Merge branch '4.4' into 5.4

* 4.4:
  [Serializer] Fix passing null to str_contains()
  [DependencyInjection] Don't reset env placeholders during compilation
  [HttpClient] Fix overriding default options with null
  [DependencyInjection] Clarify that using expressions in parameters is not allowed
  [GHA] Cancel running CI jobs when a PR is updated
  [Validator] Improve tests for the Image and File constraints
  [Validator][Tests] Fix AssertingContextualValidator not throwing on remaining expectations

Author: nicolas-grekas

Normalizer/AbstractObjectNormalizer.php

@@ -556,7 +556,7 @@ private function validateAndDenormalize(array $types, string $currentClass, stri
             // PHP's json_decode automatically converts Numbers without a decimal part to integers.
             // To circumvent this behavior, integers are converted to floats when denormalizing JSON based formats and when
             // a float is expected.
-            if (Type::BUILTIN_TYPE_FLOAT === $builtinType && \is_int($data) && str_contains($format, JsonEncoder::FORMAT)) {
+            if (Type::BUILTIN_TYPE_FLOAT === $builtinType && \is_int($data) && null !== $format && str_contains($format, JsonEncoder::FORMAT)) {
                 return (float) $data;
             }