…stic error mode

…llowing more realistic error mode (weaverryan)

This PR was squashed before being merged into the 6.3 branch.

Discussion
----------

[AssetMapper] Fixing incorrect exception & adding allowing more realistic error mode

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes-ish
| New feature?  | no-ish
| Deprecations? | no
| Tickets       | None
| License       | MIT
| Doc PR        | Still WIP

Apologies for the late PR:

A) We were accidentally using an exception class from the `Asset` component. Fixed.

B) We are parsing .js files to find imports. That, by its very nature, won't be perfect, which is fine - if there is an import we don't recognize we can just leave it alone and (ideally) notify the user. Due to the imperfect matching, the `strict` mode is too strict to be used as a default - it'll cause bug reports. I've fixed this by adding a "warning" mode and using that. It's a balance between an exception (too much) vs not reporting to the user at all (too little).

Thanks!

Commits
-------

9f52bf1 [AssetMapper] Fixing incorrect exception & adding allowing more realistic error mode

This PR was merged into the 6.3 branch.

Discussion
----------

Fix cursor on link that has no href

[WebProfilerBundle] Fix cursor on link that has no href

link to button

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->

Alternative approach for symfony#50376

`@stof` `@nicolas`-grekas

Commits
-------

893d299 Convert A link to Button

* 5.4:
  Change default branch in PR template

* 6.2:
  Change default branch in PR template

* 6.3:
  Change default branch in PR template

This PR was merged into the 6.4 branch.

Discussion
----------

[6.4] Allow 7.0 deps

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

9967e70 [6.4] Allow 7.0 deps

This PR was merged into the 6.4 branch.

Discussion
----------

Bump contracts to 3.4-dev

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

cce31bc Bump contracts to 3.4-dev

…peMC)

This PR was merged into the 6.3 branch.

Discussion
----------

[VarDumper] Fix `dd()` showing line with `null`

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Similar to symfony#50347 (comment) but for the `dd()` function:

```php
dd(null);
```

![image](https://github.com/symfony/symfony/assets/2445045/5615db1d-d48d-4720-85ce-239d3921f624)

Commits
-------

07d318a [VarDumper] Fix `dd()` showing line with `null`

…om non-asset files (weaverryan)

This PR was merged into the 6.3 branch.

Discussion
----------

[AssetMapper] Sometimes asset contents are built from non-asset files

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes-ish
| New feature?  | yes-ish
| Deprecations? | no
| Tickets       | None
| License       | MIT
| Doc PR        | Still TODO

Apologies again for the late thing - I'm *really* trying to push the component to find critical bugs or missing items.

In StimulusBundle, we dynamically build the contents of a `controllers.js` mapped asset from the `assets/controllers.json` file. This PR allows us to "bust" that asset's cache when `assets/controllers.json` is modified. Right now, it would be a bug in StimulusBundle that we can't really work around.

Other use-cases: someone decides to write an asset compiler that runs Tailwind automatically on a CSS file, and they want that dynamic asset to "vary" on the `tailwind.config.js` file.

Thanks!

Commits
-------

c05fdb8 [AssetMapper] Sometimes asset contents are built from non-asset files

…in dev server (weaverryan)

This PR was squashed before being merged into the 6.3 branch.

Discussion
----------

[AssetMapper] Avoid loading potentially ALL assets in dev server

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | None
| License       | MIT
| Doc PR        | Still TODO

Hi!

One other rough edge found when using on a real project. The dev server needs to quickly go from "public path" -> "logical path", so it can then look up the `MappedAsset`. Previously, for every served asset, it would loop over ALL assets until it found a match. We have a `CachedMappedAssetFactory`, which makes this happen quickly, but it still loads many assets into memory, including their contents. I was seeing a 13mb jump in the memory on those requests in a modest-sized app. If someone was serving a lot of images, it could get huge. No reason to do that work multiple times.

Btw, none of this happens on production - caching is here just for dev experience.

Thanks!

Commits
-------

bb97591 [AssetMapper] Avoid loading potentially ALL assets in dev server

* 5.4:
  Fix CI for experimental mode

* 6.2:
  Update github/workflows/scorecard
  Fix CI for experimental mode

* 6.3:
  Update github/workflows/scorecard
  [AssetMapper] Avoid loading potentially ALL assets in dev server
  Fix CI for experimental mode
  [VarDumper] Fix `dd()` showing line with `null`
  [AssetMapper] Sometimes asset contents are built from non-asset files

… readonly properties in MappedAsset

…o JsDelivr+esm (weaverryan, nicolas-grekas)

This PR was merged into the 6.3 branch.

Discussion
----------

[AssetMapper] Change default importmap "provider" to JsDelivr+esm

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | yes
| Deprecations? | no
| Tickets       | None
| License       | MIT
| Doc PR        |Still TODO

We currently use the https://jspm.org/ API in `importmap:require` to find a CDN URL for an npm package - just like Rails. Unfortunately, this is NOT as robust as we had thought. For me, it's broken. 3 big issues:

A) **Not Combined**
Some packages are not packed/combined. Example: [chart.js/auto](https://ga.jspm.io/npm:[email protected]/auto/auto.js) imports other packages and results in 3 requests instead of 1. Not TERRIBLE... so here IS a terrible example: [`@popperjs`/core](https://ga.jspm.io/npm:`@popperjs`/[email protected]/lib/index.js) (needed by `bootstrap`) results in nearly 50 requests ❗

B) **Downloading Broken**
For some packages, downloading simply doesn't work - rails/importmap-rails#65. ``@popperjs`/core` is another good example. Many of its imports have the form `import"./utils/getOppositeVariationPlacement.js`. If we download the main file, it looks locally for that `utils/` file, which won't be there. [`@chart`.js/auto](https://ga.jspm.io/npm:[email protected]/auto/auto.js) is another example.

C) **process.env.NODE_ENV included**
Some packages (yes, again ``@popperjs`/core` is a great example!) contain `process.env.NODE_ENV` inside - rails/importmap-rails#65 (comment)

I believe that some package advertise an "esm" package... but just don't do a good job of creating it... or create it without the browser context in mind (or at least in a way that's inconvenient for downloading).

### jsDelivr to the rescue

THANKFULLY, jsDelivr seems to have a fantastic API/hosting that is *almost* exactly what we want: https://www.jsdelivr.com/?docs=esm

They deliver fully "packaged" modules, where the only import is for peer dependencies - e.g. https://cdn.jsdelivr.net/npm/[email protected]/+esm

There IS still an issue when downloading. "Peer imports" are relative -e.g. `import*as t from"/npm/`@popperjs`/[email protected]/+esm";` However, these imports follow a VERY strict pattern. So, when `--download` is passed, we parse these, download the peer dependency and update the import contents to ``@popperjs`/core`, which works with the importmap. It's not ideal that we need to do that, but it's straightforward and works great.

Sorry again for this late PR - I had assumed that jspm was robust because Rails is using it. It turns out it's robust... unless you hit a "bad" package, then it's terrible. And they're not that rare: on ux.symfony.com, I have hit several.

Thanks!

Commits
-------

b530dc3 [AssetMapper] Fix wiring resolvers, send requests in parallel and use readonly properties in MappedAsset
de44614 [AssetMapper] Change default importmap "provider" to JsDelivr+esm

* 6.3:
  [AssetMapper] Fix wiring resolvers, send requests in parallel and use readonly properties in MappedAsset
  [AssetMapper] Change default importmap "provider" to JsDelivr+esm

This PR was merged into the 6.3 branch.

Discussion
----------

[Messenger] Fix: Typo in PHPDoc

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | no
| New feature?  | no
| Deprecations? | no
| Tickets       | -
| License       | MIT
| Doc PR        | -

Commits
-------

743aff9 Fix: Typo in PHPDoc

…mfony#50689 and update tests (alli83)

This PR was merged into the 6.3 branch.

Discussion
----------

[DoctrineBridge] add missing UPGRADE notes for symfony#50689 and update tests

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | no
| New feature?  | no
| Deprecations? | yes
| Tickets       |
| License       | MIT
| Doc PR        |

`$isSameDatabase` parameter was introduced in symfony#48059. It has been added in order to know whether the database used by doctrine is the same as the one used by the component when integrating the latter with doctrine migrations.

Also related to symfony#50689

Commits
-------

5d2817d [DoctrineBridge] add missing UPGRADE notes for symfony#50689

…adic argument

…olve()` throw on variadic argument (javaDeveloperKid)

This PR was merged into the 6.3 branch.

Discussion
----------

[HttpKernel] make `RequestPayloadValueResolver::resolve()` throw on variadic argument

| Q             | A
| ------------- | ---
| Branch?       | 6.3 <!-- see below -->
| Bug fix?      | yes
| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->
| Deprecations? | yno <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tickets       | Fix symfony#50668 <!-- prefix each issue number with "Fix #", no need to create an issue if none exists, explain below instead -->
| License       | MIT
<!--
Replace this notice by a short README for your feature/bugfix.
This will help reviewers and should be a good start for the documentation.

Additionally (see https://symfony.com/releases):
 - Always add tests and ensure they pass.
 - Bug fixes must be submitted against the lowest maintained branch where they apply
   (lowest branches are regularly merged to upper ones so they get the fixes too).
 - Features and deprecations must be submitted against the latest branch.
 - For new features, provide some code snippets to help understand usage.
 - Changelog entry should follow https://symfony.com/doc/current/contributing/code/conventions.html#writing-a-changelog-entry
 - Never break backward compatibility (see https://symfony.com/bc).
-->

Commits
-------

1c27cf1 [HttpKernel] make RequestPayloadValueResolver:resolve() throw on variadic argument

…Dumper

…g support for `GraphvizDumper` (Louis-Proffit)

This PR was merged into the 6.4 branch.

Discussion
----------

[FrameworkBundle][Workflow] Add metadata dumping support for `GraphvizDumper`

| Q             | A
| ------------- | ---
| Branch?       | 6.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Tickets       | Fix symfony#50604
| License       | MIT
| Doc PR        | symfony/symfony-docs#18398

Add `--with-metadata` option to `workflow:dump` command. It includes places, transitions and workflow's metadata in the dumped graph. Currently only supported for **GraphvizDumper** and **StateMachineGraphvizDumper**.

When used, the `label` metadata is not included in the dumped metadata because it is already the title. This could be enlarged to all styling metadata.

Commits
-------

457059d [FrameworkBundle][Workflow] Add metadata dumping support for GraphvizDumper

…rdStrength` constraint (alexandre-daubois)

This PR was merged into the 6.3 branch.

Discussion
----------

[Validator] Add the `message` option to the `PasswordStrength` constraint

| Q             | A
| ------------- | ---
| Branch?       | 6.3
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix symfony#50651
| License       | MIT
| Doc PR        | No need

Commits
-------

2eed59d [Validator] Add the `message` option to the `PasswordStrength` constraint

* 5.4:
  [Validator] Add missing validator translations in Polish language
  [HttpClient] Fix encoding some characters in query strings
  [FrameworkBundle] Ignore missing directories in about command
  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"

* 6.2:
  [Validator] Add missing validator translations in Polish language
  [HttpClient] Fix encoding some characters in query strings
  [SecurityBundle] Remove last usages of tag `security.remember_me_aware`
  [VarDumper] Dumping DateTime throws error if getTimezone is false
  Only update autoload_runtime.php when it changed
  [Intl] Update the ICU data to 73.2
  [HttpClient] Force int conversion for floated multiplier for GenericRetryStrategy
  [FrameworkBundle] Ignore missing directories in about command
  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"
  [Validator][Translator] Fix xlf files for en & fr translations. Bug introduced by symfony#50590
  Add missing EN and FR translations for newest constraints

* 6.3:
  [Validator] Add missing validator translations in Polish language
  [HttpClient] Fix encoding some characters in query strings
  [HttpKernel] make RequestPayloadValueResolver:resolve() throw on variadic argument
  [SecurityBundle] Remove last usages of tag `security.remember_me_aware`
  [VarDumper] Dumping DateTime throws error if getTimezone is false
  Only update autoload_runtime.php when it changed
  [FrameworkBundle] Fix secrets:list not displaying local vars
  [Intl] Update the ICU data to 73.2
  [DoctrineBridge] add missing UPGRADE notes for symfony#50689
  [HttpClient] Force int conversion for floated multiplier for GenericRetryStrategy
  [Security] Fix log message in OidcTokenHandler
  Don't mark RedispatchMessage as internal
  [FrameworkBundle] Ignore missing directories in about command
  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"
  [Validator] Add the `message` option to the `PasswordStrength` constraint
  [Validator][Translator] Fix xlf files for en & fr translations. Bug introduced by symfony#50590
  CS fix
  Add missing EN and FR translations for newest constraints
  [HttpClient] Remove final keyword on AsyncResponse
  [DependencyInjection] Fix support for `false` boolean env vars

The assertion will always as it is testing the same array