Feature/8637 dependabot alerts

[bdalsass]

Base information

Question	Answer
Related to a SourceForge thead / Another PR / Combodo ticket?
Type of change?	Dependencies updates

Symptom (bug) / Objective (enhancement)

Dependabot alerts on some iTop composer lib.

Proposed solution (bug and enhancement)

• Remove old doc generator
• Update twig/twig from 3.16.0 to 3.21.1
• Update tecnickcom/tcpdf from 6.7.5 to 6.10.0

Checklist before requesting a review

• I have performed a self-review of my code
• I have tested all changes I made on an iTop instance
• I have added a unit test, otherwise I have explained why I couldn't
• Is the PR clear and detailed enough so anyone can understand digging in the code?

[Hipska]

I don't see any additions to actually enable dependabot alerts?

PS; there is also a Major CVE in symfony/runtime 6.4.0

PS2; Base information needs to be updated it is about N°8637.

[steffunky]

I don't see any additions to actually enable dependabot alerts?

PS; there is also a Major CVE in symfony/runtime 6.4.0

PS2; Base information needs to be updated it is about N°8637.

• We already have a dependabot tab in our Github security page, but I don't think it's public
• I think we're not concerned as we already include this library version > 6.4.14

$ composer show symfony/runtime
name     : symfony/runtime
descrip. : Enables decoupling PHP applications from global state
keywords : runtime
versions : * v6.4.23
released : 2025-06-13, 2 months ago
type     : composer-plugin
license  : MIT License (MIT) (OSI approved) https://spdx.org/licenses/MIT.html#licenseText
homepage : https://symfony.com
source   : [git] https://github.com/symfony/runtime.git ef1f03c2ab1144ac4ef7744b9e026bdb06f2f88f
dist     : [zip] https://api.github.com/repos/symfony/runtime/zipball/ef1f03c2ab1144ac4ef7744b9e026bdb06f2f88f ef1f03c2ab1144ac4ef7744b9e026bdb06f2f88f
path     : /srv/http/iTop/lib/symfony/runtime
names    : symfony/runtime

support
source : https://github.com/symfony/runtime/tree/v6.4.23

• Agreed 😁

[Hipska]

Ah I thought because of the title that you would let Dependabot now automatically create PRs to update composer dependencies.

On Develop branch all is good, but not on 3.2:

iTop/composer.lock

Lines 4172 to 4173 in 65c9145

	"name": "symfony/runtime",
	"version": "v6.4.0",

[Hipska]

Since this PR is targeting support/3.2, symphony/runtime needs to be updated as well 😉