Bump the prod-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the prod-dependencies group with 3 updates in the / directory: smarty/smarty, endroid/qr-code and sentry/sentry.

Updates smarty/smarty from 5.8.4 to 5.8.5

Release notes

Sourced from smarty/smarty's releases.

v5.8.5

What's Changed

• Security: prevent attacker-controlled template output from forging a nocache marker that injects raw PHP into the generated cache file when a template is rendered through the extends:/inheritance path
• Fix double semicolon in getRightDelimiter method by @​colemanw in smarty-php/smarty#1202

Full Changelog: smarty-php/smarty@v5.8.4...v5.8.5

Changelog

Sourced from smarty/smarty's changelog.

[5.8.5] - 2026-10-04

• Security: prevent attacker-controlled template output from forging a nocache marker that injects raw PHP into the generated cache file when a template is rendered through the extends:/inheritance path

Commits

• 0ae6635 Merge branch 'release/5.8.5'
• 0471b1c version bump
• c0fdd48 Security: prevent nocache-marker forgery leading to cache-poisoning RCE
• 0086ada update local unit test suite:
• 0193091 Update SECURITY.md
• 1f9eef5 Fix double semicolon in getRightDelimiter method (#1202)
• See full diff in compare view

Updates endroid/qr-code from 6.0.9 to 6.1.3

Commits

• 5fa5348 Move GdWriter to GdTrait
• 1cf9904 Readonly back to avoid BC issues
• b44cb6e Fix error check
• 5806f69 Use composition instead of inheritance
• f0fe689 Remove readonly from abstract GD writer
• 5a74873 Update supported versions
• See full diff in compare view

Updates sentry/sentry from 4.32.0 to 4.34.0

Release notes

Sourced from sentry/sentry's releases.

4.34.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.34.0.

Features

• Add the $includeChannel argument to the Monolog LogsHandler to attach the Monolog channel as the channel attribute on Sentry logs. [(#2029)](getsentry/sentry-php#2029)

  $logger->pushHandler(new \Sentry\Monolog\LogsHandler(LogLevel::info(), true, true));

Bug Fixes

• Always filter "remember me" cookies, such as Laravel's remember_web_* and Symfony's REMEMBERME, when collecting HTTP data. [(#2250)](getsentry/sentry-php#2250)
• Collect cleared cookies with an empty value instead of [Filtered]. [(#2250)](getsentry/sentry-php#2250)
• Replace invalid UTF-8 in collected HTTP bodies instead of filtering the whole body, and stop escaping non-ASCII characters. [(#2250)](getsentry/sentry-php#2250)

Misc

• Cache source code excerpts per event in FrameContextifierIntegration so duplicate frames don't read the same file again. [(#2163)](getsentry/sentry-php#2163)

4.33.2

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.2.

Bug Fixes

• Collect cookies as string arrays in the form of key=value instead of maps and bodies as JSON strings. [(#2246)](getsentry/sentry-php#2246)

Misc

• Only read the request body in RequestIntegration for error events, as it is not used for transactions. [(#2247)](getsentry/sentry-php#2247)
• Add HttpSpanDataCollector to share HTTP span attribute names and formats with the framework integrations. [(#2246)](getsentry/sentry-php#2246)

4.33.1

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.1.

Bug Fixes

• Join multiple values of the same header into a single comma-separated string in Guzzle span data. [(#2241)](getsentry/sentry-php#2241)

4.33.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.0.

Features

• Add the data_collection option to control which potentially sensitive data the SDK collects. Setting it to any value other than null opts into the new behavior and ignores send_default_pii. [(#2227)](getsentry/sentry-php#2227)

  \Sentry\init([
      'dsn' => '__YOUR_DSN__',

... (truncated)

Changelog

Sourced from sentry/sentry's changelog.

4.34.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.34.0.

Features

• Add the $includeChannel argument to the Monolog LogsHandler to attach the Monolog channel as the channel attribute on Sentry logs. [(#2029)](getsentry/sentry-php#2029)

  $logger->pushHandler(new \Sentry\Monolog\LogsHandler(LogLevel::info(), true, true));

Bug Fixes

• Always filter "remember me" cookies, such as Laravel's remember_web_* and Symfony's REMEMBERME, when collecting HTTP data. [(#2250)](getsentry/sentry-php#2250)
• Collect cleared cookies with an empty value instead of [Filtered]. [(#2250)](getsentry/sentry-php#2250)
• Replace invalid UTF-8 in collected HTTP bodies instead of filtering the whole body, and stop escaping non-ASCII characters. [(#2250)](getsentry/sentry-php#2250)

Misc

• Cache source code excerpts per event in FrameContextifierIntegration so duplicate frames don't read the same file again. [(#2163)](getsentry/sentry-php#2163)

4.33.2

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.2.

Bug Fixes

• Collect cookies as string arrays in the form of key=value instead of maps and bodies as JSON strings. [(#2246)](getsentry/sentry-php#2246)

Misc

• Only read the request body in RequestIntegration for error events, as it is not used for transactions. [(#2247)](getsentry/sentry-php#2247)
• Add HttpSpanDataCollector to share HTTP span attribute names and formats with the framework integrations. [(#2246)](getsentry/sentry-php#2246)

4.33.1

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.1.

Bug Fixes

• Join multiple values of the same header into a single comma-separated string in Guzzle span data. [(#2241)](getsentry/sentry-php#2241)

4.33.0

The Sentry SDK team is happy to announce the immediate availability of Sentry PHP SDK v4.33.0.

Features

• Add the data_collection option to control which potentially sensitive data the SDK collects. Setting it to any value other than null opts into the new behavior and ignores send_default_pii. [(#2227)](getsentry/sentry-php#2227)

... (truncated)

Commits

• 3d8f4e5 release: 4.34.0
• 63bd141 Prepare 4.34.0 (#2252)
• 0e7a2f8 chore(deps): bump PHPStan to v2.2 (#2251)
• 3947405 feat(logs): Add Monolog channel to compiled log attributes (#2029)
• 1fdc4a2 perf: introduce source code caching to improve duplicate frames (#2163)
• 44ecf26 ref(pii): deprecate methods and use JSON::encode (#2250)
• 095e6dc Merge commit '8a0556ccb6cdcdce81f9af4ca8714c22cff2e003'
• 8a0556c release: 4.33.2
• f52f588 ci: Use a floating tag for Craft action (#2249)
• ecf1f84 prepare 4.33.2 (#2248)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions