Support symfony/cache-contracts 3.x for TYPO3 v13 / Symfony security update

[mm-baer]

Hi,
while updating a TYPO3 v13 LTS project, I ran into a dependency conflict caused by the current Composer constraint for symfony/cache-contracts.
Environment
TYPO3 13.4.32
PHP 8.3
evoweb/extender 11.1.2
Problem
The recently published security fix for symfony/cache (CVE-2026-45073) requires:
symfony/cache >= 7.4.12
This version in turn requires:
symfony/cache-contracts ^3.6
However, evoweb/extender currently requires:
"symfony/cache-contracts": "^2.5.3"
which prevents updating symfony/cache to a non-vulnerable version.
Composer reports:
evoweb/extender 11.1.2 requires symfony/cache-contracts ^2.5.3
Suggested solution
Would it be possible to widen the constraint to support both major versions?
"symfony/cache-contracts": "^2.5.3 || ^3.6"

From my understanding, evoweb/extender does not depend on APIs that changed incompatibly between cache-contracts 2.x and 3.x, so this should be a safe compatibility extension. Of course, this should be verified by your test suite.

Thanks for taking a look.

Bernhard

[garbast]

The develop branch is updated to your suggestion. Please check on your machine and give feedback. If positive, I'll release the change this weekend.