feat: add section about composer extra.symfony.require

alexislefebvre · alexislefebvre · commit 9f48c3320a86 · 2024-09-07T17:33:06.000+02:00
diff --git a/setup.rst b/setup.rst
@@ -282,6 +282,19 @@ create new projects. If you use Composer, you need to tell the exact version:
 
     $ composer create-project symfony/skeleton:"^5.4" my_project_directory
 
+With an already existing project, you can restrict Symfony packages to one
+LTS version by :doc:`using Symfony Flex in your project </setup/flex>`
+and setting the ``extra.symfony.require`` config:
+
+.. code-block:: terminal
+
+    $ composer config extra.symfony.require "5.4.*"
+
+.. warning::
+
+    Tools like dependabot may ignore this setting and upgrade the Symfony dependencies,
+    see this `GitHub issue about dependabot`_.
+
 The Symfony Demo application
 ----------------------------
 
@@ -316,6 +329,7 @@ Learn More
 .. _`Install Composer`: https://getcomposer.org/download/
 .. _`install the Symfony CLI`: https://symfony.com/download
 .. _`symfony-cli/symfony-cli GitHub repository`: https://github.com/symfony-cli/symfony-cli
+.. _`GitHub issue about dependabot`: https://github.com/dependabot/dependabot-core/issues/4631
 .. _`The Symfony Demo Application`: https://github.com/symfony/demo
 .. _`Symfony Flex`: https://github.com/symfony/flex
 .. _`PHP security advisories database`: https://github.com/FriendsOfPHP/security-advisories
