…stic error mode

…llowing more realistic error mode (weaverryan)This PR was squashed before being merged into the 6.3 branch.Discussion----------[AssetMapper] Fixing incorrect exception & adding allowing more realistic error mode| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes-ish| New feature?  | no-ish| Deprecations? | no| Tickets       | None| License       | MIT| Doc PR        | Still WIPApologies for the late PR:A) We were accidentally using an exception class from the `Asset` component. Fixed.B) We are parsing .js files to find imports. That, by its very nature, won't be perfect, which is fine - if there is an import we don't recognize we can just leave it alone and (ideally) notify the user. Due to the imperfect matching, the `strict` mode is too strict to be used as a default - it'll cause bug reports. I've fixed this by adding a "warning" mode and using that. It's a balance between an exception (too much) vs not reporting to the user at all (too little).Thanks!Commits-------9f52bf1 [AssetMapper] Fixing incorrect exception & adding allowing more realistic error mode

This PR was merged into the 6.3 branch.Discussion----------Fix cursor on link that has no href[WebProfilerBundle] Fix cursor on link that has no hreflink to button| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->| Deprecations? | no <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->Alternative approach forsymfony#50376`@stof` `@nicolas`-grekasCommits-------893d299 Convert A link to Button

* 5.4:  Change default branch in PR template

* 6.2:  Change default branch in PR template

* 6.3:  Change default branch in PR template

This PR was merged into the 6.4 branch.Discussion----------[6.4] Allow 7.0 deps| Q             | A| ------------- | ---| Branch?       | 6.4| Bug fix?      | no| New feature?  | no| Deprecations? | no| Tickets       | -| License       | MIT| Doc PR        | -Commits-------9967e70 [6.4] Allow 7.0 deps

This PR was merged into the 6.4 branch.Discussion----------Bump contracts to 3.4-dev| Q             | A| ------------- | ---| Branch?       | 6.4| Bug fix?      | no| New feature?  | no| Deprecations? | no| Tickets       | -| License       | MIT| Doc PR        | -Commits-------cce31bc Bump contracts to 3.4-dev

…peMC)This PR was merged into the 6.3 branch.Discussion----------[VarDumper] Fix `dd()` showing line with `null`| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | no| Deprecations? | no| Tickets       | -| License       | MIT| Doc PR        | -Similar tosymfony#50347 (comment) but for the `dd()` function:```phpdd(null);```![image](https://github.com/symfony/symfony/assets/2445045/5615db1d-d48d-4720-85ce-239d3921f624)Commits-------07d318a [VarDumper] Fix `dd()` showing line with `null`

…om non-asset files (weaverryan)This PR was merged into the 6.3 branch.Discussion----------[AssetMapper] Sometimes asset contents are built from non-asset files| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes-ish| New feature?  | yes-ish| Deprecations? | no| Tickets       | None| License       | MIT| Doc PR        | Still TODOApologies again for the late thing - I'm *really* trying to push the component to find critical bugs or missing items.In StimulusBundle, we dynamically build the contents of a `controllers.js` mapped asset from the `assets/controllers.json` file. This PR allows us to "bust" that asset's cache when `assets/controllers.json` is modified. Right now, it would be a bug in StimulusBundle that we can't really work around.Other use-cases: someone decides to write an asset compiler that runs Tailwind automatically on a CSS file, and they want that dynamic asset to "vary" on the `tailwind.config.js` file.Thanks!Commits-------c05fdb8 [AssetMapper] Sometimes asset contents are built from non-asset files

…in dev server (weaverryan)This PR was squashed before being merged into the 6.3 branch.Discussion----------[AssetMapper] Avoid loading potentially ALL assets in dev server| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | no| Deprecations? | no| Tickets       | None| License       | MIT| Doc PR        | Still TODOHi!One other rough edge found when using on a real project. The dev server needs to quickly go from "public path" -> "logical path", so it can then look up the `MappedAsset`. Previously, for every served asset, it would loop over ALL assets until it found a match. We have a `CachedMappedAssetFactory`, which makes this happen quickly, but it still loads many assets into memory, including their contents. I was seeing a 13mb jump in the memory on those requests in a modest-sized app. If someone was serving a lot of images, it could get huge. No reason to do that work multiple times.Btw, none of this happens on production - caching is here just for dev experience.Thanks!Commits-------bb97591 [AssetMapper] Avoid loading potentially ALL assets in dev server

* 5.4:  Fix CI for experimental mode

* 6.2:  Update github/workflows/scorecard  Fix CI for experimental mode

* 6.3:  Update github/workflows/scorecard  [AssetMapper] Avoid loading potentially ALL assets in dev server  Fix CI for experimental mode  [VarDumper] Fix `dd()` showing line with `null`  [AssetMapper] Sometimes asset contents are built from non-asset files

… readonly properties in MappedAsset

…o JsDelivr+esm (weaverryan, nicolas-grekas)This PR was merged into the 6.3 branch.Discussion----------[AssetMapper] Change default importmap "provider" to JsDelivr+esm| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | yes| Deprecations? | no| Tickets       | None| License       | MIT| Doc PR        |Still TODOWe currently use thehttps://jspm.org/ API in `importmap:require` to find a CDN URL for an npm package - just like Rails. Unfortunately, this is NOT as robust as we had thought. For me, it's broken. 3 big issues:A) **Not Combined**Some packages are not packed/combined. Example: [chart.js/auto](https://ga.jspm.io/npm:chart.js@4.3.0/auto/auto.js) imports other packages and results in 3 requests instead of 1. Not TERRIBLE... so here IS a terrible example: [`@popperjs`/core](https://ga.jspm.io/npm:`@popperjs`/core@2.11.7/lib/index.js) (needed by `bootstrap`) results in nearly 50 requests ❗B) **Downloading Broken**For some packages, downloading simply doesn't work -rails/importmap-rails#65. ``@popperjs`/core` is another good example. Many of its imports have the form `import"./utils/getOppositeVariationPlacement.js`. If we download the main file, it looks locally for that `utils/` file, which won't be there. [`@chart`.js/auto](https://ga.jspm.io/npm:chart.js@4.3.0/auto/auto.js) is another example.C) **process.env.NODE_ENV included**Some packages (yes, again ``@popperjs`/core` is a great example!) contain `process.env.NODE_ENV` inside -rails/importmap-rails#65 (comment)I believe that some package advertise an "esm" package... but just don't do a good job of creating it... or create it without the browser context in mind (or at least in a way that's inconvenient for downloading).### jsDelivr to the rescueTHANKFULLY, jsDelivr seems to have a fantastic API/hosting that is *almost* exactly what we want:https://www.jsdelivr.com/?docs=esmThey deliver fully "packaged" modules, where the only import is for peer dependencies - e.g.https://cdn.jsdelivr.net/npm/bootstrap@5.2.3/+esmThere IS still an issue when downloading. "Peer imports" are relative -e.g. `import*as t from"/npm/`@popperjs`/core@2.11.7/+esm";` However, these imports follow a VERY strict pattern. So, when `--download` is passed, we parse these, download the peer dependency and update the import contents to ``@popperjs`/core`, which works with the importmap. It's not ideal that we need to do that, but it's straightforward and works great.Sorry again for this late PR - I had assumed that jspm was robust because Rails is using it. It turns out it's robust... unless you hit a "bad" package, then it's terrible. And they're not that rare: on ux.symfony.com, I have hit several.Thanks!Commits-------b530dc3 [AssetMapper] Fix wiring resolvers, send requests in parallel and use readonly properties in MappedAssetde44614 [AssetMapper] Change default importmap "provider" to JsDelivr+esm

* 6.3:  [AssetMapper] Fix wiring resolvers, send requests in parallel and use readonly properties in MappedAsset  [AssetMapper] Change default importmap "provider" to JsDelivr+esm

This PR was merged into the 6.3 branch.Discussion----------[Messenger] Fix: Typo in PHPDoc| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | no| New feature?  | no| Deprecations? | no| Tickets       | -| License       | MIT| Doc PR        | -Commits-------743aff9 Fix: Typo in PHPDoc

…mfony#50689 and update tests (alli83)This PR was merged into the 6.3 branch.Discussion----------[DoctrineBridge] add missing UPGRADE notes forsymfony#50689 and update tests| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | no| New feature?  | no| Deprecations? | yes| Tickets       || License       | MIT| Doc PR        |`$isSameDatabase` parameter was introduced insymfony#48059. It has been added in order to know whether the database used by doctrine is the same as the one used by the component when integrating the latter with doctrine migrations.Also related tosymfony#50689Commits-------5d2817d [DoctrineBridge] add missing UPGRADE notes forsymfony#50689

…adic argument

…olve()` throw on variadic argument (javaDeveloperKid)This PR was merged into the 6.3 branch.Discussion----------[HttpKernel] make `RequestPayloadValueResolver::resolve()` throw on variadic argument| Q             | A| ------------- | ---| Branch?       | 6.3 <!-- see below -->| Bug fix?      | yes| New feature?  | no <!-- please update src/**/CHANGELOG.md files -->| Deprecations? | yno <!-- please update UPGRADE-*.md and src/**/CHANGELOG.md files -->| Tickets       |Fixsymfony#50668 <!-- prefix each issue number with "Fix #", no need to create an issue if none exists, explain below instead -->| License       | MIT<!--Replace this notice by a short README for your feature/bugfix.This will help reviewers and should be a good start for the documentation.Additionally (seehttps://symfony.com/releases): - Always add tests and ensure they pass. - Bug fixes must be submitted against the lowest maintained branch where they apply   (lowest branches are regularly merged to upper ones so they get the fixes too). - Features and deprecations must be submitted against the latest branch. - For new features, provide some code snippets to help understand usage. - Changelog entry should followhttps://symfony.com/doc/current/contributing/code/conventions.html#writing-a-changelog-entry - Never break backward compatibility (seehttps://symfony.com/bc).-->Commits-------1c27cf1 [HttpKernel] make RequestPayloadValueResolver:resolve() throw on variadic argument

…Dumper

…g support for `GraphvizDumper` (Louis-Proffit)This PR was merged into the 6.4 branch.Discussion----------[FrameworkBundle][Workflow] Add metadata dumping support for `GraphvizDumper`| Q             | A| ------------- | ---| Branch?       | 6.4| Bug fix?      | no| New feature?  | yes| Deprecations? | no| Tickets       |Fixsymfony#50604| License       | MIT| Doc PR        |symfony/symfony-docs#18398Add `--with-metadata` option to `workflow:dump` command. It includes places, transitions and workflow's metadata in the dumped graph. Currently only supported for **GraphvizDumper** and **StateMachineGraphvizDumper**.When used, the `label` metadata is not included in the dumped metadata because it is already the title. This could be enlarged to all styling metadata.Commits-------457059d [FrameworkBundle][Workflow] Add metadata dumping support for GraphvizDumper

…rdStrength` constraint (alexandre-daubois)This PR was merged into the 6.3 branch.Discussion----------[Validator] Add the `message` option to the `PasswordStrength` constraint| Q             | A| ------------- | ---| Branch?       | 6.3| Bug fix?      | yes| New feature?  | no| Deprecations? | no| Tickets       |Fixsymfony#50651| License       | MIT| Doc PR        | No needCommits-------2eed59d [Validator] Add the `message` option to the `PasswordStrength` constraint

* 5.4:  [Validator] Add missing validator translations in Polish language  [HttpClient] Fix encoding some characters in query strings  [FrameworkBundle] Ignore missing directories in about command  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"

* 6.2:  [Validator] Add missing validator translations in Polish language  [HttpClient] Fix encoding some characters in query strings  [SecurityBundle] Remove last usages of tag `security.remember_me_aware`  [VarDumper] Dumping DateTime throws error if getTimezone is false  Only update autoload_runtime.php when it changed  [Intl] Update the ICU data to 73.2  [HttpClient] Force int conversion for floated multiplier for GenericRetryStrategy  [FrameworkBundle] Ignore missing directories in about command  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"  [Validator][Translator] Fix xlf files for en & fr translations. Bug introduced bysymfony#50590  Add missing EN and FR translations for newest constraints

* 6.3:  [Validator] Add missing validator translations in Polish language  [HttpClient] Fix encoding some characters in query strings  [HttpKernel] make RequestPayloadValueResolver:resolve() throw on variadic argument  [SecurityBundle] Remove last usages of tag `security.remember_me_aware`  [VarDumper] Dumping DateTime throws error if getTimezone is false  Only update autoload_runtime.php when it changed  [FrameworkBundle] Fix secrets:list not displaying local vars  [Intl] Update the ICU data to 73.2  [DoctrineBridge] add missing UPGRADE notes forsymfony#50689  [HttpClient] Force int conversion for floated multiplier for GenericRetryStrategy  [Security] Fix log message in OidcTokenHandler  Don't mark RedispatchMessage as internal  [FrameworkBundle] Ignore missing directories in about command  Revert "[Messenger] Respect `isRetryable` decision of the retry strategy when deciding if failed message should be re-delivered"  [Validator] Add the `message` option to the `PasswordStrength` constraint  [Validator][Translator] Fix xlf files for en & fr translations. Bug introduced bysymfony#50590  CS fix  Add missing EN and FR translations for newest constraints  [HttpClient] Remove final keyword on AsyncResponse  [DependencyInjection] Fix support for `false` boolean env vars

The assertion will always as it is testing the same array