Symfony Release Notes

Symfony UX 3.3.0 is out. This release brings first-class support for Symfony Reprise in StimulusBundle, two new Shadcn components for the Toolkit (Sonner and Combobox), and a batch of quality-of-life improvements to the ux:install command and to how component documentation is parsed and linted.

StimulusBundle: Symfony Reprise support

Contributed by Hugo Alliaume in #3705

Symfony Reprise is the new Vite and Rsbuild integration for Symfony assets. It is brand new and still very much experimental (its first commit landed in September 2025 and the repository only just went public), so expect things to move fast and APIs to change. That said, StimulusBundle already supports it as a first-class asset system, alongside AssetMapper and Webpack Encore. Point the Reprise plugin at your controllers.json and start the app from @symfony/reprise/stimulus :

// vite.config.js (or rsbuild.config.js)
Symfony({
stimulus: './assets/controllers.json',
})

As part of this change, @symfony/stimulus-bridge is no longer a default npm peer dependency: it is specific to Webpack Encore, and Reprise projects would pull it in for nothing. Only @hotwired/stimulus remains; Encore users now install the bridge manually.

StimulusBundle: preserved stimulusFetch: 'lazy' comments

Contributed by Indra Gunawan in #3702

The stimulusFetch: 'lazy' directive that marks a controller as lazy-loaded is now detected even when it uses a preserved comment marker (/*! stimulusFetch: 'lazy' */). Tools like tsc and esbuild emit that form to keep important comments from being stripped during compilation, so lazy controllers written in TypeScript now behave as expected.

Toolkit: two new Shadcn components

Contributed by Hamza Makraz in #3477 and #3482

The Shadcn kit gains two components:

• Sonner is an opinionated toast notification component for showing transient feedback.
• Combobox combines an input with a searchable, filterable list of options for autocomplete-style selection. Install either one with ux:install .

$ php bin/console ux:install sonner --kit=shadcn
$ php bin/console ux:install combobox --kit=shadcn

Toolkit: friendlier ux:install

Contributed by Hugo Alliaume in #3700

Recipe names are stored in lower-case, so ux:install Alert used to fail with a raw "does not exist in any official kits" error. Recipe lookup is now case-insensitive: Alert resolves to the alert recipe, both without --kit (the "which kit?" prompt) and with an explicit --kit=shadcn . When a recipe genuinely does not exist in any official kit, the error now suggests the closest alternatives found across all kits instead of leaving you guessing.

Toolkit: better @prop and @block documentation

Contributed by Hugo Alliaume in #3694

Component documentation comments now have a single, well-defined format. A new ComponentDocParser reads the {# @prop #} and {# @block #} comments at the top of a Twig component, and a companion ComponentDocChecker lints them for consistency (capitalized descriptions ending with a period, valid types, and no more hand-written "Defaults to ..." strings):

{# @prop defaultValue string Define the open Tabs at initial rendering. #}
{# @prop orientation 'horizontal'|'vertical' Define the visual orientation. #}
{# @block content The default block. #}
{%-
props defaultValue = '', orientation = 'horizontal' -%}

Default values are now read directly from the {% props %} tag, so they are no longer duplicated in the description. The same parser can power both the UX website and the Toolkit linter, and it gives LLMs a clear structure to fix documentation issues against.

Shadcn tooltip fixes

Contributed by Hugo Alliaume in #3696

The Shadcn tooltip now dismisses itself on scroll and resize, and no longer intercepts pointer events while hidden, so it stops swallowing clicks on the elements underneath it.

Notable bug fixes

LiveComponent no longer returns a 500 error on malformed hydration payloads, handles nullable collection properties correctly, and stops the data-loading scanner from ignoring data-live-ignore subtrees. Autocomplete fixes a LIKE ESCAPE clause that broke search on PostgreSQL.

Full Changelog

• [StimulusBundle] Add support for Symfony Reprise (@Kocal)
• [StimulusBundle] Support preserved /*! stimulusFetch: 'lazy' */ syntax (@IndraGunawan)
• [StimulusBundle] Sort custom controllers to keep the generated loader deterministic (@Amoifr)
• [LiveComponent] Avoid 500 errors on malformed hydration payloads (@Amoifr)
• [LiveComponent] Fix data-loading scanner ignoring data-live-ignore subtrees (@Amoifr)
• [LiveComponent] Fix support for nullable collection properties on component (@rogierknoester)
• [Toolkit] Resolve ux:install recipe name case-insensitively and suggest alternatives (@Kocal)
• [Toolkit][Shadcn] Dismiss the tooltip on scroll and resize, and stop it from intercepting pointer events while hidden (@Kocal)
• [Toolkit] Refactor (again) but improve @prop and @block comments format (@Kocal)
• [Autocomplete] Fix LIKE ESCAPE clause breaking search on PostgreSQL (@Amoifr)
• [Shadcn] Add Sonner (@makraz)
• [Toolkit] Make component rendering snapshots independent from the libxml version (@Kocal)
• [Toolkit][Shadcn] Add Combobox (@makraz)

Twig 3.28.0 is out. This release sharpens error reporting with column numbers, brings back dynamic macro calls through the dot operator, and continues to polish the sandbox with less runtime overhead and finer-grained allow-listing. As usual, it also ships a batch of deprecations that pave the way for Twig 4.0.

Column numbers in syntax errors

Until now, a Twig error only told you which line was at fault. On a dense line, that left you scanning for the actual problem. Twig now tracks the source offset of every token, so errors can point at the exact column.
The column is exposed through the new Error::getTemplateColumn() method, and the underlying token offset through Token::getOffset().

Dynamic macro names through the dot operator

Calling a macro whose name is only known at runtime used to rely on the attribute() function, which was deprecated in favor of the dot operator; but the dot operator did not support macros. That gap is now closed:

{% import "forms.html.twig" as forms %}
{% set field = "text" %}
{{ forms.(field)(name, value) }}

The parenthesized expression is evaluated and used as the macro name, so you can pick a macro dynamically without falling back to a deprecated function.

Sandbox: mark callables and tags as always allowed

Some filters, functions, tests, and tags are pure and inherently safe in a sandboxed template. Forcing every security policy to allow-list them by hand is noisy and error-prone.
Filters, functions, and tests now accept an always_allowed_in_sandbox option, and token parsers can implement isAlwaysAllowedInSandbox(). When set, the sandbox skips recording the name entirely, so it never reaches the policy's security check: no allow-list entry required and no runtime cost. The security policy also gains a dedicated allow-list for tests, with the safe built-in tests flagged as always allowed so they keep working out of the box.

Faster sandboxed templates

The sandbox used to wrap every argument of every callable with a __toString check. Twig now wraps an argument only when its PHP parameter type can actually coerce a value to a string. Arguments typed as int, for instance, are left untouched, which cuts the amount of generated code and speeds up sandboxed rendering. The approach stays conservative: untyped, mixed, string, array, iterable, object, Stringable, and unknown class types all keep their check.

Stricter template correctness checks

Being able to parse and compile a template does not mean it is semantically correct. A new CorrectnessNodeVisitor centralizes those checks and deprecates a few constructs that happened to work but were never meant to: using a block tag inside a capture node such as set, and using a macro, extends, or use tag somewhere other than the root of a template.

Markup is now effectively final

Twig\Markup is now marked @final and will become truly final in Twig 4.0.

Notable bug fixes

• The include() function now returns a Markup object, so a result assigned to a variable is no longer re-escaped when printed.
• Nested block() calls now resolve against the overriding template when a block rendered through block(name, template) calls parent().
• Printed expressions are cast to string so values that cannot be converted (arrays, non-Stringable objects) report a usable stack trace at the print location.
• Backed enums are now rendered using their backing value in the html_attr function.
• Empty Markup values are no longer treated as truthy in boolean expressions.

Full Changelog

• Render backed enums using their backing value in the html_attr function (@fabpot)
• Fix Markup truthiness in boolean expressions (@xtrime-ru)
• Fix a PHP 8.5 chr() deprecation when decoding octal string escapes (@austinderrick)
• Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct (@fabpot)
• Mark Markup as final (@fabpot)
• Allow calling a macro with a dynamic name via the dot operator (@fabpot)
• Fix markdown_to_html mangling content that starts with a blank line (@fabpot)
• Add an allow-list for tests to the sandbox security policy (@fabpot)
• Add an always_allowed_in_sandbox flag for filters, functions, and tags (@fabpot)
• Track the source offset of each token and expose it in syntax errors (@fabpot)
• Make the include() function return a Markup object (@fabpot)
• Fix nested block() resolution when a directly rendered block calls parent() (@fabpot)
• Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run (@fabpot)
• Cast printed expressions to string so unconvertible values report a usable stack trace at the print location (@stof, @fabpot)
• Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11 (@fabpot)
• Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string (@fabpot)

Symfony 8.1 is backed by:

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Symfony 8.1.1 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.0

• data #64731 Release v8.1.1
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• minor #64643 [ObjectMapper] Fix reverse class mapping of private properties from parent classes (@Amoifr)
• bug #64640 Messenger commands don't yet make use of listable Redis capabilities (@dpi)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64637 [Messenger] Fix #[AsMessage] on abstract classes (@MatTheCat)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
• bug #64589 [ObjectMapper] Fix self-referencing property mapping (@GaryPEGEOT)
• bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (@soyuka)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
• minor #64620 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• minor #64629 [DependencyInjection] Fix deprecation when handling tagged iterator YAML short syntax (@MatTheCat)
• bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (@nicolas-grekas)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• bug #64595 [Cache][VarExporter] Add argument $allowNamedClosure to DeepClone to fit ext-deepclone v0.8 (@nicolas-grekas)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
• bug #64466 [ObjectMapper] Fix reverse class map throwing on unreadable source (@yoye)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• bug #64572 [DependencyInjection] Fix decorating an event listener no longer replacing it (@nicolas-grekas)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• bug #64555 [FrameworkBundle] Fix custom config directory being ignored when registering bundles (@nicolas-grekas)
• bug #64560 [FrameworkBundle] Avoid resolving all env vars when building the router request context (@nicolas-grekas)
• bug #64558 [Security] Make RoleHierarchy::getReachableRoleNames() return a list again (@nicolas-grekas)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64552 [Cache][FrameworkBundle] Fix warming up caches that hold a closure (@nicolas-grekas)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• bug #64362 [Tui] Fix vertical align (@sblondeau)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• bug #64474 [HttpKernel] Allow leading zeros in int request attributes (@ousamabenyounes)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64523 [DependencyInjection] Keep behavior-describing tags 'proxy' and 'container.service_subscriber.locator' on decorated services (@ousamabenyounes)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• bug #64536 [Form] Don't re-add deleted collection entries on submit (@eyupcanakman)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• bug #64534 [Tui] Avoid splitting Unicode ellipsis when truncating (rahul chavan)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• bug #64527 [Tui] Truncate InputWidget prompt when wider than available columns (@ousamabenyounes)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
• minor #64417 [DependencyInjection] Improve TaggedIteratorArgument deprecation warning (@jbafford)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• minor #64437 [HttpKernel] Add @template on ControllerAttributeEvent (@lyrixx)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• bug #64441 [FrameworkBundle] Fix dumping the debug container on cache:clear/cache:warmup (@nicolas-grekas)
• bug #64443 [DomCrawler] Remove final keyword on ChoiceFormField::addChoice() (@syl20b)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64449 [HttpKernel] Fix #[MapRequestPayload] being handled before #[IsGranted] (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64426 [HttpKernel] Fix TypeError in ResponseEvent when argument resolution throws (@nicolas-grekas)
• bug #64420 [FrameworkBundle] Fix "allow_no_handlers" being ignored on message buses (@damien-bp)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• minor #64403 Update CHANGELOG-8.1.md (@yauhenko)
• minor #64416 Clarify #[Target] attribute in UPGRADE-8.1 (@jbafford)

Symfony 8.0 is backed by:

PhpStorm is a JetBrains IDE designed specifically for PHP development. Out of the box, PhpStorm provides you with intelligent, feature-rich code editing tailored to every aspect of PHP programming – smart coding assistance, reliable refactorings, instant code navigation, built-in developer tools, PHP framework support, and more.

Sulu is the CMS for Symfony developers. It provides pre-built content-management features while giving developers the freedom to build, deploy, and maintain custom solutions using full-stack Symfony. Sulu is ideal for creating complex websites, integrating external tools, and building custom-built solutions.

Symfony 8.0.14 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.0.13

• data #64730 Release v8.0.14
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
• bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
• bug #64102 Remove usage of Kernel::VERSION (@fabpot)
• data #64372 Release v7.4.13
• data #64371 Release v6.4.41

❤️

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 DevOps for a Symfony project at Cloudpepper

View Symfony jobs →

$150,000 – $180,000 / year - Full remote

Symfony 7.4 is backed by:

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

Symfony 7.4.14 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.13

• data #64729 Release v7.4.14
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
• bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
• bug #64102 Remove usage of Kernel::VERSION (@fabpot)
• data #64371 Release v6.4.41

❤️ Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Lead Symfony Developer at DocuPet
View Symfony jobs →
CA$140,000 – CA$180,000 / year - Full remote

Symfony 6.4 is backed by:

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Symfony 6.4.42 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.41

• data #64728 Release v6.4.42
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
• bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)

❤️ Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Backend Symfony Developer at KRUU GmbH

View Symfony jobs →

€60,000 – €75,000 / month - Remote + part-time onsite (Bad Friedrichshall, Germany)

Symfony UX 3.2.0 and 2.36.1 are now available. Both releases fix two security issues, one in UX Icons and one in UX Toolkit, so every application using these packages should upgrade as soon as possible. On top of the security fixes, version 3.2.0 ships several new features for TwigComponent, Toolkit and Native.

Security

Two vulnerabilities were fixed in both maintained branches (2.36.1 and 3.2.0).

UX Icons rendered SVG content without sanitization, both for local icon files and for the on-demand Iconify responses (enabled by default). Because the ux_icon() Twig function outputs its SVG as safe HTML, a malicious icon set or a compromised Iconify endpoint could inject scripts and event handlers, leading to cross-site scripting. The renderer now sanitizes every icon, from any source, before it reaches the page (CVE-2026-55877).

UX Toolkit installed recipe files from a kit by copying the paths listed in its copy-files map, guarded only by a relative-path check. A crafted kit could use .. segments to escape the target directory and read or overwrite arbitrary files, up to code execution on a developer machine or CI runner. The installer now rejects any path that escapes the recipe directory (CVE-2026-55878).

Both issues were reported by Pascal Cescon and fixed by Hugo Alliaume.

Standalone components with any PSR-11 container

Contributed by Guillaume Sainthillier in #3602

TwigComponent's runtime no longer requires symfony/dependency-injection. ComponentFactory and ComponentRuntime only ever call get() and has() on their service locator, both defined by the PSR-11 Psr\Container\ContainerInterface, so they now typehint that interface instead of Symfony's concrete ServiceLocator.

This decouples the runtime from the DI component, so you can use TwigComponent standalone, with only Twig and any PSR-11 container:

use Psr\Container\ContainerInterface;
use Symfony\UX\TwigComponent\ComponentFactory;

// wire the runtime with any Psr\Container\ContainerInterface
$factory = new ComponentFactory($templateFinder, $container, $propertyAccessor, $eventDispatcher, $config, $classMap, $twig);

Inside a full Symfony application, nothing changes: ServiceLocator still implements the interface and the bundle keeps wiring it for you.

A richer ComponentRendererInterface

Contributed by Mathias H. in #3600

ComponentRendererInterface only declared createAndRender(), even though ComponentRuntime also relied on preCreateForRender(), startEmbeddedComponentRender(), and finishEmbeddedComponentRender() from the concrete, final renderer. Intercepting the render pipeline therefore meant forking the runtime or reaching into private state through reflection.

These three methods are now part of the interface, and ComponentRuntime depends on the interface instead of the concrete class. You can decorate or replace the renderer with a clean, upgrade-safe contract:

use Symfony\UX\TwigComponent\ComponentRendererInterface;
final class ComponentPreloader implements ComponentRendererInterface
{
    public function __construct(private ComponentRendererInterface $inner) {
        // preCreateForRender(), startEmbeddedComponentRender() and finishEmbeddedComponentRender() are now part of the contract
    }
}

Kit-global dependencies in UX Toolkit

Contributed by Hugo Alliaume in #3671

A Toolkit kit can install some libraries once for the whole kit (for example Flowbite), but the dependency checker only knew about per-recipe dependencies, so it flagged those kit-global imports as undeclared on every recipe.

A kit manifest can now declare its own dependencies, shared across all of its recipes:

{
  "name": "Flowbite v4",
  "dependencies": {
    "npm": [
      "flowbite"
    ],
    "importmap": [
      "flowbite"
    ]
  }
}

npm and importmap packages declared at the kit level are now treated as available for every recipe in the kit.

A linter for Toolkit kits

Contributed by Hugo Alliaume in #3655

Maintaining a kit means keeping recipes, templates, assets and dependencies in sync, and it is easy to ship a broken copy-files entry or a Stimulus controller without its JavaScript file. A new linter catches these regressions before they reach users:

$ ./vendor/bin/ux-toolkit-kit-lint path/to/your-kit

It runs structural checks (missing recipe manifests, broken copy-files entries, unknown recipe references) and coherence checks (Stimulus controllers used in Twig without a matching JavaScript file, undeclared JavaScript imports). The tool is meant for kit maintainers, so it is exposed as a standalone binary with no DI wiring, ready to run locally or from CI.

Renamed UX Native build command

Contributed by Hugo Alliaume in #3611

The UX Native command that produces the JSON configuration for the iOS and Android Hotwire Native shells was renamed to follow the ux:<...> convention and to drop the debug-flavored dump verb:

# before
$ php bin/console ux-native:dump

# after
$ php bin/console ux:native:build-configs

UX Native is still experimental, so this rename ships without a backward compatibility alias; update your scripts and CI accordingly.

Full Changelog

• CVE-2026-55877 [Icons] Sanitize Iconify SVG output and unify icon creation (@Kocal)
• CVE-2026-55878 [Toolkit] Harden recipe installer against path traversal (@Kocal)
• #3682 [Toolkit][Shadcn] Fix position and phantom text-node in tooltip recipe (@Kocal)
• #3602 [TwigComponent] Allow standalone usage with any PSR-11 container (@guillaume-sainthillier)
• #3673 [Encore] Pin vue to <3.5.36 to workaround broken upstream publish (@Kocal)
• #3672 [Toolkit][Flowbite4] Fix linting issues (@Kocal)
• #3671 [Toolkit] Allow declaring kit-global dependencies in kit manifest (@Kocal)
• #3659 [Toolkit] Consider recipe deps in StimulusControllerChecker (@Kocal)
• #3655 [Toolkit] Add lint kit command and CI lint workflow (@Kocal)
• #3652 [Toolkit][Shadcn] Fix manifest dependencies (@seb-jean)
• #3600 [TwigComponent] Expose pre/embedded render methods on ComponentRendererInterface (@treztreiz)
• #3614 [Turbo] Conflict with Mercure >=0.7.0 <0.7.2 (@Kocal)
• #3611 [Native] Rename ux-native:dump command to ux:native:build-configs (@Kocal)

Twig 3.27.1 is a patch release that fixes two regressions introduced by the sandbox hardening shipped in 3.27.0. Both involve how the sandbox inspects values that can be coerced to a string, and both are transparent once you upgrade.

Typed iterable arguments are no longer turned into arrays. To enforce the __toString policy on the elements yielded by a Traversable, 3.27.0 started materializing such values into plain arrays before handing them to host code. This broke functions typed against a concrete iterable class; passing a Symfony FormView to form_errors() in a sandboxed template failed with a FormView, array given type error. The sandbox now walks an IteratorAggregate in place and passes the original object through unchanged, so host code keeps receiving the type it expects while the yielded elements are still policy-checked.

Array access with a stringable key is now consistent. Accessing a mapping with an object key behaved differently depending on the compiled path: the optimized inline path threw Cannot access offset of type Stringable on array, while the regular path coerced the key to a string. The optimized path now coerces the key the same way, so the following works whatever the strict_variables setting:

{# `section` is an object implementing Stringable #}
{{ menu[section] }}

In a sandbox, that coercion goes through the __toString policy as well, so a disallowed class is rejected instead of silently slipping through.

Full Changelog

• Fix array access with a Stringable key to coerce the key to string consistently instead of throwing in the optimized path (@fabpot)
• Fix sandbox replacing IteratorAggregate arguments (e.g. Symfony's FormView) by a plain array (@fabpot)

Symfony 8.1 is backed by:

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Symfony 8.1.0 has just been released.

Check the New in Symfony 8.1 posts on this blog to learn about the main features of this new stable release; or check the first beta release announcement to get the list of all its new features.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.0-RC1

• data #64399 Release v8.1.0
• feature #64398 Shopware is backing Symfony 8.1, thanks to them! (@nicolas-grekas)
• feature #64397 Mailtrap is backing Ssymfony 8.1, thanks to them! (@nicolas-grekas)
• feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (@nicolas-grekas)
• feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (@nicolas-grekas)
• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
• bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
• bug #64102 Remove usage of Kernel::VERSION (@fabpot)
• data #64374 Release v8.0.13
• data #64372 Release v7.4.13
• data #64371 Release v6.4.41

Symfony UX 3.1.0 is the first feature release on the 3.x branch. It brings a brand-new Calendar Link component, provide() and inject() functions for Twig components, a modern custom element and Twig component for Turbo Mercure streams, Turbo Frame request detection, and a large alignment of the Toolkit Shadcn kit with its upstream reference. This release also ships the same security fixes as Symfony UX 2.36.0; read that announcement for the details and upgrade promptly if you use the LiveComponent or Autocomplete packages.

A new Calendar Link component

A new Calendar Link component

Contributed by Zairig Imad in #3460

Letting users add an event to their calendar usually means hand-building provider-specific URLs and an .ics file. The new Calendar Link component generates "Add to calendar" links for Google Calendar, Outlook.com, Office 365 and iCalendar (.ics), the format consumed by Apple Calendar, Outlook desktop, Thunderbird and every native calendar client.

Describe the event once with a CalendarEvent, then render links from Twig with ux_calendar_link() for a single provider or ux_calendar_links() for every registered one:

The component is marked experimental, so its API may still change.

Share data across Twig components with provide() and inject()

Contributed by Hugo Alliaume in #3512

When a component is split into nested sub-components, passing a value from the root down to a deep descendant means forwarding it as a prop through every level in between. The new provide() and inject() Twig functions, inspired by Vue.js, remove that plumbing: a parent publishes a value once and any descendant reads it, no matter how deep.

Publish a value in the parent:

Then read it in any descendant, with a fallback if no value was provided:

Values flow top-down only and are dropped once the parent finishes rendering, so sibling components never share state. Several Toolkit Shadcn recipes (accordion, tabs, dialog, tooltip and more) were reworked to use this new mechanism.

A custom element for Turbo Mercure streams

Contributed by Seb Jean in #3505

Subscribing to Mercure topics for Turbo Stream updates relied on the mercure-turbo-stream Stimulus controller and the turbo_stream_listen() Twig function. This release introduces a native custom element that manages the EventSource lifecycle on its own, plus a turbo_stream_from() Twig function and a twig:Turbo:Stream:From Twig component to subscribe declaratively:

Private topics and specific transports are first-class:

The turbo_stream_listen() Twig function is now deprecated in favor of turbo_stream_from() and the new Twig component.

Detect and render Turbo Frame requests

Contributed by Seb Jean in #3462 and #3439

Inspired by Turbo Rails, the new TurboFrame service detects whether the current request was triggered by a Turbo Frame, so a controller can return a lighter partial instead of the full page:

To go with it, a minimal @Turbo/layouts/frame.html.twig layout provides a lightweight HTML skeleton with overridable head and body blocks, so frame responses can still populate the without dragging in the full application layout.

Toolkit Shadcn kit aligned with its reference

Contributed by Seb Jean in #3538, #3551, #3567, #3590, and #3592

The Toolkit Shadcn kit received a sweeping update: more than forty components, from accordion and alert-dialog to table, tabs, tooltip and input-group, were realigned with the upstream shadcn reference, and new recipes such as hover-card and resizable were added. The Toolkit manifest also gained a version-added key so the documentation can show when each component became available.

Better LiveComponent ergonomics

Contributed by Pierre Capel in #3432 and #Amoifr

When a form submitted from a LiveAction fails validation, the resulting exception used to carry a generic "Form validation failed in component" message. It now includes the full field path and the specific violation for each error, which makes failures far easier to debug in tests and during development:

LiveComponents also now expose their loading state through the standard aria-busy="true" attribute instead of a non-standard busy attribute, so screen readers can announce re-renders and you can style them with the [aria-busy="true"] selector.

A new translation cache command

Contributed by Hugo Alliaume in #3601

Mirroring ux:icons:warm-cache, the new ux:translator:warm-cache command dumps the JavaScript and TypeScript translation files on demand, without warming the whole Symfony cache:

$ php bin/console ux:translator:warm-cache

Full Changelog

• [LiveComponent] Require X-Requested-With header to prevent CSRF (@Kocal)
• [Autocomplete] Fix XSS via unescaped AJAX response data (@Kocal)
• [LiveComponent] Parse format-less date LiveProps strictly with RFC 3339 (@Kocal)
• [LiveComponent] Cap the number of actions per _batch request (@Kocal)
• [LiveComponent] Reject malicious child component tags (@Kocal)
• [LiveComponent] Bind HMAC checksum to component name and slot (@Kocal)
• [Autocomplete] Escape LIKE wildcards in the search query (@Amoifr)
• [Translator] Add ux:translator:warm-cache command (@Kocal)
• [LiveComponent] Improve form validation error messages in exceptions (@PierreCapel)
• Use twig.safe_class tag and move setLexer to TwigComponentPass (@GromNaN)
• [LiveComponent] Make LiveComponentSubscriber safe-by-default (@Kocal)
• [Autocomplete] Use hash_equals() to compare the extra_options checksum (@Amoifr)
• [Turbo] Add custom element (@seb-jean)
• [Turbo] Add TurboFrame service to detect Turbo Frame requests (@seb-jean)
• [Turbo] Add minimal frame layout template (@seb-jean)
• [Toolkit] Add version-added key in toolkit manifest (@MrYamous)
• [CalendarLink] Add component (@zairigimad)
• [LiveComponent] Fix dynamic template resolution when using "loading" attribute (@xDeSwa)
• [TwigComponent] Include attribute name in null value error message (@IndraGunawan)
• [TwigComponent] Add provide() and inject() Twig functions (@Kocal)
• [LiveComponent] Use aria-busy attribute during component re-render (@Amoifr)
• [Toolkit][Flowbite] add Dropdown and Avatar component (@DcgRG)
• [Toolkit][Shadcn] Align 35+ components with the shadcn reference (@seb-jean)
• [Toolkit][Shadcn] Rework recipes to use provide()/inject() (@Kocal)
• [Toolkit][Shadcn] Add new recipes: hover-card, resizable, radio-group, collapsible, typography and toggle-group (@Amoifr)

Symfony UX 2.36.0 is a security release for the 2.x branch: it fixes seven vulnerabilities in the LiveComponent and Autocomplete packages, two of them rated medium severity. If your application depends on symfony/ux-live-component or symfony/ux-autocomplete, upgrade as soon as possible. The same fixes are also available on the 3.x branch through Symfony UX 3.1.0.

Medium severity

Two cross-site scripting issues are fixed in this release.

The Autocomplete Stimulus controller rendered AJAX response items by interpolating the text field directly into the dropdown's HTML, so any markup contained in the response was executed by the browser. When the dropdown values came from user-supplied content, an attacker could craft a string that triggered stored XSS for any other user who later opened a page with an autocomplete widget backed by the same data. The remote-data renderers now HTML-escape values by default. Endpoints that legitimately return HTML, for example to highlight the search term, can opt back in with the new options_as_html: true option (CVE-2026-49216).

LiveComponent re-renders interpolated the child component tag name, taken from client-controlled JSON, into the response without validation, allowing arbitrary HTML, including

Twig 3.27.0 ships five sandbox security fixes (one low, four medium) and a new opt-in strict mode for SecurityPolicy that lets you adopt the forthcoming 4.0 sandbox defaults today. We recommend upgrading any application that renders user-controlled templates in a sandbox; details and CVE references are below so you can assess your exposure.

Sandbox: opt into 4.0 strict mode today

Contributed by Fabien Potencier in #4813 and #4817

In a sandbox, the extends and use tags as well as the parent, block, and attribute functions have always been implicitly allowed, regardless of what your SecurityPolicy declared. Twig 3.12 started emitting a deprecation for the two tags; this release extends it to the three functions, because 4.0 will require all of them to be listed explicitly.

To preview the 4.0 behavior on 3.x (and silence the deprecations), enable strict mode on SecurityPolicy :

use Twig\Sandbox\SecurityPolicy;
$policy = new SecurityPolicy(
    allowedTags: ['extends', 'if', 'for'],
    allowedFilters: ['escape', 'upper'],
    allowedFunctions: ['parent', 'block'],
);
$policy->setStrict(true);

With strict mode on, every tag and every function must appear in the relevant allow-list to be usable. Any template that relied on the historical implicit allowance will throw a SecurityNotAllowedTagError or SecurityNotAllowedFunctionError, which is exactly what 4.0 will do.

Profiler: harden HtmlDumper and Profile::unserialize()

Contributed by Fabien Potencier in #4807 and #4808

Two hardening fixes land in the profiler. HtmlDumper now escapes the root profile name, so a profile created with a hostile name no longer emits raw HTML into the dump output. And Profile::unserialize() now restricts the classes PHP is allowed to instantiate to Profile itself, preventing arbitrary __unserialize() / __wakeup() magic methods from running when an untrusted profile blob is deserialized.

SourcePolicyInterface is deprecated

Contributed by Fabien Potencier in #4803

Twig\Sandbox\SourcePolicyInterface is now deprecated with no replacement. The feature sees no real-world use, and the recommended way to render templates written by untrusted authors is to point a dedicated sandboxed Environment at a loader that restricts what those templates can see, rather than toggling sandbox state per source from within a shared environment.

Security fixes

This release fixes five sandbox vulnerabilities. All of them are policy enforcement gaps rather than direct code execution issues; the realistic impact is unauthorized disclosure of data exposed through __toString() methods or property allow-lists. Applications that do not render sandboxed templates are unaffected.

Medium

A cached Template instance kept the filter, tag, and function allow-list verdict computed at construction time, so any later change of sandbox state on the same Environment was ignored. Long-lived workers (FrankenPHP, RoadRunner, Symfony Messenger consumers) sharing a single Environment between sandboxed and non-sandboxed renders are the most exposed: a non-sandboxed render of a shared layout pre-warmed its instance, after which any sandboxed render that extended, included, or imported from that layout silently skipped the allow-list. The check now runs at every entry point and is re-evaluated against the current sandbox state (CVE-2026-46636).

A dynamic mapping key such as {% set arr = {(obj): "value"} %} emitted a raw (string) cast on the key expression, so PHP invoked __toString() on the resolved object without ever consulting the sandbox policy. ArrayExpression now declares its dynamic keys as string-coercion sites, and as a side effect any expression (not only context variables) is accepted as a dynamic mapping key (CVE-2026-48806).

The join and replace filters, and the in / not in operators, coerced Stringable objects to strings without going through ensureToStringAllowed(). Both filters materialize Traversable arguments through implode() / strtr(); the operators fall through to PHP's <=> comparison. The fix recurses into Traversable operands when computing the policy check, and wraps both sides of in / not in so the policy is consulted before any coercion happens (CVE-2026-48807).

When sandboxing was enabled through SourcePolicyInterface, the column filter routed property reads through SandboxExtension with a null Source, which short-circuited the per-source decision and skipped the property allow-list entirely. The filter now calls the security policy directly using the sandbox state already computed at the call site (CVE-2026-48808).

Low

The deprecated internal wrappers in src/Resources/core.php (twig_check_arrow_in_sandbox(), twig_array_some(), twig_array_every()) were not updated when 3.26.0 changed the underlying CoreExtension signatures to take an explicit $isSandboxed boolean. As a result, array.some and array.every silently dropped the Closure-only restriction when invoked through the wrappers, and twig_check_arrow_in_sandbox() threw a TypeError on PHP 8+. The wrappers now resolve the sandbox state through the same helper that compiled templates use. Compiled templates themselves were never affected (CVE-2026-48805).

Credits

Thanks to El Kharoubi Iosif for reporting CVE-2026-48805 and CVE-2026-48806, Vincent55 Yang for reporting CVE-2026-48808 and co-reporting CVE-2026-48807, and Fabien Potencier for reporting CVE-2026-46636, co-reporting CVE-2026-48807, and providing the fixes for all five advisories.

Full Changelog

• CVE-2026-46636 Fix sandbox filter/tag/function allow-list bypass when sandbox state changes between renders
• CVE-2026-48805 Fix sandbox bypass in deprecated internal wrappers
• CVE-2026-48806 Fix sandbox __toString policy bypass via dynamic mapping keys
• CVE-2026-48807 Fix sandbox __toString bypasses via Traversable in join / replace filters and the in / not in operators
• CVE-2026-48808 Fix sandbox bypass in the column filter under SourcePolicyInterface
• #4817 Add a strict mode to SecurityPolicy to opt-in to the 4.0 sandbox behavior for the extends / use tags and the parent / block / attribute functions (@fabpot)
• #4813 Deprecate the fact that the parent, block, and attribute functions are always allowed in a sandboxed template (@fabpot)
• #4812 Fix PHP 8.1+ implicit float-to-int deprecation in sandboxed array access (@fabpot)
• #4807 Escape root profile name in HtmlDumper (@fabpot)
• #4808 Restrict allowed classes in Profile::unserialize() (@fabpot)
• #4803 Deprecate the Twig\Sandbox\SourcePolicyInterface interface (@fabpot)

Symfony 8.1 is backed by:

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Symfony 8.1.0-RC1 has just been released.

This is a pre-release version of Symfony 8.1. If you want to test it in your own applications before its final release, run the following commands:

$ composer config minimum-stability rc
$ composer config extra.symfony.require "8.1.*"
$ composer update

These commands assume that all your Symfony dependencies in composer.json use * as their version constraint. Otherwise, you will need to update the version constraints of those Symfony dependencies to 8.1.*.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.0-BETA3

• data #64377 Release v8.1.0-RC1
• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas)
• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)
• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (@nicolas-grekas)
• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (@nicolas-grekas)
• bug #64356 [Tui] Throw when ext-zip is not installed and one tries to load a zipped figlet (@nicolas-grekas)
• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (@nicolas-grekas)
• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (@Dooij)
• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (@MatTheCat)
• feature #64334 [Form] Add handle_missing_data option to opt into MissingDataHandler for absent forms (@hlecorche)
• bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (@nicolas-grekas)
• bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (@nicolas-grekas)
• bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (@signor-pedro)
• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (@ousamabenyounes)
• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (@ousamabenyounes)
• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (@nicolas-grekas)
• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)
• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (@nicolas-grekas)
• bug #64337 [Security] Initialize lazy users before serializing them (@MatTheCat)
• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (@nicolas-grekas)
• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (@nicolas-grekas)
• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (@nicolas-grekas)
• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (@MatTheCat)
• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (@ousamabenyounes)
• bug #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (@nicolas-grekas)
• feature #64312 [FrameworkBundle][Validator] Add framework.validation.property_metadata_existence_check config (@nicolas-grekas)
• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (@MatTheCat)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64234 [Tui] Fix unattached widget element styles (@masskrdjn)
• bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (@nicolas-grekas)
• bug #64223 [Tui] Fix invisible border with null color in BorderPattern's inverse strategies (@sblondeau)
• data #64306 Release v8.0.12
• data #64305 Release v7.4.12
• data #64302 Release v5.4.52

Symfony 8.0 is backed by:

Sulu is the CMS for Symfony developers. It provides pre-built content-management features while giving developers the freedom to build, deploy, and maintain custom solutions using full-stack Symfony. Sulu is ideal for creating complex websites, integrating external tools, and building custom-built solutions.

PhpStorm is a JetBrains IDE designed specifically for PHP development. Out of the box, PhpStorm provides you with intelligent, feature-rich code editing tailored to every aspect of PHP programming – smart coding assistance, reliable refactorings, instant code navigation, built-in developer tools, PHP framework support, and more.

Symfony 8.0.13 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.0.12

• data #64374 Release v8.0.13
• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas)
• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)
• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (@nicolas-grekas)
• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (@nicolas-grekas)
• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (@nicolas-grekas)
• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (@Dooij)
• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (@MatTheCat)
• bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (@nicolas-grekas)
• bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (@nicolas-grekas)
• bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (@signor-pedro)
• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (@ousamabenyounes)
• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (@ousamabenyounes)
• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (@nicolas-grekas)
• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)
• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (@nicolas-grekas)
• bug #64337 [Security] Initialize lazy users before serializing them (@MatTheCat)
• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (@nicolas-grekas)
• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (@nicolas-grekas)
• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (@nicolas-grekas)
• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (@MatTheCat)
• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (@ousamabenyounes)
• bug #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (@nicolas-grekas)
• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (@MatTheCat)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (@nicolas-grekas)
• data #64305 Release v7.4.12
• data #64302 Release v5.4.52

❤️

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Symfony 7.4 is backed by:

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

❤️ 2

Symfony 7.4.13 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.12

• data #64372 Release v7.4.13
• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas)
• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , , , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)
• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (@nicolas-grekas)
• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (@nicolas-grekas)
• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (@nicolas-grekas)
• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (@Dooij)
• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (@MatTheCat)
• bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (@nicolas-grekas)
• bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (@nicolas-grekas)
• bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (@signor-pedro)
• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (@ousamabenyounes)
• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (@ousamabenyounes)
• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (@nicolas-grekas)
• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)
• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (@nicolas-grekas)
• bug #64337 [Security] Initialize lazy users before serializing them (@MatTheCat)
• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (@nicolas-grekas)
• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (@nicolas-grekas)
• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (@nicolas-grekas)
• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (@MatTheCat)
• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (@ousamabenyounes)
• bug #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (@nicolas-grekas)
• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (@MatTheCat)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (@nicolas-grekas)
• data #64302 Release v5.4.52

❤️ 2

Published in #Releases

❤️

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Backend Symfony Developer at KRUU GmbH

View Symfony jobs →

€60,000 – €75,000 / month - Remote + part-time onsite (Bad Friedrichshall, Germany)