Gitlab CI broken because of upstream Symfony security releases that are only available in the `drupal/core-recommended`'s development branch, not in tags
Many jobs are currently broken because composer can't install drupal/core-recommended because it's fixed to 11.2.11 one example: https://git.drupalcode.org/project/canvas/-/jobs/9982049 ``` ./composer.json has been updated Running composer update drupal/core-dev drupal/canvas --with-all-dependencies Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - drupal/core-recommended is locked to version 11.2.12 and an update of this package was not requested. - drupal/core-recommended 11.2.12 requires symfony/polyfill-intl-idn ~v1.37.0 -> found symfony/polyfill-intl-idn[v1.37.0] but these were not loaded, because they are affected by security advisories ("PKSA-dwsq-ppd2-mb1x"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Problem 2 - Root composer.json requires drupal/canvas @dev -> satisfiable by drupal/canvas[dev-main]. - drupal/canvas dev-main requires drupal/core ^11.2 -> satisfiable by drupal/core[11.2.12, ..., 11.x-dev]. - drupal/core 11.2.12 requires symfony/mime ^7.4.12 -> satisfiable by symfony/mime[v7.4.12, v7.4.13, 7.4.x-dev]. - symfony/mime[v7.4.12, ..., 7.4.x-dev] require symfony/polyfill-intl-idn ^1.10 -> found symfony/polyfill-intl-idn[v1.10.0, ..., 1.x-dev] but these were not loaded, because they are affected by security advisories ("PKSA-dwsq-ppd2-mb1x"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. You can also try re-running composer require with an explicit version constraint, e.g. "composer require drupal/core-dev:*" to figure out if any version is installable, or "composer require drupal/core-dev:^2.1" if you know which you need. Installation failed, reverting ./composer.json and ./composer.lock to their original content. ```
issue