Debian Symfony Security Update: APT and Composer

Debian's Symfony advisory DSA-6617-1 lists 6.4.50+dfsg-0+deb13u1 as the fixed source package for Debian 13 (Trixie). A Symfony application can also install its own components through Composer. Start by identifying the copy the application actually loads. Debian security tracker

Inspect Debian packages and project dependencies

dpkg-query -W 'php-symfony-*'
apt-cache policy php-symfony-http-foundation

The package name in the APT query is an example. Check the actual installed component names and their origin. For an application using Composer, run the following from the project directory to inspect its lock file.

composer show --locked 'symfony/*'
composer audit --locked

The composer.lock file records the dependency versions intended for deployment. The --locked option audits that list. To establish which copy runs in production, inspect the Composer autoloader and installed packages in the deployed application. A running image can still contain older dependencies after a local lock file changes. Composer audit documentation

Update through the component's packaging channel

For a Debian-managed installation, obtain the fixed package revision through APT. For Composer-managed projects, review the affected components and constraints, test a targeted update, and deploy the new lock file with the application. Read Debian package revisions and Composer versions against the advisories for their respective channels.

After deployment, exercise normal sign-in, authorization and the application's main pages. Record the component versions in the running deployment alongside the new dependency audit.