diff --git a/RELEASE-NOTES-1.40 b/RELEASE-NOTES-1.40
index fdfcf6eef96..28d09637e64 100644
--- a/RELEASE-NOTES-1.40
+++ b/RELEASE-NOTES-1.40
@@ -46,6 +46,7 @@ For notes on 1.39.x and older releases, see HISTORY.
 
 ==== Changed external libraries ====
 * Updated codex, codex-search, and codex-icons from v0.1.1 to v0.2.1.
+* Updated symfony/yaml from 5.4.10 to 5.4.12.
 
 ===== Changed development-only external libraries =====
 * …
diff --git a/composer.json b/composer.json
index 0b5fea2fcd0..06af5ef368b 100644
--- a/composer.json
+++ b/composer.json
@@ -48,7 +48,7 @@
 		"ralouphie/getallheaders": "3.0.3",
 		"symfony/polyfill-php73": "1.26.0",
 		"symfony/polyfill-php80": "1.26.0",
-		"symfony/yaml": "5.4.10",
+		"symfony/yaml": "5.4.12",
 		"wikimedia/assert": "0.5.1",
 		"wikimedia/at-ease": "2.1.0",
 		"wikimedia/base-convert": "2.0.2",