Symfony Blog

SymfonyCon Warsaw 2026: PHP wasn't supposed to do that

Eloïse Charrier — Wed, 09 Sep 2026 11:00:00 +0200

We are thrilled to announce that SymfonyCon Warsaw 2026 will take place on November 26 and 27, 2026, in Warsaw (Poland)! Join us for a great worldwide conference with 3 parallel tracks and community events.

🎤 Speaker announcement

We are delighted to welcome Felix Eymonot, Lead Dev, Bludevon for his talk "PHP wasn't supposed to do that":

"To build a website, we used PHP. To build a mobile application, we used something else. It was a simple rule. Almost self-evident.

Then one day, a request arrived, the kind every team eventually hears: "The website is great. Now we need a mobile app."

From there the script is usually familiar: new technologies, new skills, new hires, new lines in a README nobody will read.

But what if, this time, the story could unfold differently?

In this talk, I'll show how Symfony UX Native quietly bends what we thought was an immovable line between web and mobile. Through concrete demos, we'll see how a single Symfony codebase (Twig templates, Doctrine entities, Form types, all of it ) turns into a real iOS and Android application via Hotwire Native. We'll write a bridge component live. We'll watch ux_is_native() reshape a single template for two surfaces. We'll talk honestly about architecture, developer experience, the limits of the approach, the use cases where it genuinely shines, and the questions every PHP developer asks the first time they see it work.

After Twig Components and Live Components, this is perhaps the next chapter of the story: when Symfony leaves the browser and installs itself on the home screen of your users' phones.

Because in the end, the surprising thing isn't that a mobile application can be built with Symfony. The surprising thing is that it's starting to feel perfectly logical, even though PHP wasn't supposed to do that.

(PS: No PHP developer was harmed, or forced to learn Swift, during the preparation of this talk.)"

Click here to see more talks. The full schedule will be unveiled step-by-step over the coming weeks. Stay tuned!

Ready to join us?

🏨 Accommodation

The official conference hotel offers special preferential rates and flexible conditions for our attendees. Make sure to use our dedicated link to book your room and stay right where the action happens!

🥳 Save the date for the Community Party!

Because SymfonyCon isn't just about code, we are happy to confirm that our traditional Community Party will take place on the evening of Thursday, November 26. Get ready for a great night of networking, fun, and connecting with peers!

💻 Hackday

Ready to contribute? The Hackday on Saturday, November 28 (free and open to all!) will take place at "The Brain Embassy - Czackiego" thanks to the support of Baksla.sh. Bring your laptop and your good mood!

🎟️ Get your tickets

Regular tickets are available now and for the next 14 days only! Secure your ticket today

Join us online!

💡Follow the "conference" blog posts to not miss anything!

Want the latest Symfony updates? Follow us and tune in from wherever you are 🌎

Sponsor the Symfony project.

SymfonyCon Warsaw 2026: Unveiling the workshop lineup!

Eloïse Charrier — Mon, 07 Sep 2026 17:35:00 +0200

We are counting down to SymfonyCon Warsaw 2026, taking place on November 26-27, 2026, in Warsaw (Poland)! Get ready for a week full of workshops, sessions, and community magic.

Great news today: all workshops are now online and open for registration! 👉 Check out the full list of workshops and register today!

🎓 Unveiling the workshop lineup

Want to level up your skills before the main conference? Join us on November 24 & 25 for our intensive, hands-on workshops led by industry experts.

Whether you're looking for a 2-day deep dive or a focused 1-day track, here is the full schedule:

🗓️ 2-day workshops (Nov 24 – 25)

🚀 Symfony 8: the fast track
Trainer: Benjamin Zaslavsky
Build a production-ready application from scratch using Symfony 8.1 idioms, Zero-Node Frontends (Symfony UX & AssetMapper), native AI integration, and Upsun deployments.
☸️ Kubernetes deployment for Symfony
Trainer: Tugdual Saunier
Go from a simple single-pod setup to an almost production-ready Kubernetes deployment tailored for Symfony applications.

🗓️ 1-day workshops — Tuesday, November 24

🏗️ Refactoring Towards Clean Architecture
Trainer: Damian Dziaduch
Transform legacy Symfony codebases into maintainable, resilient applications using SOLID principles, Dependency Inversion, and boundary separation.
🗄️ Doctrine ORM: Deep Dive
Trainers: Denis Brumann & Oliver Kossin
Explore current best practices, breaking changes, and advanced features in Doctrine ORM & DBAL through practical exercises.
🤖 Symfony AI - Discover The New Ecosystem
Trainer: Stiven Llupa
Dive into Symfony’s new AI ecosystem to build simple AI features and complex agentic workflows in PHP.
🎨 Deep dive into Symfony UX
Trainer: David Buchmann
Master Twig, Hotwire Turbo, Stimulus, and Live Components to build rich frontends with minimal JavaScript.
🕵️ Becoming the Godfather of Threat Modeling
Trainer: Mike Vanderbijl
Learn how to anticipate security risks, identify application vulnerabilities, and build a proactive defense mindset.

🗓️ 1-day workshops — Wednesday, November 25

🧠 Refactor yourself - you are (not) a machine
Trainer: Peter Dietrich
A non-technical workshop using developer metaphors and Gestalt therapy principles to help you uncover behavioral patterns and stop self-sabotage.
📊 Making Your Symfony App Observable Without the Pain
Trainer: Alexandre Daubois
Leverage FrankenPHP and runtime signals to set up reliable, real-time production observability in minutes.
🔒 Level Up Your Symfony Security
Trainer: Florent Morselli
Reinforce your application's security, harden authentication strategies, and audit existing security flows.
🧪 Test Driven Development the Right Way
Trainer: Diego Aguiar
Demystify TDD with PHPUnit, learn the Arrange-Act-Assert pattern, and speed up your development workflow.
🧩 Unlock the Power of Sulu 3: Go Beyond the CMS Basics
Trainer: Oliver Kossin
Extend Sulu 3 with custom Symfony bundles, build advanced features, and explore Sulu.AI.

Seats are limited to maintain small group interactions, so make sure to reserve your spot early! Check out the full list of workshops and register today!

Ready to join us?

🏨 Accommodation

🥳 Save the date for the Community Party!

💻 Hackday

🎟️ Get your tickets

Regular tickets are available now, but don't wait too long, it's only up to September 23rd. Secure your ticket today!

Join us online!

💡 Follow the "conference" blog posts to not miss anything!

Want the latest Symfony updates? Follow us and tune in from wherever you are 🌎

Sponsor the Symfony project.

A Week of Symfony #1027 (August 31 – September 6, 2026)

Javier Eguiluz — Sun, 06 Sep 2026 09:46:00 +0200

This week, Symfony 6.4.45, 7.4.18, and 8.1.6 were released with numerous bug fixes and hardening improvements. Meanwhile, we introduced symfony lsp:check, a new command that brings Symfony-aware diagnostics to your CI pipeline, catching unknown routes, missing templates, and configuration errors. Finally, we announced that you'll be able to meet the Symfony Core Team at the API Platform Conference 2026 in Lille on September 17–18.

Symfony development highlights

This week, 191 pull requests were merged (158 in code and 33 in docs) and 44 issues were closed (25 in code and 19 in docs). Excluding merges, 58 authors made additions and deletions. See details for code and docs.

6.4 changelog:

d8f8099: [Form] stop capturing Options in the upload_max_size_message closure
892055e: [FrameworkBundle] describe the webhook routing secret in the config reference
4309470: [Mailer] mark the Sendgrid webhook secret as sensitive
075471f: [Notifier] reject an empty secret in the Twilio webhook parser
5c090b9: [Webhook] reject a malformed request body with a 406 instead of a 500
9f41173: [Mime] do not treat an "@" inside the domain as the addr-spec separator
7420a8d: [Mailer, Sendgrid] verify the webhook signature before parsing the payload
7a5183e: [HttpFoundation] match paths with the DOTALL modifier
cb30648: [Notifier, Vonage] verify the payload_hash claim of signed webhooks
26456f2: [Mime] never emit a raw control character in a header
3e26161: [Messenger] fix a crash when a Redis stream entry is not a JSON object
5230b74: [Console] test the shell completion scripts and fix the escaping
5439381: [Process] use an absolute path for the cmd.exe fallback on Windows
d5eef83: [Form] accept UTC-equivalent timezones for date and time model data
8d7540c: [Finder] fix prune filters not applied to nested directories and with path excludes
f94fd8f: [Console] fix the bash completion on macOS and cover more option modes
283abf9: [Console] fix the bash completion of "--option=value" and of an aliased command
ce4f440: [Console] do not evaluate the command line in the zsh completion
4fd61ee: [WebProfilerBundle] fix a TypeError when the ajax toolbar panel is missing from the page
788ace9: [String] fix singularization of words ending in -ives
4c18bb5: [HttpFoundation] fix hitting the PCRE size limit with many trusted host patterns
cb0d402: [PropertyInfo] do not prefer a method returning the declaring class as the property accessor
7ae77ca: [Mime] reject header names containing non-printable or non-ASCII characters
701c938: [HtmlSanitizer] drop relative URLs whose first path segment contains a colon instead of throwing

7.4 changelog:

6285a43: [Mailer, Notifier] mark webhook secrets as sensitive
8c84e00: [Mailer, Notifier] reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers
e0f5a76: [Mailer] reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers
3791801: [Mailer, Notifier] verify webhook signatures before parsing the payload
21241f1: [JsonStreamer] fix generator stream exhaustion on chunked file reading
1ebccec: [Notifier] fix typo in Bluesky transport exception message
7a7cb11: [String] fix localeTitle() titlecasing only the first word when the locale has no transliterator

8.1 changelog:

177a6c7: [VarDumper] fix dumping class names to the dump server
75ee906: [Scheduler] fix duplicated schedule message when multiple methods in a class use #[AsCronTask]
00d1505: [Console] fix signal handling of invokable commands registered through the container
7c52a22: [Console] make method-level #[AsCommand] names relative to the class-level one

8.2 changelog:

4393cdb: [Mailer] reject an empty secret in the Azure webhook parser
647af27: [Mailer, Mime] update the RFC references and document what Address validates
4ebe3e5: [FrameworkBundle] add "framework.webhook.no_private_network" and "framework.webhook.http_client" options
50b0d81: [Messenger] support raw Redis stream messages
5605faf: [Mailer, Notifier] deprecate reading a non-boolean value with Dsn::getBooleanOption()
bce08b3: [Mailer] support tags in the MailerSend transports
07709d2: [Lock, Messenger, Notifier] add the "ssl" DSN option to select the HTTP scheme
d09510b: [Form] add the "form.post_validate" event
81fb59e: [Tui] add KeyBindingWidget
99f824c: [Tui] add CollapsibleWidget
e2fda34: [Tui] keep a widget's listeners across detach, and add off() to release them
262451a: [Security] add an OIDC Authorization Code Flow authenticator
8144a9f: [Tui] add tab widget
340586b: [Serializer] support extensible discriminator map via child attribute
57d450b: [Form] use the POST_VALIDATE event in PasswordHasherExtension
6d46a24: [Mailer, Mime] add RFC 6854 group support to mailbox list headers
5617fa0: [Messenger] add claim check support
0449d5c: [Yaml, FrameworkBundle] add JSON Schema validation to the lint:yaml command
f3c0b6a: [HttpKernel, RateLimiter] add option to expose X-RateLimit-* headers for the #[RateLimit] attribute
fd64a46: [Messenger] add AMPHP SQL messenger transport
9fb98ad: [Messenger] add SQS system attributes of received messages to AmazonSqsReceivedStamp
4612d33: [Finder] add root-relative directory excludes via / prefix in exclude()
d2be782: [FrameworkBundle] remove dev requirement on symfony/amp-sql-messenger
a6d9bac: [Config, FrameworkBundle, Yaml] fix schema violation lines and the list form of keyed maps
03097ea: [Console] declare docblock types for parameters of addArgument() and addOption()
0f33c88: [Security] add OIDC token-endpoint client authentication methods
f80cfe3: [SecurityBundle] always register the OIDC login callback route loader
0ae9a49: [Yaml] walk the document to resolve schema violation lines
7b08227: [Translation] add translation:update-xliff-sources command
3798b58: [Form] add #[AsFormType] and #[FormField] attributes to define form types on data classes
eae2b16: [Security] verify the OIDC ID token signature against the provider JWKS
a7e7eb8: [SecurityBundle] require the OIDC ID token signature verification for public clients
f3509f0: [Security, SecurityBundle] add OIDC PKCE, max_age, authorization-request and start-route options
3f96455: [Security, SecurityBundle] add OIDC claims source, user-identifier mapping and RP-Initiated Logout
cdc6c0b: [Messenger] force quit messenger:consume and messenger:failed:retry on repeated SIGINT
d991fc9: [Security] allow AuthorizationChecker::isGrantedForUser to check for guest permissions
718e281: [Mailer] add RemoteTemplateEmail to send emails rendered from provider-hosted templates
7ab6d43: [Mailer] add RemoteTemplateEmail support to the remaining bridges with provider-hosted templates
3370aa2: [Form] add an allow_array_submission option to let PRE_SUBMIT listeners transform submitted arrays
68f2352: [Filesystem] deprecate passing an empty string as the base path to Path::isBasePath()
c820a90: [Cache] add MongoDB cache adapters
2f26170: [Security] tell why an authenticator did not support the request in the profiler
9f992bb: [Cache, Lock, Messenger] track the Symfony component in the MongoDB driver handshake
77eda6f: [RateLimiter] stop consuming from the remaining limiters once one rejects the hit
4520f5e: [RateLimiter] allow overriding the key of a compound limiter's sub-limiters
470440a: [Mailer] add PufferPost bridge
e747895: [Messenger] add routing information to the debug:messenger command
4deeb4f: [Security] deprecate passing more than one attribute to AccessDecisionManager::decide()
ecf1cb6: [String] add a $regexp argument to the case conversion methods
e154713: [Security] add a current_user() function to the expression language provider
cda9102: [String] fix ByteString::title() titlecasing only the first word of a match

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

Symfony Developer at Steward
Part-time / Temporary - $8,700 – $13,000 / month
Full remote
View details
Symfony Developer at ATH
Contract / Freelance - €25 – €50 / hour
Full remote
View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

New course announced: Symfony Security: Going Further
(Video) Symfony Security: The Basics: Creating a Registration Form
(Video) Symfony Security: The Basics: Security Events: Tracking the Last Login

They talked about us

Upcoming Symfony Events

Symfony Meetup Köln: Cologne, Germany (September 24, 2026)
Sylius France Community Meetup by ACSEO: Aix en Provence, France (September 28, 2026)

Call to Action

Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Sponsor the Symfony project.

Meet the Symfony Core Team at the API Platform Conference 2026!

Cécile HAMEREL — Wed, 02 Sep 2026 16:30:00 +0200

The API Platform Conference, the international event dedicated to the API Platform framework and its ecosystem, will take place in two weeks in Lille, France, on September 17–18, 2026. Nearly 30 talks are scheduled, in both French and English, covering case studies around API Platform as well as tools and frameworks related to this project, created in 2015 and now a leading solution for building modern and efficient APIs. This year again, Symfony is a proud community partner of the event: meet us on the exhibition floor!

Among all the speakers and sessions planned during these two days, seven Symfony Core Team members will once again take the stage:

Kévin Dunglas, API Platform's creator, will open the conference with the opening keynote.
Nicolas Grekas, Symfony's principal core team member, will deliver a talk on Thursday, right after Soyuka's Keynote. Details on his session are still to be announced.
Robin Chalas will present From Zend Framework 1 to API Platform 4: Migration Recipe, a real-world migration case study covering legacy modernization and AI-assisted tooling.
Alexandre Daubois will show how to observe FrankenPHP, putting DX at the service of performance, live and without configuration.
Mathieu Santostefano will help you keep secure APIs without losing your mind, covering OAuth2, OIDC, JWT, and Keycloak.
Mathias Arlaud will revisit DDD x API Platform, 4 years later, covering hexagonal architecture and message-oriented patterns.
Florent Morselli will cover HTTP headers as the first line of defense for APIs and the frontend, with CSP, CORS, COOP, and COEP examples in Symfony and API Platform.

More information about the speakers and schedule can be found on the event's website.

The program leans hard into where PHP is heading next: FrankenPHP performance and tooling, AI agents and MCP as new API consumers, and honest feedback from teams running API Platform in production. Don't miss your chance to attend this incredible event, and make sure to secure your seat before tickets run out.

Any questions about the API Platform Conference 2026? Get in touch with Les-Tilleuls.coop, the event organizers.

Sponsor the Symfony project.

Introducing symfony lsp:check: Symfony-Aware Diagnostics in Your CI

Fabien Potencier — Mon, 31 Aug 2026 14:03:00 +0200

A Symfony application is full of strings that mean something: route names, template paths, translation keys, service ids, bundle configuration keys. To PHP, they are strings like any others. Your CI pipeline verifies types with PHPStan or Psalm, style with PHP-CS-Fixer and behavior with PHPUnit, but nothing alerts you if you make a typo like redirectToRoute('order_confirmaton').

The latest version of the Symfony Language Tools closes that gap. The new check command runs a headless version of the Symfony-aware diagnostics from the editor integrations: against saved files, from the command line, in CI. It works for every Symfony application, whether or not anyone on the team uses an editor integration.

Your CI Doesn't Know Symfony

Symfony reports these mistakes late, or never: mistyped route names, missing templates, missing translation keys. They survive static analysis and code review because, as far as types are concerned, everything is fine. Even the PHPStan Symfony extension, which makes PHP analysis container-aware, works at the type level and inside PHP files; templates, translations, routes and configuration files stay out of its reach.

The editor integrations catch these mistakes while you type, but an editor does not review a pull request and is not attached when a script or a coding agent modifies the application. These checks belong in CI, next to the tools you already run.

One Command in Symfony CLI

If you use the Symfony CLI (version 5.20.0 or newer), you already have the checker. Run it from the root of your workspace:

        
        $ symfony lsp:check

Project .: runtime metadata, environment dev, complete
.:src/Controller/CheckoutController.php:14:40: error [route.not_found] Route "order_confirmaton" does not exist in the selected environment.
.:templates/checkout/confirmation.html.twig:1:8: error [translation.not_found] Translation "checkout.confirmed" does not exist in domain "messages".
.:templates/checkout/confirmation.html.twig:2:13: error [template.not_found] Template "checkout/summary.html.twig" does not exist in the selected environment.
Summary: 3 diagnostics, 3 active, 0 baseline matches, 0 stale baseline entries, 3 blocking
    

Symfony CLI downloads the latest stable Symfony Language Tools automatically or you can download it from GitHub Releases and run symfony-lsp check; both invocations accept the same options.

Without arguments, the command discovers Symfony applications and checks all supported project files; pass files, directories or patterns to focus the analysis:

        
        $ symfony lsp:check src/ templates/
$ symfony lsp:check 'config/**/*.yaml'

The command reports Symfony-specific problems only, 30 diagnostic codes today (symfony lsp:check --list-codes):

unknown routes and missing required route parameters;
missing templates and Twig components;
unknown arguments of Twig functions and filters;
missing translation keys, domains and message placeholders;
unknown services and parameters;
unknown console argument and option names;
invalid bundle configuration keys, types and enums;
unknown or incompatible environment variable processors;
unknown Messenger buses and transports, and invalid handler signatures;
unknown validation constraint options;
unknown Stimulus controllers and importmap entrypoints;
unknown security firewalls and user providers;
unknown form options and invalid event listener methods.

Runtime analysis is enabled by default: the checker boots each application in the selected Symfony environment and loads the same routes, services, bundle configuration and other runtime metadata as the editor integrations, so diagnostics reflect your real application, not a guess based on conventions. Through Symfony CLI, it also inherits the project-aware symfony php selection of PHP version and configuration. When a CI job must not execute application code, use source-only mode:

$ symfony lsp:check --source-only

Reports say which analysis mode was used, and a runtime or indexing failure marks the result as incomplete instead of silently falling back to source-only analysis.

Reports Built for CI

The default report is a deterministic, human-readable list of projects, diagnostics and summary counts; three structured formats target other tools:

        
        $ symfony lsp:check --format=json > diagnostics.json
$ symfony lsp:check --format=github
$ symfony lsp:check --format=sarif > symfony-lsp.sarif
    

The GitHub format emits workflow annotations directly on files and lines. A minimal GitHub Actions job:

        
        # .github/workflows/symfony-diagnostics.yaml
name: Symfony diagnostics

on: [push, pull_request]

jobs:
    check:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v7
            - uses: shivammathur/setup-php@v2
              with:
                  php-version: '8.4'
                  tools: symfony-cli
            - run: composer install --no-progress
            - run: symfony lsp:check --format=github
    

The SARIF 2.1 report can be uploaded to code-scanning systems and includes stable fingerprints, so findings can be tracked between runs.

Exit statuses distinguish findings from failures in the checker itself:

0: analysis completed without blocking diagnostics;
10: analysis completed with blocking diagnostics;
11: invocation, configuration, selection, code policy or baseline is invalid;
12: analysis is incomplete because of an indexing, timeout, process or internal failure.

A failing diagnostic provider does not discard the other providers' findings: the partial report remains available, but the incomplete status and exit code 12 prevent CI from treating it as clean.

Adopt the Checker Gradually

An existing application may already contain known diagnostics. An occurrence-specific baseline enforces new findings without hiding the existing ones:

        
        $ symfony lsp:check --generate-baseline
$ symfony lsp:check --baseline=.symfony-lsp-baseline.json

Matches remain visible but do not block, survive unrelated line movement and distinguish repeated occurrences of the same diagnostic. Refresh the baseline explicitly with --refresh-baseline, or add --strict-baseline to require stale entries to be removed.

You can also choose which diagnostic codes block CI without filtering the report:

$ symfony lsp:check --fail-on=route.not_found,translation.not_found

Unknown codes are rejected, so a renamed or removed code cannot silently weaken the policy.

The checker and the editor integrations share the .symfony-lsp.json project configuration. Path exclusions are useful for embedded fixtures and generated sources, and missing-translation diagnostics are opt-in, as in the editor:

        
        {
    "version": 1,
    "translationDiagnostics": true,
    "excludePaths": [
        "tests/Fixtures/**",
        "generated/"
    ]
}
    

See the headless diagnostics guide for output schemas, baseline behavior, privacy guarantees, caching and the complete command-line reference, and the project configuration guide for the shared settings.

Built for Agents Too

Coding agents write a growing share of your Symfony code, and they work the way CI does: no editor attached, validating their changes with command-line tools. Give them this one. An agent that runs symfony lsp:check after each change catches its own invented route names, stale template references and broken configuration before a human reviews the diff.

The command is designed for that loop: deterministic reports, stable exit codes, machine-readable formats with precise positions and a discoverable diagnostic contract. A human and an agent running the same check see exactly the same findings.

Add It to Your Pipeline

Start with a local symfony lsp:check, add a baseline if the application needs one, then choose the output format and blocking policy that fit your pipeline. Editor users keep the diagnostics they already have; now the rest of the team, the CI and your agents get them too.

If the checker reports something it should not, misses a Symfony pattern used by your application or cannot boot the project reliably, report it on the issue tracker.

Sponsor the Symfony project.

Symfony 8.1.6 released

Fabien Potencier — Sun, 30 Aug 2026 23:44:04 +0200

Symfony 8.1.6 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.5

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
bug #65697 [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
minor #65665 [Validator] fix comment for Url requireTld argument (@dmitryuk)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65657 [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
bug #65656 [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65640 [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65632 [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
bug #65613 [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
data #64370 Release v5.4.53

Sponsor the Symfony project.

Symfony 7.4.18 released

Fabien Potencier — Sun, 30 Aug 2026 23:39:49 +0200

Symfony 7.4.18 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Changelog Since Symfony 7.4.17

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
data #64370 Release v5.4.53

Sponsor the Symfony project.

Symfony 6.4.45 released

Fabien Potencier — Sun, 30 Aug 2026 23:23:32 +0200

Symfony 6.4.45 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Changelog Since Symfony 6.4.44

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
data #64370 Release v5.4.53

Sponsor the Symfony project.

A Week of Symfony #1026 (August 24–30, 2026)

Javier Eguiluz — Sun, 30 Aug 2026 09:43:00 +0200

This week, Symfony development activity focused mostly on bug fixes, while the community celebrated a busy first week for Symfony Language Tools and the release of Symfony Reprise 1.0.0.

Symfony development highlights

This week, 112 pull requests were merged (72 in code and 40 in docs) and 68 issues were closed (40 in code and 28 in docs). Excluding merges, 44 authors made additions and deletions. See details for code and docs.

6.4 changelog:

757b06e: [PropertyInfo] do not prefer a static named constructor as the property accessor
0cb81e0: [PropertyInfo] do not prefer a static named constructor as the property mutator
38bc4c0: [Cache] fix authenticating to the master when using Redis Sentinel
f0146f7: [HttpKernel] fix regression when a locale aware service is never initialized
19a9f0c: [Console, FrameworkBundle] fix profiling a command stopped at ConsoleEvents::COMMAND
9814363: [Notifier] fix escaping of MarkdownV2 markup in TelegramTransport
ba62bf3: [Yaml] quote strings that look like octal numbers when dumping
1b0bfd1: [Serializer] fix max depth counting for subclasses that inherit MaxDepth metadata
00d9875: [Cache] respect max_execution_time in LockRegistry's wait loop
7ddd4df: [HtmlSanitizer] accept percent-encoded line breaks and tabs in the query of hostless URLs
338724d: [VarDumper] account for PHP 8.6 deprecating SplFileObject::getCsvControl()
773f277: [Mailer] use the configured secret to authenticate Postmark webhooks
eb0a2ae: [HtmlSanitizer] keep rejecting denied URL characters when percent-decoding yields malformed UTF-8
099ba8d: [Security] apply "signature_properties" when a remember-me token provider is used

7.4 changelog:

dc566db: [Lock] delete a DynamoDb lock only when the caller holds it
2bb496b: [SecurityBundle] make the remember-me cookie follow the session cookie defaults
6121e1a: [Messenger] cover the headers that describe the message with the SigningSerializer signature
c3a4933: [Mailer] reject Mailomat webhook requests with a stale timestamp

8.1 changelog:

e7fac28: [HttpClient] fix GuzzleHttpHandler consuming responses out of band
bf5c07f: [Serializer] let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted
efc7bee: [Tui] fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts
49889f2: [VarExporter] fix fatal error when loading code exported by versions < 8.1

8.2 changelog:

9e3449f: [Messenger] stop deduplicating the messages sent to a FIFO SQS queue on their content by default
cb4d4a2: [FrameworkBundle] suggest more packages for unknown commands
524a899: [Console] allow dropping multiple files
d334117: [ErrorHandler] fix what the exception page announces to assistive technologies
93fcc92: [HttpFoundation] expand PRIVATE_SUBNETS with five not-globally-reachable ranges

Newest issues and pull requests

Symfony CLI

Symfony CLI is a must-have tool when developing Symfony applications on your local machine. It includes the Symfony Local Server, the best way to run local Symfony applications. This week Symfony CLI released its new 5.20.0 version with the following changes:

Set up Buildx for release attestations (@fabpot)
Add Symfony LSP support (@fabpot)
Widen archive timeout test margins to avoid flaky metadata timeouts (@fabpot)
Use Sigstore bundles for release signing (@fabpot)
Simplify external tool validation (@fabpot)
Set up Buildx for release attestations (@fabpot)
Reject overflowing archive sizes (@fabpot)
Preserve older Upsun CLI fallbacks (@fabpot)
Preserve LSP arguments for case-insensitive commands (@fabpot)
Generalize managed external tool installation (@fabpot)
Cover zip extraction size overflow rejection (@fabpot)
Add Symfony diagnostics check command (@fabpot)

Symfony Jobs

These are some of the most recent Symfony job offers:

Symfony Developer at Steward
Part-time / Temporary - $8,700 – $13,000 / month
Full remote
View details
Symfony Developer at ATH
Contract / Freelance - €25 – €50 / hour
Full remote
View details
Lead Symfony Developer at DocuPet
Full-time - CA$140,000 – CA$180,000 / year
Full remote
View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Symfony/PHP Meetup Cologne by SensioLabs: Cologne, Germany (September 24, 2026)
Sylius France Community Meetup by ACSEO: Aix en Provence, France (September 28, 2026)

Call to Action

Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Sponsor the Symfony project.