Changelog (v8.1.6...v8.1.7) data #66075 Release v8.1.7 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66059 [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas) bug #66057 [Messenger] Do not drop the Beanstalkd keepalive raised during a c…
Changelog (v7.4.18...v7.4.19) data #66074 Release v7.4.19 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66059 [Messenger] Keep the worker running when a keepalive fails (@nicolas-grekas) bug #66057 [Messenger] Do not drop the Beanstalkd keepalive raised during…
Changelog (v6.4.45...v6.4.46) data #66073 Release v6.4.46 minor #66070 [Security] Explain why a remember-me login counts as interactive (@nicolas-grekas) minor #66060 [Form] Add the BoundsType compare message translation unit (@seb-jean) bug #66048 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas) bug #66043 [TwigBridge] Compose form theme blocks wit…
Changelog (v8.1.5...v8.1.6) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65748 [PropertyInfo] Read only the doc block of a promoted…
Changelog (v7.4.17...v7.4.18) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65740 [HttpClient] Reject https:// proxies that curl woul…
Changelog (v6.4.44...v6.4.45) bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas) bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas) bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas) bug #65740 [HttpClient] Reject https:// proxies that curl woul…
Changelog (v8.1.4...v8.1.5) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was delete…
Changelog (v7.4.16...v7.4.17) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was dele…
Changelog (v6.4.43...v6.4.44) bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas) bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas) minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum) bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was dele…
Changelog (v8.1.3...v8.1.4) bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278) bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2) bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2) bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@s…
Changelog (v7.4.15...v7.4.16) bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278) bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2) bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2) bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (…
Changelog (v8.1.2...v8.1.3) minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus) bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)
Changelog (v8.0.15...v8.0.16) minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)
Changelog (v8.1.1...v8.1.2) bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) bug #65025 [Serializer] Check the denormalized class is a…
Changelog (v8.0.14...v8.0.15) bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) bug #65025 [Serializer] Check the denormalized class is…
Changelog (v7.4.14...v7.4.15) bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) bug #65025 [Serializer] Check the denormalized class is…
Changelog (v6.4.42...v6.4.43) bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas) bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas) bug #65023 [HttpFoundation] V…
Changelog (v8.1.0...v8.1.1) data #64731 Release v8.1.1 bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld) minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) minor #64715 Bump the github-actions group across 1 directory with 2 up…
Changelog (v8.0.13...v8.0.14) data #64730 Release v8.0.14 bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld) minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) minor #64715 Bump the github-actions group across 1 directory with 2…
Changelog (v7.4.13...v7.4.14) data #64729 Release v7.4.14 bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld) minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) minor #64715 Bump the github-actions group across 1 directory with 2…
Changelog (v6.4.41...v6.4.42) data #64728 Release v6.4.42 bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld) minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot]) data #64692 [Validator] Remove needs-review-translation state from Spanish…
Changelog (v8.1.0-RC1...v8.1.0) data #64399 Release v8.1.0 feature #64398 Shopware is backing Symfony 8.1, thanks to them! (@nicolas-grekas) feature #64397 Mailtrap is backing Ssymfony 8.1, thanks to them! (@nicolas-grekas) feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (@nicolas-grekas) feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (@nicolas-grekas) bug #6…
Changelog (v8.1.0-BETA3...v8.1.0-RC1) data #64377 Release v8.1.0-RC1 security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas) security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (@nicolas-grekas) security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace…
Changelog (v8.0.12...v8.0.13) data #64374 Release v8.0.13 security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas) security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (@nicolas-grekas) security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@n…
Changelog (v7.4.12...v7.4.13) data #64372 Release v7.4.13 security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas) security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (@nicolas-grekas) security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@n…
Changelog (v6.4.40...v6.4.41) data #64371 Release v6.4.41 security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (@nicolas-grekas) security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas) security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE…
Changelog (v5.4.52...v5.4.53) data #64370 Release v5.4.53 security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (@nicolas-grekas) security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas) security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (@nicolas-…