments (#8508)
• TypedPropertyFromStrictConstructorRector: skip a protected property redeclared in a child class (#8503)
• RemoveAlwaysTrueIfConditionRector: skip a maybe-undefined variable (#8501)
• SingularSwitchToIfRector: skip nested break/continue in the case body (#8500)
• TypeDeclaration: skip redundant intersection types in union return types (#8527)
• Naming: keep mass nouns ending in data/info untouched when singularizing (#8492)

rector-doctrine 🟠

• Add DoctrineQueryBuilderSortDirectionRector (#524)
• Add DoctrineOrderByAttributeSortDirectionRector (#525)
• Register the SortDirection rules in the composer-based set and cover Expr\OrderBy::add() (#530)
• CorrectDefaultTypesOnEntityPropertyRector: support properties initialized as int (#526)

rector-symfony 🎵

... (truncated)

Commits

• 4d6a39b Rector 2.7.0
• a2c8963 Updated Rector to commit 33926fa99a7ee6c86f4d7dcb16101bf5304c8edf
• 47fb3a7 Updated Rector to commit b4d80f41ff90e2ab3cb511d466097ceae767053a
• ec544a4 Updated Rector to commit b4d80f41ff90e2ab3cb511d466097ceae767053a
• e2a1ac1 Updated Rector to commit 09b71bd39460a5daaf9b754b4ebcaecfc0fce3d4
• 0f75a58 Updated Rector to commit c5254e7c8c9b14e750c3e726f2c89322d9ad3870
• 89c175c Updated Rector to commit c5254e7c8c9b14e750c3e726f2c89322d9ad3870
• a9294b1 Updated Rector to commit b540db79a8c1f21609c4c51f9fc544cf4f7d6ce7
• 0bc2f0a Updated Rector to commit 9024bc53bf85850634116675a82266b604e06850
• 479e93d Updated Rector to commit 5b56397612aa1bb35636468fa3133d306e6277c5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions