Merge branch '7.4' into 8.0

* 7.4:
  [Console] ensure `SHELL_VERBOSITY` is always restored properly
  [Console] Add support for `Cursor` helper in invokable commands
  [MonologBridge] Improve error when HttpClient contract is installed but not the component
  simplify LogoutListenerTest
  forbid HTTP method override of GET, HEAD, CONNECT and TRACE
  [HttpClient] Add option `auto_upgrade_http_version` to control how the request HTTP version is handled in `HttplugClient` and `Psr18Client`
  [Security] Allow multiple OIDC discovery endpoints
  [AssetMapper] Fix links to propshaft
  Document BC break in AbstractController::render

Author: xabbuh

Request.php

@@ -693,6 +693,10 @@ public static function getHttpMethodParameterOverride(): bool
      */
     public static function setAllowedHttpMethodOverride(?array $methods): void
     {
+        if (array_intersect($methods ?? [], ['GET', 'HEAD', 'CONNECT', 'TRACE'])) {
+            throw new \InvalidArgumentException('The HTTP methods "GET", "HEAD", "CONNECT", and "TRACE" cannot be overridden.');
+        }
+
         self::$allowedHttpMethodOverride = $methods;
     }
 

Tests/RequestTest.php

@@ -297,6 +297,17 @@ public function testHttpMethodOverrideRespectsAllowedListWithParameter()
         }
     }
 
+    #[TestWith(['CONNECT'])]
+    #[TestWith(['GET'])]
+    #[TestWith(['HEAD'])]
+    #[TestWith(['TRACE'])]
+    public function testHttpMethodOverrideCannotBeAppliedToCertainMethods(string $httpOverrideMethod)
+    {
+        $this->expectException(\InvalidArgumentException::class);
+
+        Request::setAllowedHttpMethodOverride([$httpOverrideMethod]);
+    }
+
     public function testCreateWithRequestUri()
     {
         $request = Request::create('http://test.com:80/foo');