Changelog (v8.1.11...v8.2.0-BETA1) minor #67843 Release v8.2.0-BETA1 minor #67838 Require v3.8.1 of the contracts (@nicolas-grekas) minor #67841 Release v8.1.11 minor #67828 [DependencyInjection][FrameworkBundle] Generate config/reference.php and config/schema.json in apps without FrameworkBundle (@dtokos) minor #67827 [Process] Poll with short sleeps first when waiting for a process whose pipes a…
Changelog (v8.1.10...v8.1.11) minor #67841 Release v8.1.11 bug #67834 [HttpKernel] Accept only form, JSON and XML payloads in #[MapRequestPayload] unless acceptFormat lists other formats (@nicolas-grekas) security #GHSA-cpww-5vpx-72x7 [JsonPath] Evaluate absolute queries in filters once per query instead of once per node (@nicolas-grekas) security #GHSA-hwfg-qwvh-2wfx [HttpKernel] Don't decode CSV…
Changelog (v7.4.22...v7.4.23) minor #67840 Release v7.4.23 bug #67834 [HttpKernel] Accept only form, JSON and XML payloads in #[MapRequestPayload] unless acceptFormat lists other formats (@nicolas-grekas) security #GHSA-cpww-5vpx-72x7 [JsonPath] Evaluate absolute queries in filters once per query instead of once per node (@nicolas-grekas) security #GHSA-hwfg-qwvh-2wfx [HttpKernel] Don't decode CSV…
Changelog (v6.4.49...v6.4.50) minor #67839 Release v6.4.50 security #GHSA-q8jq-xrf4-v5j8 [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset (@nicolas-grekas) security #cve-2026-118517 [HtmlSanitizer] Require special schemes and scheme-relative URLs to carry a non-empty authority (@nicolas-grekas) security #GHSA-wm2w-4mgj-vw33 [HtmlSanitizer] Fix meta refresh URL sanitization bypass (@n…
Changelog (v5.4.55...v5.4.56) minor #67837 Release v5.4.56 security #GHSA-4qpf-57w4-m3wc [Validator] Reject non-public IP addresses in the no-priv, no-res and only-public modes (@nicolas-grekas) security #GHSA-5jff-8h8q-r5qx [Config] Do not validate XML documents on parse (@nicolas-grekas) security #GHSA-c7hm-wqwp-f9v8 [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient (@nicolas…
Changelog (v8.1.9...v8.1.10) minor #67593 Release v8.1.10 security #cve-2026-45070 [Mime] Reject parameter names containing non-token characters (@alexandre-daubois) minor #67589 [Form] Refine Persian date interval and locale translations (@ephpicman) bug #67587 [JsonStreamer] Reject scalar values of the wrong type instead of converting them (@nicolas-grekas) bug #67581 [HttpKernel] Don't keep the…
Changelog (v7.4.21...v7.4.22) minor #67592 Release v7.4.22 security #cve-2026-45070 [Mime] Reject parameter names containing non-token characters (@alexandre-daubois) minor #67589 [Form] Refine Persian date interval and locale translations (@ephpicman) bug #67587 [JsonStreamer] Reject scalar values of the wrong type instead of converting them (@nicolas-grekas) bug #67581 [HttpKernel] Don't keep th…
Changelog (v6.4.48...v6.4.49) minor #67591 Release v6.4.49 security #cve-2026-45070 [Mime] Reject parameter names containing non-token characters (@alexandre-daubois) minor #67589 [Form] Refine Persian date interval and locale translations (@ephpicman) bug #67581 [HttpKernel] Don't keep the stale container when rebuilding it fails (@lazerg) bug #67576 [Console] Don't format escaped tags again when…
Changelog (v5.4.54...v5.4.55) minor #67590 Release v5.4.55 security #cve-2026-45070 [Mime] Reject parameter names containing non-token characters (@alexandre-daubois) bug #67576 [Console] Don't format escaped tags again when sections measure their lines (@nicolas-grekas) bug #67508 [Routing] Don't ignore route conditions that are "0" (@nicolas-grekas) bug #67478 [Mime] Escape backslashes in Addres…
Changelog (v5.4.53...v5.4.54) minor #66959 Release v5.4.54 security #cve-2026-109449 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas, @lazerg) security #cve-2026-108082 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas) security #cve-2026-109413 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas) bug…
Changelog (v8.1.8...v8.1.9) minor #66917 Release v8.1.9 bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it (@HypeMC) minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas) bug #66885 [Messenger] Fix PhpSerializer::getMe…
Changelog (v7.4.20...v7.4.21) minor #66916 Release v7.4.21 bug #66905 [DoctrineBridge] Reset a non-lazy manager instead of emptying it (@HypeMC) minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas) bug #66885 [Messenger] Fix PhpSerializer::ge…
Changelog (v6.4.47...v6.4.48) minor #66915 Release v6.4.48 minor #66903 [Form][Validator] Fix Tagalog (tl) translations and typos (@jcparucha) bug #66899 [HttpClient] Fix RetryableHttpClient::withOptions() changing the base URIs of the original client (@nicolas-grekas) bug #66894 [DependencyInjection] Fix ignoring env var processors after resolving env vars before compilation (@nicolas-grekas) bug…
Changelog (v8.1.7...v8.1.8) minor #66443 Release v8.1.8 bug #66436 [Mailer][Sweego] Send the Reply-To address through the dedicated API field (@damient) minor #66438 [Form][Validator] Review Dutch (nl) translations (@michelvelswijk) bug #66434 [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti) bug #66433 [Messenger] Prevent PhpSerializer::ge…
Changelog (v7.4.19...v7.4.20) minor #66442 Release v7.4.20 bug #66436 [Mailer][Sweego] Send the Reply-To address through the dedicated API field (@damient) minor #66438 [Form][Validator] Review Dutch (nl) translations (@michelvelswijk) bug #66434 [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti) bug #66433 [Messenger] Prevent PhpSerializer:…
Changelog (v6.4.46...v6.4.47) minor #66441 Release v6.4.47 minor #66438 [Form][Validator] Review Dutch (nl) translations (@michelvelswijk) bug #66434 [DependencyInjection] Track env placeholders reused after a previous extension dropped them (@TamasSzigeti) bug #66416 [DependencyInjection][Routing] Escape identifiers in generated PHP (@thomas-chauchefoin-tob) minor #66430 [FrameworkBundle] Fix the…
Changelog (v8.1.6...v8.1.7) data #66075 Release v8.1.7 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66059 [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas) bug #66057 [Messenger] Do not drop the Beanstalkd keepalive raised during a c…
Changelog (v7.4.18...v7.4.19) data #66074 Release v7.4.19 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66059 [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas) bug #66057 [Messenger] Do not drop the Beanstalkd keepalive raised during…
Changelog (v6.4.45...v6.4.46) data #66073 Release v6.4.46 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66048 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas) bug #66043 [TwigBridge] Compose form theme blocks wit…
Changelog (v8.1.5...v8.1.6) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65748 [PropertyInfo] Read only the doc block of a promoted…
Changelog (v7.4.17...v7.4.18) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65740 [HttpClient] Reject https:// proxies that curl woul…
Changelog (v6.4.44...v6.4.45) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65740 [HttpClient] Reject https:// proxies that curl woul…
Changelog (v8.1.4...v8.1.5) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was delete…
Changelog (v7.4.16...v7.4.17) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was dele…
Changelog (v6.4.43...v6.4.44) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was dele…
Changelog (v8.1.3...v8.1.4) bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278) bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2) bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2) bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@s…
Changelog (v7.4.15...v7.4.16) bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278) bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2) bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2) bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (…
Changelog (v8.1.2...v8.1.3) minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus) bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)
Changelog (v8.0.15...v8.0.16) minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)
Changelog (v8.1.1...v8.1.2) bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) bug #65025 [Serializer] Check the denormalized class is a…