Symfony Blog

Twig 3.25.0 released

Fabien Potencier — Sun, 17 May 2026 10:12:00 +0200

Twig 3.25.0 released

Twig 3.25.0 ships with a new needs_is_sandboxed option that lets filters, functions, and tests adapt their behavior when running inside a sandbox, makes the compiled output of templates using {% embed %} deterministic across runs, and removes a long-standing limitation that prevented overriding EscaperRuntime via a custom runtime loader.

Sandbox-aware filters, functions, and tests

Contributed by Fabien Potencier in #4800

Until now, a Twig callable had no built-in way to know whether the template calling it was running in a sandbox. Filters, functions, and tests that needed to behave differently in trusted versus untrusted contexts had to inspect the environment manually and replicate the sandbox detection logic.

Twig 3.25 introduces a new needs_is_sandboxed option. When set to true, Twig passes the current sandbox state as a boolean to the callable, after the charset, the environment, and the context if those are also requested:

        
        use Twig\TwigFilter;

$filter = new TwigFilter('rot13', function (bool $sandboxed, string $text) {
    if ($sandboxed) {
        // adjust the behavior when running in a sandboxed template
    }

    return str_rot13($text);
}, ['needs_is_sandboxed' => true]);
    

The same option is available on TwigFunction and TwigTest, and on the #[AsTwigFilter], #[AsTwigFunction], and #[AsTwigTest] attributes via a needsIsSandboxed named argument.

The flag reflects the effective sandbox state for the current template source, so it correctly accounts for both the global sandbox state and any SourcePolicy you may have configured.

Deterministic embed classes

Contributed by Emma in #4797

Templates using {% embed %} now produce stable compiled output across runs, which makes it possible to ship reproducible, pre-compiled Twig builds. No change is required on your side.

Overridable `EscaperRuntime`

Contributed by Jérôme Tamarelle in #4795

You can now substitute your own EscaperRuntime implementation through any runtime loader, including FactoryRuntimeLoader and Symfony's ContainerRuntimeLoader:

        
        use Twig\Environment;
use Twig\Loader\ArrayLoader;
use Twig\Runtime\EscaperRuntime;
use Twig\RuntimeLoader\FactoryRuntimeLoader;

$twig = new Environment(new ArrayLoader());
$twig->addRuntimeLoader(new FactoryRuntimeLoader([
    EscaperRuntime::class => static fn () => new MyEscaperRuntime(),
]));
    

Symfony 8.1's TwigBundle already builds on this: EscaperRuntime is now registered as the twig.runtime.escaper service, and a new twig.safe_class resource tag lets any bundle mark a class as safe without having to decorate the environment configurator:

        
        $services->set(InvoiceNumber::class)
    ->resourceTag('twig.safe_class', ['strategy' => 'html']);

Full Changelog

#4795 Lazy load EscaperRuntime in EscaperExtension (@GromNaN)
#4800 Add a needs_is_sandboxed option for filters, functions, and tests (@fabpot)
#4797 Make embeds deterministic (@itsalmostchristmas)

Sponsor the Symfony project.

A Week of Symfony #1011 (May 11–17, 2026)

Javier Eguiluz — Sun, 17 May 2026 09:14:00 +0200

This week, Symfony published maintenance versions 6.4.39, 7.4.11, and 8.0.11. In addition, we announced the second beta release of Symfony 8.1. Finally, we shared the schedule for the SymfonyOnline June 2026 conference and more details about SymfonyDay Montreal 2026.

Symfony development highlights

This week, 51 pull requests were merged (42 in code and 9 in docs) and 34 issues were closed (29 in code and 5 in docs). Excluding merges, 23 authors made additions and deletions. See details for code and docs.

6.4 changelog:

76acf56: [Security] clarify AbstractToken's role-name decoupling and simplify ContextListener
4a804c5: [Dotenv] don't truncate OS env vars containing $ when $_ENV is unpopulated
35e8779: [WebProfilerBundle] don't try to access RawMessage::$headers
cafeaa2: [HttpKernel] use backend-handled request for terminate listeners in HttpCache
f36fbca: [Messenger] drop trace args from FlattenException normalization
6e49223: [Scheduler] use stored checkpoint as base date for debug:scheduler
cbb5873: [Console] make ConsoleSectionOutput::overwrite() atomic to fix sections + ProgressIndicator clear
78fb4f2: [Filesystem] preserve source mode when copying files
de84d00: [Process] ignore array env values before proc_open
aa86748: [Security] preserve webserver base URL in HttpUtils::createRequest()
de4b320: [Console] fix signal handler scoping
57fafa5: [AssetMapper] warn on missing bare CSS and JSON imports
b6a9d39: [Messenger] fix support for RabbitMQ v4 by adding delayed quorum queues
55a39e2: [Notifier] use hash_equals() to compare webhook signatures for Vonage
0e24c67: [String] fixed singularize traces > trace in inflector
1a4066e: [Yaml] reject non-stringables when using "!!binary"
6548e65: [Security] remove the legacy nested unserialize() call from token and exception classes
97267d7: [FrameworkBundle] bump Request/Session value resolver priority above EntityValueResolver
40c0f8b: [SecurityBundle] allow defining security provider factories without config
7aedb9f: [HttpFoundation] remove wrong documentation about the configurability of trusted proxies
8efd735: [HttpKernel] preserve named-attribute override on Request/Session value resolvers

7.4 changelog:

66e1cbd: [Mailer] use hash_equals() to compare webhook signatures for AhaSend
35dc5cc: [Messenger] ensure SigningSerializer won't decode before verifying the signature
3789137: [Security] fix impersonation being deauthenticated on every request

8.1 changelog:

f589b60: [Console] add missing symfony/polyfill-php85 dependency
af12d15: [Messenger] add delayed quorum queues in Amqp
12baa37: [Yaml] emit {} instead of { } when dumping an empty map
8139923: [HttpClient] log stale-if-error fallback in CachingHttpClient
5e5fff8: [HttpClient] add $allowList argument to NoPrivateNetworkHttpClient
923c07f: [Validator] add findByCodes() to ConstraintViolationListInterface
140dfb3: [Form] fix array_flip() warning in expanded+multiple ChoiceType on partial submit
90759e8: [HttpClient] add custom DNS resolution using a decorator
dd1be77: [Messenger] allow to respect retry strategy with RecoverableMessageHandlingException
7a1e1c8: [HttpFoundation] add missing @throws tag to BinaryFileResponse constructor
c1dd421: [Console] sort command alternatives by name
b01d14a: [Runtime] fix TypeError when resolving untyped arguments

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

DevOps for a Symfony project at Cloudpepper
Full-time - $150,000 – $180,000 / year
Full remote
View details
Lead Symfony Developer at SCTR Services
Full-time - $70,000 – $110,000 / year
Full remote
View details
Symfony Developer at Design Force Marketing
Full-time - $60,000 – $100,000 / year
Grand Haven Michigan, United States
View details
Backend Symfony Developer at ShipMonk
Contract / Freelance - $5,000 – $8,000 / month
Full remote
View details
Backend Symfony Developer at Vacatia
Full-time - $150,000 – $180,000 / year
Remote + part-time onsite (Portland, Oregon, United States)
View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Nothing Shared, Everything Gained by Kore Nordmann: Berlin, Germany (May 19, 2026)
Symfony/PHP Meetup Barcelona by SensioLabs: Barcelona, Spain (June 25, 2026)
Web Summer Camp 2026: Opatija, Croatia (July 2, 2026 – July 4, 2026)

Call to Action

Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Sponsor the Symfony project.

SymfonyDay Montreal 2026: Symfony 8: The Hexagonal Track

Eloïse Charrier — Fri, 15 May 2026 13:30:00 +0200

SymfonyDay Montreal 2026 is happening on June 4 at L'Espace Quartier Latin (UQAM). It's the perfect opportunity to sharpen your skills and meet the core team in Canada!

🎤 Speaker announcement!

We are thrilled to host Robin Chalas, CEO & Co-Founder, baksla.sh, for his talk "Symfony 8: The Hexagonal Track":

Structuring an application around its domain rather than its framework is an old idea. Making it practical has sometimes felt like swimming against the current.

Thanks to the way Symfony 8 leverages modern PHP, this drastically changes. Recent evolutions in both the language and the framework align naturally with hexagonal thinking and tactical DDD patterns — no workarounds, no fighting the tools.

Join me as I wear both my Core Team member and DDD practitioner hats to give a pragmatic look at putting your business logic first, building applications that scale with your domain's complexity and remain maintainable as they grow, with Symfony's blessing.

👉 Discover more talks by reading the full schedule

🎟️ Register Now

Limited seating available! Make sure to register here to join the gathering.

📍 Our Venue: L’Espace Quartier Latin

We are gathering at L’Espace Quartier Latin at UQAM! The venue is extremely easy to reach, both by public transport and by private transport.

🤲 L’apéro – Let’s Celebrate Together

After a full day of learning, it’s time to relax. We invite all attendees to join us for a community drink in the evening thanks to Pimcore's support. It’s a wonderful opportunity to chat with the speakers, meet fellow developers, and enjoy the unique Montreal atmosphere. Santé !

We can’t wait to see you on June 4th!

Join us online!

💡Follow the "conference" blog posts to not miss anything!

Want the latest Symfony updates? Follow us and tune in from wherever you are 🌎

Sponsor the Symfony project.

New in Symfony 8.1: Translation Improvements

Javier Eguiluz — Thu, 14 May 2026 09:55:00 +0200

Symfony 8.1 brings several improvements to the translation system: broader XLIFF format support, a more flexible enabled_locales configuration, a better translated placeholder for expanded choice fields, and a new helper class to compute locale fallback chains.

Using Environment Variables in Enabled Locales

Contributed by Nicolas Grekas in #63121

The framework.enabled_locales configuration option used to require a hard-coded list of locales. In Symfony 8.1 you can use environment variables in this list directly. Empty values are filtered out automatically, so you can declare a fixed number of slots and leave some of them empty:

        
        # config/packages/translation.yaml
framework:
    enabled_locales:
        - '%env(LOCALE_1)%'
        - '%env(LOCALE_2)%'
        - '%env(LOCALE_3)%'
        - '%env(LOCALE_4)%'
    

This is useful when the list of enabled locales depends on the deployment environment. For example, different tenants may enable different subsets of languages without requiring a separate configuration file per environment.

Translated Placeholder on Expanded Choice Fields

Contributed by Eyüp Can Akman in #63727

When a ChoiceType is rendered as a group of radio buttons or checkboxes (expanded: true), its placeholder label used the choice_translation_domain option for translation.

This caused problems with EntityType, whose choice_translation_domain defaults to false. As a result, TranslatableMessage placeholders were never translated even when an explicit translation_domain was configured.

In Symfony 8.1, placeholders for expanded choice fields now use translation_domain, matching the behavior of non-expanded

Symfony Blog

Twig 3.25.0 released

Twig 3.25.0 released

Sandbox-aware filters, functions, and tests

Deterministic embed classes

Overridable EscaperRuntime

Full Changelog

A Week of Symfony #1011 (May 11–17, 2026)

Symfony development highlights

Newest issues and pull requests

Symfony Jobs

SymfonyCasts Updates

They talked about us

Upcoming Symfony Events

Call to Action

SymfonyDay Montreal 2026: Symfony 8: The Hexagonal Track

🎤 Speaker announcement!

🎟️ Register Now

📍 Our Venue: L’Espace Quartier Latin

🤲 L’apéro – Let’s Celebrate Together

Join us online!

New in Symfony 8.1: Translation Improvements

Using Environment Variables in Enabled Locales

Translated Placeholder on Expanded Choice Fields

Overridable `EscaperRuntime`