Widen the webmozart/assert constraint to ^1.11 || ^2.0

[laticrete-pimcore]

Problem

webmozart/assert is constrained to ^1.11 on main/3.x (and ^1.5 on 2.x). Because this package is a transitive dependency of widely-installed bundles, that upper bound now blocks unrelated packages from moving to webmozart/assert ^2.0.

The concrete case that led me here: simplesamlphp/saml2 4.20.3 requires webmozart/assert ^2.0. It is the release that fixes CVE-2026-49283 (HTTP-Artifact TLS validator confusion → cross-IdP authentication bypass) and CVE-2026-49289 (DoS via XPath transform). In a Pimcore project, webmozarts/console-parallelization arrives transitively via pimcore/data-importer and pimcore/data-hub-simple-rest, so the ^1.11 bound makes that security fix uninstallable — there is no version of either package that satisfies both. Anyone in that position is stuck on a vulnerable SAML stack.

The upgrade looks safe

The 2.0 BC breaks don't appear to touch this library:

• Minimum PHP raised to 8.2 — main already requires ^8.3.
• isTraversable removed — not used here; ChunkedItemsIterator already uses isIterable.
• declare(strict_types=1) added to Assert's classes — strict_types is scoped to the calling file, and every file under src/ already declares it, so argument coercion at the call sites is unchanged either way.
• All assertion methods now return the checked value — purely additive.

All 15 concrete Assert:: methods used in src/ (positiveInteger, string, notNull, false, true, natural, greaterThan, greaterThanEq, same, numeric, notFalse, keyExists, isIterable, integerish, fileExists, plus nullOrNatural via the mixin) exist in 2.4.1.

Verified locally

Against main (377d989), with the constraint widened to ^1.11 || ^2.0 and resolution forced to webmozart/assert 2.4.1 on PHP 8.3.28:

• vendor/bin/phpunit → 325/325 pass, 480 assertions. The single risky test (ParallelizationIntegrationTest::test_it_can_run_the_command_a_command_with_the_legacy_api_in_the_main_process) reproduces identically on 1.12.1, so it is pre-existing and unrelated.
• vendor/bin/phpstan analyse -c phpstan-src.neon.dist → No errors.

One caveat for CI

infection/infection (require-dev) itself requires webmozart/assert ^1.11, so with a widened constraint Composer still resolves to 1.12.1 in this repo's own dev environment — your CI would keep testing against 1.x and nothing changes for you until Infection widens. To exercise 2.x above I temporarily dropped infection/infection from require-dev. That makes the change low-risk to accept: it unblocks downstream consumers without altering what your test matrix actually runs.

Proposal

Change webmozart/assert to ^1.11 || ^2.0 in require on main/3.x (and, if a 2.x release is still on the table, ^1.5 || ^2.0 there).

Happy to open a PR if that's welcome.