[ThieryMichel]

Fixed: Composer

Package	From → To	How
api-platform/core	3.2.16 → 3.4.17 (2 high GraphQL CVEs)	update, constraint raised to ^3.4.17
twig/twig	3.8.0 → 3.30.0 (16 advisories, 1 critical)	update
symfony/http-foundation, security-http, yaml, routing, http-client, serializer, validator, config, filesystem, http-kernel, cache, security-bundle	6.4.x → 6.4.50	update
symfony/monolog-bridge / expression-language / runtime	→ 6.4.49 / 6.4.48 / 6.4.41	update
symfony/process, dom-crawler	removed	no longer required (see below)

Fixed: Yarn

Package	From → To	How
storybook + @storybook/* (critical)	8.0.5 → 8.6.19, test-runner 0.17 → 0.21.3	direct bump, still Storybook 8
playwright	1.42.1 → 1.65.0	direct bump
glob	10.3.10 → 14.0.4	rimraf ^5 → ^6
form-data (critical), tar (critical), axios, @babel/*, braces, micromatch, picomatch, brace-expansion, browserslist, cross-spawn, flatted, joi, js-yaml, nanoid, postcss, source-map-js, ws, path-to-regexp, qs, esbuild, webpack, react-router 6.22 → 6.30.6, @remix-run/router, ajv…	latest within the ranges their parents already allow	yarn up -R
handlebars, proxy-addr (critical), express, body-parser, ip, ip-address, tar-fs, defu, ejs, store2, @fastify/busboy…	removed	dropped by the upgrades above
compression 1.8.2, dompurify 3.4.17, lodash 4.18.1, minimatch 11.0.5, serialize-javascript 7.1.4, undici 6.29.1, uuid 11.1.1, webpack-dev-middleware 7.4.6		resolutions, because the parent package's range blocks the fix. These only affect this repo's own installs, not users of @api-platform/admin.