Symfony Blog https://symfony.com/blog/ Most recent posts published on the Symfony project blog Wed, 08 Jul 2026 11:29:44 +0200 Sun, 05 Jul 2026 09:18:00 +0200 en <![CDATA[A Week of Symfony #1018 (June 29 – July 5, 2026)]]> https://symfony.com/blog/a-week-of-symfony-1018-june-29-july-5-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed This week, Symfony released Twig 3.28.0, with improvements to macros and the sandbox. In addition, we published a case study on using Symfony in the industrial sector. Lastly, we proposed a redesign of the exception page for Symfony applications. Symfony… This week, Symfony released Twig 3.28.0, with improvements to macros and the sandbox. In addition, we published a case study on using Symfony in the industrial sector. Lastly, we proposed a redesign of the exception page for Symfony applications.

Symfony development highlights

This week, 33 pull requests were merged (21 in code and 12 in docs) and 25 issues were closed (18 in code and 7 in docs). Excluding merges, 18 authors made 5,518 additions and 4,348 deletions. See details for code and docs.

6.4 changelog:

  • 8cb8182: [Yaml] fix parsing of integers with a leading plus sign
  • f64a1a7: [PropertyInfo] prevent PhpDocTypeHelper to wrongly assume keys type
  • 4442aeb: [HttpFoundation] add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS
  • 041613d: [HttpFoundation] add additional IP ranges for RFC2544 and RFC5180

8.1 changelog:

  • c8ddb25: [Tui] fix wrapping lines that end with whitespace followed by ANSI codes exceeding the width
  • c38eb1c: [Console] fix #[MapDateTime] arguments resolved as strings by BuiltinTypeValueResolver

8.2 changelog:

  • 1f6b2d5: [HttpFoundation] fold UriSigner version into the signature without a reserved parameter
  • ff431bb: [ObjectMapper] enable converting backed enums to their scalar values
  • e8d42cf: [DependencyInjection] allow computing #[AutoconfigureTag] attributes per tagged service
  • f78996a: [Yaml] improve the error message for an unterminated quoted string
  • b4cc349: [Translation] update CrowdinProvider HTTP client’s base URI

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Lead Symfony Developer at DocuPet
    Full-time - CA$140,000 – CA$180,000 / year
    Full remote
    View details
  • Backend Symfony Developer at KRUU GmbH
    Full-time - €60,000 – €75,000 / month
    Remote + part-time onsite (Bad Friedrichshall, Germany)
    View details
  • DevOps for a Symfony project at Cloudpepper
    Full-time - $150,000 – $180,000 / year
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Call to Action

Sponsor the Symfony project.
]]> https://symfony.com/blog/a-week-of-symfony-1018-june-29-july-5-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sun, 05 Jul 2026 09:18:00 +0200 https://symfony.com/blog/a-week-of-symfony-1018-june-29-july-5-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Twig 3.28.0 released]]> https://symfony.com/blog/twig-3-28-0-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Twig 3.28.0 is out. This release sharpens error reporting with column numbers, brings back dynamic macro calls through the dot operator, and continues to polish the sandbox with less runtime overhead and finer-grained allow-listing. As usual, it also ships… Twig 3.28.0 is out. This release sharpens error reporting with column numbers, brings back dynamic macro calls through the dot operator, and continues to polish the sandbox with less runtime overhead and finer-grained allow-listing. As usual, it also ships a batch of deprecations that pave the way for Twig 4.0.

Column numbers in syntax errors

Fabien Potencier
Contributed by Fabien Potencier in #4834

Until now, a Twig error only told you which line was at fault. On a dense line, that left you scanning for the actual problem. Twig now tracks the source offset of every token, so errors can point at the exact column.

The column is exposed through the new Error::getTemplateColumn() method, and the underlying token offset through Token::getOffset().

Dynamic macro names through the dot operator

Fabien Potencier
Contributed by Fabien Potencier in #4838

Calling a macro whose name is only known at runtime used to rely on the attribute() function, which was deprecated in favor of the dot operator; but the dot operator did not support macros. That gap is now closed:

{% import "forms.html.twig" as forms %}

{% set field = "text" %}

{{ forms.(field)(name, value) }}

The parenthesized expression is evaluated and used as the macro name, so you can pick a macro dynamically without falling back to a deprecated function.

Sandbox: mark callables and tags as always allowed

Fabien Potencier
Contributed by Fabien Potencier in #4816 and #4819

Some filters, functions, tests, and tags are pure and inherently safe in a sandboxed template. Forcing every security policy to allow-list them by hand is noisy and error-prone.

Filters, functions, and tests now accept an always_allowed_in_sandbox option, and token parsers can implement isAlwaysAllowedInSandbox(). When set, the sandbox skips recording the name entirely, so it never reaches the policy's security check: no allow-list entry required and no runtime cost. The security policy also gains a dedicated allow-list for tests, with the safe built-in tests flagged as always allowed so they keep working out of the box.

Faster sandboxed templates

Fabien Potencier
Contributed by Fabien Potencier in #4823

The sandbox used to wrap every argument of every callable with a __toString check. Twig now wraps an argument only when its PHP parameter type can actually coerce a value to a string. Arguments typed as int, for instance, are left untouched, which cuts the amount of generated code and speeds up sandboxed rendering. The approach stays conservative: untyped, mixed, string, array, iterable, object, Stringable, and unknown class types all keep their check.

Stricter template correctness checks

Fabien Potencier
Contributed by Fabien Potencier in #4292

Being able to parse and compile a template does not mean it is semantically correct. A new CorrectnessNodeVisitor centralizes those checks and deprecates a few constructs that happened to work but were never meant to: using a block tag inside a capture node such as set, and using a macro, extends, or use tag somewhere other than the root of a template.

Markup is now effectively final

Fabien Potencier
Contributed by Fabien Potencier in #4840

Twig\Markup is now marked @final and will become truly final in Twig 4.0.

Notable bug fixes

  • The include() function now returns a Markup object, so a result assigned to a variable is no longer re-escaped when printed.
  • Nested block() calls now resolve against the overriding template when a block rendered through block(name, template) calls parent().
  • Printed expressions are cast to string so values that cannot be converted (arrays, non-Stringable objects) report a usable stack trace at the print location.
  • Backed enums are now rendered using their backing value in the html_attr function.
  • Empty Markup values are no longer treated as truthy in boolean expressions.

Full Changelog

  • #4850 Render backed enums using their backing value in the html_attr function (@fabpot)
  • #4841 Fix Markup truthiness in boolean expressions (@xtrime-ru)
  • #4842 Fix a PHP 8.5 chr() deprecation when decoding octal string escapes (@austinderrick)
  • #4292 Introduce a CorrectnessNodeVisitor to validate that templates are semantically correct (@fabpot)
  • #4840 Mark Markup as final (@fabpot)
  • #4838 Allow calling a macro with a dynamic name via the dot operator (@fabpot)
  • #4835 Fix markdown_to_html mangling content that starts with a blank line (@fabpot)
  • #4819 Add an allow-list for tests to the sandbox security policy (@fabpot)
  • #4816 Add an always_allowed_in_sandbox flag for filters, functions, and tags (@fabpot)
  • #4834 Track the source offset of each token and expose it in syntax errors (@fabpot)
  • #4825 Make the include() function return a Markup object (@fabpot)
  • #4830 Fix nested block() resolution when a directly rendered block calls parent() (@fabpot)
  • #4828 Stop reporting a skipped test in IntegrationTestCase when there is no legacy test to run (@fabpot)
  • #4824 Cast printed expressions to string so unconvertible values report a usable stack trace at the print location (@stof, @fabpot)
  • #4826 Make IntegrationTestCase and NodeTestCase compatible with PHPUnit 11 (@fabpot)
  • #4823 Skip the sandbox __toString check on arguments whose PHP parameter type cannot implicitly coerce to string (@fabpot)
Sponsor the Symfony project.
]]> https://symfony.com/blog/twig-3-28-0-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Fri, 03 Jul 2026 22:52:00 +0200 https://symfony.com/blog/twig-3-28-0-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Case Study: Driving Green Innovation: How Symfony Empowered Veolia’s Digital Shift in Industrial Waste Management]]> https://symfony.com/blog/case-study-driving-green-innovation-how-symfony-empowered-veolia-s-digital-shift-in-industrial-waste-management?utm_source=Symfony%20Blog%20Feed&utm_medium=feed When dealing with over 10 million tons of hazardous waste every year, IT operational efficiency is a prerquisite and a critical environmental and public health responsibility As the European leader in treating hazardous industrial waste and restoring… Logo

When dealing with over 10 million tons of hazardous waste every year, IT operational efficiency is a prerquisite and a critical environmental and public health responsibility

As the European leader in treating hazardous industrial waste and restoring polluted sites, Veolia | Hazardous Waste Europe faced a major digital hurdle. Their legacy tool used by their sales representatives to subscribe their clients to the waste management functionalities of the customer portal, Optilia, was beginning to hit its performance and ergonomic limits.

To transform this cornerstone of their commercial operations, Veolia turned to technical expert Webnet. The mission: overhaul and build a brand-new, lightning-fast, intuitive, and secure back-office platform.

Here is how Webnet leveraged the power, modularity, and technical consistency of Symfony to deliver a highly scalable cloud solution in just 10 months:

The Strategy: Technical Continuity and Full Personalization

When Webnet audited the project requirements, the decision to build the new Optilia back-office on Symfony emerged naturally for three strategic reasons:

  1. Unifying the Ecosystem: Symfony was already the powerhouse driving the Optilia front-office portal. Opting for Symfony for the back-office ensured complete architectural continuity, which heavily simplified long-term maintenance and future feature scalability.

  2. Absolute Freedom: Industrial waste management involves highly specific workflows, unique data structures, and complex compliance tracking. Symfony provided the engineering team with complete flexibility to craft customized business features without dealing with framework constraints.

  3. Proven Team Expertise: As a seasoned expert in custom web application development, Webnet knew they could rely on the modern foundations of Symfony to guarantee code quality, robust security, and rapid development cycles.

Under the Hood: The Symfony Components Driving the Back-Office

To fulfill Veolia high standards of responsiveness and administrative control, Webnet deployed a multi-disciplinary team, including 4 dedicated PHP/Symfony developers.

The team designed a robust stack combining PHP, Symfony, PostgreSQL, and AWS Cloud hosting. Instead of over-engineering the platform with heavy external layers, the team cleverly picked specific Symfony components to address their core technical challenges:

  • 🎨 symfony/ux-live-component & symfony/stimulus-bundle: Built a highly reactive, snappy interface with real-time UI updates, completely bypassing the need for a complex JavaScript framework.
  • 🚀 symfony/asset-mapper & symfonycasts/sass-bundle: Streamlined modern asset compilation and native versioning without introducing any Node.js dependencies.
  • ⚙️ symfony/messenger & symfony/scheduler: Offloaded heavy data processing to asynchronous queues and smoothly automated recurring background routines.
  • ⚙️ 🔒 symfony/security-bundle: Provided robust, enterprise-grade access control to enforce strict authorization rules across internal sales teams.

Results: High Adoption and Technical Scalability

Ten months after the development kick-off, the new back-office platform went live. Webnet comprehensive approach, blending expert engineering with user training and change management—resulted in immediate success:

  1. Dramatically Faster Operations: Sales teams transitioned from a sluggish legacy system to a fast, intuitive experience, slashing wait times and accelerating subscription workflows.

  2. Enthusiastic User Adoption: The ergonomic UX delivered through Symfony UX renewed team enthusiasm and drove instant internal adoption.

  3. Stronger Client Relationships: The enhanced administration capabilities of the Optilia extranet gave clients greater transparency over environmental reporting.

  4. Future-Proof Architecture: Powered by AWS and the modularity of Symfony, the system is highly available and ready to evolve alongside fluctuating industrial waste volumes and shifting European regulations.

By choosing Symfony, Webnet and Veolia proved that enterprise-grade environmental management tools can be both technologically sophisticated yet simple and intuitive to use.

Technical stack

  • Symfony
  • PostgreSQL
  • AWS Cloud hosting
Sponsor the Symfony project.
]]> https://symfony.com/blog/case-study-driving-green-innovation-how-symfony-empowered-veolia-s-digital-shift-in-industrial-waste-management?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Thu, 02 Jul 2026 14:30:00 +0200 https://symfony.com/blog/case-study-driving-green-innovation-how-symfony-empowered-veolia-s-digital-shift-in-industrial-waste-management?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[A Week of Symfony #1017 (June 22–28, 2026)]]> https://symfony.com/blog/a-week-of-symfony-1017-june-22-28-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed This week, maintenance versions 6.4.42, 7.4.14, 8.0.14, and 8.1.1 were released. In addition, development activity for the upcoming Symfony 8.2 version was intense, adding new features such as a Cron constraint for validating cron expressions, single-use… This week, maintenance versions 6.4.42, 7.4.14, 8.0.14, and 8.1.1 were released. In addition, development activity for the upcoming Symfony 8.2 version was intense, adding new features such as a Cron constraint for validating cron expressions, single-use signed URLs, a visual indicator for dumped variables in the profiler, and support for passing non-string parameters to constraints.

Symfony development highlights

This week, 51 pull requests were merged (40 in code and 11 in docs) and 26 issues were closed (18 in code and 8 in docs). Excluding merges, 24 authors made additions and deletions. See details for code and docs.

6.4 changelog:

  • 92dbe51: [Validator] add translated messages for the Cron constraint
  • 1a7bb41: [Serializer] fix GetSetMethodNormalizer denormalization of constructor only objects
  • dcb96d2: [VarExporter] adapt ProxyHelper tests to PHP 8.6 null byte rendering in default values
  • 10fd246: [String] fix splice() on multibyte strings
  • 1b91523: [Filesystem] trim trailing whitespace from the tempnam() prefix

7.4 changelog:

  • ae1bb52: [Security] fix PHPDoc of OidcTokenGenerateCommand::addGenerator

8.2 changelog:

  • 6a74266: [Mailer] reorder EsmtpTransport authenticators to prefer PLAIN over obsolete LOGIN
  • 043c993: [Translation] make LocoProvider::read() fetch every locale when passed none
  • e2cc5db: [HttpFoundation] deprecate not passing an expiry to UriSigner::sign()
  • 513fc8a: [Notifier] allow set region SweegoOptions
  • 73c8e67: [Validator] add Cron constraint to validate cron expressions
  • 5c1b56d: [JsonStreamer] add BcMath\Number and GMP value object
  • 840decc: [TypeInfo] add type narrowing on Type::accepts()
  • 4f7bc17: [FrameworkBundle] add --dispatchers option to debug:event-dispatcher command
  • b4319d0: [HttpFoundation] refactor DEFAULT_ENCODING_OPTIONS to use expression
  • 7bf037c: [HttpKernel, WebProfilerBundle] add dump icon in result list
  • b18300d: [Workflow] add $disabledEvents to permanently silence events at the workflow level
  • 33d63a5: [DoctrineBridge] add IterableToArrayCollection transformer for Object Mapper
  • 1b0f4f1: [Validator] allow non-string values in ConstraintViolationBuilderInterface::setParameter()
  • dce1b89: [FrameworkBundle] deprecate the framework.ide config option
  • c8461c3: [FrameworkBundle] don't reference potentially missing WorkflowEvents class
  • c0615ae: [DoctrineBridge] store whether a query ran on a primary
  • c35bfc2: [FrameworkBundle] fix service _instanceof type
  • ce9ef6b: [Mailer] improve error message when SMTP server lacks SMTPUTF8 support
  • d0e3914: [HttpFoundation] allow creating single-use signed urls
  • 8e12009: [Serializer] deprecate denormalizing non-list arrays into list-typed properties

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Lead Symfony Developer at DocuPet
    Full-time - CA$140,000 – CA$180,000 / year
    Full remote
    View details
  • Backend Symfony Developer at KRUU GmbH
    Full-time - €60,000 – €75,000 / month
    Remote + part-time onsite (Bad Friedrichshall, Germany)
    View details
  • DevOps for a Symfony project at Cloudpepper
    Full-time - $150,000 – $180,000 / year
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Call to Action

Sponsor the Symfony project.
]]> https://symfony.com/blog/a-week-of-symfony-1017-june-22-28-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sun, 28 Jun 2026 09:40:00 +0200 https://symfony.com/blog/a-week-of-symfony-1017-june-22-28-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Symfony 8.1.1 released]]> https://symfony.com/blog/symfony-8-1-1-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Symfony 8.1.1 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip… Symfony 8.1.1 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.0

  • data #64731 Release v8.1.1
  • bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
  • minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
  • minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
  • minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
  • data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
  • data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
  • data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
  • minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
  • minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
  • minor #64676 Add symfony-sync-translations skill (@fabpot)
  • data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
  • minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
  • bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
  • bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
  • bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
  • bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
  • bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
  • minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
  • bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
  • minor #64643 [ObjectMapper] Fix reverse class mapping of private properties from parent classes (@Amoifr)
  • bug #64640 Messenger commands don't yet make use of listable Redis capabilities (@dpi)
  • bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
  • bug #64637 [Messenger] Fix #[AsMessage] on abstract classes (@MatTheCat)
  • bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
  • bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
  • bug #64589 [ObjectMapper] Fix self-referencing property mapping (@GaryPEGEOT)
  • bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (@soyuka)
  • bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
  • minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
  • minor #64620 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
  • data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
  • data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
  • bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
  • minor #64629 [DependencyInjection] Fix deprecation when handling tagged iterator YAML short syntax (@MatTheCat)
  • bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (@nicolas-grekas)
  • bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
  • bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (@nicolas-grekas)
  • minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
  • bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
  • data #64597 Review Indonesian (id) translations (@sawirricardo)
  • bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
  • data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
  • minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
  • bug #64595 [Cache][VarExporter] Add argument $allowNamedClosure to DeepClone to fit ext-deepclone v0.8 (@nicolas-grekas)
  • minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
  • bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
  • bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
  • bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
  • bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
  • bug #64466 [ObjectMapper] Fix reverse class map throwing on unreadable source (@yoye)
  • data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
  • bug #64572 [DependencyInjection] Fix decorating an event listener no longer replacing it (@nicolas-grekas)
  • data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
  • data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
  • bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
  • bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
  • bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
  • bug #64555 [FrameworkBundle] Fix custom config directory being ignored when registering bundles (@nicolas-grekas)
  • bug #64560 [FrameworkBundle] Avoid resolving all env vars when building the router request context (@nicolas-grekas)
  • bug #64558 [Security] Make RoleHierarchy::getReachableRoleNames() return a list again (@nicolas-grekas)
  • data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
  • data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
  • bug #64552 [Cache][FrameworkBundle] Fix warming up caches that hold a closure (@nicolas-grekas)
  • bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
  • minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
  • bug #64362 [Tui] Fix vertical align (@sblondeau)
  • data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
  • bug #64474 [HttpKernel] Allow leading zeros in int request attributes (@ousamabenyounes)
  • minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
  • bug #64523 [DependencyInjection] Keep behavior-describing tags 'proxy' and 'container.service_subscriber.locator' on decorated services (@ousamabenyounes)
  • bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
  • bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
  • bug #64536 [Form] Don't re-add deleted collection entries on submit (@eyupcanakman)
  • data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
  • data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
  • bug #64534 [Tui] Avoid splitting Unicode ellipsis when truncating (rahul chavan)
  • minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
  • data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
  • bug #64527 [Tui] Truncate InputWidget prompt when wider than available columns (@ousamabenyounes)
  • minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
  • bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
  • bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
  • minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
  • minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
  • bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
  • bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
  • bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
  • bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
  • minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
  • bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
  • minor #64417 [DependencyInjection] Improve TaggedIteratorArgument deprecation warning (@jbafford)
  • bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
  • minor #64435 Update installation command for Stopwatch component (@abdounikarim)
  • minor #64437 [HttpKernel] Add @template on ControllerAttributeEvent (@lyrixx)
  • data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
  • data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
  • bug #64441 [FrameworkBundle] Fix dumping the debug container on cache:clear/cache:warmup (@nicolas-grekas)
  • bug #64443 [DomCrawler] Remove final keyword on ChoiceFormField::addChoice() (@syl20b)
  • data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
  • bug #64449 [HttpKernel] Fix #[MapRequestPayload] being handled before #[IsGranted] (@nicolas-grekas)
  • bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
  • bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
  • bug #64426 [HttpKernel] Fix TypeError in ResponseEvent when argument resolution throws (@nicolas-grekas)
  • bug #64420 [FrameworkBundle] Fix "allow_no_handlers" being ignored on message buses (@damien-bp)
  • bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
  • minor #64403 Update CHANGELOG-8.1.md (@yauhenko)
  • minor #64416 Clarify #[Target] attribute in UPGRADE-8.1 (@jbafford)
Sponsor the Symfony project.
]]> https://symfony.com/blog/symfony-8-1-1-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sat, 27 Jun 2026 11:31:00 +0200 https://symfony.com/blog/symfony-8-1-1-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Symfony 8.0.14 released]]> https://symfony.com/blog/symfony-8-0-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Symfony 8.0.14 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip… Symfony 8.0.14 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.0.13

  • data #64730 Release v8.0.14
  • bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
  • minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
  • minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
  • minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
  • data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
  • data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
  • data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
  • minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
  • minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
  • minor #64676 Add symfony-sync-translations skill (@fabpot)
  • data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
  • minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
  • bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
  • bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
  • bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
  • bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
  • bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
  • minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
  • bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
  • bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
  • bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
  • bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
  • bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
  • minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
  • data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
  • data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
  • bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
  • bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
  • minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
  • bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
  • data #64597 Review Indonesian (id) translations (@sawirricardo)
  • bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
  • data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
  • minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
  • minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
  • bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
  • bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
  • bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
  • bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
  • data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
  • data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
  • data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
  • bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
  • bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
  • bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
  • data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
  • data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
  • bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
  • minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
  • data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
  • minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
  • bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
  • bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
  • data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
  • data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
  • minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
  • data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
  • minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
  • bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
  • bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
  • minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
  • minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
  • bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
  • bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
  • bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
  • bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
  • minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
  • bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
  • bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
  • minor #64435 Update installation command for Stopwatch component (@abdounikarim)
  • data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
  • data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
  • data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
  • bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
  • bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
  • bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
  • bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
  • bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
  • bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
  • bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
  • bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
  • bug #64102 Remove usage of Kernel::VERSION (@fabpot)
  • data #64372 Release v7.4.13
  • data #64371 Release v6.4.41
Sponsor the Symfony project.
]]> https://symfony.com/blog/symfony-8-0-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sat, 27 Jun 2026 11:28:05 +0200 https://symfony.com/blog/symfony-8-0-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Symfony 7.4.14 released]]> https://symfony.com/blog/symfony-7-4-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Symfony 7.4.14 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip… Symfony 7.4.14 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.13

  • data #64729 Release v7.4.14
  • bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
  • minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
  • minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
  • minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
  • data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
  • data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
  • data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
  • minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
  • minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
  • minor #64676 Add symfony-sync-translations skill (@fabpot)
  • data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
  • minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
  • bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
  • bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
  • bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
  • bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
  • bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
  • minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
  • bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
  • bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
  • bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
  • bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
  • bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
  • data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
  • data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
  • bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
  • bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
  • minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
  • bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
  • data #64597 Review Indonesian (id) translations (@sawirricardo)
  • bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
  • data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
  • minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
  • minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
  • bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
  • bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
  • bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
  • bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
  • data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
  • data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
  • data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
  • bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
  • bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
  • bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
  • data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
  • data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
  • bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
  • minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
  • data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
  • minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
  • bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
  • bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
  • data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
  • data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
  • minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
  • data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
  • minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
  • bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
  • bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
  • minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
  • minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
  • bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
  • bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
  • bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
  • bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
  • minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
  • bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
  • bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
  • minor #64435 Update installation command for Stopwatch component (@abdounikarim)
  • data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
  • data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
  • data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
  • bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
  • bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
  • bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
  • bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
  • bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
  • bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
  • bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
  • bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
  • bug #64102 Remove usage of Kernel::VERSION (@fabpot)
  • data #64371 Release v6.4.41
Sponsor the Symfony project.
]]> https://symfony.com/blog/symfony-7-4-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sat, 27 Jun 2026 11:17:06 +0200 https://symfony.com/blog/symfony-7-4-14-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[Symfony 6.4.42 released]]> https://symfony.com/blog/symfony-6-4-42-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Symfony 6.4.42 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project. Tip… Symfony 6.4.42 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 6.4.41

  • data #64728 Release v6.4.42
  • bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
  • minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
  • minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
  • data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
  • data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
  • data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
  • minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
  • minor #64676 Add symfony-sync-translations skill (@fabpot)
  • data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
  • bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
  • bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
  • bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
  • bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
  • bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
  • bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
  • bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
  • bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
  • data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
  • data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
  • bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
  • bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
  • minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
  • bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
  • data #64597 Review Indonesian (id) translations (@sawirricardo)
  • data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
  • minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
  • minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
  • data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
  • data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
  • data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
  • bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
  • bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
  • bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
  • data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
  • data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
  • bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
  • minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
  • data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
  • minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
  • bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
  • bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
  • data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
  • data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
  • minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
  • data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
  • bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
  • minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
  • minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
  • bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
  • bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
  • bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
  • bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
  • minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
  • bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
  • minor #64435 Update installation command for Stopwatch component (@abdounikarim)
  • data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
  • data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
  • data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
  • bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
  • bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
  • bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
  • bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
  • bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
  • bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
Sponsor the Symfony project.
]]> https://symfony.com/blog/symfony-6-4-42-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Sat, 27 Jun 2026 11:14:23 +0200 https://symfony.com/blog/symfony-6-4-42-released?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list <![CDATA[SymfonyOnline June 2026: Replays are available!]]> https://symfony.com/blog/symfonyonline-june-2026-replays-are-available?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Two weeks ago, we wrapped up another fantastic edition of SymfonyOnline, and we are still buzzing from the energy! 🎉 Our pre-conference workshops (June 9-10) focused on Symfony and AI, expertly led by Stiven Llupa and Guillaume Loulier. Thank you… Nl Blog Banner 2026 04 17T163921 336

Two weeks ago, we wrapped up another fantastic edition of SymfonyOnline, and we are still buzzing from the energy! 🎉

Our pre-conference workshops (June 9-10) focused on Symfony and AI, expertly led by Stiven Llupa and Guillaume Loulier. Thank you for sharing your expertise and sparking such great conversations!

We then transitioned into two days of inspiring conference talks (June 11-12). Day 1 explored the intersection of AI and development, while Day 2 took a deep dive into Symfony and its ecosystem.

A massive thank you to our incredible speakers, sponsors, and attendees. You are the heart of this community 👏 We also want to give a special thank you to our sponsors, Upsun and Sensiolabs , for their unwavering support.

It was amazing to connect 300 passionate developers from 34 countries! 🌍💙

🎥 Catch up on demand!

Couldn't make it to every live session? No problem. All presentation replays are fully accessible. You can watch, rewatch, and learn at your own convenience.

No ticket? No worries! You can still buy a ticket to access the full replay library.

📅 Don't miss what's coming next:

  • SymfonyCon Warsaw 2026 - November 26 & 27, 2026 (English). Join us
  • SymfonyOnline January 2027 - January 14 & 15, 2027 (English). Join us
  • SymfonyLive Paris 2027 - March 25 & 26, 2027 (French). Join us

Join us online!

💡Follow the "conference" blog posts to not miss anything!

Want the latest Symfony updates? Follow us and tune in from wherever you are 🌎

Banner Blog

Sponsor the Symfony project.
]]> https://symfony.com/blog/symfonyonline-june-2026-replays-are-available?utm_source=Symfony%20Blog%20Feed&utm_medium=feed Fri, 26 Jun 2026 12:00:00 +0200 https://symfony.com/blog/symfonyonline-june-2026-replays-are-available?utm_source=Symfony%20Blog%20Feed&utm_medium=feed#comments-list