diff --git a/CHANGELOG.md b/CHANGELOG.md
index 65e660b..3c6f8a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 where applicable.
 
+## 1.0.6 — 2026-10-09
+
+- Require maintained Symfony Routing and YAML 8.1 or newer, excluding the vulnerable 8.0 releases covered by the May 2026 advisories.
+- Require Symfony DependencyInjection 8.1.8 or newer to preserve reused environment placeholders during extension configuration and container dumping.
+
 ## 1.0.5 — 2026-10-05
 
 - Reconstruct complete configuration for lint/debug commands when the kernel reuses a compiled container. Avoid compiling a partial warm facade that lacks Twig services; retain the running runtime container.
diff --git a/composer.json b/composer.json
index 985f377..ef0f7d3 100644
--- a/composer.json
+++ b/composer.json
@@ -18,15 +18,15 @@
         "symfony/cache-contracts": "^3.6",
         "symfony/config": "^8.1",
         "symfony/console": "^8.1",
-        "symfony/dependency-injection": "^8.1",
+        "symfony/dependency-injection": "^8.1.8",
         "symfony/error-handler": "^8.1",
         "symfony/expression-language": "^8.0",
         "symfony/filesystem": "^8.0",
         "symfony/framework-bundle": "^8.1",
         "symfony/http-kernel": "^8.1",
-        "symfony/routing": "^8.0",
+        "symfony/routing": "^8.1",
         "symfony/service-contracts": "^3.6",
-        "symfony/yaml": "^8.0",
+        "symfony/yaml": "^8.1",
         "sympress/kernel": "^1.1.1"
     },
     "require-dev": {
diff --git a/docs/upstream-debug-dump.md b/docs/upstream-debug-dump.md
new file mode 100644
index 0000000..6fe61d9
--- /dev/null
+++ b/docs/upstream-debug-dump.md
@@ -0,0 +1,26 @@
+# Native debug-container dumps
+
+`SymPressFrameworkBundle::build()` already calls the native Symfony
+`FrameworkBundle::build()`. This registers Symfony's
+`ContainerBuilderDebugDumpPass`, so the Symfony 8.2 optimization is inherited when
+a stable 8.2 version is installed through the existing `^8.1` dependency ranges.
+The upstream change is in that compiler pass, not in `PhpDumper`. No additional
+SymPress cloning or dumping implementation is needed.
+
+The existing package tests exercise native framework service construction and
+fresh debug-container reconstruction, including an optimized snapshot. The
+native 8.2 dump pass has also been checked with synthetic environment parameters
+and a shared service definition: it produces usable XML/serialized dumps without
+mutating the original service arguments. That is a compatibility check, not a
+SymPress performance measurement.
+
+Symfony 8.2 is not yet stable as of 2026-10-09. This release retains stable
+dependencies and does not claim the upstream speed improvement is active on 8.1.
+The later native compile-time environment log can be inspected on an explicit
+fresh build as described in the Kernel's
+[diagnostic guide](https://github.com/SymPress/kernel/blob/main/docs/compile-time-environment.md).
+Framework's container debug command uses Symfony's native descriptors; Kernel's
+own command lists remaining placeholders and is a separate implementation.
+
+Sources: [Symfony PR 66343](https://github.com/symfony/symfony/pull/66343),
+[official performance article](https://symfony.com/blog/new-in-symfony-8-2-performance-improvements).