Make Dependabot respect Symfony Flex's "extra.symfony.require" setting

Symfony Flex has a feature that allows you to force a version constraint for all Symfony components (even for ones not explicitly defined in user's composer.json):

"extra": {
    "symfony": {
        "require": "5.4.*"
    }
}

This is really useful when Symfony is used as a full-stack framework because it ensures that all components get pinned to the exact same version.

It works great when a developer is manually updating packages (e.g. composer update 'symfony/*' -W).

The problem arises when Dependabot decides to update a dependency that depends on Symfony components. In Dependabot's default configuration, transitive dependencies will get updated as well. This can lead to a project that requires a specific version of Symfony have a mix of different component versions if it lags behind the latest available major version (e.g. a combination of 5.4 and 6.0 components). When this happens, a developer has to manually update packages again (with Composer that has the Symfony Flex plugin loaded) in order to restore the desired component versions.

Would it be possible to bundle Symfony Flex with Dependabot so it's aware of the extra.symfony.require setting?

Start by tracing Dependabot's Composer update path and how it handles transitive dependencies. Review Symfony Flex's extra.symfony.require setting and the linked feature description, then verify that updates preserve the requested Symfony component constraint without requiring a manual Composer update.