EE-282: Support Symfony 7.4

[vinayak-iyer-paysera]

Summary

This lets the bundle install and work on Symfony 7.4. It also removes the deprecation notices Symfony 5.4 and later report for the bundle's classes, and the one Symfony 7.4 reports for its XML service files. The workflow step that gets the Symfony 3 and 4 jobs installing again came in separately through #11, which is merged. I propose releasing it as 1.4.0. It needed paysera/lib-dependency-injection 1.5.0 (paysera/lib-dependency-injection#8), because this bundle requires that library and its earlier versions stop at Symfony 6. 1.5.0 is now released, so I have taken this out of draft.

Why

• symfony/framework-bundle stops at 6.x, so no Symfony 7 application can install the bundle.
• On Symfony 7 the container build is a fatal error. ConfigurationInterface declares getConfigTreeBuilder(): TreeBuilder, and Configuration overrides it untyped.
• The code uses symfony/config, symfony/dependency-injection and symfony/http-kernel without requiring them. symfony/framework-bundle 7.4 accepts their 8.x versions, so on PHP 8.4 Composer takes http-kernel 8.0.
• With Symfony's debug class loader on (dev environment, phpunit-bridge), Symfony 5.4 and later report notices against the bundle's classes: load() and getConfigTreeBuilder() "might add a native return type", and the parent HttpKernel\DependencyInjection\Extension is internal since 7.1.
• Symfony 7.4 deprecates XML service configuration: loading the bundle's two XML files reports "XML configuration format is deprecated" in every container build of every application that uses the bundle.

Changes

• composer.json:
  • symfony/framework-bundle gains ^7.4 and moves to require-dev: nothing in src/ uses it, only the test application.
  • symfony/config, symfony/dependency-injection and symfony/http-kernel, which the code uses, are required at the same versions.
  • paysera/lib-normalization starts at 1.3.1. In earlier releases DateTimeNormalizer fails on PHP 8.2 and later, where date_get_last_errors() returns false.
  • Dev symfony/yaml gains ^6.0|^7.4. Dev phpunit/phpunit 9 starts at 9.6.33: 9.6.21 is the first to handle PHP 8.4's E_STRICT deprecation, and 9.6.33 the first outside CVE-2026-24765.
  • PHP stays ^7.0 || ^8.0.
• Configuration::getConfigTreeBuilder(): TreeBuilder. A class return type parses on PHP 7.0.
• The extension extends DependencyInjection\Extension\Extension, the parent of the HttpKernel class. load() gets a @return void docblock, as 1.3.1 did for build().
• The services are defined in the extension instead of Resources/config/services.xml and Resources/config/services/date_time_normalizer.xml, which are removed, as on EE-288: Add Symfony 7.4 support lib-lock-bundle#13. Their ids, classes, arguments, factory, lazy flags, tags and aliases are unchanged: they compare identical to the XML-loaded ones on Symfony 3.4, 4.4, 6.4 and 7.4. A new test pins what load() registers, with and without the date_time normalizers, and another checks that loading raises no deprecation.
• A test loads the bundle's classes with the debug class loader and fails on any notice naming them. It is skipped below Symfony 4.4.
  • It runs in its own process, and first checks that the classes are not loaded yet, so they load after the debug class
    loader is enabled.
  • It collects notices before anything loads: on PHP 8.4, compiling Symfony 4.4's own files raises deprecation notices,
    and one that reached the child process's output would fail the test whatever it said.
  • Its error handler takes only deprecations (E_DEPRECATED | E_USER_DEPRECATED), so a warning or a notice raised
    while the classes load goes to PHP's standard handler, and PHPUnit fails the test on it.
• Workflow: Symfony 7.* on PHP 8.2–8.4. The advisories step went in through EE-282: Let the Symfony 3 and 4 jobs install with current Composer #11.
• Workflow, after the second review and your notes on EE-281: Add Symfony 7.4 and psr/log 3 support lib-pagination#18 and EE-280: Add Symfony 7.4 support lib-serializer#14: every job runs with lowest and highest dependencies, and only combinations Composer cannot install are excluded: 70 jobs, 35 of them lowest. The lowest jobs that failed on PHP 8 now pass. PHPUnit 9.6 no longer turns the old releases' PHP 8 deprecation notices into errors, and lib-normalization 1.3.1 fixes the one real failure. PHP 7.0 with Symfony 4, 5 and 6 is now excluded: those versions need PHP 7.1.3 or later, and because Flex does not install on PHP 7.0, those jobs were running Symfony 3.4.
• A 1.4.0 CHANGELOG.md entry.

Backward compatibility

• Breaking only for subclasses:
  • an untyped getConfigTreeBuilder() override needs : TreeBuilder. It fails on Symfony 7 anyway;
  • a subclass of the extension loses the HttpKernel class-cache methods (deprecated in Symfony 7.1): calls fail and an override of the getter is ignored.
• Neither class is in the public API the README defines, so this is a minor release, like Symfony 5.4 and 6 support (1.2.0, 1.3.0). I found no such subclass in 115 of our applications or in the public dependents.
• On Symfony 3.4, the three new requirements start at 3.4.26.
• paysera/lib-normalization 1.3.1 is the new minimum. An application locked below it updates the two together (composer update paysera/lib-normalization-bundle -w). 26 of our 56 applications that use the bundle are below 1.3.1.
• The bundle no longer requires symfony/framework-bundle. Every Symfony application requires it itself; none of our 56 gets it only through this bundle.
• The two XML files are removed. They are not part of the public API the README defines, and none of our 115 applications imports them.
• A backward-compatibility check from 1.3.1 reports two changes in the bundle's own classes: the return type and the parent class above. The other items it lists are Symfony's own classes, which differ between the Symfony versions each side installs.

Test plan

• The suite (17 tests) passes on Symfony 3.4 to 7.4. Coverage is 88 of 89 lines (52 of 53 before); the uncovered line is Configuration's fallback for Symfony below 4.2. Against 1.3.1, the debug-class-loader test fails on 5.4, 6.0 and 6.4, and 7.4 is a fatal error. Against the XML version, the no-deprecation test fails on 7.4 with two notices, one per file.
• All 70 workflow jobs pass, run locally with the workflow's own commands: 17 tests each, one skipped where Symfony's error handler is absent. The lowest jobs install every floor the package declares, including Symfony 7.4.0 and lib-normalization 1.3.1.
• The debug-class-loader test fails when a warning or a notice is raised while the bundle's classes load, on PHPUnit 6.0, 6.5 and 9.6 (PHP 7.1, 7.2 and 8.4). Before your review it passed.
• The new test fails when the extension drops a lazy flag, a tag or an alias, passes a service id where a reference belongs, or registers the date_time normalizers without their configuration (on Symfony 7.4 and 3.4).
• A separate Symfony 4.4, 6.4 and 7.4 application uses every tag and the core services. It passes 8 tests on each, also with this round's changes. With 1.3.1, 6.4 fails on the two notices and the 7.4 install is refused.
• A Symfony 6.4 production application's full test suite gives the same result before and after: 2,195 tests, the same set, only this package moved in the lock.
• CI on this pull request: 70 of 70 jobs pass with 17 tests each (https://github.com/paysera/lib-normalization-bundle/actions/runs/36686126909). The Symfony 7 lowest jobs install framework-bundle 7.4.0.

🤖 Generated with Claude Code

[vinayak-iyer-paysera]

Following your note on lib-dependency-injection#8, every job here also runs with lowest dependencies where that combination can run (dabe1ef): 55 jobs, the 38 highest plus 17 lowest. I ran all 38 lowest combinations locally with the workflow's own commands. 17 pass. The other 21 fail inside vendor/, because the oldest releases the constraints allow don't run on PHP 8, so I excluded them with 6 entries:

• PHP 8.0–8.4 with Symfony 3 or 4: Symfony 3.4.26 and 4.4.9 call libxml_disable_entity_loader(), which PHP 8 deprecates.
• PHP 8.1–8.4: paysera/lib-normalization 1.2.0 installs paysera/lib-object-wrapper 0.3.0, whose ArrayAccess methods have no return types. That is a fatal error from PHP 8.1.
• PHP 8.4: PHPUnit 9.3.0 can't run there (E_STRICT is deprecated).

Unlike #8, this workflow turns Composer's advisory blocking off, so its lowest jobs install the real floors. One consequence: the Symfony 7.4.0 floor isn't tested at lowest. Raising the floors (paysera/lib-normalization ^1.2.1, a newer PHPUnit) would let lowest run on PHP 8.1 and later, but it changes the package's requirements, so I left it out of this pull request. Tell me if you want it here.

[vinayak-iyer-paysera]

Before your review I applied here the points you raised on lib-lock-bundle#13, lib-pagination#18, lib-serializer#14 and lib-dependency-injection#8 (b6f8902, aabd352):

• The services are defined in the extension instead of the two XML files, so Symfony 7.4 no longer reports "XML configuration format is deprecated". The definitions compare identical to the XML ones on Symfony 3.4, 4.4, 6.4 and 7.4, and a new test pins them.
• symfony/framework-bundle moves to require-dev. Nothing in src/ uses it; only the test application does.
• The lowest exclusions are gone: every lowest job now runs, 35 of 70. This answers the question in my earlier comment. Most of those failures were PHP 8 deprecation notices that PHPUnit 9.3 turned into errors, so dev PHPUnit now starts at 9.6.33. One was a real bug: lib-normalization before 1.3.1 fails on PHP 8.2 in DateTimeNormalizer, so the bundle now requires ^1.3.1.
• PHP 7.0 with Symfony 4, 5 and 6 is excluded. Composer cannot install those versions on PHP 7.0, and because Flex does not install there, those jobs were running Symfony 3.4.

CI: 70 of 70 jobs pass, 17 tests each (https://github.com/paysera/lib-normalization-bundle/actions/runs/36607653494). The description is updated with the details.

[mSprunskas]

The deprecation test hides warnings and notices while the bundle classes load
  
  - Location: tests/Functional/FunctionalDeprecationNoticesTest.php:23-29
  - Problem: The error handler records only E_USER_DEPRECATED and E_DEPRECATED. It returns true for all error types. It has no $error_levels mask, so it also catches E_WARNING, E_NOTICE and E_USER_WARNING, and then discards
    them.
  - Impact: phpunit.xml.dist sets convertWarningsToExceptions="true" and convertNoticesToExceptions="true". While DebugClassLoader loads the three bundle classes, this handler replaces the PHPUnit handler. If a class load
    causes a warning or a notice, the test passes and gives no signal. The effect is limited to this test.
  - Fix: Return false for error types that are not deprecations, so that the error goes to the standard handler. Another option is to give set_error_handler() the mask E_DEPRECATED | E_USER_DEPRECATED.

[vinayak-iyer-paysera]

Fixed in 1df96f0: the handler now takes only E_DEPRECATED | E_USER_DEPRECATED, so warnings and notices go to PHP's standard handler.

I checked it by raising an E_USER_WARNING and an E_USER_NOTICE while Configuration loads. Before the change the test passed with both; now it fails with both, on PHPUnit 6.0, 6.5 and 9.6 (PHP 7.1, 7.2 and 8.4). This holds whatever php.ini says: the test runs in its own process, PHPUnit sends that process's error output to stderr, and it fails the test on any stderr output.

CI: 70 of 70 jobs pass, 17 tests each (https://github.com/paysera/lib-normalization-bundle/actions/runs/36686126909).