Symfony UX 3.6 is out, with more than 100 pull requests merged since 3.5.1. It adds three experimental packages, UX Inspector, UX Image and UX Router, aligns the Shadcn kit of the UX Toolkit with the Nova style, and runs every Toolkit recipe in a real browser, which led to about thirty fixes in the kits.

UX Inspector

Stimulus controllers, LiveComponents and Turbo frames are spread across the DOM as data-* attributes, and the browser devtools give you no overview of them. UX Inspector is a devtools panel for Symfony UX that outlines every controller, component and frame of the page.

Pick one on the page to jump to its details, which update while the application runs. Open the panel with the pull tab on the right edge of the screen, or type u then x outside an editable field.

• Stimulus: values and their defaults, targets, CSS classes, actions and outlets, and whether the controller is connected;
• LiveComponent: props and parent props, models and their modifiers, actions and their arguments, event listeners, loading and polling;
• Turbo: the source URL, loading strategy and state of each frame, nested frames, and Stream actions.

The activity log lists events in the order they fire: LiveComponent renders, Turbo fetches with their status and duration, controller events. This first version only reads the page, and only runs in debug mode.

The Flex recipe, which registers the bundle in dev and connects your Stimulus application to it, is still in review (symfony/recipes#1586). The guided demos on the UX website show the Inspector at work.

UX Image

A responsive image needs several variants of the same file, a srcset that lists them and a sizes attribute that matches the layout. UX Image generates all three, but it never decodes, resizes or encodes an image itself: every variant is a URL, and an image CDN does the work.

Nothing is transformed by default. Every variant comes from an external CDN, through a bridge you install, and switching CDNs never touches a template. Four bridges ship with this release, each in its own package: Cloudflare, Cloudinary, imgix and KeyCDN.

On ux.symfony.com, served through Cloudinary, this template:

<twig:ux:image src="/uploads/col-de-saint-bonnet.jpg" alt="View from the Col de Saint-Bonnet" width="480" height="270" />

renders the following HTML (line breaks added for readability, the s--…-- segment signs each URL):

<img src="https://res.cloudinary.com/fnmfvsxv/image/fetch/s--pYfkWjrh--/w_480,h_270,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg" alt="View from the Col de Saint-Bonnet" srcset="https://res.cloudinary.com/fnmfvsxv/image/fetch/s--pYfkWjrh--/w_480,h_270,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg 480w, https://res.cloudinary.com/fnmfvsxv/image/fetch/s--IP7ocXoV--/w_640,h_360,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg 640w, https://res.cloudinary.com/fnmfvsxv/image/fetch/s--gCP1dXee--/w_750,h_422,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg 750w, https://res.cloudinary.com/fnmfvsxv/image/fetch/s--An-4f96H--/w_828,h_466,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg 828w, https://res.cloudinary.com/fnmfvsxv/image/fetch/s--fWWMvhjt--/w_960,h_540,c_fill,f_auto/https://ux.symfony.com/uploads/col-de-saint-bonnet.jpg 960w" sizes="(min-width: 480px) 480px, 100vw" loading="lazy" width="480" height="270" style="object-fit: cover; max-width: 480px; max-height: 270px; aspect-ratio: 480 / 270; width: 100%; height: auto;" />

<twig:ux:picture> renders one <source> per format instead. ux_image_url() returns a single URL, for an Open Graph image or an email, and presets give a name to a set of transformations.

The UX Image page has a live demo.

UX Router

Generating a Symfony URL from JavaScript has meant hard-coding paths, or installing FOSJsRoutingBundle, whose documentation covers Webpack Encore but not AssetMapper.

UX Router dumps the routes you expose when the cache warms up, and gives you path() and url() functions that return the same result as their Twig counterparts. It works with AssetMapper, Reprise (Vite and Rsbuild) and Webpack Encore, and with TypeScript, route names and parameters are type-checked.

No route is exposed by default. To expose a single route, set its expose option, the same one FOSJsRoutingBundle users already know:

// src/Controller/BlogController.php
#[Route('/blog/{slug}', name: 'app_blog_show', options: ['expose' => true])]
public function show(string $slug): Response

To expose many routes at once, list name patterns; a leading ! excludes routes. The expose option of a route always wins over the patterns:

# config/packages/ux_router.yaml
ux_router:
  routes:
    -
      'app_*'
    -
      '!app_admin_*'

The exposed routes are dumped as JavaScript to var/routes/ when the cache warms up. assets/router.js passes them to createRouter() with the default locale and exports path() and url():

// assets/router.js
import { createRouter } from '@symfony/ux-router';
import { routes, defaultLocale } from '../var/routes/index.js';
export const { path, url } = createRouter({ routes, defaultLocale });

Any other JavaScript file imports them from ./router.js:

// assets/my_file.js
import { path, url } from './router.js';

path('app_blog_show', { slug: 'hello', _query: { page: 2 } }); // '/blog/hello?page=2'
url('app_blog_show', { slug: 'hello' }); // 'https://example.com/blog/hello'

A localized route picks its variant from <html lang>, and falls back to the framework.default_locale of your application, dumped as defaultLocale.

The UX Router page has a live demo.

Front-End Code Checked Against Web Platform Baseline

The Symfony backward compatibility promise covers the PHP API, but nothing said which browser features the JavaScript and CSS of Symfony UX may rely on. Following an RFC by Simon André, the code shipped by every UX package is now checked in CI against Web Platform Baseline, "Widely available" by default.

A package can declare exceptions. Notify relies on the Notifications API, which is Baseline "Limited" as long as iOS Safari only exposes it to web apps added to the home screen. LiveComponent only uses the Navigation API when the browser supports it. UX Inspector, a development tool, targets Baseline 2024 instead, with a few CSS exceptions. The build target now comes from Browserslist instead of a hard-coded es2022. The rebuilt files are byte-identical, so nothing you install changes.

UX Toolkit: The Shadcn Kit Moves to Nova

shadcn/ui introduced several visual styles in December 2025, and Nova is the compact one, with reduced padding and margins. Every recipe of the Shadcn kit was compared against the upstream Nova sources and aligned with them.

Two recipes were rewritten to match their upstream component. select is now a listbox built from Select:* sub-components and driven by a Stimulus controller; use native-select for a native <select>. combobox is now made of Combobox:* sub-components, with multiple selection. Clicking an addon of input-group now focuses its input.

<twig:Select id="fruit" name="fruit" value="banana"><twig:Select:Trigger><twig:Select:Value placeholder="Select a fruit" /><twig:Select:Trigger><twig:Select:Content><twig:Select:Group id="fruits"><twig:Select:Label>Fruits</twig:Select:Label><twig:Select:Item value="apple">Apple</twig:Select:Item><twig:Select:Item value="banana">Banana</twig:Select:Item></twig:Select:Group></twig:Select:Content></twig:Select>

Recipes are copied into your application, so nothing changes until you install them again.

UX Toolkit: Three New Shadcn Recipes

The Shadcn kit gained three recipes:

• toast stacks notifications in a corner of the screen;
• context-menu opens a menu on right click;
• command is the command menu Shadcn builds on top of cmdk, with a Stimulus controller in place of cmdk: it filters items as you type, and handles the keyboard shortcuts cmdk users expect.

A toast can be fired from any element with the toast#add action:

<twig:Toaster position="bottom-right" duration="5000" limit="3"><twig:Button data-action="click->toast#add" data-toast-type-param="success" data-toast-title-param="Event created" data-toast-description-param="Sunday, December 3 at 9:00 AM" data-toast-action-label-param="Undo">Show Toast</twig:Button></twig:Toaster>

From JavaScript, the toast() helper exported by the controller does the same: toast.success('Event created'). To free the Toast name, the sonner recipe's component is now Sonner:Toast.

UX Toolkit: A Diff Before Overwriting a File

ux:install asks before overwriting a file that already exists, but it never showed what would change. You either trusted the recipe or compared both files yourself.

When Git is installed, the command now prints a diff first, with the changed part of each line highlighted. When the file already matches the recipe, it no longer asks at all.

$ php bin/console ux:install button --kit=shadcn

Installing recipe "button" from the Shadcn UI kit...
@@ -1,6 +1,6 @@
{%- props
## 'default'|'secondary'|'destructive'|'outline'|'ghost'|'link' The visual style variant.
-    variant = 'outline',
+    variant = 'default',
## 'default'|'xs'|'sm'|'lg'|'icon'|'icon-xs'|'icon-sm'|'icon-lg' The button size.
size = 'default',
## 'button'|'a' The HTML tag to render; use `a` when the button navigates.
File "templates/components/Button.html.twig" already exists. Do you want to overwrite it? (yes/no) [yes]:

UX Toolkit: Every Recipe Tested in a Real Browser

Toolkit recipes were tested through snapshots of the HTML they render. That says nothing about what a recipe looks like, or what happens when you click it. A new preview app now renders every example in isolation, and Playwright screenshots each one in light and dark mode, then compares it with a committed baseline: more than 1,800 screenshots across the four kits. Every interactive recipe also has its own interaction spec, and a test fails when a new one ships without it.

Writing those tests surfaced about thirty bugs in the Shadcn and Flowbite kits, all fixed in this release, among them:

• a closed sheet or drawer staying reachable with the keyboard and exposed to screen readers;
• dialog, alert-dialog, drawer, sheet and the Flowbite modal no longer being modal once moved in the DOM;
• alert-dialog opening on page load;
• a disabled slider still reacting to the keyboard, and slider losing the focus after a click on its track;
• Tab skipping the panels of navigation-menu;
• tooltip overflowing the viewport;
• date-picker focusing "Previous month" instead of a day when it opens;
• the Flowbite modal having no accessible name, and the inactive triggers of the Flowbite tabs being unreadable in dark mode.

Turbo and Notify Speak the Mercure Protocol 1.0

MercureBundle 0.6 makes the Mercure protocol 1.0 the default. That protocol dropped URI Templates, so turbo_stream_from('App\Entity\Book') stayed silent on such a hub, and the Notify Stimulus controller, which only knew the topic query parameter, subscribed to nothing.

UX Turbo and UX Notify now support MercureBundle 0.5 and 0.6, and speak the protocol of the hub they use. Listening to every entity of a class subscribes to a URL Pattern (:id) instead of a URI Template ({id}), and Notify subscribes with match instead of topic. On a hub that speaks the protocol 0.x, nothing changes. The deprecated turbo_stream_listen() throws an exception on a 1.0 hub: use turbo_stream_from() instead.

Searching ux.symfony.com

ux.symfony.com had no search: finding a package, a recipe or a demo meant browsing the site. It now has one, powered by Algolia DocSearch. Open it from the header, or press Ctrl+K (⌘K on macOS).

It covers the packages, the Toolkit kits and their recipes, the demos and resources such as the changelog, and groups the results into Packages, Kits, Demos and Resources.

Another Performance Pass

TwigComponent and UX Icons got another round of optimizations, mostly by skipping work nobody needs: walking the call stack, running mount hooks and copying render variables when no listener cares, or rendering the same icon twice.

On an admin dashboard built with the Shadcn kit, which renders about 1,800 components and 400 icons per request, a request takes 22% less CPU time with 3.6 than with 3.5.1, from 50-53 ms down to 39-41 ms, for the same HTML. These numbers are the medians of six alternating runs of 60 requests per version, in the prod environment, with PHP 8.4 and Twig 3.30. Your templates must be recompiled to benefit, which a cache clear does.

Templates that use the HTML syntax also compile faster. UX Icons now warms local icons on cache:warmup, so applications built with Webpack Encore, or that clear their cache after compiling assets, no longer start with an empty icon cache.

Full Changelog

• #4086 Update the tooling dependencies (@Kocal)
• #3533 [LiveComponent] Return StimulusAttributes from live_action() so it can be spread in a Twig component tag (@Amoifr)
• #4074 [Toolkit] Fix GitHub kits pinned to a tag prefixed with "v" (@guillaume-sainthillier)
• #3930 [LiveComponent] Export the ComponentHooks type (@Pechynho)
• #4083 [Toolkit] Run the browser tests on 8 shards (@Kocal)
• #4064 [Inspector] Reposition overlays when the panel opens or closes (@Kocal)
• #4081 [Translator] Register the configured dump directory with AssetMapper (@Kocal)
• #4082 [Router] Dump the routes when the container is built without a dump directory (@Kocal)
• #4068 [Toolkit][Shadcn] Add command recipe (@Enz000)
• #4073 [Translator] Dump the translations when the container is built without a dump directory (@guillaume-sainthillier)
• #4071 [Toolkit][Shadcn] Fix the focus lost on open in dropdown-menu and combobox, and two timing-dependent tests (@Enz000)
• #4076 [Router] Fall back to the application default locale (@feymo)
• #4080 [TwigComponent] Fix the pre-lexer mistaking <twig: inside a {% %} tag for a component (@javiereguiluz)
• #4079 [Pagination] Remove deprecated defaultPriorityMethod from the adapter iterator (@tacman)
• #4040 Add the imgix bridge (@kbond)
• #4063 [Toolkit][Shadcn] Add context-menu recipe (@Enz000)
• #4039 [Image] Add the Cloudinary bridge (@kbond, @Kocal)
• #4067 [Translator] Fix ux:translator:warm-cache writing empty translations (@Kocal)
• #4066 Make release.sh handle packages npm does not have yet (@Kocal)
• #4065 [Inspector] Drop unused version from package.json (@Kocal)
• #1234 [Router] Add Symfony UX Router package (@Kocal)
• #3927 [LiveComponent] Read the id attribute of elements, not the id property (@Pechynho)
• #3928 [LiveComponent] Do not update the URL from a response that arrives after a navigation (@Pechynho)
• #4061 [Toolkit][Shadcn] Align the kit with the upstream Shadcn Nova reference (@ker0x)
• #4059 [Translator] Fully escape translation IDs (@tnytown)
• #4062 [Toolkit][Shadcn] Fix the sheet width and the overlay exit transition (@ker0x)
• #3945 [Image] Add KeyCDN Secure Token support (@kbond)
• #4022 [LiveComponent] Reset the deterministic id counters between requests (@Pechynho)
• #4060 [LiveComponent] Sort the template map written by the cache warmer (@nicolas-grekas)
• #4050 [TwigComponent] Avoid copying the render variables when nobody listens to PreRenderEvent (@Kocal)
• #4047 [Icons] Cache the rendered HTML of repeated icons in IconRenderer (@Kocal)
• #4049 [TwigComponent] Find the host template of embedded blocks without scanning the call stack (@Kocal)
• #4048 [TwigComponent] Skip mount hooks on anonymous components when nobody listens to mount events (@Kocal)
• #4057 [Turbo] Add support for MercureBundle ^0.6 and Mercure ^0.9 (@Kocal)
• #4056 [Notify] Add support for MercureBundle ^0.6 (@Kocal)
• #4058 [Toolkit][Shadcn] Fix a caller's aria-label being ignored on pagination, breadcrumb and questionnaire (@Kocal)
• #4036 [Notify] Add support for MercureBundle ^0.5 and Mercure ^0.8 (@Chris8934)
• #4055 [CalendarLink] Fix UTC detection for VTIMEZONE (@tnytown)
• #3902 [Toolkit][Shadcn] Add toast recipe (@ker0x)
• #4043 [Autocomplete] Fix Polish translations (@TmszLBmrv)
• #4042 [Toolkit] Fix the drawer snapshots broken by twig-tailwind-extra 1.5.0 (@Kocal)
• #4041 [Toolkit] Fix the kit linter crashing on Twig 4 (@Kocal)
• #4037 [Icons][LiveComponent][StimulusBundle][TwigComponent] Describe the types listed by debug:autowiring (@nicolas-grekas)
• #3926 [LiveComponent] Finish the loading state when a request fails (@Pechynho)
• #3924 [LiveComponent] Fix child components lost inside a data-skip-morph element (@Pechynho)
• #3922 [LiveComponent] Add the render:started hook to the ComponentHooks type (@Pechynho)
• #3908 [Turbo] Only trigger the TurboStreamListenRenderer deprecation when the service is used (@jmsche)
• #3935 [Turbo] Support the Mercure protocol 1.0 in turbo_stream_from() (@lyrixx)
• #3903 [Pagination] Fix Cursor pagination with DATETIMETZ_MUTABLE columns (@Huluti)
• #4034 [Pagination] Add Ukrainian translations (@Menelion)
• #4033 [Pagination] Add Russian translations (@Menelion)
• #3900 [LiveComponent] Fix AssertDispatchedEvent::withPayloadSubset() crashing on non-scalar payload values (@Arkalo2)
• #4027 [Toolkit][Shadcn] Fix questionnaire freeform answer losing its name once moved in the DOM (@Kocal)
• #4031 [Toolkit][Shadcn] Fix alert-dialog no longer being modal once moved in the DOM (@Kocal)
• #4026 [Toolkit][Shadcn] Fix navigation-menu never opening again once moved in the DOM (@Kocal)
• #4032 [Toolkit][Flowbite] Fix modal no longer being modal once moved in the DOM (@Kocal)
• #4030 [Toolkit][Shadcn] Fix dialog no longer being modal once moved in the DOM (@Kocal)
• #4029 [Toolkit][Shadcn] Fix sonner losing its toasts once moved in the DOM (@Kocal)
• #4028 [Toolkit][Shadcn] Fix resizable handle moving twice as far once moved in the DOM (@Kocal)
• #4023 [Toolkit][Shadcn] Keep the tooltip inside the viewport and fit it to its text (@Kocal)
• #4019 [Toolkit] Show a diff when ux:install asks to overwrite a file (@Kocal)
• #3910 [Toolkit][Shadcn] Align select with the upstream Shadcn Select (@ker0x)
• #3905 [Toolkit][Shadcn] Fix data-slot being shadowed when forwarded to a child component (@ker0x)
• #3938 [Toolkit][Shadcn] Align input-group with the upstream Shadcn InputGroup (@ker0x)
• #3906 [Toolkit][Shadcn] Align combobox with the upstream Shadcn UI component (@ker0x)
• #3934 [TwigComponent] Copy plain text in one go when pre-lexing templates (@nicolas-grekas)
• #3914 [Icons] Warm local icons on cache:warmup (@nicolas-grekas)
• #3937 [Image] Add presets (@Kocal)
• #4018 [Toolkit] Fix ux:install not overwriting a file newer than the recipe (@Kocal)
• #3971 [Toolkit][Shadcn] Fix the tooltip of the disabled button example never opening (@Kocal)
• #3970 [Toolkit][Shadcn] Fix the bookmark icon not filling in the toggle examples (@Kocal)
• #3969 [Toolkit][Shadcn] Fix the close button and the action of a toast ignoring mouse clicks (@Kocal)
• #3968 [Toolkit][Shadcn] Fix the slider losing the focus after a click on its track (@Kocal)
• #3967 [Toolkit][Shadcn] Fix a disabled slider still reacting to the keyboard (@Kocal)
• #3966 [Toolkit][Shadcn] Fix a closed sheet staying reachable with the keyboard (@Kocal)
• #3965 [Toolkit][Shadcn] Fix the resizable handle missing its separator state (@Kocal)
• #3964 [Toolkit][Shadcn] Fix Tab skipping the panels of the navigation menu (@Kocal)
• #3958 [Toolkit][Shadcn] Fix the dialog trigger's aria-expanded getting out of sync (@Kocal)
• #3963 [Toolkit][Shadcn] Fix menubar submenus wrapping long labels (@Kocal)
• #3962 [Toolkit][Shadcn] Fix the radio indicator of the menubar being a ring instead of a dot (@Kocal)
• #3957 [Toolkit][Shadcn] Fix the date picker focusing "Previous month" instead of a day (@Kocal)
• #3961 [Toolkit][Shadcn] Fix dropdown submenus wrapping their labels (@Kocal)
• #3960 [Toolkit][Shadcn] Fix the radio indicator of the dropdown menu being a ring instead of a dot (@Kocal)
• #3956 [Toolkit][Shadcn] Fix the combobox list not lining up with its trigger (@Kocal)
• #3959 [Toolkit][Shadcn] Fix a closed drawer staying reachable with the keyboard (@Kocal)
• #3955 [Toolkit][Shadcn] Fix alert dialogs opening on page load (@Kocal)
• #3954 [Toolkit][Shadcn] Fix the arrow keys getting stuck before a disabled accordion item (@Kocal)
• #3953 [Toolkit][Flowbite] Fix inactive tabs being unreadable in dark mode (@Kocal)
• #3952 [Toolkit][Flowbite] Fix the modal having no accessible name (@Kocal)
• #3950 [Toolkit] Shard the browser tests and keep the server logs out of the CI output (@Kocal)
• #3949 [Toolkit][Shadcn] Fix the popover not focusing its content on a busy browser (@Kocal)
• #3948 [Toolkit] Add visual tests for recipes (@Kocal)
• #3947 [Toolkit] Ship kit preview assets and add a preview app (@Kocal)
• #3838 [Image] Add the UX Image package and its Cloudflare and KeyCDN bridges (@Kocal)
• #3866 [Inspector] Add a browser inspector for Symfony UX (@smnandre)
• #3918 [CI] Harden the npm release workflow (@Kocal)
• #3919 Conflict with symfony/asset-mapper 8.2 and later (@Kocal)
• #3916 Backport release.sh (@Kocal)
• #3917 Fix the 2.x CI (@Kocal)
• #3913 [Icons] Fetch each icon from the cache once per request (@nicolas-grekas)
• #3911 Refresh agent instructions and import skills from symfony/symfony (@Kocal)
• #3907 Use a X.Y.Z version placeholder in the assets README install commands (@Kocal)
• #3904 Check shipped assets against Web Platform Baseline (@Kocal)
• #3896 Keep the npm releases in step with the split repositories (@Kocal)

UX Inspector, UX Image and UX Router are experimental, so their API can still change, and now is when your feedback is worth the most. Try them, and open an issue if something does not fit your application.

Original source

Symfony 5.4 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 5.4.53

Cache

• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)

Console

• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)

ExpressionLanguage

• security #cve-2026-109449 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas, @lazerg)
• bug #66723 [ExpressionLanguage] Bound the depth of the parsed node tree (@nicolas-grekas)
• bug #66720 [ExpressionLanguage] Fix nesting level of chained ternaries (@lazerg)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)

Filesystem

• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)

HttpClient

• bug #66938 [HttpClient] Don't add the query option again to redirect targets in NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug #66270 [HttpClient] Don't reject highly compressed responses (@nicolas-grekas)
• bug #66080 [HttpClient] Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)

HttpFoundation

• security #cve-2026-108082 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• bug #66491 [HttpFoundation] Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)
• bug #66251 [HttpFoundation] Make session handlers non-serializable (@mcdruid)
• bug #66078 [HttpFoundation] Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)
• bug #66048 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• bug #65775 [HttpFoundation] Match paths with the DOTALL modifier (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• minor #65836 [HttpFoundation] Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)

HttpKernel

• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)

Lock

• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)

Messenger

• bug #66509 [Messenger] Reject decoded messages that carry non-sendable stamps and validate the stamps of unserialized envelopes (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)

Mime

• bug #65844 [Mime] Reject header names containing non-printable or non-ASCII characters (@nicolas-grekas)
• bug #65778 [Mime] Never emit a raw control character in a header (@Spomky)
• bug #65777 [Mime] Do not treat an "@" inside the domain as the addr-spec separator (@Spomky)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)

Process

• bug #65784 [Process] Use an absolute path for the cmd.exe fallback on Windows (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)

RateLimiter

• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)

Routing

• bug #65728 [Routing] Fix matching the "0" URL (@cs278)

Security

• bug #66629 [Security] Don't copy the security token of the session into logs (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)

SecurityBundle

• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)

Serializer

• bug #66387 [Serializer] Fix the cache key of MetadataAwareNameConverter when the context can't be serialized (@nicolas-grekas)
• bug #66079 [Serializer] Make MetadataAwareNameConverter caches per instance (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)

VarDumper

• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)

Yaml

• security #cve-2026-109413 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)

Other

• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)

Original source

Symfony 8.1.9 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.8

AssetMapper

• bug #66645 [AssetMapper] Clean up the asset being created when a compiler fails (@phcorp)

BrowserKit

• bug #66182 [BrowserKit] Fix parsing and path matching of cookies (@X-Coder264, @nicolas-grekas)

Cache

• bug #66818 [Cache] Fix expiresAfter() ignoring the clock of ArrayAdapter (@nicolas-grekas)
• bug #66651 [Cache][FrameworkBundle] Cache the parsed expressions of # attributes (@nicolas-grekas)

Clock

• bug #66833 [Clock] Fix DatePoint being one hour off when its reference is in the DST fall-back hour (@nicolas-grekas)
• bug #66831 [Clock] Fix DatePoint keeping the current time of day for dates with a relative part (@nicolas-grekas)
• bug #66708 [Clock] Fix new DatePoint() being one hour off during the DST fall-back hour (@nicolas-grekas)
• bug #66707 [Clock] Fix MockClock::sleep() with dates before 1970 (@nicolas-grekas)

Console

• bug #66863 [Console] Fix the usages of invokable commands registered as services (@nicolas-grekas)
• bug #66827 [Console] Use the clock to resolve relative dates in DateTimeValueResolver (@nicolas-grekas)
• bug #66676 [Console] Build the lazy signal listeners before a signal can interrupt an autoload (@nicolas-grekas)
• bug #66626 [Console] Fix variadic arguments and options typed with a backed enum, a uid or a date (@nicolas-grekas)

Contracts

• bug #66610 [Contracts][HttpClient] Skip tests that rely on 500ms server pauses on Windows (@nicolas-grekas)

DependencyInjection

• bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation (@nicolas-grekas)
• bug #66892 [DependencyInjection] Fix dumping strings like "50% of 100%" (@nicolas-grekas)
• bug #66790 [DependencyInjection] Align the JSON schema of service files with what the YAML loader accepts (@nicolas-grekas)
• bug #66750 [DependencyInjection] Don't reuse the cached list of bundles when the container is stale (@nicolas-grekas)
• bug #66745 [DependencyInjection] Accept empty sections in the JSON schema of service files (@nicolas-grekas)
• bug #66743 [DependencyInjection] Make the ids of anonymous services independent from the project directory (@nicolas-grekas)
• bug #66738 [DependencyInjection] Make service locator ids reproducible (@nicolas-grekas)
• bug #66596 [DependencyInjection] Fix dumping closures of "Class::method" callables (@nicolas-grekas)
• minor #66605 [DependencyInjection] Report circular parent definitions before compiler passes walk them (@nicolas-grekas)

DoctrineBridge

• bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it (@HypeMC)

ExpressionLanguage

• bug #66727 [ExpressionLanguage] Fix discrepancies between evaluated and compiled expressions (@lyrixx)
• bug #66723 [ExpressionLanguage] Bound the depth of the parsed node tree (@nicolas-grekas)
• bug #66720 [ExpressionLanguage] Fix nesting level of chained ternaries (@lazerg)
• bug #66666 [ExpressionLanguage] Don't reuse an expression parsed with other flags (@nicolas-grekas)
• bug #66654 [ExpressionLanguage] Fix evaluating a parsed expression again after a null-safe operator short-circuited it (@nicolas-grekas)

Filesystem

• bug #66663 [Filesystem] Fix touch() with zero timestamp (@ephpicman)

Form

• bug #66861 [Form] Guess the enum type of private properties declared by parent classes (@nicolas-grekas)
• bug #66859 [Form] Fix CurrencyType with active_at set to null (@nicolas-grekas)
• bug #66776 [Form] Validate the data of the current step of a form flow (@nicolas-grekas)
• bug #66647 [Form] Keep the placeholder of a required ChoiceType selectable when a parent form is optional (@nicolas-grekas)
• bug #66598 [Form] Fix FormFlow mutating session data written before 8.1 (@nicolas-grekas)
• minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha)
• minor #66698 [Form][Validator] Review Bulgarian translations (@DRaichev)
• minor #66648 [Form][Validator] Reviewed Greek translations (@angeliszotis)
• minor #66545 [Form][Security][Validator] Fix Urdu translations (@nicolas-grekas)
• minor #66601 [Form][Validator] Review Japanese translations (@akine)
• minor #66518 [Form] Fix Urdu translations (@Anwishazaman)
• minor #66525 [Form][Validator] Review Turkish (tr) translations (@mmustafasenoglu)
• minor #66488 [Form][Validator] Fix malformed placeholders in translations (@nicolas-grekas)
• minor #66486 [Form][Validator] Review Persian (fa) translations (@amirreza-khaleghverdi)

FrameworkBundle

• bug #66793 [FrameworkBundle] Fix the "Cannot unset string offsets" crash in the configuration of workflows (@nicolas-grekas)
• bug #66683 [FrameworkBundle] Inject the clock into comparison and range validators (@lazerg)
• bug #66633 [FrameworkBundle] Don't let Monolog override php_errors.log: false (@lazerg)
• bug #66649 [FrameworkBundle] Make the controller.expression_language service lazy (@nicolas-grekas)
• bug #66569 [FrameworkBundle] Don't list aliases of abstract services in debug:autowiring (@nicolas-grekas)
• bug #66504 [FrameworkBundle][Messenger][Scheduler] Require a signature for RedispatchMessage and ServiceCallMessage (@nicolas-grekas)
• minor #66742 [FrameworkBundle] Test the meta files written by the JsonStreamer cache warmer in debug mode (@nicolas-grekas)

HttpClient

• bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas)
• bug #66823 [HttpClient] Fix CachingHttpClient storing responses as stale when their start_time is old (@nicolas-grekas)
• bug #66822 [HttpClient] Fix ThrottlingHttpClient when the response has no pause handler (@nicolas-grekas)
• bug #66556 [HttpClient] Fix using HTTP/3 with CurlHttpClient (@nicolas-grekas)
• bug #66468 [HttpClient] Cap the timeout passed to curl_multi_select() (@dylanpulver)

HttpFoundation

• bug #66694 [HttpFoundation] Don't warn about request input keys nested too deeply (@logosur)
• bug #66623 [HttpFoundation] Send the RFC 10036 Incremental header from EventStreamResponse (@nicolas-grekas)
• bug #66513 [HttpFoundation] Keep the session ID when the session handler fails to read (@Firehed, @nicolas-grekas)
• bug #66491 [HttpFoundation] Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)

HttpKernel

• bug #66883 [HttpKernel] Release the services of the container when the kernel shuts down (@nicolas-grekas)
• bug #66826 [HttpKernel] Use the clock to resolve relative dates in DateTimeValueResolver (@nicolas-grekas)
• bug #66759 [HttpKernel] Don't trace the responses HttpCache cannot store as stored (@nicolas-grekas)
• bug #66703 [HttpKernel] Allow using #[Serialize] on controller classes (@klezaic)
• bug #66665 [HttpKernel] Fix HttpCache leaking an output buffer when an ESI fragment fails (@nicolas-grekas)
• bug #66662 [HttpKernel] Fix HttpCache serving a 500 instead of a 503 for stale ESI entries when the cache is locked (@lyrixx)
• bug #66631 [HttpKernel] Release the container build lock on failure path (@edefimov)

JsonPath

• bug #66593 [JsonPath] Fix escaping of backslashes and control characters in JsonPath::key() (@GabeSilvaDev)
• bug #66563 [JsonPath] Fix anchoring and slash escaping in match() and search() (@GabeSilvaDev)
• bug #66562 [JsonPath] Fix index and slice selectors dropping null array elements (@GabeSilvaDev)

JsonStreamer

• bug #66744 [JsonStreamer] Keep streamable resources for the compiler passes that run after StreamablePass (@nicolas-grekas)

Lock

• bug #66604 [Lock] Fix auto-release after a failed promotion or demotion (@nicolas-grekas)
• bug #66600 [Lock] Fix the PostgreSQL stores losing track of a lock after a failed promotion or demotion (@nicolas-grekas)
• bug #66597 [Lock] Fix FlockStore keeping a closed handle after a failed promotion (@nicolas-grekas)
• bug #66477 [Lock] Fix denormalizing in XML a Key that has no expiring time or no state (@nicolas-grekas)
• minor #66616 [Lock] Release the locks that the store tests leave behind (@nicolas-grekas)

Mailer

• bug #66536 [Mailer][MicrosoftGraph] Only forward headers that Graph can accept (@dylanpulver)
• bug #66462 [Mailer][Sweego] Accept fractional seconds in webhook timestamps (@cestercian)

Messenger

• bug #66885 [Messenger] Fix PhpSerializer::getMessageType() when a stamp holds the message (@lyrixx)
• bug #66867 [Messenger] Route zero-delay AMQP retries to the original queue (@dalerazimov)
• bug #66825 [Messenger] Fix PostgreSqlNotifyOnIdleListener missing delayed messages when the timezone is ahead of UTC (@nicolas-grekas)
• bug #66779 [Messenger] Make AMQP transports only read their own queues with --queues (@jkatruska)
• bug #66783 [Messenger][Amqp] Fix polling an empty queue counting as a message in flight (@nicolas-grekas)
• bug #66679 [Messenger] Do not treat ack failures as handling failures (@dalerazimov)
• bug #66628 [Messenger] Fix matching AMQP publisher confirms to their message after a timeout (@nicolas-grekas)
• bug #66549 [Messenger] Fix the Doctrine transport masking commit failures (@lazerg)
• bug #66541 [Messenger] Fix losing delayed messages when retrying the message that dispatched them (@nicolas-grekas)
• bug #66521 [Messenger] Add the default stamps of a message to its replayed decoding failure (@nicolas-grekas)
• bug #66509 [Messenger] Reject decoded messages that carry non-sendable stamps and validate the stamps of unserialized envelopes (@nicolas-grekas)
• bug #66497 [Messenger] Fix skipping a message that has no original transport in messenger:failed:retry (@nicolas-grekas)
• bug #66496 [Messenger] Fix moving a message between transports that use different serialization formats (@nicolas-grekas)
• bug #66492 [Messenger] Route a message that PhpSerializer fails to decode to its own bus (@nicolas-grekas)
• bug #66480 [Messenger] Fix decoding a ValidationStamp that holds a GroupSequence (@nicolas-grekas)
• bug #66478 [Messenger] Fix recognizing a repeated error when its code does not keep its type in XML (@nicolas-grekas)
• bug #66479 [Messenger] Fix decoding in XML a ValidationStamp that has one group or none (@nicolas-grekas)
• bug #66471 [Messenger] Fix ack/reject of Redis messages listed by the failed messages commands (@lazerg)
• bug #66472 [Messenger] Fix losing the payload of a message without a type header when it is retried (@nicolas-grekas)
• bug #66473 [Messenger] Fix decoding in XML an ErrorDetailsStamp that has no FlattenException (@nicolas-grekas)
• bug #66474 [Messenger] Turn any error thrown while decoding into a MessageDecodingFailedException (@nicolas-grekas)
• bug #66475 [Messenger] Don't send handler results to transports (@nicolas-grekas)
• bug #66463 [Messenger] Fix decoding ErrorDetailsStamp with the XML format (@nicolas-grekas)
• bug #66464 [Messenger] Fix duplicated stamps when a message that failed to decode is decoded on replay (@nicolas-grekas)
• bug #66460 [Messenger] Fix endless retries of messages with an empty body or an undecodable stamp header (@nicolas-grekas)
• bug #66461 [Messenger] Fix acking messages that InMemoryTransport fails to decode (@nicolas-grekas)
• bug #66453 [Messenger] Fix workers stopping on messages that fail signature verification (@nicolas-grekas)
• bug #66452 [Messenger] Don't retry messages rejected for their signature (@nicolas-grekas)
• bug #66449 [Messenger] Keep the signature of signed messages that fail to decode (@nicolas-grekas)
• bug #66455 [Messenger] Fix decoding ErrorDetailsStamp with Serializer::create() (@nicolas-grekas)
• minor #66516 [Messenger] Recommend not decoding non-sendable stamps in SerializerInterface::decode() (@nicolas-grekas)

Notifier

• bug #66838 [Notifier][Bluesky] Send the creation date of posts in UTC (@nicolas-grekas)
• bug #66814 [Notifier][PagerDuty] Keep the user payload and send the timestamp as a string (@nicolas-grekas)

ObjectMapper

• bug #66756 [ObjectMapper] Honor the target property #[Map] that leaves source out in the reverse class map (@nicolas-grekas)

PhpUnitBridge

• minor #66510 [PhpUnitBridge] Remove silencing of __sleep/wakeup() deprecations (@nicolas-grekas)

Process

• bug #66696 [Process] Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed env vars (@KalimeroMK)
• bug #66620 [Process] Fix waitUntil() missing output read by its own status updates (@KalimeroMK)

PsrHttpMessageBridge

• bug #66672 [PsrHttpMessageBridge] use the empty string instead of null as an array offset (@dalerazimov)

Routing

• bug #66798 [Routing] Align the JSON schema of route files with what the YAML loader accepts (@nicolas-grekas)

Runtime

• minor #66659 [Runtime] Fix leaked server globals in FrankenPHP worker test (@mbeccati)

Scheduler

• bug #66781 [Scheduler] Look inside the Envelope when describing a task (@KalimeroMK)
• bug #66573 [Scheduler] Fix processOnlyLastMissedRun() skipping every missed run after a restart (@lazerg)

Security

• bug #66840 [Security] Fix using OidcTokenGenerator when symfony/clock is not installed (@nicolas-grekas)
• bug #66841 [Security] Fix using OidcTokenHandler when symfony/clock is not installed (@nicolas-grekas)
• bug #66808 [Security][SecurityBundle] Fix security:oidc:generate-token resolving --not-before against the real time (@nicolas-grekas)
• bug #66802 [Security] Fix logging out users without a password when the session stores their password as crc32c (@nicolas-grekas)
• bug #66796 [Security] Fix caching the OIDC discovery keys forever when the provider gives no TTL (@nicolas-grekas)
• bug #66629 [Security] Don't copy the security token of the session into logs (@nicolas-grekas)
• bug #66548 [Security] Pass only stringable request attributes to the URL generator in HttpUtils (@lazerg)
• minor #66758 [Security] Tell that the base URI of the OIDC discovery must end with a slash (@nicolas-grekas)

SecurityBundle

• bug #66653 [SecurityBundle] Make the expression language of #[IsGranted] lazy (@nicolas-grekas)
• bug #66650 [SecurityBundle] Fix warming up the cache of access_control expressions (@nicolas-grekas)

Serializer

• bug #66862 [Serializer][Validator] Rebuild the container when attributes on non-public members change (@nicolas-grekas)
• bug #66589 [Serializer] Fix normalizers and encoders defined as child definitions for a named serializer (@HypeMC)

String

• bug #66572 [String] Fix wordwrap() with $cut when the string ends with the break (@SulimanAbdulrazzaq)
• bug #66503 [String] Fix width() of escape sequences with an intermediate or a digit final byte (@nicolas-grekas)
• bug #66500 [String] Fix width() of OSC sequences terminated by BEL (@nicolas-grekas)
• bug #66490 [String] Fix width() of skin tones on keycap and text-default bases, and of format characters (@phcorp)
• bug #66447 [String] Fix the width of emoji sequences and conjoining Hangul jamo (@nicolas-grekas)
• minor #66457 [String] Update wcswidth data with Unicode 18 (@nicolas-grekas)

Tui

• bug #66688 [Tui] Fix text ending with invalid UTF-8 measuring 0 columns or being emptied (@lyrixx)
• bug #66583 [Tui] Skip the full repaint on height-only resizes in Termux (@phcorp)
• bug #66591 [Tui] Hide the cursor when its marker is above the screen (@nicolas-grekas)
• bug #66587 [Tui] Separate the blocks of a loose list item with a blank line in MarkdownWidget (@phcorp)
• bug #66578 [Tui] Improve key handling on terminals without the Kitty protocol (@phcorp)
• bug #66582 [Tui] Decode the Ctrl+letter keys tmux sends inside a bracketed paste (@phcorp)
• bug #66581 [Tui] Close truncated hyperlinks and split large lines a chunk at a time in truncateToWidth() (@phcorp)
• bug #66580 [Tui] Fix MarkdownWidget task lists, single tildes, style leaks, partial fences and loose lists (@phcorp)
• bug #66579 [Tui] Break words and lines at Unicode and CJK boundaries (@phcorp)
• bug #66577 [Tui] Split CR line endings and expand tabs before writing (@phcorp)
• bug #66576 [Tui] Read Kitty keypad keys as the keys and text they stand for (@phcorp)
• bug #66575 [Tui] Stop holding input back behind escape sequences that never complete (@phcorp)
• bug #66555 [Tui] Match a modified escape that parse() names (@phcorp)
• bug #66539 [Tui] Fix parse() and matches() of modified function keys (@phcorp)
• bug #66502 [Tui] Give no width to format characters and lone combining marks (@nicolas-grekas)
• bug #66499 [Tui] Fix wrapLineIntoChunks() returning a chunk wider than the width after wrapping at a space (@nicolas-grekas)
• bug #66446 [Tui] Measure an emoji ZWJ, modifier or tag sequence as two columns (@nicolas-grekas)
• bug #66439 [Tui] Fix slicing counting a combining mark as a column (@phcorp)

TwigBundle

• bug #66741 [TwigBundle] Sort the templates listed by TemplateIterator (@nicolas-grekas)

Uid

• bug #66834 [Uid] Fix the date of time-based UUIDs before 1970 that have a fractional second (@nicolas-grekas)

Validator

• bug #66799 [Validator] Align the JSON schema of validation mapping files with what the YAML loader accepts (@nicolas-grekas)
• bug #66736 [Validator] Consider an empty string as valid in Week (@lyrixx)
• minor #66514 [Validator] Review Russian translations for the Audio constraint (@semx)

VarDumper

• bug #66866 [VarDumper] Fix dumping exceptions whose trace frames contain arrays or objects in extra keys (@bwoebi)

VarExporter

• minor #66673 [VarExporter] Fix DeepCloner snapshots changed by later writes to an ArrayObject (@nicolas-grekas)

WebProfilerBundle

• bug #66682 [WebProfilerBundle] Serve phpinfo() as plain text when PHP runs with the CLI SAPI (@lazerg)

Yaml

• bug #66835 [Yaml] Fix parsing timestamps with a fractional second before 1970 (@nicolas-grekas)
• bug #66830 [Yaml] Throw a ParseException on keys starting with a NUL byte when parsing mappings as objects (@lazerg)
• bug #66711 [Yaml] Fold trailing and leading white space of multi-line quoted scalars (@SulimanAbdulrazzaq)
• bug #66621 [Yaml] Do not treat quoted << keys as merge keys (@kevin9327)
• bug #66602 [Yaml] Quote the ... document end marker when dumping (@nicolas-grekas)
• bug #66592 [Yaml] Quote signed and decimal numeric strings with underscores when dumping (@GabeSilvaDev)
• bug #66567 [Yaml] Quote .inf and .nan strings when dumping (@SulimanAbdulrazzaq)
• bug #66523 [Yaml] Fix dumping tagged multi-line literal blocks (@nicolas-grekas)
• bug #66508 [Yaml] Fix round-tripping literal blocks that start with spaces-only lines (@drewmt, @nicolas-grekas)

Other

• minor #66466 Serbian translation update (@Trysha-rbrn)
• minor #66444 Use full setting name in deprecation message for consistency (@cs278)

Original source

Symfony 7.4.21 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.20

AssetMapper

• bug #66645 [AssetMapper] Clean up the asset being created when a compiler fails (@phcorp)

BrowserKit

• bug #66182 [BrowserKit] Fix parsing and path matching of cookies (@X-Coder264, @nicolas-grekas)

Cache

• bug #66818 [Cache] Fix expiresAfter() ignoring the clock of ArrayAdapter (@nicolas-grekas)
• bug #66651 [Cache][FrameworkBundle] Cache the parsed expressions of # attributes (@nicolas-grekas)

Clock

• bug #66833 [Clock] Fix DatePoint being one hour off when its reference is in the DST fall-back hour (@nicolas-grekas)
• bug #66831 [Clock] Fix DatePoint keeping the current time of day for dates with a relative part (@nicolas-grekas)
• bug #66708 [Clock] Fix new DatePoint() being one hour off during the DST fall-back hour (@nicolas-grekas)
• bug #66707 [Clock] Fix MockClock::sleep() with dates before 1970 (@nicolas-grekas)

Console

• bug #66863 [Console] Fix the usages of invokable commands registered as services (@nicolas-grekas)
• bug #66676 [Console] Build the lazy signal listeners before a signal can interrupt an autoload (@nicolas-grekas)

Contracts

• bug #66610 [Contracts][HttpClient] Skip tests that rely on 500ms server pauses on Windows (@nicolas-grekas)

DependencyInjection

• bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation (@nicolas-grekas)
• bug #66892 [DependencyInjection] Fix dumping strings like "50% of 100%" (@nicolas-grekas)
• bug #66790 [DependencyInjection] Align the JSON schema of service files with what the YAML loader accepts (@nicolas-grekas)
• bug #66745 [DependencyInjection] Accept empty sections in the JSON schema of service files (@nicolas-grekas)
• bug #66743 [DependencyInjection] Make the ids of anonymous services independent from the project directory (@nicolas-grekas)
• bug #66738 [DependencyInjection] Make service locator ids reproducible (@nicolas-grekas)
• bug #66596 [DependencyInjection] Fix dumping closures of "Class::method" callables (@nicolas-grekas)
• minor #66605 [DependencyInjection] Report circular parent definitions before compiler passes walk them (@nicolas-grekas)

DoctrineBridge

• bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it (@HypeMC)

ExpressionLanguage

• bug #66727 [ExpressionLanguage] Fix discrepancies between evaluated and compiled expressions (@lyrixx)
• bug #66723 [ExpressionLanguage] Bound the depth of the parsed node tree (@nicolas-grekas)
• bug #66720 [ExpressionLanguage] Fix nesting level of chained ternaries (@lazerg)
• bug #66666 [ExpressionLanguage] Don't reuse an expression parsed with other flags (@nicolas-grekas)
• bug #66654 [ExpressionLanguage] Fix evaluating a parsed expression again after a null-safe operator short-circuited it (@nicolas-grekas)

Filesystem

• bug #66663 [Filesystem] Fix touch() with zero timestamp (@ephpicman)

Form

• bug #66861 [Form] Guess the enum type of private properties declared by parent classes (@nicolas-grekas)
• bug #66859 [Form] Fix CurrencyType with active_at set to null (@nicolas-grekas)
• bug #66776 [Form] Validate the data of the current step of a form flow (@nicolas-grekas)
• minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha)
• minor #66698 [Form][Validator] Review Bulgarian translations (@DRaichev)
• minor #66648 [Form][Validator] Reviewed Greek translations (@angeliszotis)
• minor #66545 [Form][Security][Validator] Fix Urdu translations (@nicolas-grekas)
• minor #66601 [Form][Validator] Review Japanese translations (@akine)
• minor #66518 [Form] Fix Urdu translations (@Anwishazaman)
• minor #66525 [Form][Validator] Review Turkish (tr) translations (@mmustafasenoglu)
• minor #66488 [Form][Validator] Fix malformed placeholders in translations (@nicolas-grekas)
• minor #66486 [Form][Validator] Review Persian (fa) translations (@amirreza-khaleghverdi)

FrameworkBundle

• bug #66793 [FrameworkBundle] Fix the "Cannot unset string offsets" crash in the configuration of workflows (@nicolas-grekas)
• bug #66633 [FrameworkBundle] Don't let Monolog override php_errors.log: false (@lazerg)
• bug #66569 [FrameworkBundle] Don't list aliases of abstract services in debug:autowiring (@nicolas-grekas)
• bug #66504 [FrameworkBundle][Messenger][Scheduler] Require a signature for RedispatchMessage and ServiceCallMessage (@nicolas-grekas)
• minor #66742 [FrameworkBundle] Test the meta files written by the JsonStreamer cache warmer in debug mode (@nicolas-grekas)

HttpClient

• bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas)
• bug #66823 [HttpClient] Fix CachingHttpClient storing responses as stale when their start_time is old (@nicolas-grekas)
• bug #66822 [HttpClient] Fix ThrottlingHttpClient when the response has no pause handler (@nicolas-grekas)
• bug #66556 [HttpClient] Fix using HTTP/3 with CurlHttpClient (@nicolas-grekas)
• bug #66468 [HttpClient] Cap the timeout passed to curl_multi_select() (@dylanpulver)

HttpFoundation

• bug #66694 [HttpFoundation] Don't warn about request input keys nested too deeply (@logosur)
• bug #66623 [HttpFoundation] Send the RFC 10036 Incremental header from EventStreamResponse (@nicolas-grekas)
• bug #66513 [HttpFoundation] Keep the session ID when the session handler fails to read (@Firehed, @nicolas-grekas)
• bug #66491 [HttpFoundation] Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)

HttpKernel

• bug #66883 [HttpKernel] Release the services of the container when the kernel shuts down (@nicolas-grekas)
• bug #66826 [HttpKernel] Use the clock to resolve relative dates in DateTimeValueResolver (@nicolas-grekas)
• bug #66759 [HttpKernel] Don't trace the responses HttpCache cannot store as stored (@nicolas-grekas)
• bug #66665 [HttpKernel] Fix HttpCache leaking an output buffer when an ESI fragment fails (@nicolas-grekas)
• bug #66662 [HttpKernel] Fix HttpCache serving a 500 instead of a 503 for stale ESI entries when the cache is locked (@lyrixx)
• bug #66631 [HttpKernel] Release the container build lock on failure path (@edefimov)

JsonPath

• bug #66593 [JsonPath] Fix escaping of backslashes and control characters in JsonPath::key() (@GabeSilvaDev)
• bug #66563 [JsonPath] Fix anchoring and slash escaping in match() and search() (@GabeSilvaDev)
• bug #66562 [JsonPath] Fix index and slice selectors dropping null array elements (@GabeSilvaDev)

Lock

• bug #66604 [Lock] Fix auto-release after a failed promotion or demotion (@nicolas-grekas)
• bug #66600 [Lock] Fix the PostgreSQL stores losing track of a lock after a failed promotion or demotion (@nicolas-grekas)
• bug #66597 [Lock] Fix FlockStore keeping a closed handle after a failed promotion (@nicolas-grekas)
• bug #66477 [Lock] Fix denormalizing in XML a Key that has no expiring time or no state (@nicolas-grekas)
• minor #66616 [Lock] Release the locks that the store tests leave behind (@nicolas-grekas)

Mailer

• bug #66536 [Mailer][MicrosoftGraph] Only forward headers that Graph can accept (@dylanpulver)
• bug #66462 [Mailer][Sweego] Accept fractional seconds in webhook timestamps (@cestercian)

Messenger

• bug #66885 [Messenger] Fix PhpSerializer::getMessageType() when a stamp holds the message (@lyrixx)
• bug #66867 [Messenger] Route zero-delay AMQP retries to the original queue (@dalerazimov)
• bug #66779 [Messenger] Make AMQP transports only read their own queues with --queues (@jkatruska)
• bug #66783 [Messenger][Amqp] Fix polling an empty queue counting as a message in flight (@nicolas-grekas)
• bug #66628 [Messenger] Fix matching AMQP publisher confirms to their message after a timeout (@nicolas-grekas)
• bug #66549 [Messenger] Fix the Doctrine transport masking commit failures (@lazerg)
• bug #66541 [Messenger] Fix losing delayed messages when retrying the message that dispatched them (@nicolas-grekas)
• bug #66509 [Messenger] Reject decoded messages that carry non-sendable stamps and validate the stamps of unserialized envelopes (@nicolas-grekas)
• bug #66497 [Messenger] Fix skipping a message that has no original transport in messenger:failed:retry (@nicolas-grekas)
• bug #66496 [Messenger] Fix moving a message between transports that use different serialization formats (@nicolas-grekas)
• bug #66480 [Messenger] Fix decoding a ValidationStamp that holds a GroupSequence (@nicolas-grekas)
• bug #66478 [Messenger] Fix recognizing a repeated error when its code does not keep its type in XML (@nicolas-grekas)
• bug #66479 [Messenger] Fix decoding in XML a ValidationStamp that has one group or none (@nicolas-grekas)
• bug #66473 [Messenger] Fix decoding in XML an ErrorDetailsStamp that has no FlattenException (@nicolas-grekas)
• bug #66474 [Messenger] Turn any error thrown while decoding into a MessageDecodingFailedException (@nicolas-grekas)
• bug #66475 [Messenger] Don't send handler results to transports (@nicolas-grekas)
• bug #66463 [Messenger] Fix decoding ErrorDetailsStamp with the XML format (@nicolas-grekas)
• bug #66453 [Messenger] Fix workers stopping on messages that fail signature verification (@nicolas-grekas)
• bug #66455 [Messenger] Fix decoding ErrorDetailsStamp with Serializer::create() (@nicolas-grekas)
• minor #66516 [Messenger] Recommend not decoding non-sendable stamps in SerializerInterface::decode() (@nicolas-grekas)

Notifier

• bug #66838 [Notifier][Bluesky] Send the creation date of posts in UTC (@nicolas-grekas)
• bug #66814 [Notifier][PagerDuty] Keep the user payload and send the timestamp as a string (@nicolas-grekas)

PhpUnitBridge

• minor #66510 [PhpUnitBridge] Remove silencing of __sleep/wakeup() deprecations (@nicolas-grekas)

Process

• bug #66696 [Process] Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed env vars (@KalimeroMK)
• bug #66620 [Process] Fix waitUntil() missing output read by its own status updates (@KalimeroMK)

PsrHttpMessageBridge

• bug #66672 [PsrHttpMessageBridge] use the empty string instead of null as an array offset (@dalerazimov)

Routing

• bug #66798 [Routing] Align the JSON schema of route files with what the YAML loader accepts (@nicolas-grekas)

Runtime

• minor #66659 [Runtime] Fix leaked server globals in FrankenPHP worker test (@mbeccati)

Scheduler

• bug #66781 [Scheduler] Look inside the Envelope when describing a task (@KalimeroMK)
• bug #66573 [Scheduler] Fix processOnlyLastMissedRun() skipping every missed run after a restart (@lazerg)

Security

• bug #66840 [Security] Fix using OidcTokenGenerator when symfony/clock is not installed (@nicolas-grekas)
• bug #66841 [Security] Fix using OidcTokenHandler when symfony/clock is not installed (@nicolas-grekas)
• bug #66808 [Security][SecurityBundle] Fix security:oidc:generate-token resolving --not-before against the real time (@nicolas-grekas)
• bug #66802 [Security] Fix logging out users without a password when the session stores their password as crc32c (@nicolas-grekas)
• bug #66796 [Security] Fix caching the OIDC discovery keys forever when the provider gives no TTL (@nicolas-grekas)
• bug #66629 [Security] Don't copy the security token of the session into logs (@nicolas-grekas)
• bug #66548 [Security] Pass only stringable request attributes to the URL generator in HttpUtils (@lazerg)
• minor #66758 [Security] Tell that the base URI of the OIDC discovery must end with a slash (@nicolas-grekas)

SecurityBundle

• bug #66653 [SecurityBundle] Make the expression language of #[IsGranted] lazy (@nicolas-grekas)
• bug #66650 [SecurityBundle] Fix warming up the cache of access_control expressions (@nicolas-grekas)

Serializer

• bug #66862 [Serializer][Validator] Rebuild the container when attributes on non-public members change (@nicolas-grekas)
• bug #66589 [Serializer] Fix normalizers and encoders defined as child definitions for a named serializer (@HypeMC)

String

• bug #66572 [String] Fix wordwrap() with $cut when the string ends with the break (@SulimanAbdulrazzaq)
• bug #66503 [String] Fix width() of escape sequences with an intermediate or a digit final byte (@nicolas-grekas)
• bug #66500 [String] Fix width() of OSC sequences terminated by BEL (@nicolas-grekas)
• bug #66490 [String] Fix width() of skin tones on keycap and text-default bases, and of format characters (@phcorp)
• bug #66447 [String] Fix the width of emoji sequences and conjoining Hangul jamo (@nicolas-grekas)
• minor #66457 [String] Update wcswidth data with Unicode 18 (@nicolas-grekas)

TwigBundle

• bug #66741 [TwigBundle] Sort the templates listed by TemplateIterator (@nicolas-grekas)

Uid

• bug #66834 [Uid] Fix the date of time-based UUIDs before 1970 that have a fractional second (@nicolas-grekas)

Validator

• bug #66799 [Validator] Align the JSON schema of validation mapping files with what the YAML loader accepts (@nicolas-grekas)
• bug #66736 [Validator] Consider an empty string as valid in Week (@lyrixx)
• minor #66514 [Validator] Review Russian translations for the Audio constraint (@semx)

VarDumper

• bug #66866 [VarDumper] Fix dumping exceptions whose trace frames contain arrays or objects in extra keys (@bwoebi)

WebProfilerBundle

• bug #66682 [WebProfilerBundle] Serve phpinfo() as plain text when PHP runs with the CLI SAPI (@lazerg)

Yaml

• bug #66835 [Yaml] Fix parsing timestamps with a fractional second before 1970 (@nicolas-grekas)
• bug #66830 [Yaml] Throw a ParseException on keys starting with a NUL byte when parsing mappings as objects (@lazerg)
• bug #66711 [Yaml] Fold trailing and leading white space of multi-line quoted scalars (@SulimanAbdulrazzaq)
• bug #66621 [Yaml] Do not treat quoted << keys as merge keys (@kevin9327)
• bug #66602 [Yaml] Quote the ... document end marker when dumping (@nicolas-grekas)
• bug #66592 [Yaml] Quote signed and decimal numeric strings with underscores when dumping (@GabeSilvaDev)
• bug #66567 [Yaml] Quote .inf and .nan strings when dumping (@SulimanAbdulrazzaq)
• bug #66523 [Yaml] Fix dumping tagged multi-line literal blocks (@nicolas-grekas)
• bug #66508 [Yaml] Fix round-tripping literal blocks that start with spaces-only lines (@drewmt, @nicolas-grekas)

Other

• minor #66466 Serbian translation update (@Trysha-rbrn)
• minor #66444 Use full setting name in deprecation message for consistency (@cs278)

Original source

Symfony 6.4.48 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.47

AssetMapper

• bug #66645 [AssetMapper] Clean up the asset being created when a compiler fails (@phcorp)

BrowserKit

• bug #66182 [BrowserKit] Fix parsing and path matching of cookies (@X-Coder264, @nicolas-grekas)

Cache

• bug #66651 [Cache][FrameworkBundle] Cache the parsed expressions of # attributes (@nicolas-grekas)

Clock

• bug #66833 [Clock] Fix DatePoint being one hour off when its reference is in the DST fall-back hour (@nicolas-grekas)
• bug #66831 [Clock] Fix DatePoint keeping the current time of day for dates with a relative part (@nicolas-grekas)
• bug #66708 [Clock] Fix new DatePoint() being one hour off during the DST fall-back hour (@nicolas-grekas)
• bug #66707 [Clock] Fix MockClock::sleep() with dates before 1970 (@nicolas-grekas)

Console

• bug #66676 [Console] Build the lazy signal listeners before a signal can interrupt an autoload (@nicolas-grekas)

Contracts

• bug #66610 [Contracts][HttpClient] Skip tests that rely on 500ms server pauses on Windows (@nicolas-grekas)

DependencyInjection

• bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation (@nicolas-grekas)
• bug #66892 [DependencyInjection] Fix dumping strings like "50% of 100%" (@nicolas-grekas)
• bug #66743 [DependencyInjection] Make the ids of anonymous services independent from the project directory (@nicolas-grekas)
• bug #66738 [DependencyInjection] Make service locator ids reproducible (@nicolas-grekas)
• bug #66596 [DependencyInjection] Fix dumping closures of "Class::method" callables (@nicolas-grekas)
• minor #66605 [DependencyInjection] Report circular parent definitions before compiler passes walk them (@nicolas-grekas)

ExpressionLanguage

• bug #66727 [ExpressionLanguage] Fix discrepancies between evaluated and compiled expressions (@lyrixx)
• bug #66723 [ExpressionLanguage] Bound the depth of the parsed node tree (@nicolas-grekas)
• bug #66720 [ExpressionLanguage] Fix nesting level of chained ternaries (@lazerg)
• bug #66654 [ExpressionLanguage] Fix evaluating a parsed expression again after a null-safe operator short-circuited it (@nicolas-grekas)

Filesystem

• bug #66663 [Filesystem] Fix touch() with zero timestamp (@ephpicman)

Form

• minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha)
• minor #66698 [Form][Validator] Review Bulgarian translations (@DRaichev)
• minor #66648 [Form][Validator] Reviewed Greek translations (@angeliszotis)
• minor #66545 [Form][Security][Validator] Fix Urdu translations (@nicolas-grekas)
• minor #66601 [Form][Validator] Review Japanese translations (@akine)
• minor #66518 [Form] Fix Urdu translations (@Anwishazaman)
• minor #66525 [Form][Validator] Review Turkish (tr) translations (@mmustafasenoglu)
• minor #66488 [Form][Validator] Fix malformed placeholders in translations (@nicolas-grekas)
• minor #66486 [Form][Validator] Review Persian (fa) translations (@amirreza-khaleghverdi)

FrameworkBundle

• bug #66793 [FrameworkBundle] Fix the "Cannot unset string offsets" crash in the configuration of workflows (@nicolas-grekas)
• bug #66633 [FrameworkBundle] Don't let Monolog override php_errors.log: false (@lazerg)
• bug #66569 [FrameworkBundle] Don't list aliases of abstract services in debug:autowiring (@nicolas-grekas)

HttpClient

• bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas)
• bug #66468 [HttpClient] Cap the timeout passed to curl_multi_select() (@dylanpulver)

HttpFoundation

• bug #66694 [HttpFoundation] Don't warn about request input keys nested too deeply (@logosur)
• bug #66513 [HttpFoundation] Keep the session ID when the session handler fails to read (@Firehed, @nicolas-grekas)
• bug #66491 [HttpFoundation] Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)

HttpKernel

• bug #66883 [HttpKernel] Release the services of the container when the kernel shuts down (@nicolas-grekas)
• bug #66826 [HttpKernel] Use the clock to resolve relative dates in DateTimeValueResolver (@nicolas-grekas)
• bug #66759 [HttpKernel] Don't trace the responses HttpCache cannot store as stored (@nicolas-grekas)
• bug #66665 [HttpKernel] Fix HttpCache leaking an output buffer when an ESI fragment fails (@nicolas-grekas)
• bug #66662 [HttpKernel] Fix HttpCache serving a 500 instead of a 503 for stale ESI entries when the cache is locked (@lyrixx)
• bug #66631 [HttpKernel] Release the container build lock on failure path (@edefimov)

Lock

• bug #66604 [Lock] Fix auto-release after a failed promotion or demotion (@nicolas-grekas)
• bug #66600 [Lock] Fix the PostgreSQL stores losing track of a lock after a failed promotion or demotion (@nicolas-grekas)
• bug #66597 [Lock] Fix FlockStore keeping a closed handle after a failed promotion (@nicolas-grekas)

Messenger

• bug #66867 [Messenger] Route zero-delay AMQP retries to the original queue (@dalerazimov)
• bug #66779 [Messenger] Make AMQP transports only read their own queues with --queues (@jkatruska)
• bug #66783 [Messenger][Amqp] Fix polling an empty queue counting as a message in flight (@nicolas-grekas)
• bug #66628 [Messenger] Fix matching AMQP publisher confirms to their message after a timeout (@nicolas-grekas)
• bug #66549 [Messenger] Fix the Doctrine transport masking commit failures (@lazerg)
• bug #66541 [Messenger] Fix losing delayed messages when retrying the message that dispatched them (@nicolas-grekas)
• bug #66509 [Messenger] Reject decoded messages that carry non-sendable stamps and validate the stamps of unserialized envelopes (@nicolas-grekas)
• bug #66496 [Messenger] Fix moving a message between transports that use different serialization formats (@nicolas-grekas)
• bug #66480 [Messenger] Fix decoding a ValidationStamp that holds a GroupSequence (@nicolas-grekas)
• bug #66478 [Messenger] Fix recognizing a repeated error when its code does not keep its type in XML (@nicolas-grekas)
• bug #66479 [Messenger] Fix decoding in XML a ValidationStamp that has one group or none (@nicolas-grekas)
• bug #66473 [Messenger] Fix decoding in XML an ErrorDetailsStamp that has no FlattenException (@nicolas-grekas)
• bug #66474 [Messenger] Turn any error thrown while decoding into a MessageDecodingFailedException (@nicolas-grekas)
• bug #66475 [Messenger] Don't send handler results to transports (@nicolas-grekas)
• bug #66463 [Messenger] Fix decoding ErrorDetailsStamp with the XML format (@nicolas-grekas)
• bug #66455 [Messenger] Fix decoding ErrorDetailsStamp with Serializer::create() (@nicolas-grekas)
• minor #66516 [Messenger] Recommend not decoding non-sendable stamps in SerializerInterface::decode() (@nicolas-grekas)

Notifier

• bug #66814 [Notifier][PagerDuty] Keep the user payload and send the timestamp as a string (@nicolas-grekas)

PhpUnitBridge

• minor #66510 [PhpUnitBridge] Remove silencing of __sleep/wakeup() deprecations (@nicolas-grekas)

Process

• bug #66696 [Process] Don't let inherited SYMFONY_DOTENV_VARS override explicitly passed env vars (@KalimeroMK)
• bug #66620 [Process] Fix waitUntil() missing output read by its own status updates (@KalimeroMK)

PsrHttpMessageBridge

• bug #66672 [PsrHttpMessageBridge] use the empty string instead of null as an array offset (@dalerazimov)

Scheduler

• bug #66781 [Scheduler] Look inside the Envelope when describing a task (@KalimeroMK)

Security

• bug #66841 [Security] Fix using OidcTokenHandler when symfony/clock is not installed (@nicolas-grekas)
• bug #66629 [Security] Don't copy the security token of the session into logs (@nicolas-grekas)
• bug #66548 [Security] Pass only stringable request attributes to the URL generator in HttpUtils (@lazerg)

SecurityBundle

• bug #66653 [SecurityBundle] Make the expression language of #[IsGranted] lazy (@nicolas-grekas)
• bug #66650 [SecurityBundle] Fix warming up the cache of access_control expressions (@nicolas-grekas)

String

• bug #66572 [String] Fix wordwrap() with $cut when the string ends with the break (@SulimanAbdulrazzaq)
• bug #66503 [String] Fix width() of escape sequences with an intermediate or a digit final byte (@nicolas-grekas)
• bug #66500 [String] Fix width() of OSC sequences terminated by BEL (@nicolas-grekas)
• bug #66490 [String] Fix width() of skin tones on keycap and text-default bases, and of format characters (@phcorp)
• bug #66447 [String] Fix the width of emoji sequences and conjoining Hangul jamo (@nicolas-grekas)
• minor #66457 [String] Update wcswidth data with Unicode 18 (@nicolas-grekas)

TwigBundle

• bug #66741 [TwigBundle] Sort the templates listed by TemplateIterator (@nicolas-grekas)

Uid

• bug #66834 [Uid] Fix the date of time-based UUIDs before 1970 that have a fractional second (@nicolas-grekas)

Validator

• minor #66514 [Validator] Review Russian translations for the Audio constraint (@semx)

VarDumper

• bug #66866 [VarDumper] Fix dumping exceptions whose trace frames contain arrays or objects in extra keys (@bwoebi)

WebProfilerBundle

• bug #66682 [WebProfilerBundle] Serve phpinfo() as plain text when PHP runs with the CLI SAPI (@lazerg)

Yaml

• bug #66835 [Yaml] Fix parsing timestamps with a fractional second before 1970 (@nicolas-grekas)
• bug #66830 [Yaml] Throw a ParseException on keys starting with a NUL byte when parsing mappings as objects (@lazerg)
• bug #66711 [Yaml] Fold trailing and leading white space of multi-line quoted scalars (@SulimanAbdulrazzaq)
• bug #66621 [Yaml] Do not treat quoted << keys as merge keys (@kevin9327)
• bug #66602 [Yaml] Quote the ... document end marker when dumping (@nicolas-grekas)
• bug #66592 [Yaml] Quote signed and decimal numeric strings with underscores when dumping (@GabeSilvaDev)
• bug #66567 [Yaml] Quote .inf and .nan strings when dumping (@SulimanAbdulrazzaq)
• bug #66523 [Yaml] Fix dumping tagged multi-line literal blocks (@nicolas-grekas)
• bug #66508 [Yaml] Fix round-tripping literal blocks that start with spaces-only lines (@drewmt, @nicolas-grekas)

Other

• minor #66466 Serbian translation update (@Trysha-rbrn)

Original source

Symfony 8.1 is backed by:

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Symfony 8.1.8 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.7

• minor Release v8.1.8
• bug [Mailer][Sweego] Send the Reply-To address through the dedicated API field (@damient)
• minor [Form][Validator] Review Dutch (nl) translations (@michelvelswijk)
• bug [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti)
• bug [Messenger] Prevent PhpSerializer::getMessageType() from autoloading classes (@nicolas-grekas)
• bug [JsonStreamer] Escape types in generated PHP comments (@thomas-chauchefoin-tob)
• bug [DependencyInjection][Routing] Escape identifiers in generated PHP (@thomas-chauchefoin-tob)
• bug [Security] Bind discovered OIDC keys to issuers (@thomas-chauchefoin-tob)
• bug [Cache] Bind namespaces in PDO-based cache invalidation (@thomas-chauchefoin-tob)
• bug [JsonStreamer] Export the type as a literal in the generated encoding error message (@nicolas-grekas)
• minor [JsonStreamer] Fix generated readers and writers for names holding quotes (@nicolas-grekas)
• minor [FrameworkBundle] Fix the description of an empty webhook routing secret (@nicolas-grekas)
• bug [Tui] Paint lines already in the scrollback in place when overflowing content grows back (@nicolas-grekas)
• bug [DependencyInjection] Export the service id when sharing a circular wither service (@nicolas-grekas)
• bug [Cache] Escape glob characters when clearing Redis namespaces (@nicolas-grekas)
• bug [DoctrineBridge] Don't map the uuid and ulid type names to uid classes in DoctrineExtractor (@lazerg)
• bug [Security] Give each role its own node in the Mermaid dump (@nicolas-grekas)
• bug [Tui] Repaint the viewport without clearing the screen when overflowing content shrinks (@nicolas-grekas)
• bug [WebProfilerBundle] Escape the workflow diagram source and listener map in the profiler (@nicolas-grekas)
• bug [TypeInfo] Fix infinite recursion on recursive type aliases (@mtarld)
• bug [PropertyInfo] Fix quoted strings resolution in PhpStanExtractor with phpstan/phpdoc-parser 1.x (@mtarld)
• bug [TypeInfo] Fix Type::union() with mixed as the only non-null type (@nicolas-grekas)
• bug [DoctrineBridge] Never claim an object as a collection key type (@MlleDelphine)
• bug [ObjectMapper] Construct nested lazy-ghost targets when the mapper is decorated (@dylan-rumble)
• bug [JsonStreamer] Fix replacing templates by mixed in union types (@nicolas-grekas)
• bug [Serializer] Don't include the debug trace id in the attributes cache key (@javiereguiluz)
• minor [FrameworkBundle] Require symfony/dependency-injection ^8.1.8 (@nicolas-grekas)
• bug [JsonStreamer] Fix generic types replacement in object shapes (@mtarld)
• bug [TypeInfo] Fix printing object shape keys that contain quotes or backslashes (@nicolas-grekas)
• bug [TypeInfo] Fix printing array shape keys that contain quotes or backslashes (@nicolas-grekas)
• bug [TypeInfo] Fix object shape keys resolution in StringTypeResolver (@mtarld)
• bug [DependencyInjection][FrameworkBundle] Fix describing services that have env closure arguments (@nicolas-grekas)
• bug [HtmlSanitizer] Don't render comments as elements when the default action is Allow (@nicolas-grekas)
• bug [HtmlSanitizer] Fix sanitizeFor() with table-related, image and plaintext contexts (@nicolas-grekas)
• bug [Serializer][Validator] Fix compile-time discovery of attributes on non-public members (@nicolas-grekas)
• bug [TypeInfo] Fix quoted strings resolution with phpstan/phpdoc-parser 1.x (@mtarld)
• bug [TypeInfo] Fix accepts() of union and intersection types (@mtarld)
• bug [JsonStreamer] Fix generic types replacement in array shapes (@mtarld)
• minor [Translation] Updating and improving Albanian translations (@gazi04)
• minor [Validator] Review Albanian translations (@gazi04)
• bug [HttpKernel] Fix the log level of exceptions mapped to an HTTP status code (@nicolas-grekas)
• minor [Validator] Review Arabic translations (@fadyehabamer)
• bug [FrameworkBundle] Disable HTTP/2 push on the default HTTP client (@Amoifr)
• bug [Serializer] Fix the cache key of MetadataAwareNameConverter when the context can't be serialized (@nicolas-grekas)
• bug [Scheduler] Fix stateful schedules skipping every run when the checkpoint cannot be saved (@srebb)
• bug [Yaml] Fix tabs in block scalars and comments after empty ones (@X-Coder264)
• bug [Yaml] Fix !!str and !!float tags on block scalars (@nicolas-grekas)
• bug [Yaml] Fix several parsing edge cases (@nicolas-grekas)
• bug [Serializer] Fix quadratic time when collecting denormalization errors (@thomas-chauchefoin-tob)
• bug [DoctrineBridge] Fix DoctrineExtractor for uid types and collections indexed by custom types (@MlleDelphine)
• bug [TypeInfo] Fix array shape keys resolution in StringTypeResolver (@mtarld)
• bug [TypeInfo] Fix resolving unknown class constants (@mtarld)
• bug [TypeInfo] Fix resolving class keyword constants without type context (@mtarld)
• bug [Finder] Treat a .git file as the repository root in ignoreVCSIgnored() (@rubas)
• bug [HttpKernel] Don't send headers again in HttpKernel::terminateWithException() (@nicolas-grekas)
• bug [TypeInfo] Fix class names resolution in the global namespace (@mtarld)
• bug [HttpKernel] Fix reading the listeners of the default dispatcher from an unserialized EventDataCollector (@nicolas-grekas)
• minor [Validator] reviewed Polish translation units 149-165 (@thunderer)
• minor [Form][Validator] Remove needs-review-translation state from Spanish translations (@abp002)
• minor [Form] reviewed Polish translation unit 130 (@thunderer)
• bug [Validator] Prevent ffprobe option injection from video filenames (@thomas-chauchefoin-tob)
• bug [Finder] Avoid quadratic backtracking when globs contain consecutive stars (@nicolas-grekas)
• bug [Form] Stop using the deprecated any() matcher in ValidatorExtensionTrait (@mbabker)
• bug [AssetMapper] Fix CSS and JSON loaders breaking under es-module-shims (@nicolas-grekas)
• minor [WebProfilerBundle] Fix EventSource::close() on requests already finished or cleared (@nicolas-grekas)
• minor [WebProfilerBundle] Truncate long non-GET URLs in the AJAX requests table (@nicolas-grekas)
• bug [WebProfilerBundle] Mark EventSource requests as finished when closed (@jmsche)
• bug [WebProfilerBundle] Fix long URLs overflowing the AJAX requests table in the toolbar (@jmsche)
• bug [Doctrine] Resolve DBAL types through the connection instead of the static registry (@GromNaN)
• bug [SecurityBundle] Dispatch the events of firewalls sharing a context on their own dispatcher (@nicolas-grekas)
• bug [HttpClient] Align GuzzleHttpHandler with Guzzle when on_headers throws (@nicolas-grekas)
• bug [HttpClient] Fix NativeHttpClient::stream() skipping responses not opened yet (@nicolas-grekas)
• bug [HttpClient] Don't reject highly compressed responses (@nicolas-grekas)
• bug [Messenger] Fix a doctrine/dbal 4.5 deprecation in DoctrinePostgreSqlFilterIntegrationTest (@nicolas-grekas)
• bug [HttpFoundation] Make session handlers non-serializable (@mcdruid)
• bug [Serializer] Fix denormalizing the discriminator type property when a name converter renames it (@nicolas-grekas)
• minor [Validator] Update Swedish translation #64518 (@H4wKs)
• bug [Uid] Fix Ulid::isValid() accepting base-58 strings above 2^128 (@nicolas-grekas)
• bug [Uid] Fix comparing a Uuid with a Ulid (@nicolas-grekas)
• bug [Uid] Fix UuidV7 ordering when the clock goes backwards (@nicolas-grekas)
• bug [Messenger] Avoid priority 0 when retrying AMQP messages (@X-Coder264)
• minor [Validator] Review Indonesian audio translations (@Yoruxyv)
• bug [DependencyInjection] Fix moving tags to the outermost decorator when a decorator is decorated (@nicolas-grekas)
• minor [Validator] Fix Range PHPDoc to accept \DateTimeInterface min/max (@paulferrett)
• bug [HttpClient] Don't set CURLOPT_WRITEFUNCTION from within the write callback (@nicolas-grekas)
• bug [ErrorHandler] Remove the backtrace from the array kept by FatalError (@janedbal)
• bug [Messenger] Fix sub-second delays being lost by the Doctrine transport (@wimwinterberg)
• minor [Validator] Review Croatian translations (@HypeMC)
• minor [Translation] Reviewing french validator translations (@Kevin-HESSE)
• bug [FrameworkBundle] Fix DotenvVault corrupting a value that contains a back-reference (@lazerg)
• minor [Translation] Review Brazilian Portuguese validator messages (@Kaemiemi)
• minor [Form][Security][Validator] Review Macedonian (mk) translations (@KalimeroMK)
• bug [SecurityBundle] Make the remember-me config tree independent from the session config (@nicolas-grekas)
• bug [Workflow] Escape the hash in Mermaid labels (@nicolas-grekas)
• bug [Messenger] Fix InMemoryTransport delay when it spans a DST transition (@SystematicCZ)
• bug [Security] Keep the real role names in the labels of the Mermaid dump (@javiereguiluz)
• minor [HttpClient] Document that withOptions() rejects an unsupported option (@nicolas-grekas)
• bug [Form] Fix FormFlow creation, step fallback, backward navigation and reset (@yceruto)
• minor Remove needs-review-translation flag for Russian validators (@theprogrammist)
• minor [Validator] Add translations for the Audio constraint (@nicolas-grekas)
• bug [ErrorHandler] Use the fatal error backtrace provided by PHP 8.5 (@janedbal)
• bug [ErrorHandler] Stop recursing when the logger keeps throwing (@nicolas-grekas)
• bug [Validator] Fix the Video constraint ignoring its codec and container options (@nicolas-grekas)
• minor [Lock] Document that only the owning key can release a lock (@nicolas-grekas)
• bug [Console] Fix quadratic formatting of non-ASCII content (@a-muzyka)
• minor translation: Serbian Translation of issues 66107,66108 (@Trysha-rbrn)
• minor [Form] Review Indonesian translation for validators (@Yoruxyv)
• minor [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug [FrameworkBundle] Cache the serializer metadata in debug mode when it comes from mapping files (@nicolas-grekas)
• minor Missing translations for Croatian (hr) (@gjuric)
• minor [Notifier] Fix the event dispatcher type of the FakeChat transports (@nicolas-grekas)
• bug [Yaml] Fix the line offset handed to nested block parsers (@lazerg)
• minor [Security] Document that user checkers run on every authentication (@nicolas-grekas)
• minor [Security] Fix the type declared for the event dispatcher (@nicolas-grekas)
• minor [Form] Review Italian translation for validators (@GiuseppePuleri)
• minor [Form] Review French translation for range bound validator (@rooneyi)
• bug [Messenger] Hold the signals until the SQS request is actually sent (@nicolas-grekas)
• bug [HttpClient] Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug [Serializer] Make MetadataAwareNameConverter caches per instance (@nicolas-grekas)
• bug [HttpFoundation] Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)
• data Release v7.4.19
• data Release v6.4.46

Published in Releases

❤️
Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Symfony Developer at Steward
View Symfony jobs →
$8,700 – $13,000 / month - Full remote

Original source

Symfony 7.4 is backed by:

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Symfony 7.4.20 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.19

• minor Release v7.4.20
• bug [Mailer][Sweego] Send the Reply-To address through the dedicated API field (@damient)
• minor [Form][Validator] Review Dutch (nl) translations (@michelvelswijk)
• bug [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti)
• bug [Messenger] Prevent PhpSerializer::getMessageType() from autoloading classes (@nicolas-grekas)
• bug [JsonStreamer] Escape types in generated PHP comments (@thomas-chauchefoin-tob)
• bug [DependencyInjection][Routing] Escape identifiers in generated PHP (@thomas-chauchefoin-tob)
• bug [Security] Bind discovered OIDC keys to issuers (@thomas-chauchefoin-tob)
• bug [Cache] Bind namespaces in PDO-based cache invalidation (@thomas-chauchefoin-tob)
• minor [JsonStreamer] Fix generated readers and writers for names holding quotes (@nicolas-grekas)
• minor [FrameworkBundle] Fix the description of an empty webhook routing secret (@nicolas-grekas)
• bug [DependencyInjection] Export the service id when sharing a circular wither service (@nicolas-grekas)
• bug [Cache] Escape glob characters when clearing Redis namespaces (@nicolas-grekas)
• bug [DoctrineBridge] Don't map the uuid and ulid type names to uid classes in DoctrineExtractor (@lazerg)
• bug [Security] Give each role its own node in the Mermaid dump (@nicolas-grekas)
• bug [WebProfilerBundle] Escape the workflow diagram source and listener map in the profiler (@nicolas-grekas)
• bug [TypeInfo] Fix infinite recursion on recursive type aliases (@mtarld)
• bug [PropertyInfo] Fix quoted strings resolution in PhpStanExtractor with phpstan/phpdoc-parser 1.x (@mtarld)
• bug [TypeInfo] Fix Type::union() with mixed as the only non-null type (@nicolas-grekas)
• bug [DoctrineBridge] Never claim an object as a collection key type (@MlleDelphine)
• bug [ObjectMapper] Construct nested lazy-ghost targets when the mapper is decorated (@dylan-rumble)
• bug [JsonStreamer] Fix replacing templates by mixed in union types (@nicolas-grekas)
• bug [Serializer] Don't include the debug trace id in the attributes cache key (@javiereguiluz)
• bug [TypeInfo] Fix printing array shape keys that contain quotes or backslashes (@nicolas-grekas)
• bug [HtmlSanitizer] Don't render comments as elements when the default action is Allow (@nicolas-grekas)
• bug [HtmlSanitizer] Fix sanitizeFor() with table-related, image and plaintext contexts (@nicolas-grekas)
• bug [Serializer][Validator] Fix compile-time discovery of attributes on non-public members (@nicolas-grekas)
• bug [TypeInfo] Fix quoted strings resolution with phpstan/phpdoc-parser 1.x (@mtarld)
• bug [TypeInfo] Fix accepts() of union and intersection types (@mtarld)
• bug [JsonStreamer] Fix generic types replacement in array shapes (@mtarld)
• minor [Translation] Updating and improving Albanian translations (@gazi04)
• minor [Validator] Review Albanian translations (@gazi04)
• bug [HttpKernel] Fix the log level of exceptions mapped to an HTTP status code (@nicolas-grekas)
• minor [Validator] Review Arabic translations (@fadyehabamer)
• bug [FrameworkBundle] Disable HTTP/2 push on the default HTTP client (@Amoifr)
• bug [Serializer] Fix the cache key of MetadataAwareNameConverter when the context can't be serialized (@nicolas-grekas)
• bug [Scheduler] Fix stateful schedules skipping every run when the checkpoint cannot be saved (@srebb)
• bug [Yaml] Fix tabs in block scalars and comments after empty ones (@X-Coder264)
• bug [Yaml] Fix !!str and !!float tags on block scalars (@nicolas-grekas)
• bug [Yaml] Fix several parsing edge cases (@nicolas-grekas)
• bug [Serializer] Fix quadratic time when collecting denormalization errors (@thomas-chauchefoin-tob)
• bug [DoctrineBridge] Fix DoctrineExtractor for uid types and collections indexed by custom types (@MlleDelphine)
• bug [TypeInfo] Fix array shape keys resolution in StringTypeResolver (@mtarld)
• bug [TypeInfo] Fix resolving unknown class constants (@mtarld)
• bug [TypeInfo] Fix resolving class keyword constants without type context (@mtarld)
• bug [Finder] Treat a .git file as the repository root in ignoreVCSIgnored() (@rubas)
• bug [HttpKernel] Don't send headers again in HttpKernel::terminateWithException() (@nicolas-grekas)
• bug [TypeInfo] Fix class names resolution in the global namespace (@mtarld)
• bug [HttpKernel] Fix reading the listeners of the default dispatcher from an unserialized EventDataCollector (@nicolas-grekas)
• minor [Validator] reviewed Polish translation units 149-165 (@thunderer)
• minor [Form][Validator] Remove needs-review-translation state from Spanish translations (@abp002)
• minor [Form] reviewed Polish translation unit 130 (@thunderer)
• bug [Validator] Prevent ffprobe option injection from video filenames (@thomas-chauchefoin-tob)
• bug [Finder] Avoid quadratic backtracking when globs contain consecutive stars (@nicolas-grekas)
• bug [Form] Stop using the deprecated any() matcher in ValidatorExtensionTrait (@mbabker)
• bug [AssetMapper] Fix CSS and JSON loaders breaking under es-module-shims (@nicolas-grekas)
• minor [WebProfilerBundle] Fix EventSource::close() on requests already finished or cleared (@nicolas-grekas)
• minor [WebProfilerBundle] Truncate long non-GET URLs in the AJAX requests table (@nicolas-grekas)
• bug [WebProfilerBundle] Mark EventSource requests as finished when closed (@jmsche)
• bug [WebProfilerBundle] Fix long URLs overflowing the AJAX requests table in the toolbar (@jmsche)
• bug [Doctrine] Resolve DBAL types through the connection instead of the static registry (@GromNaN)
• bug [SecurityBundle] Dispatch the events of firewalls sharing a context on their own dispatcher (@nicolas-grekas)
• bug [HttpClient] Fix NativeHttpClient::stream() skipping responses not opened yet (@nicolas-grekas)
• bug [HttpClient] Don't reject highly compressed responses (@nicolas-grekas)
• bug [Messenger] Fix a doctrine/dbal 4.5 deprecation in DoctrinePostgreSqlFilterIntegrationTest (@nicolas-grekas)
• bug [HttpFoundation] Make session handlers non-serializable (@mcdruid)
• bug [Serializer] Fix denormalizing the discriminator type property when a name converter renames it (@nicolas-grekas)
• minor [Validator] Update Swedish translation #64518 (@H4wKs)
• bug [Uid] Fix comparing a Uuid with a Ulid (@nicolas-grekas)
• bug [Uid] Fix UuidV7 ordering when the clock goes backwards (@nicolas-grekas)
• bug [Messenger] Avoid priority 0 when retrying AMQP messages (@X-Coder264)
• minor [Validator] Review Indonesian audio translations (@Yoruxyv)
• bug [DependencyInjection] Fix moving tags to the outermost decorator when a decorator is decorated (@nicolas-grekas)
• minor [Validator] Fix Range PHPDoc to accept \DateTimeInterface min/max (@paulferrett)
• bug [HttpClient] Don't set CURLOPT_WRITEFUNCTION from within the write callback (@nicolas-grekas)
• bug [ErrorHandler] Remove the backtrace from the array kept by FatalError (@janedbal)
• bug [Messenger] Fix sub-second delays being lost by the Doctrine transport (@wimwinterberg)
• minor [Validator] Review Croatian translations (@HypeMC)
• minor [Translation] Reviewing french validator translations (@Kevin-HESSE)
• bug [FrameworkBundle] Fix DotenvVault corrupting a value that contains a back-reference (@lazerg)
• minor [Translation] Review Brazilian Portuguese validator messages (@Kaemiemi)
• minor [Form][Security][Validator] Review Macedonian (mk) translations (@KalimeroMK)
• bug [SecurityBundle] Make the remember-me config tree independent from the session config (@nicolas-grekas)
• bug [Workflow] Escape the hash in Mermaid labels (@nicolas-grekas)
• bug [Messenger] Fix InMemoryTransport delay when it spans a DST transition (@SystematicCZ)
• bug [Security] Keep the real role names in the labels of the Mermaid dump (@javiereguiluz)
• minor [HttpClient] Document that withOptions() rejects an unsupported option (@nicolas-grekas)
• bug [Form] Fix FormFlow creation, step fallback, backward navigation and reset (@yceruto)
• minor Remove needs-review-translation flag for Russian validators (@theprogrammist)
• minor [Validator] Add translations for the Audio constraint (@nicolas-grekas)
• bug [ErrorHandler] Use the fatal error backtrace provided by PHP 8.5 (@janedbal)
• bug [ErrorHandler] Stop recursing when the logger keeps throwing (@nicolas-grekas)
• bug [Validator] Fix the Video constraint ignoring its codec and container options (@nicolas-grekas)
• minor [Lock] Document that only the owning key can release a lock (@nicolas-grekas)
• bug [Console] Fix quadratic formatting of non-ASCII content (@a-muzyka)
• minor translation: Serbian Translation of issues 66107,66108 (@Trysha-rbrn)
• minor [Form] Review Indonesian translation for validators (@Yoruxyv)
• minor [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug [FrameworkBundle] Cache the serializer metadata in debug mode when it comes from mapping files (@nicolas-grekas)
• minor Missing translations for Croatian (hr) (@gjuric)
• minor [Notifier] Fix the event dispatcher type of the FakeChat transports (@nicolas-grekas)
• bug [Yaml] Fix the line offset handed to nested block parsers (@lazerg)
• minor [Security] Document that user checkers run on every authentication (@nicolas-grekas)
• minor [Security] Fix the type declared for the event dispatcher (@nicolas-grekas)
• minor [Form] Review Italian translation for validators (@GiuseppePuleri)
• minor [Form] Review French translation for range bound validator (@rooneyi)
• bug [Messenger] Hold the signals until the SQS request is actually sent (@nicolas-grekas)
• bug [HttpClient] Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug [Serializer] Make MetadataAwareNameConverter caches per instance (@nicolas-grekas)
• bug [HttpFoundation] Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)
• data Release v6.4.46

❤️ Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Original source

Symfony 6.4 is backed by:

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Symfony 6.4.47 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.46

• minor Release v6.4.47
• minor [Form][Validator] Review Dutch (nl) translations (@michelvelswijk)
• bug [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti)
• bug [DependencyInjection][Routing] Escape identifiers in generated PHP (@thomas-chauchefoin-tob)
• minor [FrameworkBundle] Fix the description of an empty webhook routing secret (@nicolas-grekas)
• bug [DependencyInjection] Export the service id when sharing a circular wither service (@nicolas-grekas)
• bug [Cache] Escape glob characters when clearing Redis namespaces (@nicolas-grekas)
• bug [DoctrineBridge] Don't map the uuid and ulid type names to uid classes in DoctrineExtractor (@lazerg)
• bug [WebProfilerBundle] Escape the workflow diagram source and listener map in the profiler (@nicolas-grekas)
• bug [DoctrineBridge] Never claim an object as a collection key type (@MlleDelphine)
• bug [Serializer] Don't include the debug trace id in the attributes cache key (@javiereguiluz)
• minor [Translation] Updating and improving Albanian translations (@gazi04)
• minor [Validator] Review Albanian translations (@gazi04)
• bug [HttpKernel] Fix the log level of exceptions mapped to an HTTP status code (@nicolas-grekas)
• minor [Validator] Review Arabic translations (@fadyehabamer)
• bug [FrameworkBundle] Disable HTTP/2 push on the default HTTP client (@Amoifr)
• bug [Serializer] Fix the cache key of MetadataAwareNameConverter when the context can't be serialized (@nicolas-grekas)
• bug [Scheduler] Fix stateful schedules skipping every run when the checkpoint cannot be saved (@srebb)
• bug [Yaml] Fix tabs in block scalars and comments after empty ones (@X-Coder264)
• bug [Yaml] Fix !!str and !!float tags on block scalars (@nicolas-grekas)
• bug [Yaml] Fix several parsing edge cases (@nicolas-grekas)
• bug [Serializer] Fix quadratic time when collecting denormalization errors (@thomas-chauchefoin-tob)
• bug [DoctrineBridge] Fix DoctrineExtractor for uid types and collections indexed by custom types (@MlleDelphine)
• bug [Finder] Treat a .git file as the repository root in ignoreVCSIgnored() (@rubas)
• bug [HttpKernel] Fix reading the listeners of the default dispatcher from an unserialized EventDataCollector (@nicolas-grekas)
• minor [Validator] reviewed Polish translation units 149-165 (@thunderer)
• minor [Form][Validator] Remove needs-review-translation state from Spanish translations (@abp002)
• minor [Form] reviewed Polish translation unit 130 (@thunderer)
• bug [Finder] Avoid quadratic backtracking when globs contain consecutive stars (@nicolas-grekas)
• bug [Form] Stop using the deprecated any() matcher in ValidatorExtensionTrait (@mbabker)
• minor [WebProfilerBundle] Truncate long non-GET URLs in the AJAX requests table (@nicolas-grekas)
• bug [WebProfilerBundle] Fix long URLs overflowing the AJAX requests table in the toolbar (@jmsche)
• bug [Doctrine] Resolve DBAL types through the connection instead of the static registry (@GromNaN)
• bug [SecurityBundle] Dispatch the events of firewalls sharing a context on their own dispatcher (@nicolas-grekas)
• bug [HttpClient] Fix NativeHttpClient::stream() skipping responses not opened yet (@nicolas-grekas)
• bug [HttpClient] Don't reject highly compressed responses (@nicolas-grekas)
• bug [Messenger] Fix a doctrine/dbal 4.5 deprecation in DoctrinePostgreSqlFilterIntegrationTest (@nicolas-grekas)
• bug [HttpFoundation] Make session handlers non-serializable (@mcdruid)
• bug [Serializer] Fix denormalizing the discriminator type property when a name converter renames it (@nicolas-grekas)
• minor [Validator] Update Swedish translation #64518 (@H4wKs)
• bug [Uid] Fix comparing a Uuid with a Ulid (@nicolas-grekas)
• bug [Messenger] Avoid priority 0 when retrying AMQP messages (@X-Coder264)
• minor [Validator] Review Indonesian audio translations (@Yoruxyv)
• bug [DependencyInjection] Fix moving tags to the outermost decorator when a decorator is decorated (@nicolas-grekas)
• bug [HttpClient] Don't set CURLOPT_WRITEFUNCTION from within the write callback (@nicolas-grekas)
• bug [ErrorHandler] Remove the backtrace from the array kept by FatalError (@janedbal)
• bug [Messenger] Fix sub-second delays being lost by the Doctrine transport (@wimwinterberg)
• minor [Validator] Review Croatian translations (@HypeMC)
• minor [Translation] Reviewing french validator translations (@Kevin-HESSE)
• bug [FrameworkBundle] Fix DotenvVault corrupting a value that contains a back-reference (@lazerg)
• minor [Translation] Review Brazilian Portuguese validator messages (@Kaemiemi)
• minor [Form][Security][Validator] Review Macedonian (mk) translations (@KalimeroMK)
• bug [Workflow] Escape the hash in Mermaid labels (@nicolas-grekas)
• bug [Messenger] Fix InMemoryTransport delay when it spans a DST transition (@SystematicCZ)
• minor [HttpClient] Document that withOptions() rejects an unsupported option (@nicolas-grekas)
• minor Remove needs-review-translation flag for Russian validators (@theprogrammist)
• minor [Validator] Add translations for the Audio constraint (@nicolas-grekas)
• bug [ErrorHandler] Use the fatal error backtrace provided by PHP 8.5 (@janedbal)
• bug [ErrorHandler] Stop recursing when the logger keeps throwing (@nicolas-grekas)
• minor [Lock] Document that only the owning key can release a lock (@nicolas-grekas)
• bug [Console] Fix quadratic formatting of non-ASCII content (@a-muzyka)
• minor translation: Serbian Translation of issues 66107,66108 (@Trysha-rbrn)
• minor [Form] Review Indonesian translation for validators (@Yoruxyv)
• minor [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug [FrameworkBundle] Cache the serializer metadata in debug mode when it comes from mapping files (@nicolas-grekas)
• minor Missing translations for Croatian (hr) (@gjuric)
• minor [Notifier] Fix the event dispatcher type of the FakeChat transports (@nicolas-grekas)
• bug [Yaml] Fix the line offset handed to nested block parsers (@lazerg)
• minor [Security] Document that user checkers run on every authentication (@nicolas-grekas)
• minor [Security] Fix the type declared for the event dispatcher (@nicolas-grekas)
• minor [Form] Review Italian translation for validators (@GiuseppePuleri)
• minor [Form] Review French translation for range bound validator (@rooneyi)
• bug [HttpClient] Add missing non-routable ranges to NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug [Serializer] Make MetadataAwareNameConverter caches per instance (@nicolas-grekas)
• bug [HttpFoundation] Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)

Original source

Modulepreload Links Under a Strict CSP

Contributed by Hugo Alliaume in #134 and #149

Under a nonce-based Content-Security-Policy (script-src 'nonce-...', the kind NelmioSecurityBundle sets up), the tags Reprise renders, and their matching HTTP Link: preload headers, never carried a nonce. The browser blocks them, and once a modulepreload is blocked the module it points to fails to load, so the app's JavaScript never runs.

A nonce passed to reprise_entry_script_tags() through attributes, or set in the global script_attributes, now reaches the entry's modulepreload links and their Link: header, while the other attributes stay on the script tag:

{{ reprise_entry_script_tags('app', attributes={ nonce: csp_nonce('script'), 'data-turbo-track': 'reload', }) }}
<link rel="modulepreload" href="/build/shared.js" nonce="r4nd0m">
<script src="/build/app.js" type="module" nonce="r4nd0m" data-turbo-track="reload"></script>

RenderAssetTagEvent is now dispatched for modulepreload links too, under a new modulepreload type ($event->isModulepreload()). And the Link: header now copies nonce, integrity and crossorigin from the final tag, after the listeners ran, instead of recomputing them from entrypoints.json: a listener changing them used to leave the header out of sync with the tag, and the browser discards a preload that does not match.

Stimulus Controllers Without a Dev Server Restart

Contributed by Hugo Alliaume in #138 and #143

The virtual:symfony/controllers module was generated once, when the dev server started. Adding or removing a local controller, toggling a stimulusFetch: 'lazy' comment, or a controllers.json updated by Symfony Flex after a composer require symfony/ux-* all needed a dev server restart to show up. Webpack Encore picked these changes up on its own.

Both Vite and Rsbuild now regenerate the module and reload the page when one of those files changes. It is a full page reload, not hot replacement of the controller. Local controllers can also use the .jsx and .tsx extensions, like they could with Encore:

assets/controllers/hello_controller.js        -> hello
assets/controllers/chart_controller.tsx       -> chart
assets/controllers/admin/user_controller.jsx  -> admin--user

No More Rebuild Loop Under Rsbuild

Contributed by Hugo Alliaume in #139 and #140

With @rsbuild/plugin-tailwindcss (Tailwind CSS v4 watches the project's directories, the one holding outputPath included), rsbuild dev and rsbuild build --watch rebuilt forever: after every compile, Reprise rewrites entrypoints.json, manifest.json and, in dev, the copied files, the watcher sees the directory change, and Rspack compiles again. Vite was not affected, since its watcher already ignores build.outDir. The Rsbuild integration now adds outputPath and the metadata files to Rspack's watchOptions.ignored, keeping Rspack's default ignores when you set none and merging with yours (RegExp, glob or function) when you do.

Those rewrites also raced with PHP. writeFileSync() truncates a file before writing it, so a request landing in between could read an empty entrypoints.json and fail with a JsonException. On both bundlers, the two files are now written to a temporary file next to them and renamed over the target, with a fallback to a direct write when the rename fails (Windows can refuse it while another process holds the file open).

Keep the Metadata Out of the Public Directory

Contributed by Indra Gunawan in #121

Shipped in 1.2.0. Reprise wrote entrypoints.json and manifest.json into outputPath, next to the compiled assets. Upload that directory to public object storage or a CDN and the two files go with it, unless you exclude them by hand.

The new metadataPath option (defaulting to outputPath) writes them somewhere else, while the compiled assets and copied files stay in outputPath. AssetMapper gets the same idea in Symfony 8.2 with its new metadata_dir option.

// vite.config.ts
import { defineConfig } from 'vite'
import Symfony from '@symfony/reprise/vite'
export default defineConfig({
  plugins: [
    Symfony({
      outputPath: 'public/build',
      metadataPath: 'var/reprise',
    }),
  ],
})

// rsbuild.config.ts
import { defineConfig } from '@rsbuild/core'
import Symfony from '@symfony/reprise/rsbuild'
export default defineConfig({
  plugins: [
    Symfony({
      outputPath: 'public/build',
      metadataPath: 'var/reprise',
    }),
  ],
})

# config/packages/reprise.yaml
reprise:
  output_path: '%kernel.project_dir%/var/reprise'

If you rely on manifest.json for asset() calls, point framework.assets.json_manifest_path at the new location too, as the metadataPath documentation shows.

Style Entries Ship CSS Only

Contributed by Guillaume Sainthillier in #111

Shipped in 1.1.3. A style entry is an entry that points straight at a stylesheet, what Encore's addStyleEntry() did. Under Vite, it compiled to an empty JavaScript chunk that Vite pruned after Reprise had recorded it: the rendered

Original source

A CMS often lets each site customize how content fields are displayed. The default theme defines the field wrapper, while a site theme overrides the block used to render an image. The wrapper calls that block, but neither theme extends the other. Inheritance alone cannot make the wrapper see the site's override.

BlockChain composes their blocks at runtime. It first shipped in Twig 3.29, so you can use it today.

Using BlockChain

The same pattern works for a data-grid cell: the admin theme provides the wrapper, while the application theme customizes the value:

{# admin_theme.html.twig #}
{% extends 'admin_base.html.twig' %}
{% block cell %}<td class="admin">{{ parent() }}</td>{% endblock %}

{# admin_base.html.twig #}
{% block cell %}{{ block('cell_value') }}{% endblock %}

{# application_theme.html.twig #}
{% block cell_value %}<strong>{{ value }}</strong>{% endblock %}

{# base_theme.html.twig #}
{% block cell_value %}{{ value }}{% endblock %}

Create a chain in order of precedence, then render the block you need:

use Twig\BlockChain;
$defaults = new BlockChain($twig, ['base_theme.html.twig']);
$blocks = new BlockChain($twig, ['admin_theme.html.twig', 'application_theme.html.twig', $defaults]);
echo $blocks->renderBlock('cell', ['value' => 'Pending']);

The result is
<td class="admin"><strong>Pending</strong></td>. Each entry can be a template name, a loaded template or another chain. You can reuse $defaults in other theme stacks.

How Block Lookup Works

The first matching block wins:
cell comes from the admin theme, while block('cell_value') picks the application override.

parent() stays within the defining template's inheritance hierarchy; it does not jump to the next theme. See the BlockChain documentation for the full lookup rules, context handling and other methods.

The same pattern is useful for form controls, CMS fields and email fragments: your renderer picks the block name, and Twig finds the right theme.

How It Helps Open-Source Projects

Symfony Forms: Symfony's form renderer has long combined blocks from unrelated themes: a form view can have its own theme, inherit themes from its parent view and fall back to the default layout. A form_row block from one theme can call block('form_widget') and find an override in another. Before BlockChain, the Twig Bridge had to walk template parents, merge block maps and pass those maps to Twig's internal rendering API.

The Twig Bridge now uses BlockChain when available.

This integration is available in all currently supported Symfony versions. If you upgrade to Twig 3.29, update the Twig Bridge too.

Beyond Symfony: Other renderers implement similar block composition and could benefit from the same Twig API:

• Ibexa Core selects field-type blocks, such as ibexa_string_field, across local and configured CMS field templates. Its field renderer currently builds the block map itself.
• Prezent Grid layers grid themes and resolves widget blocks for column types. A chain could compose its themes while the grid renderer keeps its column-type fallback logic.
• Listing traverses template parents and merges their blocks before rendering listing and column blocks. A chain could take over that traversal.

The need to compose blocks across independent templates is not specific to Symfony, which is why the API landed in Twig.

Original source

Symfony UX 3.5 is out, with close to ninety pull requests merged since 3.4, enough to make it one of the largest releases the project has shipped. It brings a brand new Pagination package, hands component attribute rendering over to Twig itself, lets you document component props with the Twig 3.29 comment syntax, and adds twenty new Shadcn recipes to the UX Toolkit.

UX Pagination, At Last

For years, whenever Fabien Potencier teased a new Symfony component, someone in the community guessed "Pagination". It finally exists, though in Symfony UX rather than in Symfony itself.

symfony/ux-pagination paginates arrays, Doctrine ORM and DBAL queries, and any custom data source behind a single request-aware PaginatorInterface. PHP owns the query, Twig renders accessible navigation, and the browser follows ordinary links: no JavaScript, no Stimulus, no Turbo required.

Three strategies are available: numbered pagination for exact totals, lookahead when you only need a reliable next link and want to skip the COUNT query, and bidirectional cursor pagination when rows can move while somebody is browsing.

The twig:ux:pagination component ships default, Bootstrap and Tailwind themes, translations in ten locales, JSON serialization, and an optional LiveComponent integration through ComponentWithPaginationTrait. The bundle is experimental, but its own page on the UX website is already live.

Component Attributes Are Now Rendered by Twig

ComponentAttributes used to hand-roll its own attribute rendering: it threw on null, dropped aria-* set to false, rendered a boolean true bare, and threw on arrays, iterables and enums. That was a partial, in places invalid, reimplementation of what Twig has rendered natively since 3.24, when html_attr() landed.

Both {{ attributes }} and attributes.render() now resolve values through that same logic, so a component and a plain Twig template render attributes identically. Twig 3.29 is what made the reuse possible: it exposed the per-value building block behind html_attr().

ComponentAttributes#defaults() also understands MergeableInterface from twig/html-extra, which is how the Toolkit now merges Tailwind classes. This needs twig/html-extra ^3.29 and twig/twig ^3.24, and it may break your tests if you assert on the rendered HTML of a component's attributes: boolean, null, aria-*, and non-scalar values render differently now.

UX Icons and UX Map Follow the Same Rules

ux_icon(), twig:ux:icon, ux_map() and twig:ux:map render their attributes through the same code path, so the typed values of html_attr_type() and tailwind_classes now work there too. The same warning applies: if you assert on the or map attributes, regenerate those assertions.

The same change fixes a separate bug in UX Icons: an omitted aria-label, aria-labelledby, or title used to suppress the automatic aria-hidden="true", leaving the icon neither labelled nor hidden from assistive technology.

Documenting Props and Blocks with Twig Comments

Twig 3.29 introduced documentation comments, and TwigComponent now reads them. Write a ## comment above a prop inside {% props %}, or a {## ... ##} comment above a block, and the description is captured at compile time.

PropsNode::getPropDocumentation() exposes it per prop. The UX Toolkit is both the reason this syntax exists and its first consumer: wanting to document the props and blocks of every kit recipe is what pushed for an official Twig syntax instead of inventing another convention. Every kit recipe then dropped its old {# @prop #} and {# @block #} docblocks for it, and the prop tables on the UX website are generated from it.

Dynamic Component Names in the HTML Syntax

{% component %} has accepted a dynamic expression since 3.4. The HTML syntax now does too, through twig:component and its is attribute:

<twig:component is="Alert" type="success" />

{# Dynamic component name #}
<twig:component :is="componentName" type="success" />

{# Dynamic in a loop #}
{% set prefix = 'DynamicNameComponent' %}
{% for i in 1..2 %}
<twig:component :is="prefix ~ i" />
{% endfor %}

Twig 4 Support

Autocomplete, Cropper.js, Dropzone, Icons, LiveComponent, Map, StimulusBundle, Toolkit, Turbo and TwigComponent now run on Twig 4 as well as Twig 3.

One Twig 4 change affects Turbo templates that pass a fully qualified class name to turbo_stream_from() or twig:Turbo:Stream:From. Twig 3 requires escaping backslashes in string literals and silently drops the ones you forget, so 'App\Entity\Book' reached Turbo as the unusable topic AppEntityBook. Twig 4 keeps an unrecognized escape sequence intact, the way PHP does, so the class name now resolves. Templates already using the documented 'App\Entity\Book' form behave the same on both versions.

Autocomplete Without Doctrine

UX Autocomplete was tied to Doctrine ORM. Backing a field with an API, a search engine or an in-memory list meant writing a custom endpoint. It now accepts any data source: implement AutocompleterInterface, tag the service with an alias, and the new ux_autocomplete route serves it.

The Doctrine API stays fully supported: EntityAutocompleterInterface and the ux.entity_autocompleter tag work exactly as before. The ux_entity_autocomplete route is now an alias of ux_autocomplete, and is deprecated.

Removing a Component, and Downloading a File, from a LiveAction

A LiveAction can now end its own component. LiveResponse::remove() performs one final render, so emitted events still reach other components, then disconnects the Stimulus controller and takes the element off the page:

#[LiveAction]
public function dismiss(NotificationRepository $repository): LiveResponse {
    $repository->markAsRead($this->notification);
    $this->emit('notificationDismissed', ['id' => $this->notification->getId()]);
    return LiveResponse::remove();
}

The element carries a data-live-removing attribute until any animation on it finishes, then is dropped: nothing is deleted server-side, only the component leaves the page.

LiveResponse::downloadUrl() and LiveResponse::downloadFile() trigger a file download while the component keeps its state and re-renders. Prefer downloadUrl() whenever the file can be served from its own route: the browser downloads it natively, so nothing sits in memory on either side, progress is reported, and range requests and resuming work.

Dropzone Accepts Several Files

Pass the standard multiple option inherited from FileType, and the Dropzone accumulates files across successive selections instead of replacing the previous one, previews each of them, and lets the user remove them individually before submitting:

->add('photos', DropzoneType::class, [
    'multiple' => true,
    'remove_label' => 'Delete', // labels the per-file remove button
])

In multiple mode, dropzone:change carries a FileList rather than a single File, a new dropzone:remove event is dispatched with the removed file, and dropzone:clear is not dispatched since there is no clear button. The same release fixes the drop zone appearing empty when the very same file is dropped twice in a row, which Chrome reports without firing a change event.

Cropper.js Runs on Intervention Image 3 and 4

Server-side cropping is powered by Intervention Image, and the package was pinned to version 2, which triggers PHP deprecations. Versions 3 and 4 are now supported, and version 2 keeps working as the lowest supported version.

The image driver is configurable too, which was not possible before:

# config/packages/cropperjs.yaml
cropperjs:
  driver:
    gd

# "gd" (default), "imagick" or "vips"

gd and imagick ship with intervention/image. vips also needs the intervention/image-driver-vips package, the libvips system library and ext-ffi. If you need full control, register your own service implementing DriverInterface and point cropperjs.driver_service at it. Both options require intervention/image 3 or higher.

Custom Icon Finders

ux:icons:lock scans your Twig templates, which means it cannot find an icon whose name is built at runtime. IconFinderInterface lets you declare those names from any source, a database, an API or a PHP enum:

// src/Icons/AppIconFinder.php
final class AppIconFinder implements IconFinderInterface {
    public function icons(): array {
        $icons = ['tabler:mail'];
        foreach (Status::cases() as $status) {
            $icons[] = $status->icon();
        }
        return $icons;
    }
}

Thanks to autoconfiguration, the finder is registered for you. Its icons are merged with the ones found in your templates, and are used both by ux:icons:lock and when warming the icon cache.

UX Icons Parses SVG with the PHP 8.4 Dom API

SVG parsing moved from \DOMDocument to the \Dom\XMLDocument API introduced in PHP 8.4. Beyond being the modern API, it fixes a real bug: \DOMDocument dropped the xmlns attribute when rebuilding an icon's attributes, so an icon rendered from a local file came out without it.

That is a markup change. If you assert on the output of ux_icon() or twig:ux:icon, regenerate those assertions and clear your icon cache after upgrading.

StimulusHelper Is Autowirable

The Stimulus attributes the Twig helpers build are also available from PHP, through the StimulusHelper service, which you can now autowire. Reach for it when the element you want to decorate is not written in a template, a form field for instance:

public function __construct(private StimulusHelper $stimulusHelper) {}

public function buildForm(FormBuilderInterface $builder, array $options): void {
    $attributes = $this->stimulusHelper->createStimulusAttributes();
    $attributes->addController('country-picker', ['locale' => 'fr']);
    $attributes->addAction('country-picker', 'refresh', 'change');
    $builder->add('country', CountryType::class, ['attr' => $attributes->toArray()]);
}

The field then renders with data-controller, data-action, and the value attributes the Twig helpers would have produced.

UX Toolkit: Blocks

A recipe is a pack of files and dependencies for one component. A block is a whole page section built from a kit's components, installed and previewed as a unit. The Shadcn kit ships the first two, login-01 and login-02:

$ php bin/console ux:install login-01 --kit=shadcn

Installing it pulls in the recipes it is built from, here button, card, input, and label, and writes the LoginForm component into your templates. Dashboards, sidebars and other ready-to-use sections are where this goes next.

UX Toolkit: Twenty New Shadcn Recipes

The Shadcn kit gained twenty recipes: attachment, bubble, calendar, carousel, date-picker, drawer, dropdown-menu, form, input-otp, marker, menubar, message, native-select, navigation-menu, popover, questionnaire, scroll-area, sheet, sidebar, and slider. The typography recipe was removed.

Both Tailwind kits also changed how they merge classes: component variants now go through attributes.defaults({ class: '...'|tailwind_classes }) instead of tailwind_merge, so the classes you pass to a component override its own. This requires symfony/ux-twig-component 3.5.

Browse them all, with a live preview, on ux.symfony.com/toolkit.

UX Toolkit: Accessibility, Documented on Every Recipe

Every one of the sixty Shadcn recipes now carries an ## Accessibility section in its README.md, visible on the UX website. It says what the recipe already handles, what it expects from your markup, and what you still have to do yourself.

Writing them surfaced real bugs, now fixed. alert-dialog, dialog, drawer, and sheet rendered aria-labelledby and aria-describedby on a roleless wrapper rather than on the element, which left the modal without an accessible name. Right-to-left layouts were broken by physical spacing and border utilities, now replaced with their logical counterparts. A dialog focuses its first form field, or the [autofocus] element, when it opens. And button no longer renders type="button" when as is not a button.

The Standalone AssetMapper Bundle

Symfony 8.2 moves the AssetMapper configuration out of FrameworkBundle and into a standalone AssetMapperBundle. Every UX package that registers assets detects it, so nothing changes for you whether you run Symfony 7.4, 8.0 or 8.2.

A Performance Pass

A dozen pull requests went after hot paths across the monorepo, each one measured before and after. TwigComponent absorbed most of the work, on two fronts: its render pipeline and its pre-lexer.

Its render pipeline no longer rebuilds a ComponentMetadata on every call, no longer allocates and dispatches five events per render when nothing listens to them, and now builds its render variables in a single pass. That pipeline was profiled against an EasyAdmin index page, the kind of page that renders hundreds of small components. Its pre-lexer used to copy the whole remaining template on every call to consume(), several times per character, which made pre-lexing quadratic in the size of the template. It now scans the template in place instead.

The rest is smaller and spread out. LiveComponent memoizes its attribute-method lookups per class instead of rebuilding a ReflectionClass on every render, and skips the bracket pipeline for plain model names. UX Icons cuts allocations in IconRenderer::renderIcon(), and UX Map renders each icon once instead of once per marker. In the browser, StimulusBundle stops watching the DOM once every lazy controller is loaded and normalizes controller names faster, while the Translator caches the regular expression compiled by strtr(). The Toolkit stops re-walking the filesystem on every Recipe::getFiles().

Full Changelog

• [Toolkit][Shadcn] Drop the dead height option from recipe previews (@Kocal)
• [Toolkit][Shadcn] Add message recipe (@ker0x)
• [Toolkit][Shadcn] Add questionnaire recipe (@ker0x)
• [Toolkit][Shadcn] Add date-picker recipe (@ker0x)
• [Map] Make the Google Maps browser test resilient (@smnandre)
• [Toolkit][Shadcn] Add calendar recipe (@ker0x)
• [Toolkit] Read prop and block docs from Twig documentation comments (@Kocal)
• [Autocomplete][Cropperjs][Dropzone][LiveComponent][StimulusBundle][Toolkit][TwigComponent] Add support for Twig 4.x (@Kocal)
• [Icons][Map] Render attributes through twig/html-extra's html_attr() logic (@Kocal)
• [TwigComponent] Render component attributes through twig/html-extra's html_attr() (@Kocal)
• [Toolkit][Shadcn] Add bubble recipe (@ker0x)
• [LiveComponent] Handle paths beginning with double slash in LiveUrlSubscriber (@mbuliard)
• [Icons] Add IconFinderInterface to create custom finders to lock icons (@pierredup)
• [Toolkit][Shadcn] Document accessibility, fix -based recipies accessibility, and improve right-to-left layouts (@Kocal)
• [Toolkit][Shadcn] Add marker recipe (@ker0x)
• [Toolkit][Shadcn] Add attachment recipe (@ker0x)
• [Toolkit][Shadcn] Add carousel recipe (@Kocal)
• [Toolkit][Shadcn] Fix the rich colors of Sonner recipe (@Kocal)
• [LiveComponent] Upgrade Idiomorph to 0.7.4 (@smnandre)
• [Autocomplete] Add a max_options option to control how many options the dropdown displays (@Kocal)
• [Autocomplete][Chartjs][Cropperjs][Dropzone][LiveComponent][Map][Notify][React][StimulusBundle][Turbo][Vue] Update TypeScript's target to es2022 (@Kocal)
• [Autocomplete] Make search test fixtures deterministic (fix flakky) (@smnandre)
• [StimulusBundle] Detect the standalone AssetMapper bundle (@smnandre)
• [Toolkit] Fix ux:install reporting the source path of the installed files (@ker0x)
• [Toolkit] Restore the "available since" note on recipe install steps (@Kocal)
• [StimulusBundle] Make StimulusHelper autowirable and document PHP usage (@Kocal)
• [React] Update E2E dependencies (@smnandre)
• [Pagination] Add new UX Pagination component (@smnandre)
• [LiveComponent] Add LiveResponse::remove() to trigger component deletion (@smnandre)
• [LiveComponent] Add file downloads from a LiveAction (@smnandre)
• [CalendarLink] Derive a stable ICS UID from the event content (@Kocal)
• [CalendarLink] Make DTSTAMP deterministic via the Clock component (@Kocal)
• [CalendarLink] Anchor timed events to their time zone with TZID and VTIMEZONE (@Kocal)
• [CalendarLink] Make IcsBuilder internal (@Kocal)
• [Autocomplete] Translated 'Add placeholder' to Italian (@luigif)
• [Toolkit][Shadcn] Add sidebar recipe (@Amoifr)
• [Toolkit][Shadcn] Add form recipe (@Kocal)
• [Toolkit][Shadcn] Add drawer recipe (@Kocal)
• [Toolkit][Shadcn] Add sheet recipe (@Kocal)
• [Toolkit][Shadcn] popover: honor [autofocus] and skip hidden inputs when focusing content (@Kocal)
• [Toolkit][Shadcn] Focus the first form field when a dialog opens (@Kocal)
• [Toolkit][Shadcn] Add slider recipe (@Kocal)
• [Toolkit][Shadcn] Add scroll-area recipe (@Kocal)
• [Toolkit][Shadcn] Remove typography recipe (@Kocal)
• [Toolkit][Shadcn] Add native-select recipe (@Amoifr)
• [Toolkit][Shadcn] Add navigation-menu recipe (@Kocal)
• [Toolkit][Shadcn] Add DropdownMenu component (@Kocal)
• [Toolkit][Shadcn] Add popover recipe (@Kocal)
• [LiveComponent] Fix proxy turning "toJSON" and "then" protocol probes into server actions (@Amoifr)
• [Toolkit][Shadcn] Fix the hover-card usage example crashing on a plain HTML trigger (@Amoifr)
• [TwigComponent] Capture prop documentation comments (@Kocal)
• [Toolkit][Shadcn] Add menubar recipe (@Kocal)
• [Toolkit][Shadcn] Add input-otp recipe (@Kocal)
• [LiveComponent] Cache the attribute-method lookups per component class (@Kocal)
• [TwigComponent] Fix twig:blockquote is not a block (@smnandre)
• [Map] Render each UX icon once instead of once per marker (@Kocal)
• [StimulusBundle] Stop watching the DOM once every lazy controller is loaded (@Kocal)
• [TwigComponent] Reduce per-character work in the pre-lexer scan loops (@Kocal)
• [Translator] Cache the RegExp compiled by strtr() (@Kocal)
• [LiveComponent] Skip the bracket pipeline for plain model names (@Kocal)
• [StimulusBundle] Speed up Stimulus name normalization (@Kocal)
• [TwigComponent] Apply review remarks from #3692 (@Kocal)
• [TwigComponent] Reduce per-render CPU cost of static components (@javiereguiluz)
• [TwigComponent] Fix quadratic scanning in TwigPreLexer::consume() (@Kocal)
• [Toolkit] Stop re-walking the filesystem on every Recipe::getFiles() (@Kocal)
• [TwigComponent] Build the exposed properties without a generator (@Kocal)
• [Icons] Cut per-render allocations in IconRenderer::renderIcon() (@Kocal)
• [TwigComponent] Fix { verbatim } pre-lexing (@smnandre)
• [Icons] Migrate to modern \Dom\XMLDocument API (@Kocal)
• [TwigComponent] Add dynamic component support for HTML-syntax (@seb-jean)
• [Toolkit] Finalize support for Blocks, add Shadcn's login-01 and login-02 blocks (@seb-jean)
• [Toolkit] Migrate Tailwind kits to the tailwind_classes mergeable idiom (@Kocal)
• [TwigComponent] Support MergeableInterface in ComponentAttributes (@Kocal)
• Upgrade pnpm to 11.21.0 (@Kocal)
• [Toolkit] Restore the filename above installation code blocks (filename code options) (@Kocal)

Symfony UX 3.5.1 followed a few hours later, with two fixes for the standalone AssetMapper bundle that 3.5.0 had missed:

• [Map] Add missing support for Symfony 8.2's standalone AssetMapperBundle (@Kocal)
• [Pagination] Add missing support for Symfony 8.2's standalone AssetMapperBundle (@Kocal)

UX Pagination is experimental, which means its API can still change before a stable release. That is exactly when your feedback is worth the most, so try it and open an issue if something does not fit. The same goes for the attribute rendering change: if upgrading broke an assertion in a way this post did not warn you about, we want to hear about it.

Original source

Symfony 8.1 is backed by

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Symfony 8.1.7 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.6

• data Release v8.1.7
• minor [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas)
• minor [Form] Add the BoundsType compare message translation unit (@seb-jean)
• bug [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas)
• bug [Messenger] Do not drop the Beanstalkd keepalive raised during a command (@nicolas-grekas)
• bug [Messenger] Fix keepalive on the Amazon SQS transport (@nicolas-grekas)
• bug [Messenger] Make PhpSerializer::getMessageType() agree with unserialize() (@nicolas-grekas)
• bug [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• bug [TwigBridge] Compose form theme blocks with Twig's BlockChain when available (@fabpot)
• bug [Form] Describe the options of a type extension registered on a type extension (@fabpot)
• bug [Messenger][Amqp] Fix polling an empty queue counting as a message in flight (@nicolas-grekas)
• bug [Translation] Resolve Phrase locales by their code instead of by their name (@nicolas-grekas)
• bug [Console] Report a validation error instead of a TypeError on numeric arguments and options (@tanguychenier)
• bug [Messenger] Drop the messages queued by a failed nested dispatch (@nicolas-grekas)
• bug [AssetMapper][FrameworkBundle] Stop versioning the assets the mapper already resolved (@Amoifr)
• bug [HttpFoundation] Fix IpUtils::anonymize() for non-canonical IPv4-mapped addresses (@GabeSilvaDev)
• bug [Doctrine][Messenger] Do not lose the signals raised while fetching (@nicolas-grekas)
• bug [String] Keep the case of a leading acronym in ByteString::camel() (@Amoifr)
• bug [DoctrineBridge][FrameworkBundle][HttpKernel][TwigBundle] Escape percent signs in kernel path parameters (@nicolas-grekas)
• bug [DependencyInjection] Deep-clone only the mutable parts of a prototype definition (@nicolas-grekas)
• minor [Tui] Scroll overheight frames that grow instead of repainting the viewport (@fabpot)
• bug [Console] Keep messages containing malformed UTF-8 when wrapping (@Meacue)
• bug [Tui] Fix cursor jumps and partial rendering of overheight frames (@ineersa)
• bug [Finder] Only treat a leading hash as a gitignore comment and strip trailing spaces only (@fabpot)
• bug [FrameworkBundle] Fix the fatal when a cache pool cannot be cleared (@nicolas-grekas)
• bug [Mailer] Reconnect when the server closed the transmission channel (@ousamabenyounes)
• bug [Finder] Fix building the gitignore regex for files with many patterns (@fabpot)
• bug [Finder] Fix ignoreVCSIgnored() when the search directory is reached through a symlink (@fabpot)
• bug [Tui] Measure malformed UTF-8 instead of throwing (@fabpot)
• minor [SecurityBundle] Make two tests survive the FrameworkBundle split of the branch above (@nicolas-grekas)
• bug [Security] Do not follow redirects on the OIDC JWKS, OAuth2 introspection and CAS validation endpoints (@nicolas-grekas)
• bug [Security] Do not follow redirects on the OIDC UserInfo endpoint (@nicolas-grekas)
• minor [Form][Validator] Review Romanian (ro) translations (@robertiulianstoica)
• bug [Messenger] Fix Beanstalkd keepalive when triggered during another command (@HypeMC)
• bug [Messenger] Fix Beanstalkd reconnect mechanism (@HypeMC)
• bug [HttpClient] Suppress warnings from failed DNS lookups (@Toflar)
• bug [Security] Read the OAuth2 verified claims as booleans (@nicolas-grekas)
• bug [Security] Read the OIDC verified claims as booleans (@nicolas-grekas)
• bug [Messenger] Fix sub-second delays being ignored by the in-memory transport (@nicolas-grekas)
• bug [Serializer] Don't reuse list items with deep_object_to_populate (@nicolas-grekas)
• bug [FrameworkBundle] Fix configuring the S/MIME encrypter cipher (@nicolas-grekas)
• bug [Cache] Don't close lock handles that are still in use when evicting a slot (@nicolas-grekas)
• bug [FrameworkBundle] Fix HTTP client request assertion matching (@X-Coder264)
• bug [FrameworkBundle] Fix referencing "lock.factory" when no default lock resource is configured (@nicolas-grekas)
• bug [Validator] Drop unreachable territory keys from IBAN formats (@lazerg)
• bug [FrameworkBundle] Fix container compilation when a JsonPath function is registered (@nicolas-grekas)
• bug [FrameworkBundle] Fix the "framework.remote-event" config node being impossible to set (@nicolas-grekas)
• bug [Security] Read the "active" member of an introspection response as a boolean (@Spomky)
• bug [Security] Answer 401 instead of 500 when the introspection request fails (@Spomky)
• minor [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug [Cache] Add support for relay 0.50 (@nicolas-grekas)
• minor [Console] Type the autocompleter callback as returning a list (@nicolas-grekas)
• bug [Security] Reset the login rate limiter on successful login with a peekable limiter (@lazerg)
• bug [Tui] Fix bottom viewport rendering after content shrinks (@fabpot)
• minor [Console] Disambiguate the autocompleter callback return type (@SanderMuller)
• minor [Validator] Review Hungarian translations (@1ed)
• minor Review Catalan validator translations (@Victor-369)
• bug [Console] Reject #[AsCommand] on both a class and its __invoke() method (@nicolas-grekas)
• bug [Console] Make method-level #[AsCommand] names relative to the class-level one (@nicolas-grekas)
• bug [Console] Fix signal handling of invokable commands registered through the container (@nicolas-grekas)
• bug [String] Fix localeTitle() titlecasing only the first word when the locale has no transliterator (@nicolas-grekas)
• bug [HtmlSanitizer] Drop relative URLs whose first path segment contains a colon instead of throwing (@nicolas-grekas)
• bug [Mime] Reject header names containing non-printable or non-ASCII characters (@nicolas-grekas)
• bug [Scheduler] Fix duplicated schedule message when multiple methods in a class use #[AsCronTask] (@lazerg)
• bug [PropertyInfo] Do not prefer a method returning the declaring class as the property accessor (@lazerg)
• minor [HttpFoundation] Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)
• bug [VarDumper] Fix dumping class names to the dump server (@lazerg)
• minor [Validator] Complete Traditional Chinese translations (@HsukqiLee)
• bug [String] Fix singularization of words ending in -ives (@dylanpulver)
• bug [WebProfilerBundle] Fix a TypeError when the ajax toolbar panel is missing from the page (@lazerg)
• bug [Console] Do not evaluate the command line in the zsh completion (@GromNaN, @nicolas-grekas)
• minor [Console] Fix the bash completion of "--option=value" and of an aliased command (@GromNaN)
• bug [Console] Fix the bash completion on macOS and cover more option modes (@GromNaN)
• minor [Notifier] Fix typo in Bluesky transport exception message (@mdalikadar)
• bug [Finder] Fix prune filters not applied to nested directories and with path excludes (@nicolas-grekas)
• bug [JsonStreamer] Fix generator stream exhaustion on chunked file reading (@vlastv)
• minor Review Italian validator translations (@JJordan0C)
• bug [Form] Accept UTC-equivalent timezones for date and time model data (@ousamabenyounes)
• bug [Process] Use an absolute path for the cmd.exe fallback on Windows (@nicolas-grekas)
• bug [Console] Test the shell completion scripts and fix the escaping (@GromNaN)
• minor [Validator] Review Bosnian (bs) translations (@ivanoviczeljko)
• bug [Messenger] Fix a crash when a Redis stream entry is not a JSON object (@nicolas-grekas)
• bug [Mime] Never emit a raw control character in a header (@Spomky)
• bug [Notifier][Vonage] Verify the payload_hash claim of signed webhooks (@nicolas-grekas)
• bug [HttpFoundation] Match paths with the DOTALL modifier (@nicolas-grekas)
• bug [Mailer][Notifier] Verify webhook signatures before parsing the payload (@nicolas-grekas)
• bug [Mailer][Sendgrid] Verify the webhook signature before parsing the payload (@nicolas-grekas)
• bug [Mime] Do not treat an "@" inside the domain as the addr-spec separator (@Spomky)
• bug [Webhook] Reject a malformed request body with a 406 instead of a 500 (@nicolas-grekas)
• bug [Mailer] Reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers (@nicolas-grekas)
• bug [Notifier] Reject an empty secret in the Twilio webhook parser (@nicolas-grekas)
• bug [Mailer][Notifier] Reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers (@nicolas-grekas)
• minor [Mailer][Notifier] Mark webhook secrets as sensitive (@nicolas-grekas)
• minor [Mailer] Mark the Sendgrid webhook secret as sensitive (@nicolas-grekas)
• minor [FrameworkBundle] Describe the webhook routing secret in the config reference (@nicolas-grekas)
• minor [Form] Stop capturing Options in the upload_max_size_message closure (@bendavies)

❤️ Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Symfony Developer at Steward

View Symfony jobs →

$8,700 – $13,000 / month - Full remote

Original source

Symfony 7.4 is backed by:

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

Symfony 7.4.19 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.18

• data Release v7.4.19
• minor [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas)
• minor [Form] Add the BoundsType compare message translation unit (@seb-jean)
• bug [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas)
• bug [Messenger] Do not drop the Beanstalkd keepalive raised during a command (@nicolas-grekas)
• bug [Messenger] Fix keepalive on the Amazon SQS transport (@nicolas-grekas)
• bug [Messenger] Make PhpSerializer::getMessageType() agree with unserialize() (@nicolas-grekas)
• bug [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• bug [TwigBridge] Compose form theme blocks with Twig's BlockChain when available (@fabpot)
• bug [Form] Describe the options of a type extension registered on a type extension (@fabpot)
• bug [Messenger][Amqp] Fix polling an empty queue counting as a message in flight (@nicolas-grekas)
• bug [Translation] Resolve Phrase locales by their code instead of by their name (@nicolas-grekas)
• bug [Console] Report a validation error instead of a TypeError on numeric arguments and options (@tanguychenier)
• bug [Messenger] Drop the messages queued by a failed nested dispatch (@nicolas-grekas)
• bug [AssetMapper][FrameworkBundle] Stop versioning the assets the mapper already resolved (@Amoifr)
• bug [HttpFoundation] Fix IpUtils::anonymize() for non-canonical IPv4-mapped addresses (@GabeSilvaDev)
• bug [Doctrine][Messenger] Do not lose the signals raised while fetching (@nicolas-grekas)
• bug [String] Keep the case of a leading acronym in ByteString::camel() (@Amoifr)
• bug [DoctrineBridge][FrameworkBundle][HttpKernel][TwigBundle] Escape percent signs in kernel path parameters (@nicolas-grekas)
• bug [Console] Keep messages containing malformed UTF-8 when wrapping (@Meacue)
• bug [Finder] Only treat a leading hash as a gitignore comment and strip trailing spaces only (@fabpot)
• bug [FrameworkBundle] Fix the fatal when a cache pool cannot be cleared (@nicolas-grekas)
• bug [Mailer] Reconnect when the server closed the transmission channel (@ousamabenyounes)
• bug [Finder] Fix building the gitignore regex for files with many patterns (@fabpot)
• bug [Finder] Fix ignoreVCSIgnored() when the search directory is reached through a symlink (@fabpot)
• bug [Security] Do not follow redirects on the OIDC JWKS, OAuth2 introspection and CAS validation endpoints (@nicolas-grekas)
• bug [Security] Do not follow redirects on the OIDC UserInfo endpoint (@nicolas-grekas)
• minor [Form][Validator] Review Romanian (ro) translations (@robertiulianstoica)
• bug [Messenger] Fix Beanstalkd keepalive when triggered during another command (@HypeMC)
• bug [Messenger] Fix Beanstalkd reconnect mechanism (@HypeMC)
• bug [HttpClient] Suppress warnings from failed DNS lookups (@Toflar)
• bug [Security] Read the OAuth2 verified claims as booleans (@nicolas-grekas)
• bug [Security] Read the OIDC verified claims as booleans (@nicolas-grekas)
• bug [Messenger] Fix sub-second delays being ignored by the in-memory transport (@nicolas-grekas)
• bug [Serializer] Don't reuse list items with deep_object_to_populate (@nicolas-grekas)
• bug [FrameworkBundle] Fix configuring the S/MIME encrypter cipher (@nicolas-grekas)
• bug [Cache] Don't close lock handles that are still in use when evicting a slot (@nicolas-grekas)
• bug [FrameworkBundle] Fix HTTP client request assertion matching (@X-Coder264)
• bug [FrameworkBundle] Fix referencing "lock.factory" when no default lock resource is configured (@nicolas-grekas)
• bug [Validator] Drop unreachable territory keys from IBAN formats (@lazerg)
• bug [FrameworkBundle] Fix the "framework.remote-event" config node being impossible to set (@nicolas-grekas)
• bug [Security] Read the "active" member of an introspection response as a boolean (@Spomky)
• bug [Security] Answer 401 instead of 500 when the introspection request fails (@Spomky)
• minor [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug [Cache] Add support for relay 0.50 (@nicolas-grekas)
• minor [Console] Type the autocompleter callback as returning a list (@nicolas-grekas)
• bug [Security] Reset the login rate limiter on successful login with a peekable limiter (@lazerg)
• minor [Console] Disambiguate the autocompleter callback return type (@SanderMuller)
• minor [Validator] Review Hungarian translations (@1ed)
• minor Review Catalan validator translations (@Victor-369)
• bug [String] Fix localeTitle() titlecasing only the first word when the locale has no transliterator (@nicolas-grekas)
• bug [HtmlSanitizer] Drop relative URLs whose first path segment contains a colon instead of throwing (@nicolas-grekas)
• bug [Mime] Reject header names containing non-printable or non-ASCII characters (@nicolas-grekas)
• bug [PropertyInfo] Do not prefer a method returning the declaring class as the property accessor (@lazerg)
• minor [HttpFoundation] Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)
• minor [Validator] Complete Traditional Chinese translations (@HsukqiLee)
• bug [String] Fix singularization of words ending in -ives (@dylanpulver)
• bug [WebProfilerBundle] Fix a TypeError when the ajax toolbar panel is missing from the page (@lazerg)
• bug [Console] Do not evaluate the command line in the zsh completion (@GromNaN, @nicolas-grekas)
• minor [Console] Fix the bash completion of "--option=value" and of an aliased command (@GromNaN)
• bug [Console] Fix the bash completion on macOS and cover more option modes (@GromNaN)
• minor [Notifier] Fix typo in Bluesky transport exception message (@mdalikadar)
• bug [Finder] Fix prune filters not applied to nested directories and with path excludes (@nicolas-grekas)
• bug [JsonStreamer] Fix generator stream exhaustion on chunked file reading (@vlastv)
• minor Review Italian validator translations (@JJordan0C)
• bug [Form] Accept UTC-equivalent timezones for date and time model data (@ousamabenyounes)
• bug [Process] Use an absolute path for the cmd.exe fallback on Windows (@nicolas-grekas)
• bug [Console] Test the shell completion scripts and fix the escaping (@GromNaN)
• minor [Validator] Review Bosnian (bs) translations (@ivanoviczeljko)
• bug [Messenger] Fix a crash when a Redis stream entry is not a JSON object (@nicolas-grekas)
• bug [Mime] Never emit a raw control character in a header (@Spomky)
• bug [Notifier][Vonage] Verify the payload_hash claim of signed webhooks (@nicolas-grekas)
• bug [HttpFoundation] Match paths with the DOTALL modifier (@nicolas-grekas)
• bug [Mailer][Notifier] Verify webhook signatures before parsing the payload (@nicolas-grekas)
• bug [Mailer][Sendgrid] Verify the webhook signature before parsing the payload (@nicolas-grekas)
• bug [Mime] Do not treat an "@" inside the domain as the addr-spec separator (@Spomky)
• bug [Webhook] Reject a malformed request body with a 406 instead of a 500 (@nicolas-grekas)
• bug [Mailer] Reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers (@nicolas-grekas)
• bug [Notifier] Reject an empty secret in the Twilio webhook parser (@nicolas-grekas)
• bug [Mailer][Notifier] Reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers (@nicolas-grekas)
• minor [Mailer][Notifier] Mark webhook secrets as sensitive (@nicolas-grekas)
• minor [Mailer] Mark the Sendgrid webhook secret as sensitive (@nicolas-grekas)
• minor [FrameworkBundle] Describe the webhook routing secret in the config reference (@nicolas-grekas)
• minor [Form] Stop capturing Options in the upload_max_size_message closure (@bendavies)

Original source

Symfony 6.4 is backed by:

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Symfony 6.4.46 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.45

• data #66073 Release v6.4.46
• minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas)
• minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean)
• bug #66048 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• bug #66043 [TwigBridge] Compose form theme blocks with Twig's BlockChain when available (@fabpot)
• bug #66041 [Form] Describe the options of a type extension registered on a type extension (@fabpot)
• bug #66037 [Translation] Resolve Phrase locales by their code instead of by their name (@nicolas-grekas)
• bug #66032 [Messenger] Drop the messages queued by a failed nested dispatch (@nicolas-grekas)
• bug #66027 [AssetMapper][FrameworkBundle] Stop versioning the assets the mapper already resolved (@Amoifr)
• bug #66023 [HttpFoundation] Fix IpUtils::anonymize() for non-canonical IPv4-mapped addresses (@GabeSilvaDev)
• bug #65995 [String] Keep the case of a leading acronym in ByteString::camel() (@Amoifr)
• bug #66003 [DoctrineBridge][FrameworkBundle][HttpKernel][TwigBundle] Escape percent signs in kernel path parameters (@nicolas-grekas)
• bug #65976 [Console] Keep messages containing malformed UTF-8 when wrapping (@Meacue)
• bug #65963 [Finder] Only treat a leading hash as a gitignore comment and strip trailing spaces only (@fabpot)
• bug #65974 [FrameworkBundle] Fix the fatal when a cache pool cannot be cleared (@nicolas-grekas)
• bug #65967 [Mailer] Reconnect when the server closed the transmission channel (@ousamabenyounes)
• bug #65962 [Finder] Fix building the gitignore regex for files with many patterns (@fabpot)
• bug #65961 [Finder] Fix ignoreVCSIgnored() when the search directory is reached through a symlink (@fabpot)
• bug #65952 [Security] Do not follow redirects on the OIDC UserInfo endpoint (@nicolas-grekas)
• minor #65926 [Form][Validator] Review Romanian (ro) translations (@robertiulianstoica)
• bug #65914 [HttpClient] Suppress warnings from failed DNS lookups (@Toflar)
• bug #65912 [Security] Read the OIDC verified claims as booleans (@nicolas-grekas)
• bug #65904 [Messenger] Fix sub-second delays being ignored by the in-memory transport (@nicolas-grekas)
• bug #65907 [Serializer] Don't reuse list items with deep_object_to_populate (@nicolas-grekas)
• bug #65893 [Cache] Don't close lock handles that are still in use when evicting a slot (@nicolas-grekas)
• bug #65889 [FrameworkBundle] Fix HTTP client request assertion matching (@X-Coder264)
• bug #65888 [Validator] Drop unreachable territory keys from IBAN formats (@lazerg)
• bug #65883 [FrameworkBundle] Fix the "framework.remote-event" config node being impossible to set (@nicolas-grekas)
• minor #65876 [Validator] Add missing Arabic translation for validation units (@EmanFateen)
• bug #65867 [Cache] Add support for relay 0.50 (@nicolas-grekas)
• bug #65859 [Security] Reset the login rate limiter on successful login with a peekable limiter (@lazerg)
• minor #65854 [Validator] Review Hungarian translations (@1ed)
• minor #65856 Review Catalan validator translations (@Victor-369)
• bug #65843 [HtmlSanitizer] Drop relative URLs whose first path segment contains a colon instead of throwing (@nicolas-grekas)
• bug #65844 [Mime] Reject header names containing non-printable or non-ASCII characters (@nicolas-grekas)
• bug #65837 [PropertyInfo] Do not prefer a method returning the declaring class as the property accessor (@lazerg)
• minor #65836 [HttpFoundation] Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)
• minor #65832 [Validator] Complete Traditional Chinese translations (@HsukqiLee)
• bug #65823 [String] Fix singularization of words ending in -ives (@dylanpulver)
• bug #65822 [WebProfilerBundle] Fix a TypeError when the ajax toolbar panel is missing from the page (@lazerg)
• bug #65818 [Console] Do not evaluate the command line in the zsh completion (@GromNaN, @nicolas-grekas)
• minor #65815 [Console] Fix the bash completion of "--option=value" and of an aliased command (@GromNaN)
• bug #65811 [Console] Fix the bash completion on macOS and cover more option modes (@GromNaN)
• bug #65801 [Finder] Fix prune filters not applied to nested directories and with path excludes (@nicolas-grekas)
• minor #65786 Review Italian validator translations (@JJordan0C)
• bug #65780 [Form] Accept UTC-equivalent timezones for date and time model data (@ousamabenyounes)
• bug #65784 [Process] Use an absolute path for the cmd.exe fallback on Windows (@nicolas-grekas)
• bug #65783 [Console] Test the shell completion scripts and fix the escaping (@GromNaN)
• minor #65782 [Validator] Review Bosnian (bs) translations (@ivanoviczeljko)
• bug #65779 [Messenger] Fix a crash when a Redis stream entry is not a JSON object (@nicolas-grekas)
• bug #65778 [Mime] Never emit a raw control character in a header (@Spomky)
• bug #65776 [Notifier][Vonage] Verify the payload_hash claim of signed webhooks (@nicolas-grekas)
• bug #65775 [HttpFoundation] Match paths with the DOTALL modifier (@nicolas-grekas)
• bug #65773 [Mailer][Sendgrid] Verify the webhook signature before parsing the payload (@nicolas-grekas)
• bug #65777 [Mime] Do not treat an "@" inside the domain as the addr-spec separator (@Spomky)
• bug #65772 [Webhook] Reject a malformed request body with a 406 instead of a 500 (@nicolas-grekas)
• bug #65768 [Notifier] Reject an empty secret in the Twilio webhook parser (@nicolas-grekas)
• minor #65765 [Mailer] Mark the Sendgrid webhook secret as sensitive (@nicolas-grekas)
• minor #65762 [FrameworkBundle] Describe the webhook routing secret in the config reference (@nicolas-grekas)
• minor #65756 [Form] Stop capturing Options in the upload_max_size_message closure (@bendavies)

Original source

Symfony 8.1 is backed by:
Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!
Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.
TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.
Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Symfony 8.1.6 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.5

• bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
• bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65728 [Routing] Fix matching the "0" URL (@cs278)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
• bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
• bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
• bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
• bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
• bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
• bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• bug #65697 [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
• minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
• minor #65665 [Validator] fix comment for Url requireTld argument (@dmitryuk)
• bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor #65657 [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
• bug #65656 [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
• minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor #65646 Review translations for Estonian (et) (@erkia)
• bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug #65640 [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
• bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
• minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
• minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug #65632 [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
• bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• bug #65613 [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
• minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
• bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor #65587 [Validator] Review Urdu translations (@UmairRathore)
• bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
• bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
• data #64370 Release v5.4.53

❤️ Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Original source