[Task]: Upgrade dependencies for 2026 (#1745)

* upgrade dependencies for 2026

* Apply php-cs-fixer changes

* fix: sonar

* Apply php-cs-fixer changes

* [Widgets] PQL filter not working correct (#1744)

* use new pql filter for tree

* update dependencies

* Apply php-cs-fixer changes

* fix: rebase

* fix: PHP Stan

Author: lukmzig

composer.json

@@ -17,13 +17,13 @@
   "prefer-stable": true,
   "minimum-stability": "dev",
   "require": {
-    "php": "~8.3.0 || ~8.4.0",
+    "php": "~8.4.0 || ~8.5.0",
     "league/csv": "^9.27",
-    "nesbot/carbon": "^3.8.4",
-    "pimcore/static-resolver-bundle": "^3.5.0 ",
-    "pimcore/generic-data-index-bundle": "^2.5.0",
-    "pimcore/pimcore": "^12.3",
-    "zircote/swagger-php": "^4.8 || ^5.0",
+    "nesbot/carbon": "^3.10.0",
+    "pimcore/static-resolver-bundle": "^2026.1",
+    "pimcore/generic-data-index-bundle": "^2026.1",
+    "pimcore/pimcore": "^2026.1",
+    "zircote/swagger-php": "^5.0",
     "ext-zip": "*",
     "symfony/mercure": "^0.6.5",
     "symfony/mercure-bundle": "^0.3.9",
@@ -34,9 +34,9 @@
     "ext-filter": "*",
     "php-http/discovery": "^1.20",
     "psr/http-factory": "^1.0",
-    "symfony/psr-http-message-bridge": "^6.3 || ^7.0"
+    "symfony/psr-http-message-bridge": "^7.4"
   },
-  "require-dev": {    
+  "require-dev": {
     "roave/security-advisories": "dev-latest",
     "codeception/codeception": "^5.3",
     "codeception/stub": "^4.1.4",
@@ -66,12 +66,12 @@
   },
   "extra": {
     "branch-alias": {
-      "dev-2025.4": "1.x-dev"
+      "dev-2026.x": "2026.1.x-dev"
     },
     "pimcore": {
       "bundles": [
         "Pimcore\\Bundle\\StudioBackendBundle\\PimcoreStudioBackendBundle"
       ]
     }
   }
-}
+}

docker-compose.yml

@@ -1,7 +1,7 @@
 version: '3.0'
 services:
     php-studio-backend-bundle:
-        image: pimcore/pimcore:php8.3-debug-latest
+        image: pimcore/pimcore:php8.4-debug-latest
         environment:
             PHP_IDE_CONFIG: serverName=localhost
         working_dir: /var/cli

src/Asset/Controller/Upload/AddController.php

@@ -21,7 +21,6 @@
 use Pimcore\Bundle\StudioBackendBundle\Asset\Service\UploadServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\DatabaseException;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ForbiddenException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\NotFoundException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\UserNotFoundException;
@@ -37,8 +36,8 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Attribute\MapRequestPayload;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -58,7 +57,6 @@ public function __construct(
 
     /**
      * @throws DatabaseException
-     * @throws EnvironmentException
      * @throws ForbiddenException
      * @throws NotFoundException
      * @throws UserNotFoundException
@@ -90,14 +88,9 @@ public function __construct(
     ])]
     public function addAsset(
         int $parentId,
-        // TODO: Symfony 7.1 change to https://symfony.com/blog/new-in-symfony-7-1-mapuploadedfile-attribute
-        Request $request,
+        #[MapUploadedFile] UploadedFile $file,
         #[MapRequestPayload] ?UploadAssetParameter $parameter = null,
     ): JsonResponse {
-        $file = $request->files->get('file');
-        if (!$file instanceof UploadedFile) {
-            throw new EnvironmentException('Invalid file found in the request');
-        }
 
         return $this->jsonResponse(
             [

src/Asset/Controller/Upload/ReplaceController.php

@@ -18,8 +18,6 @@
 use Pimcore\Bundle\StudioBackendBundle\Asset\Service\UploadServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\DatabaseException;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ElementStreamResourceNotFoundException;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ForbiddenException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\NotFoundException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\UserNotFoundException;
@@ -35,7 +33,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -55,7 +53,6 @@ public function __construct(
 
     /**
      * @throws DatabaseException
-     * @throws EnvironmentException
      * @throws ForbiddenException
      * @throws NotFoundException
      * @throws UserNotFoundException
@@ -93,15 +90,9 @@ public function __construct(
     ])]
     public function replaceAsset(
         int $id,
-        // TODO: Symfony 7.1 change to https://symfony.com/blog/new-in-symfony-7-1-mapuploadedfile-attribute
-        Request $request
+        #[MapUploadedFile] UploadedFile $file,
     ): JsonResponse {
 
-        $file = $request->files->get('file');
-        if (!$file instanceof UploadedFile) {
-            throw new ElementStreamResourceNotFoundException(0, 'File');
-        }
-
         return new JsonResponse(
             [
                 'data' => $this->uploadService->replaceAssetBinary(

src/Asset/Controller/Upload/ZipController.php

@@ -17,7 +17,6 @@
 use OpenApi\Attributes\Property;
 use Pimcore\Bundle\StudioBackendBundle\Asset\Service\ExecutionEngine\ZipServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ForbiddenException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\NotFoundException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\UserNotFoundException;
@@ -33,7 +32,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -43,8 +42,6 @@
  */
 final class ZipController extends AbstractApiController
 {
-    private const FILE_KEY = 'zipFile';
-
     public function __construct(
         private readonly SecurityServiceInterface $securityService,
         private readonly ZipServiceInterface $zipService,
@@ -54,7 +51,6 @@ public function __construct(
     }
 
     /**
-     * @throws EnvironmentException
      * @throws ForbiddenException
      * @throws NotFoundException
      * @throws UserNotFoundException
@@ -76,13 +72,13 @@ public function __construct(
     #[MultipartFormDataRequestBody(
         [
             new Property(
-                property: self::FILE_KEY,
+                property: 'zipFile',
                 description: 'Zip file to upload',
                 type: 'string',
                 format: 'binary'
             ),
         ],
-        [self::FILE_KEY]
+        ['zipFile']
     )]
     #[DefaultResponses([
         HttpResponseCodes::FORBIDDEN,
@@ -91,19 +87,14 @@ public function __construct(
     ])]
     public function addAssetsZip(
         int $parentId,
-        // TODO: Symfony 7.1 change to https://symfony.com/blog/new-in-symfony-7-1-mapuploadedfile-attribute
-        Request $request
+        #[MapUploadedFile(name: 'zipFile')] UploadedFile $zipFile,
     ): JsonResponse {
-        $file = $request->files->get(self::FILE_KEY);
-        if (!$file instanceof UploadedFile) {
-            throw new EnvironmentException('Invalid zip file found in the request');
-        }
 
         return $this->jsonResponse(
             [
                 'jobRunId' => $this->zipService->uploadZipAssets(
                     $this->securityService->getCurrentUser(),
-                    $file,
+                    $zipFile,
                     $parentId
                 ),
             ]

src/Asset/Service/DocumentService.php

@@ -24,7 +24,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\HttpResponseCodes;
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\HttpResponseHeaders;
 use Pimcore\Bundle\StudioBackendBundle\Util\Trait\StreamedResponseTrait;
-use Pimcore\Document\Adapter;
+use Pimcore\Document\AdapterInterface;
 use Pimcore\Messenger\AssetUpdateTasksMessage;
 use Pimcore\Model\Asset\Document;
 use Pimcore\Model\Asset\Enum\PdfScanStatus;
@@ -105,7 +105,7 @@ public function validatePdfScanStatus(
     private function getStreamFromDocument(Document $asset): StreamedResponse
     {
         $adapter = $this->documentResolver->getDefaultAdapter();
-        if (!$adapter) {
+        if (!$adapter instanceof AdapterInterface) {
             throw new EnvironmentException('Document adapter is not available.');
         }
 
@@ -146,7 +146,7 @@ private function validateAssetDocument(Document $asset): void
      * @throws ElementStreamResourceNotFoundException
      */
     private function getPdfStreamFromAdapter(
-        Adapter $adapter,
+        AdapterInterface $adapter,
         Document $asset
     ): StreamedResponse {
         try {

src/Bundle/Seo/Controller/Redirect/ImportController.php

@@ -19,7 +19,6 @@
 use Pimcore\Bundle\StudioBackendBundle\Bundle\Seo\Schema\RedirectImportStats;
 use Pimcore\Bundle\StudioBackendBundle\Bundle\Seo\Service\CsvServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\ElementStreamResourceNotFoundException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
 use Pimcore\Bundle\StudioBackendBundle\OpenApi\Attribute\Request\MultipartFormDataRequestBody;
 use Pimcore\Bundle\StudioBackendBundle\OpenApi\Attribute\Response\DefaultResponses;
@@ -29,7 +28,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -49,7 +48,7 @@ public function __construct(
     }
 
     /**
-     * @throws ElementStreamResourceNotFoundException|EnvironmentException
+     * @throws EnvironmentException
      */
     #[Route(self::ROUTE, name: 'pimcore_studio_api_bundle_seo_redirects_import', methods: ['POST'])]
     #[IsGranted(UserPermissions::REDIRECTS->value)]
@@ -80,13 +79,8 @@ public function __construct(
         HttpResponseCodes::UNAUTHORIZED,
         HttpResponseCodes::NOT_FOUND,
     ])]
-    public function importRedirects(Request $request): JsonResponse
+    public function importRedirects(#[MapUploadedFile] UploadedFile $file): JsonResponse
     {
-        $file = $request->files->get('file');
-        if (!$file instanceof UploadedFile) {
-            throw new ElementStreamResourceNotFoundException(0, 'File');
-        }
-
         return $this->jsonResponse($this->csvService->importRedirects($file->getRealPath()));
     }
 }

src/Class/Controller/BulkImport/PrepareImportController.php

@@ -19,8 +19,6 @@
 use Pimcore\Bundle\StudioBackendBundle\Class\Schema\BulkImport\BulkImportPrepareResponse;
 use Pimcore\Bundle\StudioBackendBundle\Class\Service\BulkImport\BulkImportServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\InvalidArgumentException as ApiInvalidArgumentException;
 use Pimcore\Bundle\StudioBackendBundle\OpenApi\Attribute\Request\MultipartFormDataRequestBody;
 use Pimcore\Bundle\StudioBackendBundle\OpenApi\Attribute\Response\DefaultResponses;
 use Pimcore\Bundle\StudioBackendBundle\OpenApi\Attribute\Response\SuccessResponse;
@@ -29,7 +27,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -48,10 +46,6 @@ public function __construct(
         parent::__construct($serializer);
     }
 
-    /**
-     * @throws EnvironmentException
-     * @throws ApiInvalidArgumentException
-     */
     #[Route(
         path: self::ROUTE,
         name: 'pimcore_studio_api_class_bulk_import_prepare',
@@ -85,15 +79,8 @@ public function __construct(
         HttpResponseCodes::UNAUTHORIZED,
         HttpResponseCodes::UNPROCESSABLE_CONTENT,
     ])]
-    public function prepareImport(Request $request): JsonResponse
+    public function prepareImport(#[MapUploadedFile] UploadedFile $file): JsonResponse
     {
-        $file = $request->files->get('file');
-        if (!$file instanceof UploadedFile) {
-            throw new ApiInvalidArgumentException(
-                'Invalid file found in the request'
-            );
-        }
-
         return $this->jsonResponse(
             $this->bulkImportService->prepareImport($file)
         );

src/Class/Controller/CustomLayout/ImportController.php

@@ -19,7 +19,6 @@
 use Pimcore\Bundle\StudioBackendBundle\Class\Schema\CustomLayout\CustomLayout;
 use Pimcore\Bundle\StudioBackendBundle\Class\Service\CustomLayoutServiceInterface;
 use Pimcore\Bundle\StudioBackendBundle\Controller\AbstractApiController;
-use Pimcore\Bundle\StudioBackendBundle\Exception\Api\EnvironmentException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\InvalidArgumentException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\NotFoundException;
 use Pimcore\Bundle\StudioBackendBundle\Exception\Api\NotWriteableException;
@@ -33,7 +32,7 @@
 use Pimcore\Bundle\StudioBackendBundle\Util\Constant\UserPermissions;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 use Symfony\Component\HttpFoundation\JsonResponse;
-use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Attribute\MapUploadedFile;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 use Symfony\Component\Serializer\SerializerInterface;
@@ -52,7 +51,6 @@ public function __construct(
 
     /**
      * @throws NotFoundException
-     * @throws EnvironmentException
      * @throws NotWriteableException
      * @throws JsonEncodingException
      * @throws InvalidArgumentException
@@ -97,13 +95,8 @@ public function __construct(
         HttpResponseCodes::NOT_FOUND,
         HttpResponseCodes::BAD_REQUEST,
     ])]
-    public function importCustomLayout(string $customLayoutId, Request $request): JsonResponse
+    public function importCustomLayout(string $customLayoutId, #[MapUploadedFile] UploadedFile $file): JsonResponse
     {
-        $file = $request->files->get('file');
-        if (!$file instanceof UploadedFile) {
-            throw new EnvironmentException('Invalid file found in the request');
-        }
-
         return $this->jsonResponse(
             $this->customLayoutService->importCustomLayoutActionFromJson(
                 $customLayoutId,