Updated Drupal core and contrib modules.

[AlexSkrypnyk]

Summary

Updated Drupal core from 11.3.5 to 11.3.7 - two patch releases covering bug fixes and stability improvements. Updated 59 contrib packages in total, including Symfony components unified at 7.4.8, developer tooling (Rector, PHPStan, Drush), and the Behat testing ecosystem. Applied auto-fixes for 7 coding standards violations in 2 files. All changes are patch or minor releases with no breaking changes expected and no security advisories reported.

Changes

• behat/behat updated from 3.29.0 to 3.30.0 minor
  
  See changes: Behat/Behat@v3.29.0...v3.30.0
  
  Release notes: https://github.com/Behat/Behat/releases/tag/v3.30.0

• consolidation/annotated-command updated from 4.10.4 to 4.10.5 patch
  
  See changes: consolidation/annotated-command@4.10.4...4.10.5
  
  Release notes: https://github.com/consolidation/annotated-command/releases/tag/4.10.5

• consolidation/config updated from 3.2.0 to 3.2.1 patch
  
  See changes: consolidation/config@3.2.0...3.2.1
  
  Release notes: https://github.com/consolidation/config/releases/tag/3.2.1

• consolidation/log updated from 3.1.1 to 3.1.2 patch
  
  See changes: consolidation/log@3.1.1...3.1.2
  
  Release notes: https://github.com/consolidation/log/releases/tag/3.1.2

• consolidation/output-formatters updated from 4.7.0 to 4.7.1 patch
  
  See changes: consolidation/output-formatters@4.7.0...4.7.1
  
  Release notes: https://github.com/consolidation/output-formatters/releases/tag/4.7.1

• consolidation/site-alias updated from 4.1.2 to 4.1.3 patch
  
  See changes: consolidation/site-alias@4.1.2...4.1.3
  
  Release notes: https://github.com/consolidation/site-alias/releases/tag/4.1.3

• dantleech/gherkin-lint updated from 0.2.3 to 0.2.4 patch
  
  See changes: dantleech/gherkin-lint-php@0.2.3...0.2.4
  
  Release notes: https://github.com/dantleech/gherkin-lint-php/releases/tag/0.2.4

• drevops/behat-screenshot updated from 2.2.0 to 2.3.0 minor
  
  See changes: drevops/behat-screenshot@2.2.0...2.3.0
  
  Release notes: https://github.com/drevops/behat-screenshot/releases/tag/2.3.0

• drevops/behat-steps updated from 3.5.2 to 3.7.0 minor
  
  See changes: drevops/behat-steps@3.5.2...3.7.0
  
  Release notes: https://github.com/drevops/behat-steps/releases/tag/3.7.0

• drupal/ai updated from 1.3.0 to 1.3.3 patch

• drupal/coder updated from 9.0.0-beta1 to 9.0.0 patch
  
  See changes: pfrenssen/coder@9.0.0-beta1...9.0.0
  
  Release notes: https://github.com/pfrenssen/coder/releases/tag/9.0.0

• drupal/core updated from 11.3.5 to 11.3.7 patch
  
  See changes: drupal/core@11.3.5...11.3.7
  
  Release notes: https://github.com/drupal/core/releases/tag/11.3.7

• drupal/core-composer-scaffold updated from 11.3.5 to 11.3.7 patch
  
  See changes: drupal/core-composer-scaffold@11.3.5...11.3.7
  
  Release notes: https://github.com/drupal/core-composer-scaffold/releases/tag/11.3.7

• drupal/core-recommended updated from 11.3.5 to 11.3.7 patch
  
  See changes: drupal/core-recommended@11.3.5...11.3.7
  
  Release notes: https://github.com/drupal/core-recommended/releases/tag/11.3.7

• drupal/drupal-driver updated from 2.4.0 to 2.4.3 patch
  
  See changes: jhedstrom/DrupalDriver@v2.4.0...v2.4.3
  
  Release notes: https://github.com/jhedstrom/DrupalDriver/releases/tag/v2.4.3

• drupal/drupal-extension updated from 5.2.1 to 5.3.3 minor
  
  See changes: jhedstrom/drupalextension@v5.2.1...v5.3.3
  
  Release notes: https://github.com/jhedstrom/drupalextension/releases/tag/v5.3.3

• drush/drush updated from 13.7.1 to 13.7.2 patch
  
  See changes: drush-ops/drush@13.7.1...13.7.2
  
  Release notes: https://github.com/drush-ops/drush/releases/tag/13.7.2

• ergebnis/composer-normalize updated from 2.50.0 to 2.51.0 minor
  
  See changes: ergebnis/composer-normalize@2.50.0...2.51.0
  
  Release notes: https://github.com/ergebnis/composer-normalize/releases/tag/2.51.0

• ergebnis/json-pointer updated from 3.7.1 to 3.8.0 minor
  
  See changes: ergebnis/json-pointer@3.7.1...3.8.0
  
  Release notes: https://github.com/ergebnis/json-pointer/releases/tag/3.8.0

• justinrainbow/json-schema updated from 6.7.2 to 6.8.0 minor
  
  See changes: jsonrainbow/json-schema@v6.7.2...6.8.0
  
  Release notes: https://github.com/jsonrainbow/json-schema/releases/tag/6.8.0

• laravel/prompts updated from 0.3.14 to 0.3.16 patch
  
  See changes: laravel/prompts@v0.3.14...v0.3.16
  
  Release notes: https://github.com/laravel/prompts/releases/tag/v0.3.16

• maennchen/zipstream-php updated from 3.2.1 to 3.2.2 patch
  
  See changes: maennchen/ZipStream-PHP@3.2.1...3.2.2
  
  Release notes: https://github.com/maennchen/ZipStream-PHP/releases/tag/3.2.2

• mck89/peast updated from 1.17.4 to 1.17.5 patch
  
  See changes: mck89/peast@v1.17.4...v1.17.5
  
  Release notes: https://github.com/mck89/peast/releases/tag/v1.17.5

• mglaman/phpstan-drupal updated from 2.0.11 to 2.0.13 patch
  
  See changes: mglaman/phpstan-drupal@2.0.11...2.0.13
  
  Release notes: https://github.com/mglaman/phpstan-drupal/releases/tag/2.0.13

• openai-php/client updated from 0.19.0 to 0.19.1 patch
  
  See changes: openai-php/client@v0.19.0...v0.19.1
  
  Release notes: https://github.com/openai-php/client/releases/tag/v0.19.1

• phpdocumentor/reflection-docblock updated from 6.0.2 to 6.0.3 patch
  
  See changes: phpDocumentor/ReflectionDocBlock@6.0.2...6.0.3
  
  Release notes: https://github.com/phpDocumentor/ReflectionDocBlock/releases/tag/6.0.3

• phpspec/prophecy updated from 1.26.0 to 1.26.1 patch
  
  See changes: phpspec/prophecy@v1.26.0...v1.26.1
  
  Release notes: https://github.com/phpspec/prophecy/releases/tag/v1.26.1

• phpstan/phpstan updated from 2.1.40 to 2.1.48 patch

• psy/psysh updated from 0.12.21 to 0.12.22 patch
  
  See changes: bobthecow/psysh@v0.12.21...v0.12.22
  
  Release notes: https://github.com/bobthecow/psysh/releases/tag/v0.12.22

• rector/rector updated from 2.3.8 to 2.4.2 minor
  
  See changes: rectorphp/rector@2.3.8...2.4.2
  
  Release notes: https://github.com/rectorphp/rector/releases/tag/2.4.2

• slevomat/coding-standard updated from 8.28.0 to 8.28.1 patch
  
  See changes: slevomat/coding-standard@8.28.0...8.28.1
  
  Release notes: https://github.com/slevomat/coding-standard/releases/tag/8.28.1

• symfony/browser-kit updated from 7.4.4 to 7.4.8 patch
  
  See changes: symfony/browser-kit@v7.4.4...v7.4.8
  
  Release notes: https://github.com/symfony/browser-kit/releases/tag/v7.4.8

• symfony/config updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/config@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/config/releases/tag/v7.4.8

• symfony/console updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/console@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/console/releases/tag/v7.4.8

• symfony/css-selector updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/css-selector@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/css-selector/releases/tag/v7.4.8

• symfony/dependency-injection updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/dependency-injection@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/dependency-injection/releases/tag/v7.4.8

• symfony/dom-crawler updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/dom-crawler@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/dom-crawler/releases/tag/v7.4.8

• symfony/error-handler updated from 7.4.4 to 7.4.8 patch
  
  See changes: symfony/error-handler@v7.4.4...v7.4.8
  
  Release notes: https://github.com/symfony/error-handler/releases/tag/v7.4.8

• symfony/event-dispatcher updated from 7.4.4 to 7.4.8 patch
  
  See changes: symfony/event-dispatcher@v7.4.4...v7.4.8
  
  Release notes: https://github.com/symfony/event-dispatcher/releases/tag/v7.4.8

• symfony/filesystem updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/filesystem@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/filesystem/releases/tag/v7.4.8

• symfony/finder updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/finder@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/finder/releases/tag/v7.4.8

• symfony/http-client updated from 6.4.34 to 6.4.36 patch
  
  See changes: symfony/http-client@v6.4.34...v6.4.36
  
  Release notes: https://github.com/symfony/http-client/releases/tag/v6.4.36

• symfony/http-foundation updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/http-foundation@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/http-foundation/releases/tag/v7.4.8

• symfony/http-kernel updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/http-kernel@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/http-kernel/releases/tag/v7.4.8

• symfony/mailer updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/mailer@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/mailer/releases/tag/v7.4.8

• symfony/mime updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/mime@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/mime/releases/tag/v7.4.8

• symfony/polyfill-php81 updated from 1.33.0 to 1.36.0 minor
  
  See changes: symfony/polyfill-php81@v1.33.0...v1.36.0
  
  Release notes: https://github.com/symfony/polyfill-php81/releases/tag/v1.36.0

• symfony/polyfill-php83 updated from 1.33.0 to 1.36.0 minor
  
  See changes: symfony/polyfill-php83@v1.33.0...v1.36.0
  
  Release notes: https://github.com/symfony/polyfill-php83/releases/tag/v1.36.0

• symfony/process updated from 7.4.5 to 7.4.8 patch
  
  See changes: symfony/process@v7.4.5...v7.4.8
  
  Release notes: https://github.com/symfony/process/releases/tag/v7.4.8

• symfony/psr-http-message-bridge updated from 7.4.4 to 7.4.8 patch
  
  See changes: symfony/psr-http-message-bridge@v7.4.4...v7.4.8
  
  Release notes: https://github.com/symfony/psr-http-message-bridge/releases/tag/v7.4.8

• symfony/routing updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/routing@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/routing/releases/tag/v7.4.8

• symfony/serializer updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/serializer@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/serializer/releases/tag/v7.4.8

• symfony/string updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/string@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/string/releases/tag/v7.4.8

• symfony/translation updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/translation@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/translation/releases/tag/v7.4.8

• symfony/validator updated from 7.4.7 to 7.4.8 patch
  
  See changes: symfony/validator@v7.4.7...v7.4.8
  
  Release notes: https://github.com/symfony/validator/releases/tag/v7.4.8

• symfony/var-dumper updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/var-dumper@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/var-dumper/releases/tag/v7.4.8

• symfony/var-exporter updated from 7.4.0 to 7.4.8 patch
  
  See changes: symfony/var-exporter@v7.4.0...v7.4.8
  
  Release notes: https://github.com/symfony/var-exporter/releases/tag/v7.4.8

• symfony/yaml updated from 7.4.6 to 7.4.8 patch
  
  See changes: symfony/yaml@v7.4.6...v7.4.8
  
  Release notes: https://github.com/symfony/yaml/releases/tag/v7.4.8

• webmozart/assert updated from 2.1.6 to 2.3.0 minor
  
  See changes: webmozarts/assert@2.1.6...2.3.0
  
  Release notes: https://github.com/webmozarts/assert/releases/tag/2.3.0

Summary by CodeRabbit

• Chores

  • Updated framework and development tool dependencies to the latest stable versions for improved security and stability.

• Bug Fixes

  • Improved clamav configuration detection to use strict type comparisons, ensuring the correct antivirus mode is selected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c7a001a4-83b4-4971-9119-fd01a07043e3

📥 Commits

Reviewing files that changed from the base of the PR and between 377d6c5 and 8fc3ba5.

⛔ Files ignored due to path filters (1)

• composer.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• composer.json
• web/modules/custom/do_feed/tests/src/Unit/Hook/PreprocessViewsViewRowRssHookTest.php
• web/sites/default/includes/modules/settings.clamav.php

---

📝 Walkthrough

Walkthrough

This PR updates Composer dependency versions across production (Drupal core, Drush, Symfony HTTP client) and development packages (Behat-related tools, PHPStan, Rector), adjusts test data provider indentation formatting, and modifies ClamAV configuration logic to enforce strict type comparisons in array validation.

Changes

Cohort / File(s)	Summary
Dependency Updates composer.json	Bumped production dependencies: drupal/core-composer-scaffold, drupal/core-recommended (~11.3.5 → ~11.3.7), drush/drush (^13.7.1 → ^13.7.2), symfony/http-client (^6.4.34 → ^6.4.36). Updated dev dependencies: behat/behat, dantleech/gherkin-lint, drevops/behat-screenshot, drevops/behat-steps, drupal/drupal-extension, ergebnis/composer-normalize, mglaman/phpstan-drupal, phpstan/phpstan, rector/rector.
Test Formatting web/modules/custom/do_feed/tests/src/Unit/Hook/PreprocessViewsViewRowRssHookTest.php	Adjusted indentation alignment in dataProviderSkipsNonString() test data provider without altering logic or expected outcomes.
Strict Type Checking web/sites/default/includes/modules/settings.clamav.php	Added strict comparison (TRUE third parameter) to in_array() check for DRUPAL_CLAMAV_MODE to enforce type-safe validation against allowed values.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Update PHP - All packages except core - Minor and patch #160: Contains identical changes to all three modified files with overlapping dependency updates and the same strict in_array() modification.
• Updated core and dependencies. #133: Updates composer.json with overlapping Drupal core and dependency version bumps.
• Upgraded behat steps and added AI instructions to maintain the site. #39: Modifies Behat-related development dependencies in composer.json alongside other tooling updates.

Suggested labels

PR: Dependencies, Dependencies

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Updated Drupal core and contrib modules' accurately reflects the primary change—updating Drupal core and multiple contributed packages, which represents the main scope of this PR.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/drupal-updates-april-2026

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch feature/drupal-updates-april-2026

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}