BC break in 7.4.0: Configuration path "security.access_control" cannot be overwritten #62547
Description
Symfony version(s) affected
7.4.0
Description
We have a test in CI that installs Mautic for production which started to fail today with error
> generate-assets: bin/console mautic:assets:generate
Executing command (CWD): bin/console mautic:assets:generate
In BaseNode.php line 313:
[Symfony\Component\Config\Definition\Exception\ForbiddenOverwriteException]
Configuration path "security.access_control" cannot be overwritten. You have to define all options for this path, and any of its sub-paths in one configuration section.
Exception trace:
at /var/www/html/test_composer/vendor/symfony/config/Definition/BaseNode.php:313
Symfony\Component\Config\Definition\BaseNode->merge() at /var/www/html/test_composer/vendor/symfony/config/Definition/ArrayNode.php:369
Symfony\Component\Config\Definition\ArrayNode->mergeValues() at /var/www/html/test_composer/vendor/symfony/config/Definition/BaseNode.php:345
Symfony\Component\Config\Definition\BaseNode->merge() at /var/www/html/test_composer/vendor/symfony/config/Definition/Processor.php:33
Symfony\Component\Config\Definition\Processor->process() at /var/www/html/test_composer/vendor/symfony/config/Definition/Processor.php:46
Symfony\Component\Config\Definition\Processor->processConfiguration() at /var/www/html/test_composer/vendor/symfony/dependency-injection/Extension/Extension.php:113
Symfony\Component\DependencyInjection\Extension\Extension->processConfiguration() at /var/www/html/test_composer/vendor/symfony/security-bundle/DependencyInjection/SecurityExtension.php:104
Symfony\Bundle\SecurityBundle\DependencyInjection\SecurityExtension->load() at /var/www/html/test_composer/vendor/symfony/dependency-injection/Compiler/MergeExtensionConfigurationPass.php:81
Symfony\Component\DependencyInjection\Compiler\MergeExtensionConfigurationPass->process() at /var/www/html/test_composer/vendor/symfony/http-kernel/DependencyInjection/MergeExtensionConfigurationPass.php:40
Symfony\Component\HttpKernel\DependencyInjection\MergeExtensionConfigurationPass->process() at /var/www/html/test_composer/vendor/symfony/dependency-injection/Compiler/Compiler.php:73
Symfony\Component\DependencyInjection\Compiler\Compiler->compile() at /var/www/html/test_composer/vendor/symfony/dependency-injection/ContainerBuilder.php:820
Symfony\Component\DependencyInjection\ContainerBuilder->compile() at /var/www/html/test_composer/vendor/symfony/http-kernel/Kernel.php:505
Symfony\Component\HttpKernel\Kernel->initializeContainer() at /var/www/html/test_composer/docroot/app/AppKernel.php:237
AppKernel->boot() at /var/www/html/test_composer/vendor/symfony/framework-bundle/Console/Application.php:195
Symfony\Bundle\FrameworkBundle\Console\Application->registerCommands() at /var/www/html/test_composer/vendor/symfony/framework-bundle/Console/Application.php:69
Symfony\Bundle\FrameworkBundle\Console\Application->doRun() at /var/www/html/test_composer/vendor/symfony/console/Application.php:195
Symfony\Component\Console\Application->run() at /var/www/html/test_composer/bin/console:16
Script bin/console mautic:assets:generate handling the generate-assets event returned with error code 1
Script @generate-assets was called via post-update-cmd
I confirmed it's not related with the latest changes that were merged as it fails with commits merged a month ago.
It also doesn't fail on our DDEV because it has the Symfony versions locked in composer.lock but when installing for production it will take the latest Symfony 7 release.
I noticed that the version 7.4.0 was released yesterday so it looks very likely that is the root cause of the failed CI check.
I'm still investigating. Just wanted to report this ASAP.
The error looks very similar to the one reported here: #40071
How to reproduce
composer create-project mautic/recommended-project:^7.0.0-rc . --no-interaction -vvv
Possible Solution
No response
Additional Context
This is where Mautic defines security.access_control:
https://github.com/mautic/mautic/blob/7.x/app/config/security.php#L143-L157