chore(deps): bump the composer group with 3 updates

[dependabot]

Bumps the composer group with 3 updates: symfony/mcp-bundle, phpunit/phpunit and rector/rector.

Updates symfony/mcp-bundle from 0.11.0 to 0.12.0

Release notes

Sourced from symfony/mcp-bundle's releases.

v0.12.0

Changelog (symfony/mcp-bundle@v0.11.0...v0.12.0)

• feature #2352 Show MCP capabilities in profiler on every request (@​chr-hertel)
• feature #2350 Add debug:mcp command listing registered capabilities (@​chr-hertel)
• feature #2349 Replace file-based discovery with compile-time container registration (@​chr-hertel)

Changelog

Sourced from symfony/mcp-bundle's changelog.

CHANGELOG

0.12

• Register tools, prompts, resources, and resource templates via container instead of the SDK's file-based discovery
• Add debug:mcp command listing the registered MCP capabilities with their handlers
• Show MCP capabilities (including their handlers) in the profiler panel on every request, not only on requests serving MCP

0.11

• Add http.allowed_hosts configuration to allow custom hosts or disable the DNS rebinding protection when exposing a public MCP server
• Add MCP Apps support via the #[AsMcpApp]/#[AsMcpAppTool] attributes: interactive HTML UI resources whose tools return a context array the bundle renders server-side with Twig (HTML-over-the-wire); configurable via mcp.apps.enabled

0.8

• Add framework session store backed by Symfony's SessionHandlerInterface

0.4

• Add ResetInterface support to TraceableRegistry to clear collected data between requests

0.3

• Add support for server description, icons, and website URL

0.1

• Add the bundle

Commits

• 7ffd7bf [MCP Bundle] Show MCP capabilities in profiler on every request
• e641da6 [MCP Bundle] Add debug:mcp command listing registered capabilities
• c57bdad [MCP Bundle] Replace file-based discovery with compile-time container registr...
• See full diff in compare view

Updates phpunit/phpunit from 13.3.0 to 13.3.1

Release notes

Sourced from phpunit/phpunit's releases.

PHPUnit 13.3.1

Changed

• Invoking a static hook method such as setUpBeforeClass() no longer triggers a deprecation warning on PHP 8.6

---

Learn how to install or update PHPUnit 13.3 in the documentation.

Keep up to date with PHPUnit:

• You can follow @​phpunit@phpc.social to stay up to date with PHPUnit's development.
• You can subscribe to the PHPUnit Updates newsletter to receive updates about and tips for PHPUnit.

Changelog

Sourced from phpunit/phpunit's changelog.

[13.3.1] - 2026-08-13

Changed

• Invoking a static hook method such as setUpBeforeClass() no longer triggers a deprecation warning on PHP 8.6

Commits

• fc02493 Prepare release
• e29a704 Update dependencies
• 04157ce Do not pass object to ReflectionMethod::invoke() for static hook methods (whi...
• 7efd432 Revert "Do not report deprecations triggered by myclabs/deep-copy"
• a2048e9 Merge branch '12.5' into 13.3
• 83be0fc Merge branch '11.5' into 12.5
• 9375d10 Merge branch '10.5' into 11.5
• bbd3c83 Update dependencies
• dbc02ef Make closure comparison test independent of PHP 8.6 closure reuse
• 5d20f13 Do not report deprecations triggered by myclabs/deep-copy
• Additional commits viewable in compare view

Updates rector/rector from 2.6.1 to 2.6.2

Release notes

Sourced from rector/rector's releases.

Released Rector 2.6.2

The 2.6.0 release introduced composer-based sets. This release finishes the job: every extension package now ships a single composer-based set, and the per-version set providers behind the old guessing game are gone.

use Rector\Config\RectorConfig;
return RectorConfig::configure()
->withComposerBased(
doctrine: true,
phpunit: true,
twig: true,
);

Each rule inside checks composer.json/installed.json on its own and runs only if the installed package version matches its constraint. No SymfonySetList::SYMFONY_63, no picking a PHPUnit version by hand. We're working hard to bring Drupal and Laravel community packages to the same system.

Run only the PHP rules (#8322)

A new --php option on the process command runs only rules bound to a minimal PHP version — those implementing MinPhpVersionInterface. Useful to split a PHP upgrade from the rest, without a second config:

vendor/bin/rector process src --php --dry-run

New features 🥳

• [Process] Add --php option to run only PHP version rules (#8322)
• [Configuration] Resolve the composer-based set of extension packages in withComposerBased() (#8332), load Doctrine and Twig composer-based sets (#8313)
• [Configuration] Report explicit error when the --only rule exists but is not registered in rector.php (#8300)
• [DX] Warn on skipped classes that are not Rector rules (#8323), include the skipped class name in the message (#8325)
• [DX] Show previous exceptions during bootstrap (#8287)

 [WARNING] This skipped class is not a Rector rule, so it can never be skipped.
           Only classes that implement "Rector\Contract\Rector\RectorInterface"
           can be used in "->withSkip()"

New rules 🎉

rector-src

• [DeadCode] RemoveRedundantTypeCheckRector (#8307)

... (truncated)

Commits

• 03cd615 Rector 2.6.2
• 112412c Updated Rector to commit d39693f97e95e5dfb160f6d3529b740ac1c24b38
• db9eb19 Updated Rector to commit 29928dd034534323ebf603bd1602b4f20ecd3ac6
• 722336e Updated Rector to commit 09ee9549d7e20c168004ec0111ba165f91350541
• 3654819 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f42c503 Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• f7bbc4f Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 08865fb Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• b00041d Updated Rector to commit ede5061101ddf7cc6c6d22aba492ecbfa2d7e4cf
• 032c857 Updated Rector to commit 768539a46a08410a7e25a643fe3777ab9c17b116
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud