[Security] Bump symfony/symfony from 3.4.33 to 3.4.35

[dependabot-preview]

Bumps symfony/symfony from 3.4.33 to 3.4.35. This update includes security fixes.

Vulnerabilities fixed

Sourced from The PHP Security Advisories Database.

CVE-2019-18889: Forbid serializing AbstractAdapter and TagAwareAdapter instances

Affected versions: >=3.1.0, <3.2.0; >=3.2.0, <3.3.0; >=3.3.0, <3.4.0; >=3.4.0, <3.4.35; >=4.0.0, <4.1.0; >=4.1.0, <4.2.0; >=4.2.0, <4.2.12; >=4.3.0, <4.3.8

Sourced from The PHP Security Advisories Database.

CVE-2019-18887: Use constant time comparison in UriSigner

Affected versions: >=2.2.0, <2.3.0; >=2.3.0, <2.4.0; >=2.4.0, <2.5.0; >=2.5.0, <2.6.0; >=2.6.0, <2.7.0; >=2.7.0, <2.8.0; >=2.8.0, <2.8.52; >=3.0.0, <3.1.0; >=3.1.0, <3.2.0; >=3.2.0, <3.3.0; >=3.3.0, <3.4.0; >=3.4.0, <3.4.35; >=4.0.0, <4.1.0; >=4.1.0, <4.2.0; >=4.2.0, <4.2.12; >=4.3.0, <4.3.8

Sourced from The PHP Security Advisories Database.

CVE-2019-18888: Prevent argument injection in a MimeTypeGuesser

Affected versions: >=2.0.0, <2.1.0; >=2.1.0, <2.2.0; >=2.2.0, <2.3.0; >=2.3.0, <2.4.0; >=2.4.0, <2.5.0; >=2.5.0, <2.6.0; >=2.6.0, <2.7.0; >=2.7.0, <2.8.0; >=2.8.0, <2.8.52; >=3.0.0, <3.1.0; >=3.1.0, <3.2.0; >=3.2.0, <3.3.0; >=3.3.0, <3.4.0; >=3.4.0, <3.4.35; >=4.0.0, <4.1.0; >=4.1.0, <4.2.0; >=4.2.0, <4.2.12; >=4.3.0, <4.3.8

Release notes

Sourced from symfony/symfony's releases.

v3.4.35

Changelog (since symfony/symfony@v3.4.34...v3.4.35)

• bug #34344 [Console] Constant STDOUT might be undefined (@​nicolas-grekas)
• security #cve-2019-18889 [Cache] forbid serializing AbstractAdapter and TagAwareAdapter instances (@​nicolas-grekas)
• security #cve-2019-18888 [HttpFoundation] fix guessing mime-types of files with leading dash (@​nicolas-grekas)
• security #cve-2019-18887 [HttpKernel] Use constant time comparison in UriSigner (@​stof)

[PR] symfony/symfony#34350
[SECURITY] Security release

v3.4.34

Changelog (since symfony/symfony@v3.4.33...v3.4.34)

• bug #34297 [DI] fix locators with numeric keys (@​nicolas-grekas)
• bug #34282 [DI] Dont cache classes with missing parents (@​nicolas-grekas)
• bug #34181 [Stopwatch] Fixed bug in getDuration when counting multiple ongoing periods (@​TimoBakx)
• bug #34179 [Stopwatch] Fixed a bug in StopwatchEvent::getStartTime (@​TimoBakx)
• bug #34203 [FrameworkBundle] [HttpKernel] fixed correct EOL and EOM month (@​erics86)

[PR] symfony/symfony#34322

Changelog

Sourced from symfony/symfony's changelog.

• 3.4.35 (2019-11-13)

• bug #34344 [Console] Constant STDOUT might be undefined (nicolas-grekas)

• security #cve-2019-18889 [Cache] forbid serializing AbstractAdapter and TagAwareAdapter instances (nicolas-grekas)

• security #cve-2019-18888 [HttpFoundation] fix guessing mime-types of files with leading dash (nicolas-grekas)

• security #cve-2019-18887 [HttpKernel] Use constant time comparison in UriSigner (stof)

• 3.4.34 (2019-11-11)

• bug #34297 [DI] fix locators with numeric keys (nicolas-grekas)

• bug #34282 [DI] Dont cache classes with missing parents (nicolas-grekas)

• bug #34181 [Stopwatch] Fixed bug in getDuration when counting multiple ongoing periods (TimoBakx)

• bug #34179 [Stopwatch] Fixed a bug in StopwatchEvent::getStartTime (TimoBakx)

• bug #34203 [FrameworkBundle] [HttpKernel] fixed correct EOL and EOM month (erics86)

Commits

• 2adc85d Merge pull request #34350 from fabpot/release-3.4.35
• 02257c8 updated VERSION for 3.4.35
• 3e25850 updated CHANGELOG for 3.4.35
• 32bde39 bug #34344 [Console] Constant STDOUT might be undefined (nicolas-grekas)
• 53dc781 minor #34340 Allow returning null from NormalizerInterface::normalize (teohha...
• bb8c82c [Console] Constant STDOUT might be undefined.
• 1c8edc5 Allow returning null from NormalizerInterface::normalize
• 4cc37df security #cve-2019-18889 [Cache] forbid serializing AbstractAdapter and TagAw...
• b21025b security #cve-2019-18888 [HttpFoundation] fix guessing mime-types of files wi...
• 0102134 security #cve-2019-18887 [HttpKernel] Use constant time comparison in UriSign...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)