Support more recent version(s) of Symfony

[GuySartorelli]

We currently use "^3.4 || ^4.0" for our Symfony constraints according to the Symfony releases calendar But anything < 4.4 is end of life, and 4.4 will be in security fixes only from just before 2023.

We have an RFC (#10220) to adopt an official Symfony support policy. Once we have decided on a policy, we should update our constraints to avoid potential vulnerabilities being included in projects as a result of these constraints.
Currently 5.4 is the LTS release, though 6.0 is also available.

Related issues

• RFC: Adopt an official Symfony support policy #10220
• Swiftmailer is end-of-life. Need to upgrade to Symfony Mailer #10097
• Migrate deprecated symfony AbstractCache to AbstractAdapter #9958
• RFC: Use Symfony Console Component for Tasks and better cli support #5542

Modules and packages with outdated Symfony constraints

The lists below are based on a fresh 4.x install of recipe-kitchen-sink. I have included any packages that have mainline Symfony dependencies that don't include 6 in the constraint. Depending on the RFP actions may not be necessary for any that include 5.x in their constraint.

Core and supported modules

• silverstripe/assets
  • symfony/filesystem: ^3.4|^4.0|^5.0
• silverstripe/behat-extension
  • symfony/dom-crawler: ^3 || ^4
  • symfony/dom-finder: ^3.2 || ^4
• silverstripe/config
  • symfony/finder: ^3.4 || ^4.0
  • symfony/yaml: ^3.4 || ^4.0
• silverstripe/framework
  • symfony/cache: ^3.4 || ^4.0
  • symfony/config: ^3.4 || ^4.0
  • symfony/translation: ^3.4 || ^4.0
  • symfony/yaml: ^3.4 || ^4.0
• silverstripe/fulltextsearch
  • symfony/process: ^3.4 || ^4
• silverstripe/versioned
  = symfony/cache: ^3.4 || ^4
• symbiote/silverstripe-advancedworkflow
  • symfony/yaml: ^3 || ^4

Kitchen Sink Dependencies

• behat/mink-extension (dependency of silverstripe/behat-extension)
  • symfony/config: ^2.7|^3.0|^4.0
• silverstripe/event-dispatcher (dependency of silverstripe/graphql 4.x)
  • symfony/event-dispatcher: ^4.4 || ^5
• silverstripe/serve (dependency of silverstripe/recipe-testing which in turn is a dev-dependency of silverstripe/recipe-kitchen-sink)
  • symfony/process: ^3.0 || ^4.0
• ua-parser/uap-php (dependency of silverstripe/session-manager which isn't in the supported list but is required by silverstripe/recipe-cms)
  • symfony/yaml: ^3.4 || ^4.2 || ^4.3 || ^5.0
  • symfony/filesystem: ^3.4 || ^4.2 || ^4.3 || ^5.0
  • symfony/finder: ^3.4 || ^4.2 || ^4.3 || ^5.0
  • symfony/console: ^3.4 || ^4.2 || ^4.3 || ^5.0
• web-auth/webauthn-lib 3.x, though 4.x constrains symfony packages to ^6.0 (dependency of silverstripe/webauthn-authenticator)
  • symfony/process: ^3.0|^4.0|^5.0

[GuySartorelli]

This is superceded by our major release policy - this work was already done for CMS 5