Roave/SecurityAdvisories@8e5526bbc66bcd7689664e6654c7ebc2acb983da didn't pick up `"doctrine/orm": ">=2.5.0,<2.5.1"` (defined in [`doctrine/orm/2015-08-31.yaml`](https://github.com/Ocramius/security-advisories/blob/a579dad6b78a429a04e1568f10d3661766dcb78c/doctrine/orm/2015-08-31.yaml#L9)) This needs investigation.