@@ -282,6 +282,19 @@ create new projects. If you use Composer, you need to tell the exact version:
282282
283283 $ composer create-project symfony/skeleton:"^5.4" my_project_directory
284284
285+ With an already existing project, you can restrict Symfony packages to one
286+ LTS version by:doc: `using Symfony Flex in your project </setup/flex >`
287+ and setting the ``extra.symfony.require `` config:
288+
289+ ..code-block ::terminal
290+
291+ $ composer config extra.symfony.require "5.4.*"
292+
293+ ..warning ::
294+
295+ Tools like dependabot may ignore this setting and upgrade the Symfony dependencies,
296+ see this `GitHub issue about dependabot `_.
297+
285298The Symfony Demo application
286299----------------------------
287300
@@ -316,6 +329,7 @@ Learn More
316329.. _`Install Composer` :https://getcomposer.org/download/
317330.. _`install the Symfony CLI` :https://symfony.com/download
318331.. _`symfony-cli/symfony-cli GitHub repository` :https://github.com/symfony-cli/symfony-cli
332+ .. _`GitHub issue about dependabot` :https://github.com/dependabot/dependabot-core/issues/4631
319333.. _`The Symfony Demo Application` :https://github.com/symfony/demo
320334.. _`Symfony Flex` :https://github.com/symfony/flex
321335.. _`PHP security advisories database` :https://github.com/FriendsOfPHP/security-advisories