Symfony 8.1 is backed by:
Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!
Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.
TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.
Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Symfony 8.1.6 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.5

• bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
• bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65728 [Routing] Fix matching the "0" URL (@cs278)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
• bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
• bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
• bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
• bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
• bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
• bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• bug #65697 [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
• minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
• minor #65665 [Validator] fix comment for Url requireTld argument (@dmitryuk)
• bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor #65657 [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
• bug #65656 [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
• minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor #65646 Review translations for Estonian (et) (@erkia)
• bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug #65640 [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
• bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
• minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
• minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug #65632 [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
• bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• bug #65613 [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
• minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
• bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor #65587 [Validator] Review Urdu translations (@UmairRathore)
• bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
• bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
• data #64370 Release v5.4.53

❤️ Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Symfony 7.4 is backed by:

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

Symfony 7.4.18 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.17

• bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65728 [Routing] Fix matching the "0" URL (@cs278)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
• bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
• bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
• bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
• bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
• bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
• bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
• bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor #65646 Review translations for Estonian (et) (@erkia)
• bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
• minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
• minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
• bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor #65587 [Validator] Review Urdu translations (@UmairRathore)
• bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
• bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
• data #64370 Release v5.4.53

❤️

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Symfony Developer at Steward

View Symfony jobs →

$8,700 – $13,000 / month - Full remote

Symfony 6.4 is backed by:

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

Symfony 6.4.45 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.44

• bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65728 [Routing] Fix matching the "0" URL (@cs278)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor #65646 Review translations for Estonian (et) (@erkia)
• bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
• minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
• minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
• bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor #65587 [Validator] Review Urdu translations (@UmairRathore)
• bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• data #64370 Release v5.4.53

❤️ Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Reprise was introduced on this blog a few weeks ago, and the pitch has not changed: it is a thin plugin, not a build tool. Vite and Rsbuild do the real work (bundling, hashing, source maps, HMR, the dev server); Reprise only adds the Symfony glue they leave out, the entrypoints.json and manifest.json files and the Twig tags that render them, the way Webpack Encore did.

That narrow scope is why 1.0 can land this soon. The bundlers underneath are mature and battle-tested, and Reprise's own surface is small, so a few stabilizing releases (0.6.1 through 0.8.0) were enough to settle it. Reprise 1.0.0 makes it official: the experimental notice is gone, and the public API now follows semantic versioning and Symfony's backward compatibility promise.

A backward compatibility promise

1.0 is not a new pile of features, it is a commitment. Everything an application depends on is now covered by semantic versioning and Symfony's backward compatibility promise: within a major version the public API stays stable, and anything that has to change is deprecated first and removed only in the next major.

Stabilizing toward 1.0

Contributed by Hugo Alliaume and Loïck Piera in #67, #68, #69, #70, #72, #81, #82 and #93

Most of the work since the announcement was not visible in the API: end-to-end tests with Vitest and Playwright now exercise both bundlers against a real Symfony backend on every CI run, the playground was rebuilt as a proper Reprise and Symfony UX showcase, and Subresource Integrity got two fixes, on the preloaded Link headers and on module-script preloading.

The first contribution from outside the maintainer landed here too, a per-entry opt-out of copied-filename hashing for assets that need a stable path on disk. The Webpack Encore migration guide now names every Encore method, mapping each one to its Reprise feature or to the bundler that handles it natively.

Reprise is 1.0, but still young. If you are on Encore and eyeing Vite or Rsbuild, or starting a new project on a modern bundler, this is a good moment to try it on something real:

$ composer require symfony/reprise
$ npm install @symfony/reprise --save-dev

Then wire the plugin into your Vite or Rsbuild config, as the installation guide shows.

Feedback, issues and contributions are more than welcome on Reprise on GitHub 🚀

Twig Knows Your PHP

Custom Twig functions and filters used to be opaque strings. Symfony Language Tools now connects the ones defined by your application to their PHP implementations.

Type a function or filter name to get completion. Hover it to see the PHP signature and its documentation. Use Go to Definition to open the callable, or Find All References to list its usages across templates.

Named arguments work too. The server understands parameters injected by Twig, completes the remaining ones and reports unknown names.

The implementation is deliberately conservative. Dynamic names and callables are ignored.

Typed Twig Templates

Twig's types tag can now describe the variables expected by a template:

{% types {
## The product displayed on this page.
product: 'App\Entity\Product',
featured?: 'boolean',
} %}

Completion and hover include the declared type, whether the variable is optional and its documentation.

Components from Bundles

Twig component support now reads the effective runtime registry. It recognizes anonymous components, custom renderers and components shipped by installed bundles.

That includes components such as ux:icon. Completion knows their names and Go to Definition opens the vendor class when it is available locally.

Decorated Twig loaders and bundle-provided Stimulus registries are supported as well.

Real Applications as Tests

The first version was tested against the Symfony applications that power symfony.com and its subdomains.

The test matrix is now public. Every relevant change runs the server against pinned revisions of Kimai, Mautic, Sulu Demo, Sylius, Shopware, and Symfony Demo. Together, they cover Symfony 6.4, 7.4 and 8.1.

The server indexes each application from cold and warm states, boots it and runs real completion, hover, navigation, references, code actions and rename requests.

These applications quickly exposed assumptions hidden by small fixtures. The result is support for XML service definitions, INI translation catalogs, Doctrine XML and YAML mappings, public assets, themed Twig loaders, non-standard kernels and configuration shorthands.

XML Services

Symfony Language Tools now indexes services, aliases, parameters, decorators, tags and references declared in XML.

Navigation, references and rename work across XML, YAML and PHP. Completion in XML is not supported yet.

Doctrine Beyond Attributes

Doctrine support originally relied on PHP attributes. Runtime metadata now adds entities and fields declared through XML or YAML mappings, including entities shipped by dependencies.

Field completion, hover and navigation therefore work on many more projects.

Plain Old Public Assets

Not every application uses AssetMapper. The asset() integration now falls back to files under public/, so Webpack Encore and other build pipelines get completion and navigation too.

Unknown paths are not reported as errors as Symfony asset packages can have their own fallback logic.

Your PHP Can Stay in Docker

The language server is self-contained, but runtime indexing needs to boot your application. So it meant a compatible PHP executable on the host.

Not anymore. Configure the PHP command and the path of the project inside the container:

{
"symfonyLsp.phpCommand": ["docker", "compose", "exec", "-T", "php", "php"],
"symfonyLsp.containerProjectRoot": "/app"
}

The application boots inside Docker while navigation continues to open files on the host. The same mechanism works with a virtual machine or any isolated PHP command.

Project discovery also understands more layouts: kernels outside the App namespace, legacy app/AppKernel.php applications, Symfony Runtime front controllers and FrameworkBundle installed transitively.

More Editors

VS Code and Neovim were available on day one. Zed now has an official extension for Linux and macOS. It downloads the appropriate server automatically and runs alongside Zed's PHP language server.

OpenCode can also start Symfony Language Tools as a custom language server. Its coding agent gets Symfony-aware diagnostics, hover, navigation and references. OpenCode does not request every interactive LSP feature yet, but it is already a useful combination.

The standalone server remains available for any other LSP client. On Windows, VS Code now connects to the bundled server over a local socket automatically. The VS Code package can also be installed in VSCodium from the release VSIX.

Saying Less

A language server must know when to say nothing. False positives are annoying, but false edits are dangerous.

This week, Symfony Language Tools learned to ignore many more uncertain cases:

• PHP and Twig comments;
• Twig verbatim blocks;
• dynamic Stimulus controller expressions;
• dynamic Twig callable options;
• unpacked or dynamic translation parameter maps;
• files owned by dependencies.

Rename and quick fixes are now kept inside application-owned files. Quick fixes also use the unsaved editor contents and versioned edits.

There is more: internationalized routes use their canonical names.

Runtime indexing now tolerates noisy consoles, large metadata snapshots and kernel shutdown failures. When a refresh fails, the last valid metadata remains available.

Indexing at Scale

The source index is now streamed to its persistent store instead of keeping a second complete copy in memory. Parser results are reused; ignored and unreadable files are skipped; garbage collection runs during large scans.

CI generates projects with 1,500 and 6,000 source files to enforce linear scaling and per-file memory budgets. The server memory limit is configurable, with a default ceiling of 2 GB.

Live indexing is safer too. A file saved during a full scan can no longer be overwritten by an older result. Removing a workspace folder cancels its work and releases its indexes. New directories, changed ignore rules and composer.lock updates are detected without restarting the editor.

The Tree-sitter parser is now compiled into the server executable as well. One binary, one process.

Still a Beta

Version 0.16 is a large step, but Symfony Language Tools is still a beta. We are releasing often because every real application teaches the server something a fixture did not.

Install the update, open your application and tell us where it gets confused on the issue tracker.

Symfony 8.1 is backed by:

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Symfony 8.1.5 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.4

• bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas)
• bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas)
• minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum)
• bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (@nicolas-grekas)
• bug #65514 [Messenger] Tell apart handler services that share the same class (@nicolas-grekas)
• minor #65583 [Validator] Review Croatian translations (@HypeMC)
• bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (@nicolas-grekas)
• bug #65584 [Form] Map violations to child forms named after the snake cased property (@nicolas-grekas)
• bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (@nicolas-grekas)
• bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (@llupa)
• bug #65455 [Console] Do not resolve core utility parameters as command input (@lazerg)
• bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (@nicolas-grekas)
• bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (@nicolas-grekas)
• bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (@nicolas-grekas)
• bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (@nicolas-grekas)
• bug #65532 [DependencyInjection] Keep escaping when resolving values against a resolved parameter bag (@nicolas-grekas)
• bug #65530 [Form] Apply the configured rounding mode when no scale is set (@nicolas-grekas)
• bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (@nicolas-grekas)
• bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (@nicolas-grekas)
• bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (@nicolas-grekas)
• bug #65519 [DomCrawler] Detect the charset from meta tags only (@nicolas-grekas)
• bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (@nicolas-grekas)
• bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (@nicolas-grekas)
• bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (@nicolas-grekas)
• bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (@nicolas-grekas)
• bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (@nicolas-grekas)
• bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65508 [Intl] Follow the ICU parent locale when falling back (@nicolas-grekas)
• bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (@nicolas-grekas)
• bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (@nicolas-grekas)
• bug #65502 [Security] Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (@nicolas-grekas)
• bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (@nicolas-grekas)
• bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (@nicolas-grekas)
• bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (@nicolas-grekas)
• bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (@nicolas-grekas)
• bug #65498 [Process] Do not wait for output when the input iterator has more data (@nicolas-grekas)
• bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (@nicolas-grekas)
• bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (@nicolas-grekas)
• bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (@nicolas-grekas)
• bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (@nicolas-grekas)
• bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (@nicolas-grekas)
• bug #65487 [Messenger] Fail when messenger:consume is given no receiver (@nicolas-grekas)
• bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (@nicolas-grekas)
• bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (@nicolas-grekas)
• bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (@nicolas-grekas)
• bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (@nicolas-grekas)
• bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (@nicolas-grekas)
• bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (@nicolas-grekas)
• bug #65479 [Form] Fix generating the CSRF token when the form attributes are replaced (@nicolas-grekas)
• bug #65474 [DependencyInjection] Fix compiling nested service locators (@nicolas-grekas)
• bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (@nicolas-grekas)
• bug #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (@nicolas-grekas)
• minor #65574 [Validator] Update Albanian translations (@llupa)
• bug #65528 [Security] Track session usage when a lazy firewall reads the token (@nicolas-grekas)
• bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (@nicolas-grekas)
• bug #65523 [PropertyInfo] Use the same mutator method for types and write info (@nicolas-grekas)
• bug #65520 [BrowserKit] Return the most specific cookie when several ones match (@nicolas-grekas)
• bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (@nicolas-grekas)
• bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (@nicolas-grekas)
• bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (@nicolas-grekas)
• minor #65577 Add skill to merge PRs (@nicolas-grekas)
• minor #65571 [Validator] Review Brazilian Portuguese translations (@henriquejsza)
• bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (@nicolas-grekas)
• minor #65572 [Validator] Review French translations (@Amoifr)
• bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (@lazerg)
• bug #65500 [Console] Keep backslashes preceding < and > when escaping text (@nicolas-grekas)
• bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (@nicolas-grekas)
• bug #65477 [Finder] Do not report dangling symlinks as both files and directories (@nicolas-grekas)
• bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (@nicolas-grekas)
• bug #65471 [Console] Fix clearing more lines than a section holds (@nicolas-grekas)
• bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (@nicolas-grekas)
• bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (@nicolas-grekas)
• bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (@nicolas-grekas)
• bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (@lazerg)
• bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (@nicolas-grekas)
• bug #65535 [Tui] Stop delivering the rest of an over-cap paste as key events (@nicolas-grekas, @fabpot)
• bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (@nicolas-grekas)
• bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (@wazum)
• bug #65475 [ErrorHandler] Don't autoload when resolving "@return" class constants (@nicolas-grekas)
• bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (@nicolas-grekas)
• bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (@nicolas-grekas)
• bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (@nicolas-grekas)
• minor #65453 [Validator] Add the EntityExists and Ulid message translation units (@nicolas-grekas)
• bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (@lazerg)
• bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (@nicolas-grekas)
• bug #65441 [DependencyInjection] Skip abstract classes and interfaces in findTaggedResourceIds() (@nicolas-grekas)
• bug #65416 [Tui] Batch of bug fixes (@sadiqk2, @nicolas-grekas)
• bug #65291 [Serializer] Enforce the element type of scalar collections (@nicolas-grekas)
• bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (@nicolas-grekas)
• bug #65429 [Cache] Fix numeric string keys being cast to integers (@nicolas-grekas)
• bug #65425 [Yaml] Fix parsing an alias followed by a comment (@eyupcanakman)
• bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (@nicolas-grekas)
• bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (@Nitram1123)
• bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)
• bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (@nicolas-grekas)
• bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (@eyupcanakman)
• bug #65388 [Notifier][Mercure] Add support for Mercure 0.8 (@lazerg)
• bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (@nicolas-grekas)
• bug #65391 [DomCrawler] Read the whole content of a textarea (@nicolas-grekas)
• bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (@nicolas-grekas)
• bug #65385 [ObjectMapper] Allow #[Map] on abstract classes (@nicolas-grekas)
• bug #65379 [DoctrineBridge] Fix explicit MapEntity mapping being overwritten by a route mapping (@nicolas-grekas)
• bug #65365 [Yaml] Restore the default dump output for sequences of mappings (@eissasoubhi)
• bug #65366 [ObjectMapper] Only honor an explicitly inbound target #[Map] for the same-name copy (@soyuka)
• bug #65376 [Validator] Allow a literal # in the fragment part of Url (@lazerg)
• minor #65378 Add an agent skill for authoring pull requests (@nicolas-grekas)
• bug #65371 [Translation] Read CSV translations without SplFileObject (@nicolas-grekas)
• bug #65372 [HttpFoundation] Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65367 Fix PHP 8.6 deprecations (@nicolas-grekas)
• bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (@tomsommer)
• bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (@ousamabenyounes)
• bug #65347 [Tui] Ignore arbitrary hex lengths Color cannot use (@sadiqk2)
• bug #65354 [Serializer] Throw on XML data without a root node (@nicolas-grekas)
• bug #65344 [Tui] Keep horizontal layout inside the available columns (@sadiqk2)
• bug #65341 [Tui] Enforce the paste cap when the end marker is split across reads (@sadiqk2)
• bug #65330 [Tui] Stop a column slice at a wide character instead of taking later columns (@sadiqk2)
• bug #65331 [Tui] Match ctrl+alt+ in its CSI u encoding too (@sadiqk2)
• bug #65321 [Console] Resolve UIDs whatever their format (@MatTheCat)
• bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (@nicolas-grekas)
• bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (@nicolas-grekas)
• bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (@nicolas-grekas)
• minor #65310 [HttpClient] Remove unused code in AsyncResponse::__destruct() (@lyrixx)
• bug #65309 [VarExporter] Split Exporter::export() so it stops crashing the PHP 8.5 JIT compiler (@petrdobr)
• bug #65305 [Messenger] Handle synchronous batch nack (@eissasoubhi)
• bug #65303 [FrameworkBundle] Do not leak the response body from assertResponseRedirects() when not verbose (@nicolas-grekas)
• bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (@eissasoubhi)
• bug #65294 [ObjectMapper] Fix reusing an already mapped object for a different target (@ousamabenyounes)
• bug #62352 [Serializer] Convert the elements of scalar collections (@nicolas-grekas)
• minor #65290 [FrameworkBundle] Tolerate a newer DependencyInjection InstanceofType shape in the reference fixture (@nicolas-grekas)
• bug #65288 [Cache] Fix stampede protection not being disabled on CLI (@nicolas-grekas)
• bug #65280 [FrameworkBundle] Wire the webhook request parser with the configured header names (@nicolas-grekas)
• bug #65274 [Mailer][Notifier] Avoid retaining messages without the profiler (@eissasoubhi)
• bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (@nicolas-grekas)
• bug #65276 [Tui] Clamp borders that do not fit their container (@nicolas-grekas)
• bug #65271 [DependencyInjection] Fix circular references through expressions (@eissasoubhi)
• bug #65273 [Notifier][Sevenio] Fix successful sends being reported as failures (@lazerg)
• bug #65266 [Tui] Track descendant positions of cached horizontal layout children (@fabpot)
• bug #65275 [PropertyInfo] Ignore methods that only look like accessors (@nicolas-grekas)
• bug #65268 [Tui] Reuse cached subtrees during vertical layout (@fabpot)
• bug #65263 [Console] Keep falsy answers when collecting an array with #[Ask] (@sadiqk2)
• bug #65264 [Mime] Do not drop the last line of a resource-backed message (@sadiqk2)
• bug #65265 [Uid] Compare times by value in MockUuidFactory (@sadiqk2)
• bug #65262 [AssetMapper] Include front controller in dev asset URLs (@eissasoubhi)
• bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (@bhavin-nakrani)
• bug #65255 [Tui] Fix column width accounting (@sadiqk2)
• bug #65254 [Tui] Fix stdin framing and key id decoding (@sadiqk2)
• bug #65258 [Console] Restore the catchExceptions state after running a command message (@KevinMartinsDev)
• bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65250 [DependencyInjection] Fix class-level tag attributes being overridden by interface-level ones (@nicolas-grekas)
• bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (@javiereguiluz)
• bug #65240 [WebProfilerBundle] move macros to the template root (@xabbuh)
• bug #65242 [Console] Fix parsing #[Target] attribute on arguments of invokable commands (@HypeMC)
• bug #65245 [Tui] Treat a zero terminal size as unknown (@Bosun18)
• bug #65244 [Tui] Fix stop() scrolling the top of the frame off the screen (@Bosun18)
• bug #65239 [Console] Fix terminator handling in the image protocols (@nicolas-grekas)
• bug #65196 [Console] Fix decoding chunked Kitty graphics payloads (@sadiqk2)
• bug #65197 [Console] Fix writing one-shot iterables to a CombinedOutput (@sadiqk2)

Symfony 7.4 is backed by:

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

Symfony 7.4.17 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.16

• bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas)
• bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas)
• minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum)
• bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (@nicolas-grekas)
• bug #65514 [Messenger] Tell apart handler services that share the same class (@nicolas-grekas)
• minor #65583 [Validator] Review Croatian translations (@HypeMC)
• bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (@nicolas-grekas)
• bug #65584 [Form] Map violations to child forms named after the snake cased property (@nicolas-grekas)
• bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (@nicolas-grekas)
• bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (@llupa)
• bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (@nicolas-grekas)
• bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (@nicolas-grekas)
• bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (@nicolas-grekas)
• bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (@nicolas-grekas)
• bug #65532 [DependencyInjection] Keep escaping when resolving values against a resolved parameter bag (@nicolas-grekas)
• bug #65530 [Form] Apply the configured rounding mode when no scale is set (@nicolas-grekas)
• bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (@nicolas-grekas)
• bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (@nicolas-grekas)
• bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (@nicolas-grekas)
• bug #65519 [DomCrawler] Detect the charset from meta tags only (@nicolas-grekas)
• bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (@nicolas-grekas)
• bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (@nicolas-grekas)
• bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (@nicolas-grekas)
• bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (@nicolas-grekas)
• bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (@nicolas-grekas)
• bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65508 [Intl] Follow the ICU parent locale when falling back (@nicolas-grekas)
• bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (@nicolas-grekas)
• bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (@nicolas-grekas)
• bug #65502 [Security] Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (@nicolas-grekas)
• bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (@nicolas-grekas)
• bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (@nicolas-grekas)
• bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (@nicolas-grekas)
• bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (@nicolas-grekas)
• bug #65498 [Process] Do not wait for output when the input iterator has more data (@nicolas-grekas)
• bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (@nicolas-grekas)
• bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (@nicolas-grekas)
• bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (@nicolas-grekas)
• bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (@nicolas-grekas)
• bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (@nicolas-grekas)
• bug #65487 [Messenger] Fail when messenger:consume is given no receiver (@nicolas-grekas)
• bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (@nicolas-grekas)
• bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (@nicolas-grekas)
• bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (@nicolas-grekas)
• bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (@nicolas-grekas)
• bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (@nicolas-grekas)
• bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (@nicolas-grekas)
• bug #65479 [Form] Fix generating the CSRF token when the form attributes are replaced (@nicolas-grekas)
• bug #65474 [DependencyInjection] Fix compiling nested service locators (@nicolas-grekas)
• bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (@nicolas-grekas)
• bug #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (@nicolas-grekas)
• minor #65574 [Validator] Update Albanian translations (@llupa)
• bug #65528 [Security] Track session usage when a lazy firewall reads the token (@nicolas-grekas)
• bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (@nicolas-grekas)
• bug #65523 [PropertyInfo] Use the same mutator method for types and write info (@nicolas-grekas)
• bug #65520 [BrowserKit] Return the most specific cookie when several ones match (@nicolas-grekas)
• bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (@nicolas-grekas)
• bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (@nicolas-grekas)
• bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (@nicolas-grekas)
• minor #65577 Add skill to merge PRs (@nicolas-grekas)
• minor #65571 [Validator] Review Brazilian Portuguese translations (@henriquejsza)
• bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (@nicolas-grekas)
• minor #65572 [Validator] Review French translations (@Amoifr)
• bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (@lazerg)
• bug #65500 [Console] Keep backslashes preceding < and > when escaping text (@nicolas-grekas)
• bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (@nicolas-grekas)
• bug #65477 [Finder] Do not report dangling symlinks as both files and directories (@nicolas-grekas)
• bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (@nicolas-grekas)
• bug #65471 [Console] Fix clearing more lines than a section holds (@nicolas-grekas)
• bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (@nicolas-grekas)
• bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (@nicolas-grekas)
• bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (@nicolas-grekas)
• bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (@lazerg)
• bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (@nicolas-grekas)
• bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (@nicolas-grekas)
• bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (@wazum)
• bug #65475 [ErrorHandler] Don't autoload when resolving "@return" class constants (@nicolas-grekas)
• bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (@nicolas-grekas)
• bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (@nicolas-grekas)
• bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (@nicolas-grekas)
• minor #65453 [Validator] Add the EntityExists and Ulid message translation units (@nicolas-grekas)
• bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (@lazerg)
• bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (@nicolas-grekas)
• bug #65441 [DependencyInjection] Skip abstract classes and interfaces in findTaggedResourceIds() (@nicolas-grekas)
• bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (@nicolas-grekas)
• bug #65429 [Cache] Fix numeric string keys being cast to integers (@nicolas-grekas)
• bug #65425 [Yaml] Fix parsing an alias followed by a comment (@eyupcanakman)
• bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (@nicolas-grekas)
• bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (@Nitram1123)
• bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)
• bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (@nicolas-grekas)
• bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (@eyupcanakman)
• bug #65388 [Notifier][Mercure] Add support for Mercure 0.8 (@lazerg)
• bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (@nicolas-grekas)
• bug #65391 [DomCrawler] Read the whole content of a textarea (@nicolas-grekas)
• bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (@nicolas-grekas)
• bug #65366 [ObjectMapper] Only honor an explicitly inbound target #[Map] for the same-name copy (@soyuka)
• bug #65376 [Validator] Allow a literal # in the fragment part of Url (@lazerg)
• minor #65378 Add an agent skill for authoring pull requests (@nicolas-grekas)
• bug #65371 [Translation] Read CSV translations without SplFileObject (@nicolas-grekas)
• bug #65372 [HttpFoundation] Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65367 Fix PHP 8.6 deprecations (@nicolas-grekas)
• bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (@tomsommer)
• bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (@ousamabenyounes)
• bug #65354 [Serializer] Throw on XML data without a root node (@nicolas-grekas)
• bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (@nicolas-grekas)
• bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (@nicolas-grekas)
• bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (@nicolas-grekas)
• minor #65310 [HttpClient] Remove unused code in AsyncResponse::__destruct() (@lyrixx)
• bug #65305 [Messenger] Handle synchronous batch nack (@eissasoubhi)
• bug #65303 [FrameworkBundle] Do not leak the response body from assertResponseRedirects() when not verbose (@nicolas-grekas)
• bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (@eissasoubhi)
• minor #65290 [FrameworkBundle] Tolerate a newer DependencyInjection InstanceofType shape in the reference fixture (@nicolas-grekas)
• bug #65288 [Cache] Fix stampede protection not being disabled on CLI (@nicolas-grekas)
• bug #65274 [Mailer][Notifier] Avoid retaining messages without the profiler (@eissasoubhi)
• bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (@nicolas-grekas)
• bug #65271 [DependencyInjection] Fix circular references through expressions (@eissasoubhi)
• bug #65273 [Notifier][Sevenio] Fix successful sends being reported as failures (@lazerg)
• bug #65275 [PropertyInfo] Ignore methods that only look like accessors (@nicolas-grekas)
• bug #65263 [Console] Keep falsy answers when collecting an array with #[Ask] (@sadiqk2)
• bug #65264 [Mime] Do not drop the last line of a resource-backed message (@sadiqk2)
• bug #65265 [Uid] Compare times by value in MockUuidFactory (@sadiqk2)
• bug #65262 [AssetMapper] Include front controller in dev asset URLs (@eissasoubhi)
• bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (@bhavin-nakrani)
• bug #65258 [Console] Restore the catchExceptions state after running a command message (@KevinMartinsDev)
• bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65250 [DependencyInjection] Fix class-level tag attributes being overridden by interface-level ones (@nicolas-grekas)
• bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (@javiereguiluz)

Symfony 6.4 is backed by

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

Symfony 6.4.44 has just been released.
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.43

• bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas)
• bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas)
• minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum)
• bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (@nicolas-grekas)
• bug #65514 [Messenger] Tell apart handler services that share the same class (@nicolas-grekas)
• minor #65583 [Validator] Review Croatian translations (@HypeMC)
• bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (@nicolas-grekas)
• bug #65584 [Form] Map violations to child forms named after the snake cased property (@nicolas-grekas)
• bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (@nicolas-grekas)
• bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (@nicolas-grekas)
• bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (@nicolas-grekas)
• bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (@nicolas-grekas)
• bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (@nicolas-grekas)
• bug #65532 [DependencyInjection] Keep escaping when resolving values against a resolved parameter bag (@nicolas-grekas)
• bug #65530 [Form] Apply the configured rounding mode when no scale is set (@nicolas-grekas)
• bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (@nicolas-grekas)
• bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (@nicolas-grekas)
• bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (@nicolas-grekas)
• bug #65519 [DomCrawler] Detect the charset from meta tags only (@nicolas-grekas)
• bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (@nicolas-grekas)
• bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (@nicolas-grekas)
• bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (@nicolas-grekas)
• bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (@nicolas-grekas)
• bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (@nicolas-grekas)
• bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65508 [Intl] Follow the ICU parent locale when falling back (@nicolas-grekas)
• bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (@nicolas-grekas)
• bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (@nicolas-grekas)
• bug #65502 [Security] Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (@nicolas-grekas)
• bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (@nicolas-grekas)
• bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (@nicolas-grekas)
• bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (@nicolas-grekas)
• bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (@nicolas-grekas)
• bug #65498 [Process] Do not wait for output when the input iterator has more data (@nicolas-grekas)
• bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (@nicolas-grekas)
• bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (@nicolas-grekas)
• bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (@nicolas-grekas)
• bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (@nicolas-grekas)
• bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (@nicolas-grekas)
• bug #65487 [Messenger] Fail when messenger:consume is given no receiver (@nicolas-grekas)
• bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (@nicolas-grekas)
• bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (@nicolas-grekas)
• bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (@nicolas-grekas)
• bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (@nicolas-grekas)
• bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (@nicolas-grekas)
• bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (@nicolas-grekas)
• bug #65474 [DependencyInjection] Fix compiling nested service locators (@nicolas-grekas)
• bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (@nicolas-grekas)
• minor #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (@nicolas-grekas)
• minor #65574 [Validator] Update Albanian translations (@llupa)
• bug #65528 [Security] Track session usage when a lazy firewall reads the token (@nicolas-grekas)
• bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (@nicolas-grekas)
• bug #65523 [PropertyInfo] Use the same mutator method for types and write info (@nicolas-grekas)
• bug #65520 [BrowserKit] Return the most specific cookie when several ones match (@nicolas-grekas)
• bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (@nicolas-grekas)
• bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (@nicolas-grekas)
• bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (@nicolas-grekas)
• minor #65577 Add skill to merge PRs (@nicolas-grekas)
• minor #65571 [Validator] Review Brazilian Portuguese translations (@henriquejsza)
• bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (@nicolas-grekas)
• minor #65572 [Validator] Review French translations (@Amoifr)
• bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (@lazerg)
• bug #65500 [Console] Keep backslashes preceding < and > when escaping text (@nicolas-grekas)
• bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (@nicolas-grekas)
• bug #65477 [Finder] Do not report dangling symlinks as both files and directories (@nicolas-grekas)
• bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (@nicolas-grekas)
• bug #65471 [Console] Fix clearing more lines than a section holds (@nicolas-grekas)
• bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (@nicolas-grekas)
• bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (@nicolas-grekas)
• bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (@nicolas-grekas)
• bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (@lazerg)
• bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (@nicolas-grekas)
• bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (@nicolas-grekas)
• bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (@wazum)
• bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (@nicolas-grekas)
• bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (@nicolas-grekas)
• bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (@nicolas-grekas)
• minor #65453 [Validator] Add the EntityExists and Ulid message translation units (@nicolas-grekas)
• bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (@lazerg)
• bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (@nicolas-grekas)
• bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (@nicolas-grekas)
• bug #65429 [Cache] Fix numeric string keys being cast to integers (@nicolas-grekas)
• bug #65425 [Yaml] Fix parsing an alias followed by a comment (@eyupcanakman)
• bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (@nicolas-grekas)
• bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (@Nitram1123)
• bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)
• bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (@nicolas-grekas)
• bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (@eyupcanakman)
• bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (@nicolas-grekas)
• bug #65391 [DomCrawler] Read the whole content of a textarea (@nicolas-grekas)
• bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (@nicolas-grekas)
• bug #65376 [Validator] Allow a literal # in the fragment part of Url (@lazerg)
• minor #65378 Add an agent skill for authoring pull requests (@nicolas-grekas)
• bug #65371 [Translation] Read CSV translations without SplFileObject (@nicolas-grekas)
• bug #65372 [HttpFoundation] Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65367 Fix PHP 8.6 deprecations (@nicolas-grekas)
• bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (@tomsommer)
• bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (@ousamabenyounes)
• bug #65354 [Serializer] Throw on XML data without a root node (@nicolas-grekas)
• bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (@nicolas-grekas)
• bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (@nicolas-grekas)
• bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (@nicolas-grekas)
• minor #65310 [HttpClient] Remove unused code in AsyncResponse::__destruct() (@lyrixx)
• bug #65305 [Messenger] Handle synchronous batch nack (@eissasoubhi)
• bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (@eissasoubhi)
• bug #65288 [Cache] Fix stampede protection not being disabled on CLI (@nicolas-grekas)
• bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (@nicolas-grekas)
• bug #65271 [DependencyInjection] Fix circular references through expressions (@eissasoubhi)
• bug #65275 [PropertyInfo] Ignore methods that only look like accessors (@nicolas-grekas)
• bug #65264 [Mime] Do not drop the last line of a resource-backed message (@sadiqk2)
• bug #65262 [AssetMapper] Include front controller in dev asset URLs (@eissasoubhi)
• bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (@bhavin-nakrani)
• bug #65258 [Console] Restore the catchExceptions state after running a command message (@KevinMartinsDev)
• bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (@javiereguiluz)
• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

Reprise 0.8.0 is out, a few weeks after the project was introduced on this blog. This release brings back an Encore behavior that some codebases depend on: copied files that keep a stable path on disk. It also fixes a manifest discrepancy between Vite and Rsbuild.

Copied Files Can Keep Their Path

Contributed by Loïck Piera in #81

Encore's copyFiles() could keep a copied file at a fixed path on disk and put the hash in the query string instead. Codebases end up relying on that: templates hardcoding asset('/build/images/logo.svg'), PHP code reading a file from a known location, CDN rules. Reprise always hashed the filename, so migrating such a project from Encore meant writing a custom plugin.

A copy entry now accepts a hash option, true by default. Set it to false and the file keeps its logical path, while the content hash moves to the manifest.json value as a query string:

// vite.config.ts
import { defineConfig } from 'vite'
import Symfony from '@symfony/reprise/vite'
export default defineConfig({
  // ...
  plugins: [
    Symfony({
      copy: [
        {
          from: 'assets/images',
          to: 'images',
          hash: false,
        },
      ],
    }),
  ],
})

// rsbuild.config.ts
import { defineConfig } from '@rsbuild/core'
import Symfony from '@symfony/reprise/rsbuild'
export default defineConfig({
  // ...
  plugins: [
    Symfony({
      copy: [
        {
          from: 'assets/images',
          to: 'images',
          hash: false,
        },
      ],
    }),
  ],
})

The file lands at public/build/images/logo.svg and the manifest carries the cache-busting query, so asset() keeps returning a versioned URL:

{
  "build/images/logo.svg": "/build/images/logo.svg?87dcc351"
}

The option is per entry, so hashed and stable copies can live in the same config. Proxies or CDNs configured to ignore query strings will not pick up new versions of these files, which is why hashed filenames remain the default. The same pull request also lets an empty to place copied files at the root of outputPath, for the ones that have to sit at a fixed top-level URL like favicon.ico or site.webmanifest.

Same Manifest Keys on Vite and Rsbuild

Contributed by Hugo Alliaume in #82

manifest.json maps a logical asset path to its hashed URL, which is what makes asset('fonts/query.woff2') resolve to the built file in Twig. A stylesheet can reference that same file with a query string or a fragment tacked on, and both are everyday CSS:

@font-face {
  font-family: "Query";
  src: url("./fonts/query.woff2?v=1") format("woff2");
}
.icon {
  background: url("./media/icon.svg#frag");
}

Vite wrote the manifest key as build/fonts/query.woff2, with the query string already stripped. Rsbuild carried it over instead and wrote build/fonts/query.woff2?v=1, a key that asset('fonts/query.woff2') in Twig would never match. Same project, same CSS: the font resolved through Vite and failed through Rsbuild. The query string and the fragment describe how the CSS references the file, not the file itself, so both are now stripped before the manifest key is written.

Corepack Is Gone

Contributed by Hugo Alliaume in #84 and #85

Node.js stopped shipping Corepack in v25, after the TSC voted to stop distributing it. It was also a slow way to reach pnpm, since every command went through a Node.js shim that first had to resolve and download the package manager.

Reprise no longer relies on it. The CI workflows use pnpm/setup, which fetches the standalone pnpm binary and installs Node.js in one step, and contributors install pnpm the usual way instead of running corepack enable. Symfony UX made the same move in symfony/ux#3774.

Full Changelog

• Add a per-entry opt-out of copied filenames hashing (@pyrech)
• [Manifest] Strip url() query and fragment from Rspack keys (@Kocal)
• [CI] Replace Corepack with pnpm/setup (@Kocal)
• [CI] Use pnpm/setup in the release workflow (@Kocal)
• Update all npm devDependencies (@Kocal)
• Link the announcement blog post in the README (@Kocal)

Reprise is still experimental and still 0.x, so this is the moment where feedback shapes what comes after Encore. Try it on a real project, open an issue, or send a pull request on GitHub.

Symfony 8.1 is backed by:

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Symfony 8.1.4 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.3

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65174 [Tui] Keep ANSI codes ordered when slicing across a color change (@smnandre)
• bug #65177 [HttpClient] Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 (@peter17)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65150 [Tui] Render raw HTML in MarkdownWidget instead of dropping it (@lazerg)
• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
• bug #65149 [DependencyInjection] Resolve factories on "service_container" against the concrete container class (@lazerg)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65122 [Messenger] Re-send original payload when retrying undecodable messages (@SystematicCZ)
• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
• bug #65105 [Uid] Fix the weak-secret guard in Uuid47Transformer for secrets longer than 16 bytes (@semx)
• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
• bug #65085 [Messenger] Stop the PostgreSQL transport from blocking the worker loop (@bzajacc)
• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (@alexisLefebvre)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #64696 [Config] Generate unsealed array shapes for any normalizers (@ousamabenyounes)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (@nicolas-grekas)

Symfony 7.4 is backed by:

As the creator of Symfony, SensioLabs supports companies using Symfony, with an offering encompassing consultancy, expertise, services, training, and technical assistance to ensure the success of web application development projects.

redirection.io logs all your website’s HTTP traffic, and lets you fix errors with redirect rules in seconds. Give your marketing, SEO and IT teams the right tool to manage your website traffic efficiently!

Private Packagist is a fast, reliable, and secure Composer repository for your private packages. It mirrors all your open-source dependencies for better availability and monitors them for security vulnerabilities.

JoliCode is a team of passionate developers and open-source lovers, with a strong expertise in PHP & Symfony technologies. They can help you build your projects using state-of-the-art practices.

Symfony 7.4.16 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.15

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (@alexisLefebvre)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #64696 [Config] Generate unsealed array shapes for any normalizers (@ousamabenyounes)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (@nicolas-grekas)
• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

Symfony UX 3.4 expands Toolkit with a Bootstrap 5.3 kit, reusable design-system-agnostic behaviors and richer documentation for kit authors. The release also adds dynamic Twig component names, safer on-demand icons, modern React and Vue bundler support and a stable Translator component.

Bootstrap 5.3 Kit

Contributed by in #3713

Bootstrap users previously had to turn the framework's markup into reusable Twig components themselves. The new Bootstrap kit provides 25 ready-to-use recipes based on Bootstrap 5.3, including accordions, alerts, cards, carousels, dropdowns, modals, navigation bars, pagination, toasts and tooltips.

Install each recipe on demand with the Toolkit command:

$ php bin/console ux:install alert --kit bootstrap

The installed Twig components use the familiar Bootstrap options and classes:

<twig:Alert color="success" heading="Profile updated" dismissible>Your account settings have been saved.</twig:Alert>

The components are copied into your application, where you can use them as-is or customize their markup and behavior. Toolkit also includes the kit-level Bootstrap dependency when installing any of these recipes.

Design-System-Agnostic Toolkit Recipes

Contributed by in #3707, #3725 and #3740

Common interface behaviors are often rebuilt in every application because they don't belong to a specific design system. The new common Toolkit kit provides five unstyled recipes that you can install and customize in your project:

• post-link submits a link as a form, with optional method spoofing, CSRF protection and a confirmation prompt;
• logout-link builds on post-link to log users out securely with a POST request;
• closeable removes an element immediately, after a delay or automatically;
• clipboard copies a value or an element's content and supports several kinds of success feedback;
• tooltip provides accessible hover, focus, click and manual tooltips positioned with Floating UI.

Install recipes independently with the Toolkit command:

$ php bin/console ux:install clipboard --kit common

The installed controller can then be used directly in your templates:

<div data-controller="clipboard">
  <code data-clipboard-target="source">php bin/console cache:clear</code>
  <button type="button" data-action="clipboard#copy">
    <span data-clipboard-target="idle">Copy</span>
    <span data-clipboard-target="success" hidden>Copied!</span>
  </button>
</div>

Because the recipes ship without presentation styles, they work with any CSS framework or your own design system.

Self-Documenting Toolkit Recipes

Contributed by Hugo Alliaume in #3718

Before Symfony UX 3.4, a recipe lived in the Symfony UX repository while its documentation was a Twig template in the ux.symfony.com repository. Adding a recipe or reorganizing its examples split the work almost equally between the two repositories.

Recipes now ship a self-contained README.md next to their implementation. Toolkit renders it as HTML or portable Markdown, including installation instructions, live examples and generated API references. In practice, about 99% of recipe work can now happen in the Symfony UX repository; the generic rendering layer in ux.symfony.com accounts for the remaining 1%.

Stimulus Controller API References

Contributed by Kevin Bond in #3724 and #3733

Recipes that only ship a Stimulus controller had no generated API reference. Toolkit can now document the complete public API of a controller from @value, @target, @css-class, @outlet and @action tags in its docblock:

/**
 *
 * @value autoClose  Delay before the notification closes.
 * @target timerbar   Element that displays the remaining time.
 * @action close      Removes the notification.
 */
export default class extends Controller {
  static values = { autoClose: Number };
  static targets = ['timerbar'];
  close() { this.element.remove(); }
}

Toolkit generates the matching attributes, types and descriptions in the API reference. Its linter also checks that the tags agree with the controller, so the code remains the source of truth.

Kit-Level Dependencies

Contributed by Simon André in #3719

Dependencies shared by every recipe in a kit were declared in the kit manifest but omitted when installing an individual recipe. The installer now includes these Composer, npm and importmap dependencies automatically.

Kit authors can therefore declare a library once instead of repeating it in every recipe manifest:

{
  "name": "Bootstrap",
  "dependencies": {
    "npm": ["bootstrap@^5.3.0"],
    "importmap": ["bootstrap", "bootstrap/dist/css/bootstrap.min.css"]
  }
}

Dynamic Twig Component Names

Contributed by andreybotanic in #3395

Dynamic component selection previously required the component() function, which cannot define component blocks. The {% component %} tag now accepts a parenthesized expression, combining dynamic selection with props and blocks:

{% for tab in dashboard.tabs %}
  {% component (tab.componentName) with {loading: 'lazy'} %}
    {% block loadingContent %}
      <p>Loading {{ tab.label }} ...</p>
    {% endblock %}
  {% endcomponent %}
{% endfor %}

Parentheses distinguish an expression from a literal component name. For example, {% component Alert %} still renders the component named Alert, while {% component (componentName) %} resolves the name from the current context.

Persistent On-Demand Icons

Contributed by Hugo Alliaume in #3741

The icon lock command cannot discover names that are built dynamically, which can leave production dependent on the Iconify API. Enable the new iconify.auto_lock option in development to save every on-demand icon the first time it is rendered:

# config/packages/ux_icons.yaml
when@dev:
  ux_icons:
    iconify:
      auto_lock: true

Browsing the application now writes those icons to assets/icons/. Commit the generated files so production can serve them locally without contacting Iconify.

Translator Is Now Stable

Contributed by Hugo Alliaume in #3716

Symfony UX Translator has been available for three years and its API has stabilized. It is no longer marked as experimental, so applications can use Symfony translations from JavaScript and TypeScript with the regular Symfony backward compatibility expectations.

React and Vue Support for Modern Bundlers

Contributed by Hugo Alliaume in #3714

React and Vue controller registration previously expected Webpack's require.context(). Both integrations now accept import.meta.glob(), which makes them work naturally with Vite and Rsbuild through Symfony Reprise:

import { registerReactControllerComponents } from '@symfony/ux-react';
import { registerVueControllerComponents } from '@symfony/ux-vue';

registerReactControllerComponents(
  import.meta.glob('./react/controllers/**/*.{jsx,tsx}', { eager: true })
);

registerVueControllerComponents(
  import.meta.glob('./vue/controllers/**/*.vue')
);

React components must be imported eagerly. Vue supports both eager imports and lazy loading. Existing Webpack Encore applications can continue using require.context() unchanged.

Full Changelog

• [Toolkit][Common] Add clipboard and tooltip recipes (@kbond)
• [Toolkit] Document Stimulus controller CSS classes and outlets in the API reference (@kbond)
• [Icons] Add auto_lock to persist on-demand icons (@Kocal)
• [TwigComponent] Support component tag names from expressions (@andreybotanic)
• [Toolkit] Rework and normalize usage of attributes.defaults() in kit components (@seb-jean, @Kocal)
• Add sync-packages.php to normalize package .gitattributes files (@Kocal)
• Fix broken assets/tsconfig.json reference affecting Webpack 5.109 and later (@zalesak)
• [Toolkit] Remove the height preview option (@Kocal)
• [Toolkit] Document Stimulus controllers in the recipe API reference (@kbond)
• [Toolkit][Common] Add the closeable recipe (@kbond)
• [Translator] Make the component non-experimental (@Kocal)
• [Toolkit] Add the Bootstrap Toolkit kit (@smnandre, @Kocal)
• [Toolkit] Fix suggested frontend installation commands (@smnandre)
• [Toolkit] Support kit-level dependencies (@smnandre)
• [Toolkit] Require the correct twig/html-extra version for html_attr_* filters (@Kocal)
• [Toolkit] Add a documentation rendering layer so kits can describe themselves (@Kocal)
• [React][Vue] Add support for import.meta.glob() through Symfony Reprise (@Kocal)
• [Toolkit][Common] Add the common kit with logout-link and post-link recipes (@kbond)
• [Toolkit][Shadcn] Fix Table:Cell and Table:Head class attribute merging (@stephen-lewis)
• [Toolkit] Add the ClassMergeSpacingChecker to the linter (@Kocal)

Applications that adopt PHP 8.6's new I/O polling API normally cannot run that code on older PHP versions. Symfony Polyfill 1.41.0 brings this API to PHP 8.1 and later, alongside several compatibility fixes for the Grapheme, Intl and PHP version polyfills.

PHP 8.6 I/O Polling on Older PHP Versions

Contributed by Nicolas Grekas in #612

Monitoring many sockets, pipes or files with stream_select() requires applications and asynchronous frameworks to manage parallel arrays and account for platform limitations. PHP 8.6 introduces the Io\Poll API, a focused, object-oriented interface for waiting until one or more I/O resources are ready.

The new symfony/polyfill-io-poll package makes the same API available on PHP 8.1 and later:

$ composer require symfony/polyfill-io-poll

Create a polling context, register a stream and wait for the requested events:

// src/Network/ConnectionAcceptor.php
namespace App\Network;
use Io\Poll\Context;
use Io\Poll\Event;
use StreamPollHandle;

$server = stream_socket_server('tcp://127.0.0.1:8080');
$poll = new Context();
$poll->add(new StreamPollHandle($server), [Event::Read]);
foreach ($poll->wait(timeoutSeconds: 30) as $watcher) {
    if ($watcher->hasTriggered(Event::Read)) {
        $connection = stream_socket_accept($watcher->getHandle()->getStream());
        // Process the connection
    }
}

A Context can watch multiple handles for read, write, error and hang-up events. Each call to wait() returns the triggered Watcher objects, which can also carry application data and be modified or removed as requirements change.

The polyfill uses the portable Poll backend and does not support edge-triggered events. On PHP 8.6 and later, the native implementation takes over automatically and can select optimized platform backends such as epoll, kqueue, or WSAPoll. The PHP polling API RFC provides the complete API and design details.

Full Changelog

• [Grapheme] Reject out-of-range offsets in the grapheme_str[ri]?pos() family (@nicolas-grekas)
• [IoPoll] Polyfill the Io\Poll API (@nicolas-grekas)
• [Php83][Php85][Grapheme] Throw ValueError on PHP 7 for functions that never returned false (@nicolas-grekas)
• [Intl][Icu] Avoid pulling deprecated symfony/intl 5.4 on PHP < 8.1 (@nicolas-grekas)
• [Php74] Align mb_str_split() polyfill with Mbstring and native (@nicolas-grekas)
• Document the polyfill design principles (@nicolas-grekas)

Symfony 8.0.16 was released on July 29, 2026. It is the last release of the 8.0 branch.

Symfony's release policy gives standard versions eight months of support, with bug fixes and security fixes ending at the same time. Symfony 8.0.0 was published on November 27, 2025, so the branch closes at the end of July 2026, right on schedule. From now on, no further bug fix or security release will be published for 8.0, and the branch is frozen.

Every version that ends its life deserves a look back, and this one has a lot to show.

The release where Symfony met modern PHP once again

Symfony 8.0 shipped the same day as Symfony 7.4 LTS, with the same feature set. That is how Symfony majors work: the last minor of a series and the first of the next one are functionally identical, and the major only removes the code deprecated along the way. For 8.0, that meant deleting 13,202 lines of deprecated code and raising the minimum PHP version to 8.4.

Behind those two numbers sat two years of work, more than 7,300 commits and more than 650 new features, contributed by over 615 people.

The PHP 8.4 requirement is what made 8.0 special. It was not a routine version bump: it let Symfony delete its own implementations of things the engine now does natively.

• Native lazy objects replaced LazyGhostTrait and LazyProxyTrait, so lazy services and Doctrine proxies now rely on the engine instead of generated code.
• DomCrawler and HtmlSanitizer moved to PHP's native HTML5 parser, which is both faster and closer to what browsers actually do.
• __sleep()/__wakeup() gave way to __serialize()/__unserialize() across the components.

A framework that gets smaller while gaining features is a rare thing, and 8.0 is the clearest example of it in Symfony's history.

One way to configure an application

Symfony 8.0 removed the XML configuration format and the fluent PHP config format. What remains is YAML and a new PHP format based on array shapes, designed so that your IDE and your static analyzer understand it.

The array shapes are generated from the actual configuration definitions, so autocompletion and type checking come for free. A config/reference.php file is generated automatically to document everything available, and YAML config files get a JSON schema for validation and autocompletion.

Three formats became two, and the two that remain are better tooled than any of the three were.

Commands you write, not scaffold

Invokable commands became the natural way to write console commands. 8.0 added #[Input] to bind a whole DTO, #[Interact] and #[Ask] for interactive prompts, support for BackedEnum arguments, usages declared through #[AsCommand], the Cursor helper, and support for invokable commands in CommandTester.

The boilerplate that used to open every command class is simply gone.

Four components out of the lab

JsonStreamer, JsonPath and ObjectMapper dropped their experimental status in 8.0 and joined TypeInfo as fully supported components covered by the backward compatibility promise. High performance JSON encoding and decoding, JSONPath queries, object to object mapping and PHP type introspection are now part of the stable surface of the framework.

And a long list of smaller things

• Multi-step forms through FormFlow, with per-step validation and conditional branching.
• Security voters that explain themselves, with the access_decision() and access_decision_for_user() Twig functions, plus #[IsGranted] restricted by HTTP method and stateless CSRF protection based on Sec-Fetch-Site.
• An RFC 9111 compliant CachingHttpClient, so client-side HTTP caching finally follows the spec.
• HTTP QUERY method support, and request body parsing for PUT, DELETE, PATCH and QUERY.
• Signed messages in Messenger, so queued messages cannot be tampered with before consumption.
• Weighted workflow transitions, to model processes that need quantities and not just states.
• UUID v7 by default, with microsecond precision and a MockUuidFactory for deterministic tests.
• Automatic FrankenPHP worker mode detection, and a configurable APP_SHARE_DIR for data shared across servers.
• Readable exception traces in the terminal, instead of HTML dumped into your console.

The full story is in the New in Symfony 8.0/7.4 series and the 8.0.0 beta announcement.

Eight months of maintenance, in numbers

Between 8.0.1 on December 7, 2025 and 8.0.16 on July 29, 2026, the branch received 16 patch releases carrying 646 changes: 592 bug fixes, 29 CVEs and 21 data updates. 270 people authored those commits, touching 62 components. The busiest ones were DependencyInjection, FrameworkBundle, Serializer, Messenger, Cache, Console, Validator and HttpClient.

That is the part of a release nobody advertises, and it is the part that makes the framework trustworthy. Every one of those 592 bug reports had someone who took the time to write it up, and someone who took the time to fix it.

What to do now

If you are still on 8.0, you are running unmaintained code as of today. Two supported paths:

• Upgrade to Symfony 8.1 (released May 29, 2026, maintained until January 2027). The backward compatibility promise applies, so the upgrade should require no change in your code. This is the path to follow if you track the standard release cadence, with 8.2 due in November 2026.
• Move to Symfony 7.4 LTS (bug fixes until November 2028, security fixes until November 2029). It carries the same features as 8.0, plus the deprecated code layers that 8.0 removed. This is the option for teams that need a long support window rather than the latest features.

The upgrade guide and SymfonyInsight upgrade reports will tell you what needs attention. To avoid being caught out next time, subscribe to the roadmap notifications, which announce new releases and end of maintenance dates ahead of time.

Thank you

Thanks to the 615+ contributors who built Symfony 8.0, and to the 270 who kept it healthy for eight months after its release. Thanks as well to everyone who reported a bug, reviewed a pull request, triaged an issue, translated a message, or updated the documentation.

Symfony 8.0 was backed by Sulu, the CMS for Symfony developers, and by PhpStorm, the JetBrains IDE built for PHP. The Symfony 7.4 LTS release published the same day was backed by SensioLabs, JoliCode, redirection.io and Private Packagist. Support like theirs is what allows this release process, and the eight months of maintenance that follow every version, to exist at all.

See you on 8.1.

Symfony 8.1 is backed by:

TYPO3 is an open source enterprise content management system, built with open web standards. It delivers high-performance digital solutions through a robust feature set renowned for its scalable architecture, multisite and multilingual capabilities, and connectivity. TYPO3 has been certified as a digital public good by the Digital Public Goods Alliance, bringing a trusted CMS platform to the broader PHP and Symfony ecosystem.

Mailtrap is a platform for testing and delivering emails, designed to support modern development workflows and production-grade sending. It offers secure sandboxes, email APIs, and monitoring tools for reliable email delivery.

Shopware is an open headless commerce platform powered by Symfony and Vue.js that is used by thousands of shops and supported by a huge, worldwide community of developers, agencies and merchants.

Les-Tilleuls.coop is a team of 70+ Symfony experts who can help you design, develop and fix your projects. We provide a wide range of professional services including development, consulting, coaching, training and audits. We also are highly skilled in JS, Go and DevOps. We are a worker cooperative!

Symfony 8.1.3 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.2

• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

❤️ Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

💼 Lead Symfony Developer at DocuPet

View Symfony jobs →

CA$140,000 – CA$180,000 / year - Full remote