Backend Frameworks Release Notes

Updates for frameworks for building server applications, web APIs, and backend services.

Get this feed:

Products (7)

Latest Backend Frameworks Updates

Nov 11, 2026
Date parsed from source:
Nov 11, 2026

First seen by Releasebot:
Nov 11, 2026
Hono

v4.13.18

Hono releases security fixes for request validation, body memory handling, mounted paths, and static file serving. The updates address cases that could skip validation, exhaust memory, misroute requests, or serve files through inconsistent path decoding.
Security fixes

This release includes fixes for the following security issues:

validator() skips validation for requests whose Content-Type parameters are formatted differently

Affects: validator('json') and validator('form') in hono/validator. A Content-Type with whitespace before ;, a trailing ;, or an unusual parameter name was not recognized, so the validator saw an empty object while the handler could read all fields. This completes the fix for GHSA-4h7h-rv7c-7m2v. The validator now decides by the media type alone, as c.req.parseBody() does. GHSA-92p4-j3wq-jmqx

bodyLimit() keeps every transfer chunk of a request body in memory

Affects: bodyLimit() in hono/body-limit. A body sent in very small transfer chunks was retained as one object per chunk, so a request within the configured limit could exhaust memory. The body is now buffered in one array bounded by maxSize. GHSA-39q9-qp46-w8xg

mount() and app.mount() forward a wrong path when a custom getPath adds a prefix

Affects: mount() in hono/mount and app.mount() on 4.13.16 and 4.13.17. With a getPath that prepends a prefix such as the host name, one segment too many was removed from the forwarded path, so middleware scoped inside the mount prefix could be skipped. The prefix is removed from the routed path again. Paths that would change meaning when forwarded now get 400, and an optional regular expression parameter in a mount path throws. GHSA-h25j-2p75-qj33

serveStatic() serves a path that was decoded twice when allowPercentInPath is enabled

Affects: serveStatic() in hono/serve-static and the runtime adapters, only with allowPercentInPath: true. A malformed percent escape in the request path was decoded a second time, so a path that middleware registered on the encoded form did not see could still reach a static file. The file path must now be the same as the routed path, and otherwise the response is 404. GHSA-74fm-fwc7-3fwp

Users who rely on validator(), bodyLimit(), mount() with a custom getPath, or serveStatic() with allowPercentInPath are strongly encouraged to upgrade to this version.

Full Changelog: v4.13.17...v4.13.18
Original source
Nov 10, 2026
Date parsed from source:
Nov 10, 2026

First seen by Releasebot:
Nov 11, 2026
FastAPI by Tiangolo

0.162.4

FastAPI adds an official coding-agent skill for version-aware guidance and requires AnyIO 4.1.0 or newer at runtime.
FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Fixes

🐛 Require AnyIO 4.1.0 or newer at runtime. PR #16730 by @tiangolo.

Original source
All of your release notes in one feed

Join Releasebot and get updates from Hono and hundreds of other software products.

Create account
Get updates with:
Nov 10, 2026
Date parsed from source:
Nov 10, 2026

First seen by Releasebot:
Nov 11, 2026
FastAPI by Tiangolo

0.162.3

FastAPI adds Python 3.15 support, updates Pydantic, and introduces an official skill to help coding agents follow version-specific features and recommended patterns. The release also refreshes the documentation theme and expands translated docs.
FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Upgrades

⬆️ Add support for Python 3.15. PR #16727 by @tiangolo.

⬆️ Update locked Pydantic to 2.14.3. PR #16728 by @tiangolo.

⬆️ Upgrade markdown-include-variants to 0.0.10. PR #16705 by @tiangolo.

Docs

📝 Adopt unversioned snippets and _non_an variants. PR #16707 by @tiangolo.

🎨 Use the Zensical modern theme for docs. PR #16701 by @tiangolo.

🐛 Fix AI coding agent notice links in previews. PR #16700 by @tiangolo.

📝 Add an AI coding agent notice to the docs. PR #16699 by @tiangolo.

Translations

🌐 Update Traditional Chinese translations. PR #16719 by @tiangolo.

🌐 Update Chinese translations. PR #16718 by @tiangolo.

🌐 Update Ukrainian translations. PR #16717 by @tiangolo.

🌐 Update Turkish translations. PR #16716 by @tiangolo.

🌐 Update Russian translations. PR #16715 by @tiangolo.

🌐 Update Portuguese translations. PR #16714 by @tiangolo.

🌐 Update Korean translations. PR #16713 by @tiangolo.

🌐 Update Japanese translations. PR #16712 by @tiangolo.

🌐 Update Hindi translations. PR #16711 by @tiangolo.

🌐 Update French translations. PR #16710 by @tiangolo.

🌐 Update Spanish translations. PR #16709 by @tiangolo.

🌐 Update German translations. PR #16708 by @tiangolo.

🌐 Update Korean translations to match the English docs. PR #16706 by @tiangolo.

Internal

🔥 Remove obsolete docs snippet commands. PR #16724 by @tiangolo.

🐛 Preserve snippet variants when cleaning up docs sources. PR #16722 by @tiangolo.

Original source
Nov 9, 2026
Date parsed from source:
Nov 9, 2026

First seen by Releasebot:
Nov 10, 2026
fiber by gofiber

v3.7.0

fiber releases an update focused on safer request handling, with map-based query and form binding, tighter static-file symlink protections, and controls for sensitive headers on redirects. It also improves performance and fixes issues across routing, middleware, clients, and caching.
🚀 New

Update fasthttp to v1.78.0 (#4779, #4803, #4862)

fasthttp v1.78.0 (from v1.75.0) hardens request framing, multipart parsing, redirects and file serving, and speeds up path normalization, query parsing, header setters and Client.Do.

https://github.com/valyala/fasthttp/releases/tag/v1.78.0

Support map fields in query and form binding (#4788)

Struct fields of type map[string]T now bind from query strings and form bodies; attributes[color] and attributes.color both give the key color.

type Filter struct { Attributes map[string]string `query:"attributes"` // ?attributes[color]=red&attributes.size=m Tags map[string][]string `query:"tags"` // ?tags[sale]=yes&tags[sale]=new Limits map[string]int `query:"limits"` // ?limits[max]=5 }

https://docs.gofiber.io/api/bind#map-fields

Add AllowSymlinksOutsideRoot to the static middleware (#4803)

A root on disk is now confined: symbolic links that leave it, and absolute ones, are handled like missing files unless AllowSymlinksOutsideRoot is set.

app.Use("/assets", static.New("./public", static.Config{ AllowSymlinksOutsideRoot: true, // default: false }))

https://docs.gofiber.io/middleware/static#config

Let proxy.DoRedirects and the Fiber client drop extra sensitive headers on a redirect (#4800)

New opt-in RedirectSensitiveHeaders on proxy.SecurityPolicy and the client (Client, Request, Config) names headers such as X-Api-Key that a redirect to another origin (proxy) or host (client) drops; empty by default.

policy := proxy.DefaultSecurityPolicy() policy.RedirectSensitiveHeaders = []string{"X-Api-Key", "X-Auth-Token"} proxy.WithSecurityPolicy(policy) cli := client.New().SetRedirectSensitiveHeaders("X-Api-Key")

https://docs.gofiber.io/middleware/proxy#headers-on-a-cross-origin-redirect

🧹 Updates

Share host splitting and IDNA folding (#4851)

Align forwarded header list parsing (#4847)

Share forwarded IP scanning and ignore empty elements (#4820)

Share redirect URL normalization (#4824)

Speed up media type parameter parsing (#4807)

Avoid allocations for empty typed lookups (#4852)

Consolidate control-character scanning (#4783)

cache/limiter: Walk Cache-Control lists with headerlist and write Retry-After without a string (#4833)

cors/csrf: Share origin allow-list parsing (#4836)

encryptcookie: Build the AEAD once per middleware instead of per cookie (#4838)

etag: Checksum bodies with slicing-by-8 (#4794)

limiter: Format rate-limit header values without allocating (#4822)

proxy: Copy the forwarder name before storing it in the refused-request test (#4819)

redirect/rewrite: Share pattern compilation (#4846)

Share the client cookie jar host normalization (#4844)

Share the value-redaction helper across middleware (#4821)

Deduplicate the unit tests with shared helpers (#4825)

Use a nolint:revive directive on App.Handler (#4831)

🐛 Fixes

Stop optional path parameters from swallowing a slash (#4778)

Stat the index for directory SendFile ranges and move the path guards into internal/fspath (#4769)

Skip empty forwarded host and proto elements and restore the Next loop (#4856)

Preserve nil first field lines when joining headers (#4840)

Return an empty charset when its value is not a token (#4781)

Preserve redirects and errors in Fresh checks (#4811)

Trim the whitespace around comma-split header values in Bind (#4793)

Reject out-of-range int and uint in generic parsers on 32-bit (#4832)

Make Links add to the Link header instead of replacing it (#4829)

Serve a request with a TLS state over TLS in app.Test (#4839)

Send the measured Content-Length of an unsized body in app.Test (#4830)

Make Listen return when GracefulContext is done during startup (#4770)

cache: End cached entries when a revalidation is refused with 401, 403 or 407 (#4785)

cache: Release the lock when CacheInvalidator panics and simplify the lock flow (#4765)

cache/proxy/session: Close the gaps found auditing the recent merges (#4855)

compress: Honor repeated and quoted response Cache-Control lines (#4802)

encryptcookie: Handle duplicate cookie names (#4774)

hostauthorization: Compare IPv6 hosts by address, not by spelling (#4798)

hostauthorization: Bound the port value, not its digit count (#4796)

idempotency: Exclude unchanged upstream headers from storage (#4834)

idempotency/proxy: Stop cookie replay and refuse path parameters (#4791)

keyauth: Omit the Bearer error parameters from the challenge when no credentials are sent (#4837)

limiter: Fix spec mismatches and consolidate its code and tests (#4762)

limiter/proxy: Fix key aliasing and the redirect, SSRF and Balancer issues (#4784)

static: Refuse a path with an empty first segment on a root mount (#4772)

Synchronize client cookie jar reads during initialization (#4843)

Return each key once from the client's QueryParam.Keys and FormData.Keys (#4776)

Copy client response header keys before reading their values (#4771)

Fix header, body, routing and session handling defects (#4850)

🛠️ Maintenance

20 changes

bump github.com/valyala/fasthttp from 1.77.0 to 1.78.0 in the fasthttp-modules group (#4862)

bump github.com/shamaton/msgpack/v3 from 3.2.6 to 3.2.7 (#4863)

bump github.com/gofiber/schema from 1.9.2 to 1.9.3 (#4853)

bump github.com/gofiber/utils/v2 from 2.6.3 to 2.6.4 (#4845)

bump go.yaml.in/yaml/v3 from 3.0.5 to 3.0.6 (#4835)

bump github.com/gofiber/schema from 1.9.1 to 1.9.2 (#4823)

bump github.com/fxamacker/cbor/v2 from 2.9.6 to 2.10.0 (#4816)

bump golang.org/x/net from 0.61.0 to 0.62.0 in the golang-modules group across 1 directory (#4812)

bump DavidAnson/markdownlint-cli2-action from 24.2.0 to 25.0.0 (#4813)

bump github.com/gofiber/schema from 1.9.0 to 1.9.1 (#4810)

bump github.com/gofiber/utils/v2 from 2.6.2 to 2.6.3 (#4808)

bump github.com/valyala/fasthttp from 1.76.0 to 1.77.0 in the fasthttp-modules group (#4803)

bump github.com/molecule-man/go-brrr from 1.3.0 to 1.3.1 (#4805)

bump github.com/shamaton/msgpack/v3 from 3.2.5 to 3.2.6 (#4804)

bump github.com/gofiber/schema from 1.8.8 to 1.9.0 (#4787)

bump github.com/shamaton/msgpack/v3 from 3.2.4 to 3.2.5 (#4786)

bump streetsidesoftware/cspell-action from 9.1.0 to 9.2.0 (#4782)

bump github.com/valyala/fasthttp from 1.75.0 to 1.76.0 in the fasthttp-modules group (#4779)

bump github.com/philhofer/fwd from 1.2.0 to 1.2.1 (#4780)

bump github.com/shamaton/msgpack/v3 from 3.2.3 to 3.2.4 (#4766)

📚 Documentation

Add a Migrate section to the README (#4790)

Update ctx and intro examples (#4806)

Explain bounding proxy-derived storage keys (#4841)

Explain client and server redirect control-byte policies (#4842)

logger: Explain the ignored SendStatus error in the fallback handler (#4826)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: v3.6.1...v3.7.0

Thank you @10kartik, @Alifarid0011, @anqorithm, @appdever01, @arditxhuveli1, @b84330808, @Dev-next-gen, @ElsiPotka, @fadiromdhan3, @fadiroot, @gaby, @helmipradita, @IslamElsayed, @kaankucukx, @ninadsutrave, @nk-batman21, @PerryLink, @Rachit-Gandhi, @ReneWerner87, @RS-ITACHI, @via2004, @YOGESH256 and @yxshee for making this release possible.
Original source
Nov 7, 2026
Date parsed from source:
Nov 7, 2026

First seen by Releasebot:
Nov 8, 2026
Hono

v4.13.17

Hono releases a maintenance update with fixes across cookies, URL parsing, response handling, content negotiation, timing metrics, JSX security, static site generation, AWS Lambda headers, and handler types.
What's Changed

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in #5608

fix(utils/url): do not match a query key across separators in #5607

fix(etag,pretty-json): cancel the discarded response body in #5606

fix(client): detect the JSON media type with whitespace before a parameter in #5609

fix(timing): honor a precision of 0 in setMetric in #5363

fix(utils/mime,ssg): match media types case-insensitively in #5449

fix(timing): escape double quotes and backslashes in Server-Timing descriptions in #5478

fix(etag): preserve commas within quoted entity tags in #5353

fix(accepts): preserve exact media type quality over subtype wildcards in #5427

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in #5611

fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in #5430

fix(ssg): do not reuse created directories across toSSG runs in #5381

fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in #5483

fix(jsx): escape element and object attribute values in #5512

fix(jsx): do not render ref objects as attributes in #5615

fix(factory): keep independent return types for nine handlers in #5618

Full Changelog: v4.13.16...v4.13.17
Original source
Nov 7, 2026
Date parsed from source:
Nov 7, 2026

First seen by Releasebot:
Nov 8, 2026
Filament

v5.11.2

Filament releases v5.11.2 with broad fixes for tables, imports, rich content, search, and accessibility, plus configurable CSV import encoding and Czech and Spanish translation updates.
What's Changed

fix: prevent group selection from collapsing layout tables by @people-sea in #20938

fix: preserve image alignment in rendered prose by @danharrin in #20940

fix: render the static menu ARIA attributes of grouped actions on the server by @webard in #20937

Fix: only cascade action group visibility cache clearing after calling an action by @webard in #20936

Add missing Czech translations for JavaScript components by @kojdad-alt in #20949

feat: allow configuring CSV import encoding by @danharrin in #20951

fix: render grouped table headers and summaries as list items by @people-sea in #20950

Translate missing keys to Spanish (js fields) by @luisprmat in #20953

fix: delay retries for overlapping import chunks by @danharrin in #20955

chore: align form-specific API naming by @danharrin in #20956

fix: avoid empty group list items by @people-sea in #20954

fix: preserve policy response statuses on resource pages by @danharrin in #20957

fix: collapsible content layout drops group and selection classes on records by @wit3 in #20952

Fix dropdown closing on window resize after opening it from its trigger by @jayhemnani9910 in #20966

Keep global search key bindings working after results are rendered by @intrepidws in #20963

fix: remove empty drop-label space from disabled uploads by @danharrin in #20972

fix: ignore Enter while an IME is composing text in TagsInput by @cable8mm in #20969

fix: show placeholders for empty rich content by @danharrin in #20974

fix: normalize enum record titles by @danharrin in #20973

fix: correct rich editor image spacing and CSS ownership by @danharrin in #20975

fix: support latest Rector in v4 upgrades by @danharrin in #20976

fix: preserve explicitly disabled chart legends by @danharrin in #20977

fix: resolve nested attachment originals safely by @danharrin in #20978

fix: respect hidden labels in specialized table summarizers by @danharrin in #20980

fix: respect SelectColumn option searchability when limiting preloads by @danharrin in #20979

fix: preserve rich editor mention labels across providers by @danharrin in #20981

fix: limit each Range summarizer endpoint independently by @danharrin in #20982

fix: normalize default child content by @danharrin in #20983

fix: correct PostgreSQL search identifier quoting by @danharrin in #20984

fix: prevent vertical tab navigation from stretching by @danharrin in #20986

fix: preserve scroll position when submitting modals inside tabs by @danharrin in #20987

New Contributors

@jayhemnani9910 made their first contribution in #20966

@cable8mm made their first contribution in #20969

Full Changelog: v5.11.1...v5.11.2
Original source
Nov 7, 2026
Date parsed from source:
Nov 7, 2026

First seen by Releasebot:
Nov 8, 2026
Filament

v4.16.2

Filament releases an update that adds configurable CSV import encoding and improves reliability across tables, rich content, forms, search, and uploads, alongside fixes for accessibility, translations, and layout behavior.
What's Changed

fix: prevent group selection from collapsing layout tables by @people-sea in #20938

fix: preserve image alignment in rendered prose by @danharrin in #20940

fix: render the static menu ARIA attributes of grouped actions on the server by @webard in #20937

Fix: only cascade action group visibility cache clearing after calling an action by @webard in #20936

Add missing Czech translations for JavaScript components by @kojdad-alt in #20949

feat: allow configuring CSV import encoding by @danharrin in #20951

fix: render grouped table headers and summaries as list items by @people-sea in #20950

fix: delay retries for overlapping import chunks by @danharrin in #20955

chore: align form-specific API naming by @danharrin in #20956

fix: avoid empty group list items by @people-sea in #20954

fix: preserve policy response statuses on resource pages by @danharrin in #20957

fix: collapsible content layout drops group and selection classes on records by @wit3 in #20952

Fix dropdown closing on window resize after opening it from its trigger by @jayhemnani9910 in #20966

Keep global search key bindings working after results are rendered by @intrepidws in #20963

fix: remove empty drop-label space from disabled uploads by @danharrin in #20972

fix: ignore Enter while an IME is composing text in TagsInput by @cable8mm in #20969

fix: show placeholders for empty rich content by @danharrin in #20974

fix: normalize enum record titles by @danharrin in #20973

fix: correct rich editor image spacing and CSS ownership by @danharrin in #20975

fix: support latest Rector in v4 upgrades by @danharrin in #20976

fix: preserve explicitly disabled chart legends by @danharrin in #20977

fix: resolve nested attachment originals safely by @danharrin in #20978

fix: respect hidden labels in specialized table summarizers by @danharrin in #20980

fix: respect SelectColumn option searchability when limiting preloads by @danharrin in #20979

fix: preserve rich editor mention labels across providers by @danharrin in #20981

fix: limit each Range summarizer endpoint independently by @danharrin in #20982

fix: normalize default child content by @danharrin in #20983

fix: correct PostgreSQL search identifier quoting by @danharrin in #20984

fix: prevent vertical tab navigation from stretching by @danharrin in #20986

fix: preserve scroll position when submitting modals inside tabs by @danharrin in #20987

New Contributors

@jayhemnani9910 made their first contribution in #20966

@cable8mm made their first contribution in #20969

Full Changelog: v4.16.1...v4.16.2
Original source
Nov 7, 2026
Date parsed from source:
Nov 7, 2026

First seen by Releasebot:
Nov 8, 2026
FastAPI by Tiangolo

0.162.2

FastAPI adds an official coding-agent skill with guidance for AI app development and FastAPI Cloud.
FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Docs

📝 Add FastAPI Cloud guidance to the FastAPI skill. PR #16697 by @tiangolo.

📝 Add guidance for developing FastAPI apps with AI. PR #16695 by @tiangolo.

Internal

🔧 Add an agent skills note to GitHub releases. PR #16696 by @tiangolo.

Original source
Nov 5, 2026
Date parsed from source:
Nov 5, 2026

First seen by Releasebot:
Nov 5, 2026
Symfony

Symfony UX 3.7 released

Symfony releases UX 3.7 with experimental atomic CSS for Twig and self-hosted image servers, a stable UX Toolkit with new recipes, and improvements across components, Dropzone, autocomplete and Turbo. The update also fixes LiveComponent bugs and speeds up rendering on pages with many components.

Symfony UX 3.7 is out, with more than 100 pull requests merged since 3.6. It adds UX CSS, an experimental package that turns design tokens into atomic CSS, two self-hosted image servers to UX Image, and takes the UX Toolkit out of experimental. LiveComponent gets 13 bug fixes, Dropzone a round of new features, and pages with many components render faster.

UX CSS

Utility classes written as strings, like the ones of Tailwind CSS, are plain text: a misspelled class gets no CSS, and nothing reports it. UX CSS gives Twig a css() function inspired by Panda CSS: you pass it style properties and design tokens, and it returns class names.

Every css() call is validated. A misspelled property or token name is reported as an error on the page in debug mode, by lint:twig in CI, and by cache:clear at deploy, where it makes the command fail in prod. A css() call without dynamic values has no cost at runtime: the compiled template already holds its class names as a plain string, so nothing is computed when the page renders.

PHP reads your templates and writes one stylesheet, without Node.js. It works with AssetMapper, Symfony Reprise and Webpack Encore. On ux.symfony.com, this card:

symfony/ux-css

Typed atomic CSS for Twig.
View on GitHub
renders
, and the bundle writes the matching rules, with every token as a CSS variable (reformatted for readability):

@layer tokens, utilities;
@layer tokens {
:where(:root, :host) {
--colors-blue-600: #1572b6;
/* ... /
--colors-fg: var(--colors-gray-900);
--colors-surface: var(--colors-white);
}
.dark {
--colors-fg: var(--colors-gray-50);
--colors-surface: var(--colors-gray-800);
}
}
@layer utilities {
.p_lg { padding: var(--spacing-lg); }
.bg_surface { background: var(--colors-surface); }
/ ... */
.hover:bg_blue.700:is(:hover, [data-hover]) { background: var(--colors-blue-700); }
}

UX CSS supports every token category of Panda CSS, and the same optional CSS reset (preflight: true).

Editor support is still partial. The Symfony plugin for PhpStorm and Symfony Language Tools already complete the properties and token names of css(). Pull requests in review for the PhpStorm plugin add the value of each token to the completion (1rem next to the spacing token md for the p property), a preview of the color of color tokens, and Ctrl+click to go from a token to its declaration. Language Tools is getting the same features.

In March 2026, for its 1,000th issue, A Week of Symfony listed wishes for the next 1,000 weeks of Symfony UX, and one was an integration with Panda CSS. UX CSS is inspired by Panda CSS rather than built on it. It ships 35 weeks later, and it runs without Node.js.

UX Image: Two Self-Hosted Image Servers

The four bridges of UX Image 3.6 send every variant to an image CDN: Cloudflare, Cloudinary, imgix or KeyCDN. 3.7 adds two bridges for image servers you run yourself, Imagor and IPX. Templates stay the same: switching provider only changes the DSN.

Imagor fetches the original image from your site, and signs every URL with the key of the server:

.env

UX_IMAGE_DSN=imagor://images.example.com?origin=https%3A%2F%2Fexample.com&sign_key=your-secret

IPX, built on sharp, reads the images from your public/ directory:

.env

UX_IMAGE_DSN=ipx://images.example.com

UX Toolkit Is No Longer Experimental

The UX Toolkit now follows the Symfony backward compatibility promise. It covers the ux:install command and its options, the ux_toolkit configuration, and the format of the kit and recipe manifest.json files.

It does not cover the content of the recipes. A recipe can change from one version to the next, and installing it again gives you the new one. A recipe you already installed is your own code, and nothing updates it behind your back.

UX Toolkit: Choose Where Recipes Are Installed

ux:install always wrote Twig components to templates/components/ and Stimulus controllers to assets/controllers/, so kit files ended up mixed with the components of your application.

The new components and controllers options each take a dir, which must match where your application already loads files from, and an optional subdirectory. With a subdirectory, ux:install rewrites the copied files so the names keep working: twig:Button becomes twig:ui:Button, and the dialog controller becomes ui--dialog.

config/packages/ux_toolkit.yaml

ux_toolkit:
components:
subdirectory: 'ui'
controllers:
subdirectory: 'ui'

Kits opt in with the %COMPONENTS_DIR% and %CONTROLLERS_DIR% placeholders in the copy-files destinations of their recipes. Every kit shipped with the Toolkit uses them.

Missing the TogglePassword Package?

UX TogglePassword was contributed by Félix Eymonot in UX 2.11 (#1000), then deprecated in 2.29 and removed in 3.0. To keep the feature, its migration guide had you copy a Stimulus controller and a form type extension into your application.

If you only need the button, the Common kit of the UX Toolkit now has a password-visibility recipe. Its Stimulus controller switches a field between password and text from a toggle button, and hides the password again when the form is submitted or reset, and when the page is left:
Show Hide
There is no toggle form option: the button lives in your template. The Password Visibility recipe has a live preview.

UX Toolkit: New Recipes, Blocks and Fixes

Besides password-visibility, the kits gained four recipes:
• sortable (Common) reorders a list, a table body or a grid with drag-and-drop, powered by SortableJS, and can save the new position of each moved item to your server;
• message-scroller (Shadcn) is the scroll container of a chat: it follows streamed responses, loads history without jumping and jumps to any message;
• code-block (Shadcn) displays code, terminal output and diffs, with line numbers and a copy button;
• trace (Shadcn) shows the steps of an AI response, such as reasoning, tool calls and sources, each with its status.

The Shadcn kit also has the blocks it was missing: login-03 to login-05, signup-01 to signup-05 and sidebar-01 to sidebar-16. Porting them exposed bugs in the recipes they use, now fixed:
• the content of sidebar not scrolling when it is taller than the sidebar, which left the last entries of a long menu out of reach;
• the gap of floating and inset sidebars being 16px too wide, and nested sidebars exposing several landmarks with the same name;
• dropdown-menu ignoring align when it opens on the left or the right of its trigger, so a menu in a sidebar footer could leave the screen.

The rich color toasts of sonner are now opaque in dark mode, and its empty toast list no longer catches clicks when a Content Security Policy blocks inline styles.

TwigComponent: A Shorthand for Dynamic Props

Passing a variable to a prop of the same name meant writing the name twice: :message="message". In the HTML syntax, :message alone is now a shorthand for it, like the same-name shorthand of Vue 3.4:

<twig:Alert :message :type="level" />
{# same as #}
<twig:Alert :message="message" :type="level" />

The name must be a valid Twig variable name, so :data-message still needs a value. A bare :message used to be a syntax error, so existing templates are not affected.

LiveComponent: 13 Bug Fixes

LiveComponent has no new feature in this release, but 13 bug fixes, sent by eight contributors. Among them:
• a #[LiveProp] array of entities with a Uuid identifier failing to dehydrate, and a LiveProp typed with a resolve_target_entities interface failing to hydrate;
• LiveCollectionTrait reusing the index of a removed item, which brought the removed Doctrine entity back, and a collection of DTOs failing to dehydrate as soon as a row was added;
• the queued request never being sent after an error response, which left the promise of action(), set() or render() pending forever;
• a child component with an explicit id failing to re-render when its props changed;
• live form updates submitting disabled choices, which browsers never submit, so validation failed on a live update but passed on a real submit;
• the events emitted by an action that returns a redirect leaking into the next request of a long-running process, such as FrankenPHP in worker mode;
• overflown dates such as 2026-02-31 being rolled over to another date instead of rejected.

Dropzone: Filter, Transform and Restyle Files

The file picker only shows the files that match the accept attribute of the input, but drag and drop ignored it. Dropzone now leaves out the dropped files that do not match accept, and the files over the new max_files option, and dispatches dropzone:reject so you can tell the user. With the Validator component, max_files also adds a Count constraint on the server:

$builder->add('photos', DropzoneType::class, ['multiple' => true, 'max_files' => 5, 'attr' => ['accept' => 'image/*']]);

The rest of the release:
• a dropzone:pre-add event to transform, replace or reject the files before they are added, for example to resize photos in the browser before the upload;
• a dropzone_preview_item_template form theme block, to render the preview of each file from your own ;
• a data-state attribute on the container (empty, filled, dragging, processing) to style each state;
• a placeholder option, which replaces the placeholder passed in attr;
• the same events in single-file and multiple modes.

Some of these change the behavior, for example when your own CSS sets display on the parts of the Dropzone, or when accept only lists MIME types. Read the Dropzone UPGRADE file before updating.

Autocomplete: Preferred Choices in Ajax Fields

Ajax-powered fields ignored the preferred_choices option, so the preferred choices were mixed with the other results. The endpoint now lists them first, on every page of results and while the user searches. Like the other options of an Ajax field, set it in the field class:

#[AsEntityAutocompleteField]
class FoodAutocompleteField extends AbstractType {
public function configureOptions(OptionsResolver $resolver): void {
$resolver->setDefaults([
// ...
'preferred_choices' => fn (Options $options) => $this->foodRepository->findBy(['favorite' => true]),
]);
}
public function getParent(): string {
return BaseEntityAutocompleteType::class;
}
}

In a multiple field, the endpoint now excludes the selected options before paginating, so a page full of selected options no longer hides the next ones. Reopening the dropdown no longer shows the results of an old search, and the clear button only shows on a select that has an empty option.

Turbo: More Control over Mercure Stream Sources

A private stream source sets the Mercure authorization cookie, and the browser keeps one such cookie per hub. So the last page rendered decided which topics every open tab could receive. The new subscribe option grants more topics than the ones the page listens to:

<twig:Turbo:Stream:From topics="chat" private :subscribe="['chat', 'news']" />

twig:Turbo:Stream:From now renders its other HTML attributes, and a stream source marked with data-turbo-permanent keeps its connection to the hub from one page to the next. When the page and the hub do not share a domain, the new turbo.mercure.ignore_cookie_domain_errors option renders nothing and logs a warning, instead of failing the whole page. Javier Eguiluz also rewrote the start of the documentation, which now explains how Turbo works before showing code.

Faster Live Components

TwigComponent now reads the component metadata its cache warmer saved, instead of rebuilding it with reflection on every request, and copies fewer variables and walks the call stack less often. LiveComponent no longer runs its listeners for the components that are not live, and no longer computes an id for each of them during a re-render. A computed property that returns null is now cached too, instead of running again, query included, on every access.

On the admin dashboard used for 3.6, which now also holds 28 live components among its 1,800 components, every request below takes less CPU time with 3.7, for the same HTML. The last four re-render the posts table, a live component:

Request | 3.6 | 3.7 | Change
Dashboard, 25 rows | 57.1-58.9 ms | 48.5-51.0 ms | -15%
Dashboard, 100 rows | 144.5-149.0 ms | 120.0-122.6 ms | -18%
Ticking 3 rows | 45.0-47.0 ms | 25.4-27.7 ms | -43%
Ticking 3 rows, 100 rows | 158.0-162.1 ms | 85.5-87.5 ms | -46%
Typing in the search box | 51.4-51.8 ms | 30.0-31.2 ms | -40%
Deleting the 3 ticked rows | 47.5-48.2 ms | 26.4-28.2 ms | -42%

These numbers are the medians of six alternating runs of 60 requests per version, in the prod environment, with PHP 8.4 and Twig 3.30.

Your templates must be recompiled to benefit, which a cache clear does. Templates that use the HTML syntax also compile faster: the pre-lexer was rewritten around a single scanner, and one pass over 672 real templates takes 32% less time.

Full Changelog

[LiveComponent] Rebuild Component on reconnect when props changed in between (@Amoifr)
[LiveComponent] Fix dehydrating arrays of entities with a Uuid identifier (@HawkForge)
[LiveComponent] Prevent LiveCollectionTrait from reusing removed indexes (@Amoifr)
[LiveComponent] Fix hydrating entities typed with a resolve_target_entities interface (@HawkForge)
[Autocomplete] Exclude already selected options from remote results (@anthovallet)
[LiveComponent] Fix (de)hydration of DTO collections containing a null item (@0xABCD01)
[Pagination] Fix the Doctrine ORM count when a parameter is only used by the SELECT or the ORDER BY (@ker0x)
[LiveComponent] Reject overflown dates during date hydration (@Mlucas44)
[TwigComponent] Add a shorthand for dynamic props named like a variable (@Kocal)
[LiveComponent] Fix NoModificationAllowedError when closing the error modal twice (@Amoifr)
[Autocomplete] Support the preferred_choices option in Ajax-powered fields (@Kocal)
[Autocomplete] Only add the clear button to a select that has an empty option (@Qronicle)
[Turbo] Add an option to ignore the cookie domain errors of private stream sources (@ker0x)
[Turbo] Add a subscribe option to turbo_stream_from() and twig:Turbo:Stream:From (@ker0x)
[Turbo] Keep the EventSource of a permanent open across visits (@ker0x)
[Turbo] Render the HTML attributes of twig:Turbo:Stream:From (@ker0x)
[Dropzone] Use one code path for the single-file and multiple modes (@ker0x)
[Dropzone] Leave out the dropped files that do not match accept and the files over max_files, and dispatch dropzone:reject (@ker0x)
[Dropzone] Add a placeholder option to DropzoneType (@ker0x)
[Dropzone] Make the clear button, file name and image preview targets optional in single-file mode (@ker0x)
[Dropzone] Render the preview of each file from a template in multiple mode (@ker0x)
[Dropzone] Expose the state with data-state and toggle the parts with hidden instead of inline styles (@ker0x)
[Dropzone] Add a dropzone:pre-add event to transform files before they are added (@ker0x)
[Css] Stop naming shared reference types after another property (@Kocal)
[Css] Accept any value for a token category with no token, like Panda (@Kocal)
[Css] Support every Panda token category (@Kocal)
[Css] Accept CSS strings in values (@Kocal)
[Css] Add the preflight option (@Kocal)
[Css] Link to the documentation from the generated stylesheet (@Kocal)
[Css] Write the value of every token to the reference file (@Kocal)
[Css] Write the value of each color token to the reference file (@Kocal)
[Css] Add the CSS component (@Kocal)
[LiveComponent] Reset the LiveResponder between requests (@KevinMartinsDev)
[Image] Add the Imagor bridge (@tacman)
[TwigComponent] Use the warmed component properties cache (@javiereguiluz)
[TwigComponent] Run the outer blocks backtrace once per template method (@javiereguiluz)
[TwigComponent] Set the parent template of embedded components before the render (@javiereguiluz)
[TwigComponent] Copy the context only when props override it (@javiereguiluz)
[TwigComponent] Cache null results of computed properties (@javiereguiluz)
[TwigComponent] Rewrite the pre-lexer around a single scanner (@Kocal)
[Image] Add the IPX bridge (@Kocal)
[Turbo] Keep the connected attribute of when morphing (@nicolas-grekas)
[Router][Translator] Don't load the routes and translations when the container is built (@Kocal)
[LiveComponent] Keep the route and its defaults on batch action sub-requests (@arrabiata-asanz)
[Toolkit] Fix the URL of the Flowbite kit (@hifarrer)
[Pkg] Move the tooling devDependencies of the packages to the root package.json (@Kocal)
[CI] Run the tests of the bridges once their package is done (@Kocal)
[CI] Run only the tests of the packages a pull request affects (@Kocal)
[LiveComponent] Look up the Doctrine manager of an entity class once (@Kocal)
[Toolkit][Common] Add password-visibility recipe (@seb-jean)
[Toolkit] Warn about copy-files destinations that skip the installation placeholders (@Kocal)
[Turbo] Register the stream format on the current request instead of a new one (@nicolas-grekas)
[Toolkit][Common] Add sortable recipe (@seb-jean)
[Pagination] Support date columns as Doctrine ORM cursor fields (@lyrixx)
[Autocomplete] Refresh stale remote options when the dropdown reopens (@DanerSharifi-FR)
[Toolkit] Make the installation directories of recipes configurable (@Kocal)
[LiveComponent][TwigComponent] Skip live-only and data-model listeners for other components (@Kocal)
[TwigComponent] Fix pre-lexer only recognizing one spelling of block and embed tags (@dbu)
[LiveComponent] Fix disabled choices being submitted by live form updates (@Amoifr)
[Pagination] Support Symfony UID cursor fields (@norkunas)
[LiveComponent] Send the queued request after an error response (@Pechynho)
[LiveComponent] Keep the id of a child component with an explicit id when its props change (@Pechynho)
[LiveComponent] Sync the value of selects mapped via a form after re-render (@abp002)
[LiveComponent] Only match children fingerprints against live components (@Kocal)
[LiveComponent] Reset deterministic ids without a PostRenderEvent listener (@Kocal)
[Toolkit][Shadcn] Add message-scroller recipe (@Enz000)
[Toolkit] Fix update_toolkit_tests.sh stopping before the screenshots of a block (@Kocal)
[Toolkit][Shadcn] Fix nested and side-by-side sidebars exposing landmarks with the same name (@Kocal)
[Toolkit][Shadcn] Add an as prop to Sidebar:GroupLabel and size nested icons in Sidebar:MenuButton (@Kocal)
[Toolkit][Shadcn] Fix the gap of floating and inset sidebars being 16px too wide (@Kocal)
[Toolkit][Shadcn] Fix dropdown-menu ignoring align on the left and right sides (@Kocal)
[Toolkit][Shadcn] Add the missing login, signup and sidebar blocks (@Kocal)
[Toolkit][Shadcn] Add code-block recipe (@ker0x)
[Toolkit][Shadcn] Add trace recipe (@ker0x)
[Toolkit][Shadcn] Make the rich color toasts of Sonner opaque in dark mode (@Kocal)
[Toolkit][Shadcn] Round the position of the navigation-menu panel to a whole pixel (@Enz000)
[Native] Add the historical location navigation (@feymo)
[TwigComponent] Do not leave a component on the ComponentStack when its pre-render fails (@Pechynho)
[Toolkit][Shadcn] Fix the empty toast list of Sonner catching clicks under a CSP (@abp002)
[Translator] Fall back to the application default locale (@feymo)
Generate the packages .gitignore, and ignore the .vitest/ report directory (@Kocal)
[Turbo] Reset the broadcast listener between requests (@KevinMartinsDev)
[Toolkit] Fix the preview wiring tests with strict AssetMapper imports (@Enz000)

UX CSS and UX Image are experimental, so their API can still change, and now is when your feedback is worth the most. Try them, and open an issue if something does not fit your application.
Original source
Nov 5, 2026
Date parsed from source:
Nov 5, 2026

First seen by Releasebot:
Nov 5, 2026
Symfony

Symfony 8.1.11 released

Symfony releases version 8.1.11 with extensive bug and security fixes across its framework components, improving reliability and protecting applications in areas including HTTP handling, routing, serialization, YAML, and HTML sanitization.
Symfony 8.1 is backed by:

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Symfony 8.1.11 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.10

AssetMapper

bug #67802 [AssetMapper] Fix the resolution of relative paths in downloaded packages (@nicolas-grekas)

bug #67750 [AssetMapper] Decode the version of a jsDelivr import before resolving it (@mathieudz)

bug #67621 [AssetMapper] Fix importmap:remove deleting the files of local entries (@nicolas-grekas)

BrowserKit

bug #67685 [BrowserKit] Match cookies across equivalent IPv6 addresses (@X-Coder264)

bug #67684 [BrowserKit] Expire cookies dated at the Unix epoch (@X-Coder264)

Cache

bug #67759 [Cache] Fix FilesystemTagAwareAdapter::deleteItems() returning true when some items could not be deleted (@nicolas-grekas)

bug #67741 [Cache] Fix Redis deleteItems() returning true when some items could not be deleted (@nicolas-grekas)

bug #67736 [Cache] Fix tag-aware deleteItems() returning false when the per-item retry succeeds (@nicolas-grekas)

bug #67720 [Cache] Retry failed early expiration callbacks (@nicolas-grekas)

bug #67703 [Cache] Honor the $save flag set by the callback in EarlyExpirationHandler (@BenMacha)

bug #67714 [Cache] Preserve null results from synchronous early recomputation (@nicolas-grekas)

bug #67681 [Cache] Add support for relay 0.61 (@nicolas-grekas)

minor #67744 [Cache] Mark connection options as #[\SensitiveParameter] (@nicolas-grekas)

Config

security #ghsa-5jff-8h8q-r5qx [Config] Do not validate XML documents on parse (@nicolas-grekas)

Console

bug #67832 [Console] Fix ProgressBar::iterate() keeping the max of a previous iterable for a non-countable one (@nicolas-grekas)

bug #67831 [Console] Fix ProgressBar's percent after finish() on undecorated output without a max (@nicolas-grekas)

bug #67830 [Console] Fix ProgressBar::finish() with a lowered max and restarting a finished bar without a max (@jack-worman)

bug #67823 [Console] Fix ProgressBar frames on undecorated output when resuming, restarting or finishing (@jack-worman)

bug #67811 [Console] Fix ProgressBar::setMaxSteps() not updating the percentage (@nicolas-grekas)

bug #67805 [Console] Fix ProgressBar::start() computing the percentage against the previous max (@jack-worman)

bug #67770 [Console] Fix outline block lines ending with a backslash (@nicolas-grekas)

bug #67769 [Console] Fix text ending with a backslash escaping the closing tag that follows it (@nicolas-grekas)

bug #67762 [Console] Keep an escaped tag delimiter with its backslash when wrapping text (@initd-it)

bug #67677 [Console] Register service argument locators under the resolved names of commands (@kbond)

bug #67634 [Console] Fix setRow(), setColumnMaxWidth() and consecutive rowspans in Table (@nicolas-grekas)

bug #67633 [Console] Fix Table cells that span rows when they follow a cell that spans columns (@ybai08)

DependencyInjection

bug #67757 [DependencyInjection] Fix #[Target] resolution when two names give the same camelCase alias (@nicolas-grekas)

Filesystem

security #ghsa-6prc-h956-hxjq [Filesystem] Only treat a valid URI scheme as the root of a path (@nicolas-grekas)

bug #67786 [Filesystem] Fix failure handling in remove() (@nicolas-grekas)

bug #67778 [Filesystem] Reserve temporary removal directories atomically (@X-Coder264)

Finder

bug #67785 [Finder] Fix Glob::toRegex() producing an invalid regex for bracket expressions containing a slash (@0xABCD01)

Form

bug #67776 [Form] Map data validation errors to the sibling form that has the field (@nicolas-grekas)

bug #67772 [Form] Keep validation errors on their originating form (@X-Coder264)

bug #67699 [Form] Validate the collection entries that keep_as_list doesn't need to renumber (@BenMacha)

bug #67731 [Form] Fix allow_delete removing collection entries submitted as null (@nicolas-grekas)

bug #67700 [Form] Ignore collection entries with invalid names when allow_add is enabled (@BenMacha)

bug #67702 [Form] Fix submitting "0" to a non-compound root form (@BenMacha)

bug #67713 [Form] Skip unsubmitted collection entries with delete_empty (@nicolas-grekas)

bug #67701 [Form] Fix the post_max_size check when it is set to a negative value (@BenMacha)

bug #67650 [Form] Preserve the Unix epoch in date string transformation (@ahbaqdadi)

minor #67795 [Form] Review Greek translations (@sogav21)

minor #67773 [Form] Review Croatian translations (@HypeMC)

minor #67674 [Form] Review Polish translations (@lukaszkrakowiak)

minor #67660 [Form] Review Japanese translations (@OTA-EITA)

minor #67623 [Form][Validator] Review Slovak (sk) translations (@tito10047)

minor #67642 [Form][Validator] Review and improve Chinese (zh_CN) translations (@siganushka)

minor #67635 [Form][Validator] Review and fix Luxembourgish (lb) translations (@mweimerskirch)

minor #67632 [Form] Fix Dutch translations for validators (@mdalikadar)

minor #67631 [Form] Fix Italian translations for validators (@mdalikadar)

minor #67626 [Form][Security][Validator] Review Vietnamese translations (@HongTin2104)

minor #67622 [Form][Validator] review translations for Ukrainian (uk) (@qconer)

minor #67627 [Form][Validator] Review translations for Chinese (zh_TW) (@HsukqiLee)

minor #67447 [Form] Review Turkish (tr) validator translations (@erenbati)

minor #67617 [Form][Validator] Review German translations (@Rommmoa)

HtmlSanitizer

security #ghsa-q8jq-xrf4-v5j8 [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset (@nicolas-grekas)

security #cve-2026-118517 [HtmlSanitizer] Require special schemes and scheme-relative URLs to carry a non-empty authority (@nicolas-grekas)

security #ghsa-wm2w-4mgj-vw33 [HtmlSanitizer] Fix meta refresh URL sanitization bypass (@nicolas-grekas)

HttpClient

security #ghsa-c7hm-wqwp-f9v8 [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient (@nicolas-grekas)

security #ghsa-gq53-v8w2-gjhj [HttpClient] Don't send the options of the default scope to other origins in ScopingHttpClient (@nicolas-grekas)

bug #67619 [HttpClient] Let PHP destruct the response decorated by TraceableResponse (@nicolas-grekas)

bug #67612 [HttpClient] Fix AsyncResponse throwing a LogicException when it is canceled while streaming (@nicolas-grekas)

bug #67610 [HttpClient] Fix getContent() returning a truncated body when the response is canceled while it reads it (@nicolas-grekas)

bug #67599 [HttpClient] Fix reading a traced CurlResponse as a stream after its decorator is destructed (@PhilETaylor)

bug #67609 [HttpClient] Fix CurlHttpClient writing the body of a response to stdout when it is canceled during stream() (@nicolas-grekas)

bug #67605 [HttpClient] Fix clearing the DNS cache of pending requests when a traced response is destructed (@nicolas-grekas)

HttpFoundation

security #ghsa-xg2q-4rrq-657q [HttpFoundation] Split the private ranges usable as trusted proxies from the deny list of private subnets (@nicolas-grekas)

security #ghsa-xg2q-4rrq-657q [HttpFoundation] Add the list of private ranges usable as trusted proxies (@nicolas-grekas)

security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is listed in a MethodRequestMatcher (@nicolas-grekas)

security #cve-2026-118514 [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher (@nicolas-grekas)

security #ghsa-5mx8-mwrp-5693 [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by the client (@nicolas-grekas)

security #ghsa-3h27-hjv7-fqjx [HttpFoundation] Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment (@jack-worman)

bug #67829 [HttpFoundation] Fix Request::getBaseUrl() for a percent-encoded or wrong-case script name after a prefix, and behind an alias (@jack-worman)

bug #67826 [HttpFoundation] Don't use the script name as Request::getBaseUrl() when it's not in the URI path (@jack-worman)

bug #67804 [HttpFoundation] Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment (@jack-worman)

bug #67814 [HttpFoundation] Fix UrlHelper for fragments behind a trusted X-Forwarded-Prefix and for an empty path (@nicolas-grekas)

bug #67800 [HttpFoundation] Preserve the base URL for query and fragment references (@ahbaqdadi)

minor #67760 [HttpFoundation][Lock][Semaphore] Do not expose the DSN in the exception thrown for unsupported connections (@nicolas-grekas)

minor #67746 [HttpFoundation] Mark the DSN and options of SessionHandlerFactory as #[\SensitiveParameter] (@nicolas-grekas)

HttpKernel

security #ghsa-hwfg-qwvh-2wfx [HttpKernel] Don't decode CSV and YAML payloads unless acceptFormat lists them (@nicolas-grekas)

security #ghsa-wg5q-m2ww-f3c9 [HttpKernel] Restore the router context of the parent request after a sub-request (@nicolas-grekas)

bug #67834 [HttpKernel] Accept only form, JSON and XML payloads in #[MapRequestPayload] unless acceptFormat lists other formats (@nicolas-grekas)

bug #67683 [HttpKernel] Compute #[Cache] durations without daylight saving time (@nicolas-grekas)

bug #67607 [HttpKernel] Fix searching profiles by status code 0 (@chr-hertel)

JsonPath

security #ghsa-cpww-5vpx-72x7 [JsonPath] Evaluate absolute queries in filters once per query instead of once per node (@nicolas-grekas)

security #ghsa-cpww-5vpx-72x7 [JsonPath] Parse filter expressions once per query instead of once per node (@nicolas-grekas)

security #ghsa-cpww-5vpx-72x7 [JsonPath] Bound the regex work of one find() call (@nicolas-grekas)

bug #67601 [JsonPath] Fix negative-step slices and reject invalid slices on objects (@nicolas-grekas)

bug #67595 [JsonPath] Fix open-ended slices in the path builder (@shuvroroy)

Lock

bug #67748 [Lock] Fix DynamoDbStore listing the values of unknown options instead of their names (@nicolas-grekas)

minor #67747 [Lock] Mark the options of DynamoDbStore as #[\SensitiveParameter] (@nicolas-grekas)

minor #67745 [Lock] Mark the DSNs and options of the DBAL and MongoDB stores as #[\SensitiveParameter] (@nicolas-grekas)

Messenger

bug #67799 [Messenger] Fix infinite retries when a serializer throws a decoding failure (@Ptraaah, @nicolas-grekas)

bug #67792 [Messenger] Don't reuse a serialized body after replacing the message (@dalerazimov)

bug #67767 [Messenger] Fix the Redis transport throwing "Redis server went away" when connecting fails (@nicolas-grekas)

bug #67753 [Messenger] Treat Beanstalkd jobs that aren't Messenger envelopes as decoding failures (@nicolas-grekas)

bug #67719 [Messenger] Track keepalives independently for each received envelope (@nicolas-grekas)

bug #67712 [Messenger] Stop keeping alive the messages that a listener prevents the worker from handling (@BenMacha)

bug #67724 [Messenger] Fix Redis DSN credential decoding and exception traces (@nicolas-grekas)

bug #67711 [Messenger] Do not resend the stamp headers of a received AMQP message (@BenMacha)

bug #67709 [Messenger] Restore the schema assets filter when the Doctrine transport setup fails (@BenMacha)

bug #67710 [Messenger] Do not expose the Redis DSN in the invalid host query parameter exception (@BenMacha)

bug #67654 [Messenger] Wait for all batch handlers before acknowledging a message (@andreybolonin)

bug #67655 [Messenger] Retry the messages whose batch was flushed during a failed dispatch (@nicolas-grekas)

bug #67651 [Messenger] Let the worker flush the batches that contain a failed message (@nicolas-grekas)

bug #67647 [Messenger] Don't hide handler failures when a batch handler acks the same message (@nicolas-grekas)

bug #67643 [Messenger] Preserve handled stamps when a batch handler nacks (@dalerazimov)

minor #67771 [Messenger] Do not expose the DSN in the exception thrown when no transport supports it (@nicolas-grekas)

minor #67763 [Messenger] Treat encoded envelopes whose body or type isn't a string as decoding failures (@nicolas-grekas)

minor #67766 [Messenger] Ignore the "X-Symfony-Messenger" attribute of an SQS message when it isn't a JSON object (@nicolas-grekas)

minor #67764 [Messenger] Treat a body or header that isn't a string as a decoding failure in SigningSerializer (@nicolas-grekas)

minor #67754 [Messenger] Treat Redis stream entries that aren't Messenger envelopes as decoding failures (@nicolas-grekas)

minor #67739 [Messenger] Mark transport options as #[\SensitiveParameter] (@nicolas-grekas)

minor #67722 [Messenger] Ignore ids that are not integers when finding a message of the Doctrine transport (@BenMacha)

minor #67657 [Messenger] Release handled envelopes without waiting for the garbage collector (@nicolas-grekas)

Notifier

minor #67761 [Notifier][Translation] Do not expose the DSN in the exception thrown when its password is missing (@nicolas-grekas)

ObjectMapper

bug #67820 [ObjectMapper] Skip readonly and asymmetric visibility target properties without a property accessor (@nicolas-grekas)

PropertyAccess

bug #67733 [PropertyAccess] Fix parsing type errors thrown by anonymous classes (@nicolas-grekas)

bug #67682 [PropertyAccess] Handle uninitialized properties of anonymous classes on PHP 8.6 (@nicolas-grekas)

PropertyInfo

bug #67788 [PropertyInfo] Don't turn intersection types into class names in PhpDocExtractor (@nicolas-grekas)

bug #67789 [PropertyInfo] Return null for docblock types the extractors can't resolve (@nicolas-grekas)

RateLimiter

bug #67705 [RateLimiter] Validate the refill amount, the fixed window interval and the sliding window limit (@BenMacha)

bug #67603 [RateLimiter] Apply a changed limit to stored calendar-aligned windows (@nicolas-grekas)

bug #67598 [RateLimiter] Preserve calendar-aligned reservations across periods (@shuvroroy)

Routing

security #cve-2026-118516 [Routing] Prevent host placeholders from matching the path in compiled matchers (@nicolas-grekas)

Runtime

bug #67679 [Runtime] Terminate the kernel within the FrankenPHP request callback (@pokorny344)

Security

security #cve-2026-118513 [Security] Parse the DN into RDNs before extracting the user identifier (@nicolas-grekas)

security #ghsa-8f57-m8wj-x65w [Security] Run checkPostAuth() of user checkers on programmatic logins (@nicolas-grekas)

minor #67738 [Security] Fix Voter with anonymous classes and nested supports() calls (@nicolas-grekas)

minor #67707 [Security] Reject login links with an out of range "expires" parameter (@BenMacha)

minor #67708 [Security] Ignore target and failure paths that are neither paths nor absolute URLs (@BenMacha)

minor #67716 [Security] Reject malformed login link user identifiers (@nicolas-grekas)

minor #67706 [Security] Reject remember-me cookies with an invalid expiration time (@BenMacha)

Serializer

security #ghsa-hqp2-7rr8-hf26 [Serializer] Ignore undeclared property paths when denormalizing (@nicolas-grekas)

security #cve-2026-118515 [Serializer] Don't build UploadedFile and other file objects from denormalized data (@nicolas-grekas)

security #ghsa-pxj9-jh84-vhm5 [Serializer] Lowercase the scheme of data URIs before opening them (@nicolas-grekas)

bug #67752 [Serializer] Skip empty lines when decoding multi-column CSV documents (@0xABCD01)

bug #67665 [Serializer] Fix denormalizing a data URI ending with slashes to a File (@ahmed-bhs)

Translation

bug #67669 [Translation] Don't read provider responses as file paths (@nicolas-grekas)

minor #67625 [Translation] Reviewed the Danish translation in issue #65554 (@mcardle)

Tui

bug #67809 [Tui] Fix ProgressBarWidget when changing the max and with negative values (@nicolas-grekas)

TypeInfo

bug #67793 [TypeInfo] Fix resolving unions and intersections that PHPStan accepts (@paulferrett, @nicolas-grekas)

bug #67782 [TypeInfo] Leave out type aliases that cannot be resolved (@paulferrett)

Validator

security #ghsa-4qpf-57w4-m3wc [Validator] Reject non-public IP addresses in the no-priv, no-res and only-public modes (@nicolas-grekas)

bug #67787 [Validator] Only extract property types when auto-mapping applies (@paulferrett)

minor #67644 [Validator] Show the count in the word count messages of locales with a single plural form (@nicolas-grekas)

WebProfilerBundle

bug #67618 [WebProfilerBundle] Reset the CSP handler between requests (@norkunas)

bug #67620 [WebProfilerBundle] Reset the profiler Twig extension between requests (@nicolas-grekas)

bug #67606 [WebProfilerBundle] Return a 404 when opening the profiler file viewer without a file (@kevinsleegerslameco, @nicolas-grekas)

Yaml

security #ghsa-hwfg-qwvh-2wfx [Yaml] Fix exponential and quadratic parse times (@nicolas-grekas)

security #ghsa-hwfg-qwvh-2wfx [Yaml] Fix quadratic parse times (@nicolas-grekas)

bug #67735 [Yaml] Strip the byte order mark at the start of a stream (@0xABCD01)

Other

bug #67614 Reject trailing newlines in Content-Disposition fallbacks (@ahbaqdadi)

minor #67675 translation: checked proposed serbian translations (@Trysha-rbrn)

minor #67676 review(translation): [#64516] reviewed and updated the translation (@mikocevar)

minor #67695 Allow symfony/mercure-bundle ^0.5 (@DavidPrevot)

minor #67649 Review translations for Estonian (et) (@erkia)

Original source

Backend Frameworks Release Notes

Products (7)

Latest Backend Frameworks Updates

v4.13.18

Security fixes

0.162.4

Fixes

0.162.3

Upgrades

Docs

Translations

Internal

v3.7.0

🚀 New

🧹 Updates

🐛 Fixes

🛠️ Maintenance

📚 Documentation

v4.13.17

What's Changed

v5.11.2

What's Changed

New Contributors

v4.16.2

What's Changed

New Contributors

0.162.2

Docs

Internal

Symfony UX 3.7 released

symfony/ux-css

.env

.env

config/packages/ux_toolkit.yaml

Symfony 8.1.11 released

Changelog Since Symfony 8.1.10

AssetMapper

BrowserKit

Cache

Config

Console

DependencyInjection

Filesystem

Finder

Form

HtmlSanitizer

HttpClient

HttpFoundation

HttpKernel

JsonPath

Lock

Messenger

Notifier

ObjectMapper

PropertyAccess

PropertyInfo

RateLimiter

Routing

Runtime

Security

Serializer

Translation

Tui

TypeInfo

Validator

WebProfilerBundle

Yaml

Other