Symfony Release Notes

Last updated: Apr 14, 2026

Get this feed:
  • Apr 13, 2026
    • Date parsed from source:
      Apr 13, 2026
    • First seen by Releasebot:
      Apr 14, 2026
    Symfony logo

    Symfony

    Symfony UX 2.35 Released

    Symfony releases UX 2.35 with smarter Twig component attribute merging, a new reset_on_focus option for Autocomplete, a Flowbite 4.0 toolkit kit, and a new Shadcn Toggle component. It also improves UX Native setup and deprecates the Svelte package.

    Symfony UX 2.35 is out with smarter HTML attribute merging for Twig components, a new reset_on_focus option for Autocomplete, a brand new Flowbite 4.0 kit, and more.

    Smart HTML Attribute Merging in Twig Components

    When spreading multiple attribute sets onto a Twig component, conflicting keys would silently overwrite each other. This was especially problematic with Stimulus data-action attributes: if a button needed to trigger both a Dialog and a Tooltip, only the last data-action survived.

    ComponentAttributes now supports the AttributeValueInterface introduced in twig/html-extra 3.24. Combined with the html_attr_type and html_attr_merge Twig filters, you can declare how attribute values should be merged. For example, using the sst (space-separated tokens) strategy:

    The rendered data-action will contain all three Stimulus descriptors instead of only the last set.

    Toolkit Triggers Now Merge Attributes Correctly

    Building on the new attribute merging support, the Shadcn Dialog, AlertDialog and Tooltip trigger components now use html_attr_type('sst') for their data-action attributes. This means you can nest a Button inside both a Dialog trigger and a Tooltip trigger, and all Stimulus actions will be preserved automatically:

    Autocomplete: New reset_on_focus Option

    By default, Tom Select caches the results fetched via AJAX. When a user searches, selects an option, then clears the selection and refocuses the field, the dropdown still shows the stale search results instead of the full default list.

    The new reset_on_focus option clears the cached options and refetches the default list every time the field receives focus:

    Flowbite 4.0 Kit for Toolkit

    A new flowbite-4 kit joins the existing Shadcn kit in Symfony UX Toolkit. This first batch includes the Alert, Badge and ButtonGroup components, styled with Flowbite 4.0 and Tailwind CSS.

    Toggle Component for the Shadcn Kit

    The Shadcn kit gains a new Toggle component with variant (default or outline), size (sm, default, lg) and pressed props:

    Svelte Package Deprecated

    The symfony/ux-svelte package is now deprecated and will be removed in Symfony UX 3.0. Usage numbers have been declining steadily, and the Svelte ecosystem makes deep Symfony integration difficult compared to other frontend frameworks. If you are currently using UX Svelte, consider migrating to UX React, UX Vue, or Twig Components.

    Easier JS Dependency Installation for UX Native

    UX Native now ships an assets/ directory with a package.json, allowing Symfony Flex to automatically register the @hotwired/hotwire-native-bridge JavaScript dependency in your package.json or importmap.php. Previously, the Maker command tried to check for the dependency at runtime, but the check was broken. This fix makes the installation seamless.

    Full Changelog

    • [Svelte] Deprecate the package (@Kocal)
    • [Autocomplete] Add option clear_on_focus (@zairigimad)
    • [Toolkit][Flowbite] Add kit Flowbite 4.0 base (@DcgRG)
    • [Toolkit][Shadcn] Add Toggle (@zairigimad)
    • [Chartjs][Icons][Map][Notify][React][Svelte][Toolkit][Turbo][TwigComponent][Vue][Native] Allow Symfony UX 3.x packages (@Kocal)
    • [Native] Introduce assets/ to ease installation of @hotwired/hotwire-native-bridge JS dependency (@Kocal)
    • [Toolkit] Embrace html_attr_type from twig/html-extra:^3.24 to correctly merge trigger's attributes (@Kocal)
    • [TwigComponent] Add support for AttributeValueInterface from twig/html-extra:^3.24.0 in ComponentAttributes (@Kocal)
    Original source
  • Apr 13, 2026
    • Date parsed from source:
      Apr 13, 2026
    • First seen by Releasebot:
      Apr 14, 2026
    Symfony logo

    Symfony

    Symfony UX 3.0.0 Released

    Symfony ships UX 3.0, a major release that drops deprecated 2.x code, raises requirements to PHP 8.4 and Symfony 7.4, removes four ecosystem packages, updates Google Maps loading, and modernizes test support with PHPUnit 11.

    Symfony UX 3.0 is a new major release. Following Symfony's release process, this version removes all features deprecated during the 2.x cycle and raises the minimum requirements to PHP 8.4 and Symfony 7.4. If your application runs without deprecation notices on Symfony UX 2.x, upgrading should be straightforward.

    Removed Packages: Swup, LazyImage, Typed, TogglePassword

    Four packages have been removed from the Symfony UX ecosystem. These packages provided thin wrappers around third-party JavaScript libraries with minimal PHP integration, and their functionality can be reproduced in a few lines of application code:

    • Swup: install Swup via npm or importmap:require and import it directly in your application
    • LazyImage: native browser lazy loading (loading="lazy") has made this package obsolete
    • Typed: install Typed.js via npm or importmap:require and create a small Stimulus controller
    • TogglePassword: a candidate for migration to UX Toolkit as a reusable component

    If you rely on any of these packages, check the UPGRADE-3.0.md file for migration steps.

    Deprecation Removals Across All Packages

    All code deprecated during the 2.x cycle has been removed. Here are the most notable changes:

    • Autocomplete: the ParentEntityAutocompleteType class has been replaced by BaseEntityAutocompleteType, and ExtraLazyChoiceLoader has been removed in favor of Symfony Form's built-in LazyChoiceLoader (available since Symfony 7.2).
    • LiveComponent: the csrf argument on #[AsLiveComponent] has been removed; same-origin/CORS protection is now the default.
    • TwigComponent: the twig_component.defaults configuration is now mandatory, the cva Twig function has been replaced by html_cva from twig/html-extra:^3.12, and PreCreateForRenderEvent::getProps() has been renamed to getInputProps().
    • Map: the render_map() Twig function has been replaced by ux_map(), and the title option on shapes (Polygon, Polyline, Rectangle, Circle) has been replaced by infoWindow.
    • StimulusBundle: the ux_controller_link_tags() Twig function has been removed, which requires Symfony AssetMapper 6.4 or higher.
    • Turbo, Vue, Chartjs, Notify, React, Svelte: various internal backward-compatibility layers and deprecated method signatures have been cleaned up.

    Consult the full UPGRADE-3.0.md for detailed migration instructions and code diffs.

    Cropper: Rotation Always Applied

    The Crop::getCroppedImage() and Crop::getCroppedThumbnail() methods now apply rotation automatically when the crop data includes a rotation angle. The $applyRotation parameter has been removed:

    // Before (2.x)
    $crop->getCroppedImage(applyRotation: true);
    $crop->getCroppedThumbnail(200, 200, applyRotation: true);
    // After (3.0): rotation is always applied
    $crop->getCroppedImage();
    $crop->getCroppedThumbnail(200, 200);
    

    Google Maps: Upgraded to @googlemaps/js-api-loader 2.0

    The Google Map bridge now uses @googlemaps/js-api-loader version ^2.0. If you use Symfony AssetMapper without Symfony Flex, update your import map:

    $ php bin/console importmap:require @googlemaps/js-api-loader@^2.0
    

    Some UX_MAP_DSN query parameters have changed: the version option has been renamed to v, and options id, nonce, retries, url have been removed. See the UPGRADE-3.0.md for the full list of DSN option changes.

    PHPUnit 11 Replaces Symfony PHPUnit Bridge

    The test infrastructure has been modernized: all packages now use PHPUnit 11 directly instead of the Symfony PHPUnit Bridge. This does not affect application code, but if you run the Symfony UX test suites locally, make sure you have PHPUnit 11 or higher installed.

    Full Changelog

    • [LiveComponent] Remove compatibility layer with Symfony PropertyInfo <7.1 (@Kocal)
    • Update minimum required Symfony version to 7.4 (@Kocal)
    • Upgrade minimum required PHP version to 8.4 (@Kocal)
    • [Cropper] Always apply rotation in Crop::getCroppedImage() and Crop::getCroppedThumbnail() (@MrYamous)
    • Post-merge fixes for 3.x (@Kocal)
    • [Autocomplete][Turbo] Remove BC layers for methods and parameters (@Kocal)
    • Fix 2.x -> 3.x merge (@Kocal)
    • Add phpunit.dist.xml in .gitattributes (@Kocal)
    • Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@Kocal)
    • [StimulusBundle] Remove deprecations for 3.0 (@Kocal)
    • [Vue] Remove deprecations for 3.0 (@Kocal)
    • [Map][Google] Upgrade @googlemaps/js-api-loader to ^2.0 (@Kocal)
    • [TwigComponent] Remove dev-dependency on WebpackEncoreBundle (@Kocal)
    • [Autocomplete] Remove deprecated code for 3.0 (@smnandre)
    • [Chartjs][Notify][React][Svelte] Remove StimulusHelper deprecation for 3.0 (@smnandre)
    • [Vue] Remove deprecations for 3.0 (@smnandre)
    • [Turbo] Remove deprecations for 3.0 (@smnandre)
    • [Map] Remove deprecations from Map (@Kocal)
    • [LiveComponent][UX3] Remove deprecations (@smnandre)
    • [TwigComponent][UX3] Remove deprecations (@smnandre)
    • Upgrade minimum required PHP version to 8.2 (@Kocal)
    • Update minimum required Symfony version to ^6.4 (@Kocal)
    • [TogglePassword] Remove package (@Kocal)
    • [LazyImage] Remove package (@Kocal)
    • [Typed] Remove package (@Kocal)
    • [Swup] Remove package (@smnandre)
    Original source
  • All of your release notes in one feed

    Join Releasebot and get updates from Symfony and hundreds of other software products.

    Create account
  • Apr 11, 2026
    • Date parsed from source:
      Apr 11, 2026
    • First seen by Releasebot:
      Apr 11, 2026
    Symfony logo

    Symfony

    Symfony Polyfill 1.34.0 released

    Symfony Polyfill 1.34.0 adds new PHP 8.4, 8.5, and 8.6 polyfills plus a deepclone extension fallback, helping projects stay forward-compatible while running on older PHP versions. It also improves ICU collation fallback and expands exception and attribute support.

    Symfony Polyfill 1.34.0 ships ten new polyfills that cover features from PHP 8.4, 8.5, and 8.6, along with a new polyfill for the deepclone Symfony PHP extension. This release lets you write forward-compatible code against upcoming PHP APIs while still running on the PHP versions your projects support today.

    PDO driver-specific subclasses

    PHP 8.4 introduced dedicated Pdo\Mysql, Pdo\Pgsql, Pdo\Sqlite, Pdo\Odbc, Pdo\Firebird, and Pdo\Dblib subclasses with their own driver-specific constants and methods, and PHP 8.5 deprecates the equivalents on the base PDO class. This polyfill makes the new classes and constants available on earlier PHP versions, so you can move away from the deprecated API without waiting for every target runtime to reach PHP 8.4:

    Note that the PDO::connect() static factory introduced alongside the subclasses is not polyfilled.

    Thanks to @nicolas-grekas and @jnoordsij for #549.

    bcmath rounding functions

    PHP 8.4 added bcround(), bcceil(), and bcfloor() to round arbitrary-precision decimal numbers without ever converting them to floats. The polyfill makes the three functions available on earlier PHP versions, together with the RoundingMode constants that bcround() expects:

    Thanks to @Dean151 for #546.

    IntlListFormatter

    PHP 8.5 ships a new IntlListFormatter class that joins items into a locale-aware list, picking the correct conjunction and punctuation for each language. The ICU polyfill provides it back to PHP 7.2 using the CLDR list patterns:

    Thanks to @Ayesh for #532.

    locale_is_right_to_left()

    PHP 8.5 also exposes locale_is_right_to_left() (along with the Locale::isRightToLeft() method), which returns true for locales written from right to left such as Arabic or Hebrew. You can use it to flip the layout direction of a response without shipping your own list of RTL language codes:

    Thanks to @alexander-schranz for #527.

    grapheme_levenshtein()

    PHP's built-in levenshtein() counts bytes, which produces incorrect results as soon as a string contains multi-byte characters or combining marks. PHP 8.5 adds grapheme_levenshtein(), which operates on grapheme clusters so that user-visible characters are counted as one unit:

    Thanks to @sudam802 for #558.

    Filter exception classes

    PHP 8.5 introduces a FILTER_THROW_ON_FAILURE flag that makes filter_var() throw instead of returning false on invalid input. The throwing behavior itself cannot be emulated, but the new exception classes can, which lets library authors write catch blocks that compile on both PHP 8.5 and earlier releases:

    Thanks to @Ayesh for #557.

    DelayedTargetValidation attribute

    PHP 8.5 adds the #[DelayedTargetValidation] attribute, which tells the engine to defer target validation of a user attribute until reflection actually instantiates it. This unblocks attribute authors who need to apply an attribute to a target that the engine would otherwise reject. The polyfill provides an empty stub so the attribute compiles and is visible through reflection on earlier PHP versions:

    Thanks to @DanielEScherzer for #541.

    clamp()

    Looking further ahead, the release ships a polyfill for the upcoming PHP 8.6 clamp() function, which constrains a numeric value between a minimum and a maximum:

    Thanks to @kylekatarnls for #554.

    Polyfill for the deepclone extension

    Symfony now ships an optional symfony/php-ext-deepclone native extension that round-trips arbitrary PHP value graphs through an array representation, preserving object identity, references, cycles, and private property state. It is several times faster than unserialize(serialize(...)) and produces output that OPcache can map into shared memory when dumped via var_export().

    The new symfony/polyfill-deepclone package provides the same deepclone_to_array() and deepclone_from_array() functions in pure PHP, reusing the wire format already used by Symfony\Component\VarExporter\DeepCloner:

    When the native extension is loaded, the polyfill steps aside.

    Thanks to @nicolas-grekas and @GromNaN for #561.

    Collator::compare() fallback

    Before this release, calling Collator::compare() on the ICU polyfill raised a MethodNotImplementedException. It now falls back to a deterministic string comparison based on the spaceship operator, so code that needs a stable ordering (rather than full ICU collation) works out of the box:

    Thanks to @aymericcucherousset for #560.

    Full Changelog

    • Fix bcdiv handling of DivisionByZeroError (@nicolas-grekas)
    • mbstring polyfills must not raise value errors in PHP 7 (@derrabus)
    • [8.5] Add locale_is_right_to_left() (@alexander-schranz)
    • [Intl] Add PHP 8.5 IntlListFormatter to ICU polyfill (@Ayesh)
    • Add polyfill for PDO driver specific subclasses (@nicolas-grekas, @jnoordsij)
    • Add the grapheme_levenshtein polyfill (@sudam802)
    • [PHP 8.5] Add new \Filter\FilterException and Filter\FilterFailedException (@Ayesh)
    • Add fallback implementation for Collator::compare() (@aymericcucherousset)
    • Fix PHP 7.2 compatibility for PHP 8.4 polyfill (@Seldaek)
    • Add polyfill for symfony/php-ext-deepclone (@nicolas-grekas, @GromNaN)
    • [8.6] Add clamp function (@kylekatarnls)
    • [8.4] implement bcround, bcceil and bcfloor (@Dean151)
    • Ctype: Give the correct deprecations for PHP 8.1+ (@BackEndTea)
    • [8.5] Add polyfill for DelayedTargetValidation (@DanielEScherzer)
    Original source
  • Mar 31, 2026
    • Date parsed from source:
      Mar 31, 2026
    • First seen by Releasebot:
      Apr 1, 2026
    Symfony logo

    Symfony

    Symfony 6.4.36 released

    Symfony ships 6.4.36 with a broad set of bug fixes across DependencyInjection, Serializer, Cache, HttpClient, Messenger, Console, TwigBridge, and more, improving stability, compatibility, and performance for Symfony 6.4 users.

    Symfony 6.4 is backed by:

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    Symfony 6.4.36 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 6.4.35

    • bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (@nicolas-grekas)
    • bug #63817 [Serializer] Fix denormalization of nested array with key types (@mtarld)
    • bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (@lyrixx)
    • bug #63806 [Ldap] Make the Adapter resettable (@kira0269, @nicolas-grekas)
    • bug #63720 [MonologBridge] Fix ConsoleHandler losing output after nested command terminates (@mp3000mp)
    • bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (@wazum)
    • bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (@pcescon)
    • bug #63683 [TwigBridge] Fix image method to use DataPart content ID (@pavelwitassek)
    • bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (@sn3mdev)
    • bug #63747 [Cache] Fix Psr16Cache::getMultiple() returning ValueWrapper with TagAwareAdapter (@pcescon)
    • bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (@pcescon)
    • bug #63777 [FrameworkBundle] Fix setting router.request_context.base_url when option default_uri is defined (@nicolas-grekas)
    • bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (@LachlanArthur)
    • bug #63726 [HttpClient] Unset push response content when the push handler is released (@sakozoko)
    • bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (@pcescon)
    • bug #63724 [HttpKernel] Fix allowing invalid #[Autowire] references in controller arguments (@valtzu)
    • bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (@shyim)
    • bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (@nicolas-grekas)
    • bug #63676 [HttpKernel] Reset router locale to default when finishing main request (@guillaumeVDP)
    • bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (@andyexeter)
    • bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (@guillaumeVDP)
    • bug #63656 [Form] Fix typed property initialization in ValidatorExtension (@SeverinGloeckle)
    • bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (@wazum)
    • bug #63639 [ErrorHandler] "@method" deprecation notices are missing when interface inheritance is used (@mpdude)
    • bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (@nicolas-grekas)
    • bug #63629 Fix deprecation notices for "@method" annotations and classes with __call() (@mpdude)
    • bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (@nicolas-grekas)

    ❤️ Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Backend Symfony Developer at Travis International Road Services

    €3,800 – €4,500 / month - Remote + part-time onsite (Tilburg, Netherlands)

    Original source
  • Mar 31, 2026
    • Date parsed from source:
      Mar 31, 2026
    • First seen by Releasebot:
      Apr 1, 2026
    Symfony logo

    Symfony

    Symfony 7.4.8 released

    Symfony 7.4.8 ships with a broad set of bug fixes across DependencyInjection, Serializer, Cache, HttpClient, Messenger, TwigBridge, Dotenv, and more, improving stability, compatibility, and performance for Symfony projects.

    Symfony 7.4 is backed by:

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

    redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    Symfony 7.4.8 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 7.4.7

    • bug #63812 [DependencyInjection] Fix tagged_iterator/tagged_locator in array PHP config (@javiereguiluz)
    • bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (@nicolas-grekas)
    • bug #63817 [Serializer] Fix denormalization of nested array with key types (@mtarld)
    • bug #63782 [Serializer] Fix mixed-typed constructor parameters overriding getter-inferred type (@pcescon)
    • bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (@lyrixx)
    • bug #63806 [Ldap] Make the Adapter resettable (@kira0269, @nicolas-grekas)
    • bug #63720 [MonologBridge] Fix ConsoleHandler losing output after nested command terminates (@mp3000mp)
    • bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (@wazum)
    • bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (@pcescon)
    • bug #63683 [TwigBridge] Fix image method to use DataPart content ID (@pavelwitassek)
    • bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (@sn3mdev)
    • bug #63747 [Cache] Fix Psr16Cache::getMultiple() returning ValueWrapper with TagAwareAdapter (@pcescon)
    • bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (@pcescon)
    • bug #63777 [FrameworkBundle] Fix setting router.request_context.base_url when option default_uri is defined (@nicolas-grekas)
    • bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (@LachlanArthur)
    • bug #63726 [HttpClient] Unset push response content when the push handler is released (@sakozoko)
    • bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (@pcescon)
    • bug #63724 [HttpKernel] Fix allowing invalid #[Autowire] references in controller arguments (@valtzu)
    • bug #63722 [SecurityBundle] Fix profiler showing ERROR instead of DENIED (@audain-dg)
    • bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (@shyim)
    • bug #63648 [VarDumper] Wrong dumper output for Accept: aplication/json requests (@rfcdt)
    • bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (@nicolas-grekas)
    • bug #63676 [HttpKernel] Reset router locale to default when finishing main request (@guillaumeVDP)
    • bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (@andyexeter)
    • bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (@guillaumeVDP)
    • bug #63656 [Form] Fix typed property initialization in ValidatorExtension (@SeverinGloeckle)
    • bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (@wazum)
    • bug #63639 [ErrorHandler] "@method" deprecation notices are missing when interface inheritance is used (@mpdude)
    • bug #63627 [Serializer] Fix self type reference on promoted constructor parameter (@andersonamuller, @nicolas-grekas)
    • bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (@nicolas-grekas)
    • bug #63629 Fix deprecation notices for "@method" annotations and classes with __call() (@mpdude)
    • bug #63624 [JsonStreamer] Fix lazy instantiation for internal PHP classes (@Maxcastel)
    • bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (@nicolas-grekas)
    • bug #63611 [Process] Throw InvalidArgumentException when env block exceeds Windows limit (Nadim AL ABDOU)
    • bug #63616 [HttpKernel] Set propertyPath on MapUploadedFile validation violations (@eyupcanakman)

    ❤️ Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Backend Symfony Developer at ShipMonk

    View Symfony jobs →

    $5,000 – $8,000 / month - Full remote

    Original source
  • Mar 31, 2026
    • Date parsed from source:
      Mar 31, 2026
    • First seen by Releasebot:
      Apr 1, 2026
    Symfony logo

    Symfony

    Symfony 8.0.8 released

    Symfony ships 8.0.8 with a broad round of bug fixes across DependencyInjection, Serializer, Cache, HttpClient, Console, Twig, Messenger, and more, improving stability, compatibility, and developer experience in the latest 8.0 maintenance release.

    Symfony 8.0 is backed by:

    PhpStorm is a JetBrains IDE designed specifically for PHP development. Out of the box, PhpStorm provides you with intelligent, feature-rich code editing tailored to every aspect of PHP programming – smart coding assistance, reliable refactorings, instant code navigation, built-in developer tools, PHP framework support, and more.

    Sulu is the CMS for Symfony developers. It provides pre-built content-management features while giving developers the freedom to build, deploy, and maintain custom solutions using full-stack Symfony. Sulu is ideal for creating complex websites, integrating external tools, and building custom-built solutions.

    Symfony 8.0.8 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 8.0.7

    • bug #63812 [DependencyInjection] Fix tagged_iterator/tagged_locator in array PHP config (@javiereguiluz)
    • bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (@nicolas-grekas)
    • bug #63817 [Serializer] Fix denormalization of nested array with key types (@mtarld)
    • bug #63782 [Serializer] Fix mixed-typed constructor parameters overriding getter-inferred type (@pcescon)
    • bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (@lyrixx)
    • bug #63806 [Ldap] Make the Adapter resettable (@kira0269, @nicolas-grekas)
    • bug #63720 [MonologBridge] Fix ConsoleHandler losing output after nested command terminates (@mp3000mp)
    • bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (@wazum)
    • bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (@pcescon)
    • bug #63683 [TwigBridge] Fix image method to use DataPart content ID (@pavelwitassek)
    • bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (@sn3mdev)
    • bug #63747 [Cache] Fix Psr16Cache::getMultiple() returning ValueWrapper with TagAwareAdapter (@pcescon)
    • bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (@pcescon)
    • bug #63777 [FrameworkBundle] Fix setting router.request_context.base_url when option default_uri is defined (@nicolas-grekas)
    • bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (@LachlanArthur)
    • bug #63726 [HttpClient] Unset push response content when the push handler is released (@sakozoko)
    • bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (@pcescon)
    • bug #63724 [HttpKernel] Fix allowing invalid #[Autowire] references in controller arguments (@valtzu)
    • bug #63722 [SecurityBundle] Fix profiler showing ERROR instead of DENIED (@audain-dg)
    • bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (@shyim)
    • bug #63648 [VarDumper] Wrong dumper output for Accept: aplication/json requests (@rfcdt)
    • bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (@nicolas-grekas)
    • bug #63676 [HttpKernel] Reset router locale to default when finishing main request (@guillaumeVDP)
    • bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (@andyexeter)
    • bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (@guillaumeVDP)
    • bug #63656 [Form] Fix typed property initialization in ValidatorExtension (@SeverinGloeckle)
    • bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (@wazum)
    • bug #63639 [ErrorHandler] "@method" deprecation notices are missing when interface inheritance is used (@mpdude)
    • bug #63627 [Serializer] Fix self type reference on promoted constructor parameter (@andersonamuller, @nicolas-grekas)
    • bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (@nicolas-grekas)
    • bug #63629 Fix deprecation notices for "@method" annotations and classes with __call() (@mpdude)
    • bug #63624 [JsonStreamer] Fix lazy instantiation for internal PHP classes (@Maxcastel)
    • bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (@nicolas-grekas)
    • bug #63611 [Process] Throw InvalidArgumentException when env block exceeds Windows limit (Nadim AL ABDOU)
    • bug #63616 [HttpKernel] Set propertyPath on MapUploadedFile validation violations (@eyupcanakman)

    ❤️ Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Symfony Developer at Design Force Marketing

    View Symfony jobs →

    $60,000 – $100,000 / year - Grand Haven Michigan, United States

    Original source
  • Mar 18, 2026
    • Date parsed from source:
      Mar 18, 2026
    • First seen by Releasebot:
      Mar 18, 2026
    Symfony logo

    Symfony

    Twig 3.24.0 released

    Symfony releases Twig 3.24.0, introducing html_attr to simplify HTML attribute rendering with automatic merging and boolean handling, plus html_attr_relaxed for framework-friendly escaping. It also short-circuits null-safe chains and enables variable renaming in object destructuring, with a full changelog.

    Twig 3.24.0 has just been released with a major new feature for working with HTML attributes, improved null-safe operator behavior, and variable renaming in object destructuring.

    The html_attr function

    Building HTML attributes in templates has always been tedious: you need to handle escaping, conditional attributes, merging CSS classes, and boolean attributes like disabled or required. The new html_attr function takes care of all of that:

    < div {{ html_attr({class: ['btn', 'btn-primary'], id: 'submit'}) }} > Click me </ div>
    

    {# Output:

    Click me #}

    The function accepts multiple attribute maps, merging them automatically. Boolean values, null, and aria-*/data-* attributes are handled with sensible defaults: false and null omit the attribute, true prints the attribute with an empty value, and aria-* attributes render "true"/"false" strings as expected by the spec:

    {%
    set base = {class: ['btn']} %}
    {%
    set variant = {class: ['btn-primary'], disabled: true} %}
    < button {{ html_attr(base, variant) }} > Submit </ button >
    

    {# Output: Submit #}

    Two companion filters are also available: html_attr_merge to merge attribute maps without rendering them, and html_attr_type to handle multi-valued attributes like comma-separated srcset or sizes (thanks to @mpdude and @polarbirke).

    See #3930.

    The html_attr_relaxed escaping strategy

    Some front-end frameworks like Vue.js use special characters in attribute names: :checked, @click, v-bind:[prop]. The standard html_attr escaping strategy encodes these characters, breaking the framework integration. The new html_attr_relaxed strategy keeps :, @, [, and ] unescaped while still protecting against injection:

    < input {{ html_attr({':disabled': 'isLoading', '@input': 'validate'})|e('html_attr_relaxed') }} >
    

    {# Output: <input :disabled="isLoading" @input="validate"> #}

    This strategy is also used internally by the html_attr function for attribute names (thanks to @mpdude).

    See #4743.

    Short-circuiting in null-safe operator chains

    The null-safe operator (?.) now properly short-circuit the entire chain when null is encountered, matching the behavior of PHP, Symfony PropertyAccess, and the ExpressionLanguage component. Previously, only the immediate access was guarded, so user?.address.city would still try to access .city on the null result. Now, the rest of the chain is skipped:

    {{ user?.address.city }}
    

    {# Returns null if user is null; address.city is not evaluated #}

    This makes null-safe chains much safer and more predictable (thanks to @HypeMC).

    See #4748.

    Renaming variables in object destructuring

    Object destructuring, introduced in Twig 3.23, now supports renaming variables using the key: variable syntax. The key is the property to extract, and the variable is the local name to assign it to, just like JavaScript:

    {%
    do {name: userName, email: userEmail} = user %}
    

    {{ userName }}

    {# user.name #}

    {{ userEmail }}

    {# user.email #}

    This is especially useful when destructuring multiple objects that share the same property names:

    {%
    do {data: product, error: productError} = loadProduct() %}
    
    {%
    do {data: stock, error: stockError} = loadStock() %}
    

    See #4759.

    Full Changelog

    • Add an html_attr function to make outputting HTML attributes easier (@mpdude, @polarbirke)
    • Fix null coalescing operator with imported macros (@fabpot)
    • Add getOperatorTokens() to ExpressionParserInterface to separate operator token registration from parser identity (@fabpot)
    • Ensure filters/attributes aren't mistaken for operators (@brandonkelly)
    • Deprecate passing non AbstractExpression nodes to MatchesBinary (@fabpot)
    • Deprecate passing a non-AbstractExpression node to Parser::setParent() (@fabpot)
    • Add support for renaming variables in object destructuring (@fabpot)
    • Support short-circuiting in null-safe operator chains (@HypeMC)
    • Add html_attr_relaxed escaping strategy (@mpdude)
    Original source
  • Mar 6, 2026
    • Date parsed from source:
      Mar 6, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 6.4.35 released

    Symfony announces the release of Symfony 6.4.35 with a set of bug fixes since 6.4.34 and provides upgrade guidance via the upgrade guide and SymfonyInsight reports. It also nudges readers to subscribe to Roadmap Notifications for release updates.

    Symfony 6.4 is backed by:

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    Symfony 6.4.35 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 6.4.34

    • bug #63604 Fix ApplicationTester ignoring interactive and verbosity options when SHELL_VERBOSITY is set (@nicolas-grekas)
    • bug #63602 Fix denormalization of magic __set properties (@nicolas-grekas)
    • bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)
    • bug #63598 Add 'sms' to hostless schemes (@hivokas)
    • bug #63592 Add timeout and slot eviction to LockRegistry stampede prevention (@nicolas-grekas)
    • bug #63570 Fix OUTPUT_RAW corrupting binary content on Windows (@guillaumeVDP)
    • bug #63584 Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (@nicolas-grekas)
    • bug #63574 Fix stale container after reboot in KernelTestCase (@nicolas-grekas)
    • bug #63572 Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (@nicolas-grekas)
    • bug #63568 Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (@nicolas-grekas)
    • bug #63555 Fix int-to-float coercion for JSON # with pre-parsed array data (@eyupcanakman)
    • bug #63559 Flush batch handlers after inactivity timeout when worker is busy (@nicolas-grekas)
    • bug #63523 Fix inline attachments with custom Content-ID (@99Vicky)
    • bug #63550 Prevent negative token from causing integer underflow (@jhogervorst)
    • bug #63526 Fix Symfony web debug toolbar not being displayed (@zoglo)
    • bug #63500 Consider PSR-0/PSR-4 fallback dirs when building paths (@mpdude)
    • bug #63533 gracefully handle the kernel.runtime_mode.web parameter missing (@xabbuh)
    • bug #63534 Regex bypass when match is false with too big input (@vincent4vx)
    • bug #63496 Defer variable and command expansion to account for overrides from subsequent .env files (@nicolas-grekas)
    • bug #63506 Fix TypeError when using a custom container base class with typed $parameterBag (@nicolas-grekas)

    ❤️
    Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Backend Symfony Developer at Finviu AG
    View Symfony jobs →

    €35 – €50 / hour - Full remote

    Original source
  • Mar 6, 2026
    • Date parsed from source:
      Mar 6, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 7.4.7 released

    Symfony unveils Symfony 7.4.7 with upgrade guidance and insights to detect code changes, plus a detailed 7.4.6 changelog showing many bug fixes across tests, sessions, caching, and tooling. The note also promotes roadmap notifications and partner services for ecosystem support.

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

    Symfony 7.4.7 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 7.4.6

    • bug #63604 Fix ApplicationTester ignoring interactive and verbosity options when SHELL_VERBOSITY is set (@nicolas-grekas)
    • bug #63602 Fix denormalization of magic __set properties (@nicolas-grekas)
    • bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)
    • bug #63598 Add 'sms' to hostless schemes (@hivokas)
    • bug #63599 Fix required options check when extending a constraint with a simplified constructor (@nicolas-grekas)
    • bug #63592 Add timeout and slot eviction to LockRegistry stampede prevention (@nicolas-grekas)
    • bug #63591 Fix when constraint without expression language installed, when using closure expression (@annadamm-check24)
    • bug #63589 Fix session data contamination by non-serializable objects in form flow (@nicolas-grekas)
    • bug #63570 Fix OUTPUT_RAW corrupting binary content on Windows (@guillaumeVDP)
    • bug #63584 Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (@nicolas-grekas)
    • bug #63583 Rename schema_subscriber_check table to schema_subscriber_check for Oracle compatibility (@moneire)
    • bug #63573 Fix CachingHttpClient compatibility with decorator clients on 304 responses (@nicolas-grekas)
    • bug #63574 Fix stale container after reboot in KernelTestCase (@nicolas-grekas)
    • bug #63572 Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (@nicolas-grekas)
    • bug #63568 Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (@nicolas-grekas)
    • bug #63555 Fix int-to-float coercion for JSON # with pre-parsed array data (@eyupcanakman)
    • bug #63559 Flush batch handlers after inactivity timeout when worker is busy (@nicolas-grekas)
    • bug #63563 Fix StringTypeResolver calling Type::enum() on interfaces extending BackedEnum (@gnutix)
    • bug #63547 Fix nullable array constructor parameter overriding collection value type (@nicolas-grekas)
    • bug #63523 Fix inline attachments with custom Content-ID (@99Vicky)
    • bug #63550 Prevent negative token from causing integer underflow (@jhogervorst)
    • bug #63542 Fix resolving class const type (@gharlan)
    • bug #63510 fix is/can/has type resolver on method without property (@Guilain)
    • bug #63522 Fix SweegoTransport by allowing bool values (@qdequippe)
    • bug #63526 Fix Symfony web debug toolbar not being displayed (@zoglo)
    • bug #63500 Consider PSR-0/PSR-4 fallback dirs when building paths (@mpdude)
    • bug #63508 Handle Stringable for string-typed arguments in CheckTypeDeclarationsPass (@yoeunes)
    • bug #63509 Fix missing generator for shared types in self-referencing objects (@mtarld)
    • bug #63533 gracefully handle the kernel.runtime_mode.web parameter missing (@xabbuh)
    • bug #63534 Regex bypass when match is false with too big input (@vincent4vx)
    • bug #63496 Defer variable and command expansion to account for overrides from subsequent .env files (@nicolas-grekas)
    • bug #63506 Fix TypeError when using a custom container base class with typed $parameterBag (@nicolas-grekas)

    Published in #Releases

    ❤️
    Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Symfony Developer at Paystone
    View Symfony jobs →

    CA$75,000 – CA$100,000 / year - Full remote

    Original source
  • Mar 6, 2026
    • Date parsed from source:
      Mar 6, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 8.0.7 released

    Symfony releases 8.0.7 with a focused set of fixes and stability improvements, backed by upgrade guidance and roadmap notifications. The changelog highlights numerous bug fixes across components and a clear path to upgrading from 8.0.6, helping developers tighten security and reliability.

    Symfony 8.0 is backed by:

    PhpStorm is a JetBrains IDE designed specifically for PHP development. Out of the box, PhpStorm provides you with intelligent, feature-rich code editing tailored to every aspect of PHP programming – smart coding assistance, reliable refactorings, instant code navigation, built-in developer tools, PHP framework support, and more.

    Sulu is the CMS for Symfony developers. It provides pre-built content-management features while giving developers the freedom to build, deploy, and maintain custom solutions using full-stack Symfony. Sulu is ideal for creating complex websites, integrating external tools, and building custom-built solutions.

    Symfony 8.0.7 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 8.0.6

    • bug #63604 Fix ApplicationTester ignoring interactive and verbosity options when SHELL_VERBOSITY is set (@nicolas-grekas)
    • bug #63602 Fix denormalization of magic __set properties (@nicolas-grekas)
    • bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)
    • bug #63598 Add 'sms' to hostless schemes (@hivokas)
    • bug #63599 Fix required options check when extending a constraint with a simplified constructor (@nicolas-grekas)
    • bug #63592 Add timeout and slot eviction to LockRegistry stampede prevention (@nicolas-grekas)
    • bug #63591 Fix when constraint without expression language installed, when using closure expression (@annadamm-check24)
    • bug #63589 Fix session data contamination by non-serializable objects in form flow (@nicolas-grekas)
    • bug #63570 Fix OUTPUT_RAW corrupting binary content on Windows (@guillaumeVDP)
    • bug #63584 Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (@nicolas-grekas)
    • bug #63583 Rename schema_subscriber_check table to schema_subscriber_check for Oracle compatibility (@moneire)
    • bug #63573 Fix CachingHttpClient compatibility with decorator clients on 304 responses (@nicolas-grekas)
    • bug #63574 Fix stale container after reboot in KernelTestCase (@nicolas-grekas)
    • bug #63572 Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (@nicolas-grekas)
    • bug #63568 Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (@nicolas-grekas)
    • bug #63555 Fix int-to-float coercion for JSON # with pre-parsed array data (@eyupcanakman)
    • bug #63559 Flush batch handlers after inactivity timeout when worker is busy (@nicolas-grekas)
    • bug #63563 Fix StringTypeResolver calling Type::enum() on interfaces extending BackedEnum (@gnutix)
    • bug #63547 Fix nullable array constructor parameter overriding collection value type (@nicolas-grekas)
    • bug #63523 Fix inline attachments with custom Content-ID (@99Vicky)
    • bug #63550 Prevent negative token from causing integer underflow (@jhogervorst)
    • bug #63542 Fix resolving class const type (@gharlan)
    • bug #63510 fix is/can/has type resolver on method without property (@Guilain)
    • bug #63522 Fix SweegoTransport by allowing bool values (@qdequippe)
    • bug #63526 Fix Symfony web debug toolbar not being displayed (@zoglo)
    • bug #63500 Consider PSR-0/PSR-4 fallback dirs when building paths (@mpdude)
    • bug #63508 Handle Stringable for string-typed arguments in CheckTypeDeclarationsPass (@yoeunes)
    • bug #63509 Fix missing generator for shared types in self-referencing objects (@mtarld)
    • bug #63533 gracefully handle the kernel.runtime_mode.web parameter missing (@xabbuh)
    • bug #63534 Regex bypass when match is false with too big input (@vincent4vx)
    • bug #63496 Defer variable and command expansion to account for overrides from subsequent .env files (@nicolas-grekas)
    • bug #63506 Fix TypeError when using a custom container base class with typed $parameterBag (@nicolas-grekas)

    Published in #Releases

    ❤️
    Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    Original source
  • Feb 26, 2026
    • Date parsed from source:
      Feb 26, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 6.4.34 released

    Symfony announces the 6.4.34 release with upgrade guidance and upgrade reports. The note highlights a long list of bug fixes across token handling, reservations, forms, validation, and environment handling, plus roadmap notifications for staying updated.

    Symfony 6.4 is backed by:

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    Symfony 6.4.34 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 6.4.33

    • bug #63492 Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (@ERuban)
    • bug #63491 Fix retryAfter when consuming exactly all remaining tokens in SlidingWindow (@ERuban)
    • bug #52413 Fix reservations outside the second fixed window (@SanderSander)
    • bug #57392 Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (@antten)
    • bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@NeilPeyssard)
    • bug #47424 makePathRelative with existing files, remove ending / (Petar Marjanovic)
    • bug #52083 Don't use retry routing key when sending to failure transport (Fabien Perroquin)
    • bug #63275 Fix re-sending failed messages to a different failure transport (@bartholdbos)
    • bug #63473 Fix PriorityTaggedServiceTrait not discovering # on decorated services (@lacatoire)
    • bug #63472 Fix Bootstrap 4 form errors rendered inside (@asispts)
    • bug #54324 Fix merging POST params and files when collection entries have mismatched indices (@priyadi)
    • bug #52722 Fix type error for non-array items when Unique::fields is set (@aprat84)
    • bug #54703 Fix default locale ignored when Accept-Language has no enabled-locale match (@karimmorel)
    • bug #62681 Make ConfigDebugCommand use its container to resolve env vars (@MatTheCat)
    • bug #47432 Fix various completion edge cases (@Seldaek)
    • bug #63450 Fix missing resource tracking for type extensions in FormPass (@ranpafin)
    • bug #63454 Fix lazy firewall triggering remember me authentication on POST requests to public routes (@nicolas-grekas)
    • bug #63460 Implement missing reset() method in TraceableWorkflow (@santysisi)
    • bug #63456 Fix validator exception masked by MissingInputException on empty input (@nicolas-grekas)
    • bug #63428 Fix handling of constructor enum denormalization errors (@vvaswani)
    • bug #63438 ProgressIndicator console helper display with multiple processes (@guillaumeVDP)
    • bug #63436 Silence shell_exec warning in hasSttyAvailable (@lacatoire)
    • bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
    • bug #63437 Wrap DoctrineDbalAdapter::doSave() in savepoint to prevent transaction poisoning (@lacatoire)
    • bug #63405 Fix passing context option to property-info (@nicolas-grekas)
    • bug #63400 Fix memory exhaustion by adding an LRU cache to CssSelectorConverter (@arcangelini)
    • bug #63386 Handle invalid backed-enum values gracefully in RequestPayloadValueResolver (@nicolas-grekas)
    • bug #63384 fail gracefully when the semaphore config is used but the component is missing (@xabbuh)
    • bug #63379 Prevent false unused-env errors for abstract definitions removed at compile time (@nicolas-grekas)
    • bug #63344 Prioritize property type over is/has/can accessors (@nicolas-grekas)
    • bug #63353 Fix comparison validator crash on extreme dates (@lacatoire)
    • bug #63351 Fix SymfonyStyle block output with \r\n line endings (@lacatoire)
    • bug #63342 fix union with mixed handling for the legacy PropertyInfo Type (@xabbuh)
    • bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
    • bug #63307 Fix stale binding lookup in ResolveBindingsPass error message (@yoeunes)
    • bug #63317 Fix JsonManifestVersionStrategy exception on missing manifest in non-strict mode (@claude)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #57292 Fix parsing nested mappings in sequences (@HypeMC)
    • bug #63306 Revert "Fix DSN auth not passed to clusters in RedisTrait" (@nicolas-grekas)
    • bug #63272 Fix forwarding SSL settings to the redis sentinel (@CientistaDaWeb)
    • bug #63288 Optimize serialized size of ErrorDetailsStamp (@nicolas-grekas)
    • bug #63292 Fix AMQP heartbeat reconnection during in-flight message handling (@wazum)
    • bug #63278 Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (@mwijngaard)
    • bug #63282 Revert batch processing fix (@HypeMC)
    • bug #63259 Fix BrowserKitAssertionsTrait compatibility with HttpBrowser (@thiagomp)
    • bug #63281 Treat emoji VS16 as wide in width calc (@fabpot)
    • bug #63279 Normalize static methods when they have groups (@digilist)
    • bug #62970 Fix hot reload support (FrankenPHP) (@dunglas)
    • bug #63271 Respect schema_filter in schema listeners (@wazum)
    • bug #63262 Reject invalid paths (@nicolas-grekas)
    • bug #58460 Fix destructor throwing while timeout was handled (@Seldaek, @nicolas-grekas)
    • bug #63255 Add missing useAttributeAsKey calls (@MatTheCat)
    • bug #57561 Fix ignore invalid_reference behavior param for the some services (@Nguyen26052004)
    • bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
    • bug #63238 Fall back to 0 when getCode() does not provide an integer (@makomweb)
    • bug #63239 Fix accessing the test container when using KernelTestCase in non-debug mode (@nicolas-grekas)
    • bug #58433 Avoid skipping batch handlers on flush (Erwin Houtsma)
    • bug #63234 Fix parsing Target attributes on properties and on controllers (@nicolas-grekas)
    • bug #63231 Fix for Crowdin Translation File Replaced with Partial Data When Pushing Default Locale Without --force (@bhdnb)
    • bug #63226 Fix calling nack() when ack() fails (@nicolas-grekas)
    • bug #63230 fix engine declaration on mysql pdo table creations (@tandev)
    • bug #63225 Fix SortableIterator inadvertently and inconsistently deduplicating appended iterators (@nicolas-grekas)
    Original source
  • Feb 26, 2026
    • Date parsed from source:
      Feb 26, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 7.4.6 released

    Symfony announces the 7.4.6 release with upgrade guidance and SymfonyInsight upgrade reports, plus a detailed changelog of numerous bug fixes across the framework. It signals a real shipped update and provides tools to stay informed on maintenance and upgrades.

    Symfony 7.4 is backed by:

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

    JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

    Symfony 7.4.6 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 7.4.5

    • bug #63492 Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (@ERuban)
    • bug #63491 Fix retryAfter when consuming exactly all remaining tokens in SlidingWindow (@ERuban)
    • bug #52413 Fix reservations outside the second fixed window (@SanderSander)
    • bug #57392 Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (@antten)
    • bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@NeilPeyssard)
    • bug #47424 makePathRelative with existing files, remove ending / (Petar Marjanovic)
    • bug #52083 Don't use retry routing key when sending to failure transport (Fabien Perroquin)
    • bug #63275 Fix re-sending failed messages to a different failure transport (@bartholdbos)
    • bug #63478 Fix ArrayShapeGenerator required keys with deep merging (@lacatoire)
    • bug #63476 Correctly handle null allowedVariables in ExpressionSyntaxValidator (@alexandre-daubois)
    • bug #63473 Fix PriorityTaggedServiceTrait not discovering # on decorated services (@lacatoire)
    • bug #63446 fix nested mapping with class-level transform (Thibaut Cholley)
    • bug #63472 Fix Bootstrap 4 form errors rendered inside (@asispts)
    • bug #54324 Fix merging POST params and files when collection entries have mismatched indices (@priyadi)
    • bug #52722 Fix type error for non-array items when Unique::fields is set (@aprat84)
    • bug #54703 Fix default locale ignored when Accept-Language has no enabled-locale match (@karimmorel)
    • bug #62681 Make ConfigDebugCommand use its container to resolve env vars (@MatTheCat)
    • bug #47432 Fix various completion edge cases (@Seldaek)
    • bug #60662 assign attribute aliases to localized route if applicable (@alcohol)
    • bug #63463 Fix required options not validated when constructor calls parent with null (@lacatoire)
    • bug #63468 Fix webhook rejection by switching to form-encoded request parsing (@nicolas-grekas)
    • bug #63450 Fix missing resource tracking for type extensions in FormPass (@ranpafin)
    • bug #63435 Fix handling postal transport apikey (@MarcHagen)
    • bug #63462 Fix phpstan false-positive about config/reference.php (@nicolas-grekas)
    • bug #63454 Fix lazy firewall triggering remember me authentication on POST requests to public routes (@nicolas-grekas)
    • bug #63460 Implement missing reset() method in TraceableWorkflow (@santysisi)
    • bug #63456 Fix validator exception masked by MissingInputException on empty input (@nicolas-grekas)
    • bug #63444 Fix arguments set via # wrongly considered null in profiler (@chalasr)
    • bug #63439 Update security-1.0.xsd with missing oauth2 element (@welcoMattic)
    • bug #63428 Fix handling of constructor enum denormalization errors (@vvaswani)
    • bug #63438 ProgressIndicator console helper display with multiple processes (@guillaumeVDP)
    • bug #63436 Silence shell_exec warning in hasSttyAvailable (@lacatoire)
    • bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
    • bug #63437 Wrap DoctrineDbalAdapter::doSave() in savepoint to prevent transaction poisoning (@lacatoire)
    • bug #63416 TypeContextFactory::collectTemplates now also works with @phpstan-template and @psalm-template (@TomasLudvik)
    • bug #63415 Fix profiling commands that use # (@chalasr)
    • bug #63401 Fix constructor parameter type override when property type extractor returns a different type (@nicolas-grekas)
    • bug #63405 Fix passing context option to property-info (@nicolas-grekas)
    • bug #63400 Fix memory exhaustion by adding an LRU cache to CssSelectorConverter (@arcangelini)
    • bug #63391 Align Redis sentinel auth handling across components (@nicolas-grekas)
    • bug #62738 Fix template key-type for array (@DjordyKoert)
    • bug #63386 Handle invalid backed-enum values gracefully in RequestPayloadValueResolver (@nicolas-grekas)
    • bug #63384 fail gracefully when the semaphore config is used but the component is missing (@xabbuh)
    • bug #63380 Use mutable datetime columns in Doctrine transport schema (@nicolas-grekas)
    • bug #63379 Prevent false unused-env errors for abstract definitions removed at compile time (@nicolas-grekas)
    • bug #63375 prioritize property type over is/has/can accessors (@xabbuh)
    • bug #63372 Use SYMFONY_DOTENV_PATH variable when dumping dotenv (@Spea)
    • bug #63344 Prioritize property type over is/has/can accessors (@nicolas-grekas)
    • bug #63368 Fix ProgressBar remaining and estimated placeholder guards (@yoeunes)
    • bug #63363 Fix variadic argument handling with # (@nicolas-grekas)
    • bug #63353 Fix comparison validator crash on extreme dates (@lacatoire)
    • bug #63354 Fix invalid encoding of custom headers in SES API (@lacatoire)
    • bug #63349 Fix AbstractComparison deprecation triggered for array values (@lacatoire)
    • bug #63351 Fix SymfonyStyle block output with \r\n line endings (@lacatoire)
    • bug #63342 fix union with mixed handling for the legacy PropertyInfo Type (@xabbuh)
    • bug #59540 Fix support for inline @var docblocks on promoted properties (@wuchen90)
    • bug #63247 Skip source mapping attempts when target class condition evaluates to false (@rrajkomar)
    • bug #63333 Fix JsonStreamer forward compatibility (@mtarld)
    • bug #63264 Also bypass Sender header within MicrosoftGraphApiTransport (@deeky666)
    • bug #63330 Fix nested union null type detection in TypeFactoryTrait::union() (@yoeunes)
    • bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
    • bug #63329 Fix ArrayShapeType::getExtraValueType() return value (@yoeunes)
    • bug #63309 Fix swapped workflow/transition names in WorkflowValidator (@yoeunes)
    • bug #63315 Fix EventSource is missing static properties (Oleksii Kozhemiaka)
    • bug #63307 Fix stale binding lookup in ResolveBindingsPass error message (@yoeunes)
    • bug #63317 Fix JsonManifestVersionStrategy exception on missing manifest in non-strict mode (@claude)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #57292 Fix parsing nested mappings in sequences (@HypeMC)
    • bug #63294 Fix DateTime handling in union types (@mtarld)
    • bug #63305 Fix autoconfiguring controllers using legacy Route annotations as attributes (@nicolas-grekas)
    • bug #63306 Revert "Fix DSN auth not passed to clusters in RedisTrait" (@nicolas-grekas)
    • bug #63272 Fix forwarding SSL settings to the redis sentinel (@CientistaDaWeb)
    • bug #63288 Optimize serialized size of ErrorDetailsStamp (@nicolas-grekas)
    • bug #63292 Fix AMQP heartbeat reconnection during in-flight message handling (@wazum)
    • bug #63291 Fix composite node provider arguments in stream mode (@mtarld)
    • bug #63289 Fix union with mixed handling (@mtarld)
    • bug #63278 Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (@mwijngaard)
    • bug #63282 Revert batch processing fix (@HypeMC)
    • bug #63259 Fix BrowserKitAssertionsTrait compatibility with HttpBrowser (@thiagomp)
    • bug #63281 Treat emoji VS16 as wide in width calc (@fabpot)
    • bug #63279 Normalize static methods when they have groups (@digilist)
    • bug #62970 Fix hot reload support (FrankenPHP) (@dunglas)
    • bug #63271 Respect schema_filter in schema listeners (@wazum)
    • bug #63235 phpdocumentor/reflection-docblock 6 compatibility (@mtarld)
    • bug #63262 Reject invalid paths (@nicolas-grekas)
    • bug #58460 Fix destructor throwing while timeout was handled (@Seldaek, @nicolas-grekas)
    • bug #63260 Fix handling empty MapUploadedFile arrays (@nicolas-grekas)
    • bug #63255 Add missing useAttributeAsKey calls (@MatTheCat)
    • bug #57561 Fix ignore invalid_reference behavior param for the some services (@Nguyen26052004)
    • bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
    • bug #63101 Bypass mapping construction when RedirectController::urlRedirectAction is triggered (@florianorineveu)
    • bug #63238 Fall back to 0 when getCode() does not provide an integer (@makomweb)
    • bug #63239 Fix accessing the test container when using KernelTestCase in non-debug mode (@nicolas-grekas)
    • bug #58433 Avoid skipping batch handlers on flush (Erwin Houtsma)
    • bug #63236 Fix clearing the HttpCache store in tests (@nicolas-grekas)
    • bug #63234 Fix parsing Target attributes on properties and on controllers (@nicolas-grekas)
    • bug #63231 Fix for Crowdin Translation File Replaced with Partial Data When Pushing Default Locale Without --force (@bhdnb)
    • bug #63226 Fix calling nack() when ack() fails (@nicolas-grekas)
    • bug #63230 fix engine declaration on mysql pdo table creations (@tandev)
    • bug #63225 Fix SortableIterator inadvertently and inconsistently deduplicating appended iterators (@nicolas-grekas)
    Original source
  • Feb 26, 2026
    • Date parsed from source:
      Feb 26, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 8.0.6 released

    Symfony announces a new patch release 8.0.6 with upgrade guidance and an extensive changelog. Backed by Sulu CMS and PhpStorm tooling, the note emphasizes stability, maintenance and upgrade paths for developers.

    Symfony 8.0 is backed by:

    Sulu is the CMS for Symfony developers. It provides pre-built content-management features while giving developers the freedom to build, deploy, and maintain custom solutions using full-stack Symfony. Sulu is ideal for creating complex websites, integrating external tools, and building custom-built solutions.

    PhpStorm is a JetBrains IDE designed specifically for PHP development. Out of the box, PhpStorm provides you with intelligent, feature-rich code editing tailored to every aspect of PHP programming – smart coding assistance, reliable refactorings, instant code navigation, built-in developer tools, PHP framework support, and more.

    Symfony 8.0.6 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 8.0.5

    • bug #63492 Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (@ERuban)
    • bug #63491 Fix retryAfter when consuming exactly all remaining tokens in SlidingWindow (@ERuban)
    • bug #52413 Fix reservations outside the second fixed window (@SanderSander)
    • bug #57392 Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (@antten)
    • bug #54236 Fix exclude option being ignored for non-glob and PSR-4 resources (@NeilPeyssard)
    • bug #47424 makePathRelative with existing files, remove ending / (Petar Marjanovic)
    • bug #52083 Don't use retry routing key when sending to failure transport (Fabien Perroquin)
    • bug #63275 Fix re-sending failed messages to a different failure transport (@bartholdbos)
    • bug #63478 Fix ArrayShapeGenerator required keys with deep merging (@lacatoire)
    • bug #63476 Correctly handle null allowedVariables in ExpressionSyntaxValidator (@alexandre-daubois)
    • bug #63473 Fix PriorityTaggedServiceTrait not discovering # on decorated services (@lacatoire)
    • bug #63446 fix nested mapping with class-level transform (Thibaut Cholley)
    • bug #63472 Fix Bootstrap 4 form errors rendered inside (@asispts)
    • bug #54324 Fix merging POST params and files when collection entries have mismatched indices (@priyadi)
    • bug #52722 Fix type error for non-array items when Unique::fields is set (@aprat84)
    • bug #54703 Fix default locale ignored when Accept-Language has no enabled-locale match (@karimmorel)
    • bug #62681 Make ConfigDebugCommand use its container to resolve env vars (@MatTheCat)
    • bug #47432 Fix various completion edge cases (@Seldaek)
    • bug #60662 assign attribute aliases to localized route if applicable (@alcohol)
    • bug #63463 Fix required options not validated when constructor calls parent with null (@lacatoire)
    • bug #63468 Fix webhook rejection by switching to form-encoded request parsing (@nicolas-grekas)
    • bug #63450 Fix missing resource tracking for type extensions in FormPass (@ranpafin)
    • bug #63435 Fix handling postal transport apikey (@MarcHagen)
    • bug #63462 Fix phpstan false-positive about config/reference.php (@nicolas-grekas)
    • bug #63454 Fix lazy firewall triggering remember me authentication on POST requests to public routes (@nicolas-grekas)
    • bug #63460 Implement missing reset() method in TraceableWorkflow (@santysisi)
    • bug #63456 Fix validator exception masked by MissingInputException on empty input (@nicolas-grekas)
    • bug #63444 Fix arguments set via # wrongly considered null in profiler (@chalasr)
    • bug #63439 Update security-1.0.xsd with missing oauth2 element (@welcoMattic)
    • bug #63428 Fix handling of constructor enum denormalization errors (@vvaswani)
    • bug #63438 ProgressIndicator console helper display with multiple processes (@guillaumeVDP)
    • bug #63436 Silence shell_exec warning in hasSttyAvailable (@lacatoire)
    • bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
    • bug #63437 Wrap DoctrineDbalAdapter::doSave() in savepoint to prevent transaction poisoning (@lacatoire)
    • bug #63416 TypeContextFactory::collectTemplates now also works with @phpstan-template and @psalm-template (@TomasLudvik)
    • bug #63415 Fix profiling commands that use # (@chalasr)
    • bug #63401 Fix constructor parameter type override when property type extractor returns a different type (@nicolas-grekas)
    • bug #63405 Fix passing context option to property-info (@nicolas-grekas)
    • bug #63400 Fix memory exhaustion by adding an LRU cache to CssSelectorConverter (@arcangelini)
    • bug #63391 Align Redis sentinel auth handling across components (@nicolas-grekas)
    • bug #62738 Fix template key-type for array (@DjordyKoert)
    • bug #63386 Handle invalid backed-enum values gracefully in RequestPayloadValueResolver (@nicolas-grekas)
    • bug #63384 fail gracefully when the semaphore config is used but the component is missing (@xabbuh)
    • bug #63380 Use mutable datetime columns in Doctrine transport schema (@nicolas-grekas)
    • bug #63379 Prevent false unused-env errors for abstract definitions removed at compile time (@nicolas-grekas)
    • bug #63375 prioritize property type over is/has/can accessors (@xabbuh)
    • bug #63372 Use SYMFONY_DOTENV_PATH variable when dumping dotenv (@Spea)
    • bug #63344 Prioritize property type over is/has/can accessors (@nicolas-grekas)
    • bug #63368 Fix ProgressBar remaining and estimated placeholder guards (@yoeunes)
    • bug #63363 Fix variadic argument handling with # (@nicolas-grekas)
    • bug #63353 Fix comparison validator crash on extreme dates (@lacatoire)
    • bug #63354 Fix invalid encoding of custom headers in SES API (@lacatoire)
    • bug #63349 Fix AbstractComparison deprecation triggered for array values (@lacatoire)
    • bug #63351 Fix SymfonyStyle block output with \r\n line endings (@lacatoire)
    • bug #63342 fix union with mixed handling for the legacy PropertyInfo Type (@xabbuh)
    • bug #59540 Fix support for inline @var docblocks on promoted properties (@wuchen90)
    • bug #63247 Skip source mapping attempts when target class condition evaluates to false (@rrajkomar)
    • bug #63333 Fix JsonStreamer forward compatibility (@mtarld)
    • bug #63264 Also bypass Sender header within MicrosoftGraphApiTransport (@deeky666)
    • bug #63330 Fix nested union null type detection in TypeFactoryTrait::union() (@yoeunes)
    • bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
    • bug #63329 Fix ArrayShapeType::getExtraValueType() return value (@yoeunes)
    • bug #63309 Fix swapped workflow/transition names in WorkflowValidator (@yoeunes)
    • bug #63315 Fix EventSource is missing static properties (Oleksii Kozhemiaka)
    • bug #63307 Fix stale binding lookup in ResolveBindingsPass error message (@yoeunes)
    • bug #63317 Fix JsonManifestVersionStrategy exception on missing manifest in non-strict mode (@claude)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #63324 Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (@ckrack)
    • bug #57292 Fix parsing nested mappings in sequences (@HypeMC)
    • bug #63294 Fix DateTime handling in union types (@mtarld)
    • bug #63305 Fix autoconfiguring controllers using legacy Route annotations as attributes (@nicolas-grekas)
    • bug #63306 Revert "Fix DSN auth not passed to clusters in RedisTrait" (@nicolas-grekas)
    • bug #63272 Fix forwarding SSL settings to the redis sentinel (@CientistaDaWeb)
    • bug #63288 Optimize serialized size of ErrorDetailsStamp (@nicolas-grekas)
    • bug #63292 Fix AMQP heartbeat reconnection during in-flight message handling (@wazum)
    • bug #63291 Fix composite node provider arguments in stream mode (@mtarld)
    • bug #63289 Fix union with mixed handling (@mtarld)
    • bug #63278 Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (@mwijngaard)
    • bug #63282 Revert batch processing fix (@HypeMC)
    • bug #63259 Fix BrowserKitAssertionsTrait compatibility with HttpBrowser (@thiagomp)
    • bug #63281 Treat emoji VS16 as wide in width calc (@fabpot)
    • bug #63279 Normalize static methods when they have groups (@digilist)
    • bug #62970 Fix hot reload support (FrankenPHP) (@dunglas)
    • bug #63271 Respect schema_filter in schema listeners (@wazum)
    • bug #63235 phpdocumentor/reflection-docblock 6 compatibility (@mtarld)
    • bug #63262 Reject invalid paths (@nicolas-grekas)
    • bug #58460 Fix destructor throwing while timeout was handled (@Seldaek, @nicolas-grekas)
    • bug #63260 Fix handling empty MapUploadedFile arrays (@nicolas-grekas)
    • bug #63255 Add missing useAttributeAsKey calls (@MatTheCat)
    • bug #57561 Fix ignore invalid_reference behavior param for the some services (@Nguyen26052004)
    • bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
    • bug #63101 Bypass mapping construction when RedirectController::urlRedirectAction is triggered (@florianorineveu)
    • bug #63238 Fall back to 0 when getCode() does not provide an integer (@makomweb)
    • bug #63239 Fix accessing the test container when using KernelTestCase in non-debug mode (@nicolas-grekas)
    • bug #58433 Avoid skipping batch handlers on flush (Erwin Houtsma)
    • bug #63236 Fix clearing the HttpCache store in tests (@nicolas-grekas)
    • bug #63234 Fix parsing Target attributes on properties and on controllers (@nicolas-grekas)
    • bug #63231 Fix for Crowdin Translation File Replaced with Partial Data When Pushing Default Locale Without --force (@bhdnb)
    • bug #63226 Fix calling nack() when ack() fails (@nicolas-grekas)
    • bug #63230 fix engine declaration on mysql pdo table creations (@tandev)
    • bug #63225 Fix SortableIterator inadvertently and inconsistently deduplicating appended iterators (@nicolas-grekas)
    Original source
  • Jan 28, 2026
    • Date parsed from source:
      Jan 28, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 6.4.33 released

    Symfony 6.4.33 is released with an upgrade guide and upgrade reports. The changelog lists fixes for streams with CurlHttpClient, DocBlock resolution, PdoSessionHandler charset, AsyncResponse decoration, and Windows MSYS escaping, plus a security fix CVE-2026-24739.

    Symfony 6.4 is backed by:

    Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

    As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

    Symfony 6.4.33 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 6.4.32

    • bug #63212 Fix dealing with truncated streams after headers arrived with CurlHttpClient (nicolas-grekas)
    • bug #63208 Fix DocBlock resolution for inherited promoted properties (yoeunes)
    • bug #63170 Persist state when consuming negative tokens (jhogervorst)
    • bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (samy-mahmoudi)
    • bug #63211 Fix dealing with multiple levels of AsyncResponse decoration (nicolas-grekas)
    • bug #63202 Only send UNLISTEN query if we are actively listening (jwage)
    • security #cve-2026-24739 Fix escaping for MSYS on Windows (nicolas-grekas)
    • bug #63204 Fix resolution of self/parent types in inherited DocBlocks (yoeunes)
    • bug #63195 Clean http_cache dir in KernelTestCase::ensureKernelShutdown() (nicolas-grekas)
    • bug #63164 Fix escaping for MSYS on Windows (nicolas-grekas)
    • bug #63192 Fix appending empty iterators (nicolas-grekas)
    • bug #63193 Conflict with phpdocumentor/reflection-docblock >= 6 (branch 6.4 only) (nicolas-grekas)
    • bug #63191 Apply # to the right metadata (@VincentLanglet)

    Published in

    ❤️
    Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Symfony Developer at ongoing.ch
    View Symfony jobs →

    €80,000 – €120,000 / year - Remote + part-time onsite (Zug, Switzerland)

    Original source
  • Jan 28, 2026
    • Date parsed from source:
      Jan 28, 2026
    • First seen by Releasebot:
      Mar 13, 2026
    Symfony logo

    Symfony

    Symfony 7.3.11 released

    Symfony updates highlight the release of 7.3.11 with a clear warning that 7.3 is no longer supported, urging upgrades and pointing to upgrade guides and Insight reports. The changelog covers multiple bug fixes and a security fix, signaling active maintenance and guidance for developers.

    Symfony 7.3 is backed by:

    Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

    Warning: Symfony 7.3 is no longer supported. Consider upgrading your applications to the most recent Symfony version.

    Symfony 7.3.11 has just been released.

    Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

    Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

    Changelog Since Symfony 7.3.10

    • bug #63213 Fix lazy proxy type resolution for decorated services (nicolas-grekas)
    • bug #63212 Fix dealing with truncated streams after headers arrived with CurlHttpClient (nicolas-grekas)
    • bug #63208 Fix DocBlock resolution for inherited promoted properties (yoeunes)
    • bug #63170 Persist state when consuming negative tokens (jhogervorst)
    • bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (samy-mahmoudi)
    • bug #63211 Fix dealing with multiple levels of AsyncResponse decoration (nicolas-grekas)
    • bug #63202 Only send UNLISTEN query if we are actively listening (jwage)
    • security #cve-2026-24739 Fix escaping for MSYS on Windows (nicolas-grekas)
    • bug #63206 Conflict with phpdocumentor/reflection-docblock >= 6 (all branches) (nicolas-grekas)
    • bug #63204 Fix resolution of self/parent types in inherited DocBlocks (yoeunes)
    • bug #63195 Clean http_cache dir in KernelTestCase::ensureKernelShutdown() (nicolas-grekas)
    • bug #63164 Fix escaping for MSYS on Windows (nicolas-grekas)
    • bug #63192 Fix appending empty iterators (nicolas-grekas)
    • bug #63193 Conflict with phpdocumentor/reflection-docblock >= 6 (branch 6.4 only) (nicolas-grekas)
    • bug #63191 Apply # to the right metadata (@VincentLanglet)

    Published in Releases

    ❤️
    Help the Symfony project!

    As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

    💼 Symfony Developer at ongoing.ch
    View Symfony jobs →

    €80,000 – €120,000 / year - Remote + part-time onsite (Zug, Switzerland)

    Original source

Related vendors