Symfony Blog

A Week of Symfony #1027 (August 31 – September 6, 2026)

Javier Eguiluz — Sun, 06 Sep 2026 09:46:00 +0200

This week, Symfony 6.4.45, 7.4.18, and 8.1.6 were released with numerous bug fixes and hardening improvements. Meanwhile, we introduced symfony lsp:check, a new command that brings Symfony-aware diagnostics to your CI pipeline, catching unknown routes, missing templates, and configuration errors. Finally, we announced that you'll be able to meet the Symfony Core Team at the API Platform Conference 2026 in Lille on September 17–18.

Symfony development highlights

This week, 191 pull requests were merged (158 in code and 33 in docs) and 44 issues were closed (25 in code and 19 in docs). Excluding merges, 58 authors made additions and deletions. See details for code and docs.

6.4 changelog:

d8f8099: [Form] stop capturing Options in the upload_max_size_message closure
892055e: [FrameworkBundle] describe the webhook routing secret in the config reference
4309470: [Mailer] mark the Sendgrid webhook secret as sensitive
075471f: [Notifier] reject an empty secret in the Twilio webhook parser
5c090b9: [Webhook] reject a malformed request body with a 406 instead of a 500
9f41173: [Mime] do not treat an "@" inside the domain as the addr-spec separator
7420a8d: [Mailer, Sendgrid] verify the webhook signature before parsing the payload
7a5183e: [HttpFoundation] match paths with the DOTALL modifier
cb30648: [Notifier, Vonage] verify the payload_hash claim of signed webhooks
26456f2: [Mime] never emit a raw control character in a header
3e26161: [Messenger] fix a crash when a Redis stream entry is not a JSON object
5230b74: [Console] test the shell completion scripts and fix the escaping
5439381: [Process] use an absolute path for the cmd.exe fallback on Windows
d5eef83: [Form] accept UTC-equivalent timezones for date and time model data
8d7540c: [Finder] fix prune filters not applied to nested directories and with path excludes
f94fd8f: [Console] fix the bash completion on macOS and cover more option modes
283abf9: [Console] fix the bash completion of "--option=value" and of an aliased command
ce4f440: [Console] do not evaluate the command line in the zsh completion
4fd61ee: [WebProfilerBundle] fix a TypeError when the ajax toolbar panel is missing from the page
788ace9: [String] fix singularization of words ending in -ives
4c18bb5: [HttpFoundation] fix hitting the PCRE size limit with many trusted host patterns
cb0d402: [PropertyInfo] do not prefer a method returning the declaring class as the property accessor
7ae77ca: [Mime] reject header names containing non-printable or non-ASCII characters
701c938: [HtmlSanitizer] drop relative URLs whose first path segment contains a colon instead of throwing

7.4 changelog:

6285a43: [Mailer, Notifier] mark webhook secrets as sensitive
8c84e00: [Mailer, Notifier] reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers
e0f5a76: [Mailer] reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers
3791801: [Mailer, Notifier] verify webhook signatures before parsing the payload
21241f1: [JsonStreamer] fix generator stream exhaustion on chunked file reading
1ebccec: [Notifier] fix typo in Bluesky transport exception message
7a7cb11: [String] fix localeTitle() titlecasing only the first word when the locale has no transliterator

8.1 changelog:

177a6c7: [VarDumper] fix dumping class names to the dump server
75ee906: [Scheduler] fix duplicated schedule message when multiple methods in a class use #[AsCronTask]
00d1505: [Console] fix signal handling of invokable commands registered through the container
7c52a22: [Console] make method-level #[AsCommand] names relative to the class-level one

8.2 changelog:

4393cdb: [Mailer] reject an empty secret in the Azure webhook parser
647af27: [Mailer, Mime] update the RFC references and document what Address validates
4ebe3e5: [FrameworkBundle] add "framework.webhook.no_private_network" and "framework.webhook.http_client" options
50b0d81: [Messenger] support raw Redis stream messages
5605faf: [Mailer, Notifier] deprecate reading a non-boolean value with Dsn::getBooleanOption()
bce08b3: [Mailer] support tags in the MailerSend transports
07709d2: [Lock, Messenger, Notifier] add the "ssl" DSN option to select the HTTP scheme
d09510b: [Form] add the "form.post_validate" event
81fb59e: [Tui] add KeyBindingWidget
99f824c: [Tui] add CollapsibleWidget
e2fda34: [Tui] keep a widget's listeners across detach, and add off() to release them
262451a: [Security] add an OIDC Authorization Code Flow authenticator
8144a9f: [Tui] add tab widget
340586b: [Serializer] support extensible discriminator map via child attribute
57d450b: [Form] use the POST_VALIDATE event in PasswordHasherExtension
6d46a24: [Mailer, Mime] add RFC 6854 group support to mailbox list headers
5617fa0: [Messenger] add claim check support
0449d5c: [Yaml, FrameworkBundle] add JSON Schema validation to the lint:yaml command
f3c0b6a: [HttpKernel, RateLimiter] add option to expose X-RateLimit-* headers for the #[RateLimit] attribute
fd64a46: [Messenger] add AMPHP SQL messenger transport
9fb98ad: [Messenger] add SQS system attributes of received messages to AmazonSqsReceivedStamp
4612d33: [Finder] add root-relative directory excludes via / prefix in exclude()
d2be782: [FrameworkBundle] remove dev requirement on symfony/amp-sql-messenger
a6d9bac: [Config, FrameworkBundle, Yaml] fix schema violation lines and the list form of keyed maps
03097ea: [Console] declare docblock types for parameters of addArgument() and addOption()
0f33c88: [Security] add OIDC token-endpoint client authentication methods
f80cfe3: [SecurityBundle] always register the OIDC login callback route loader
0ae9a49: [Yaml] walk the document to resolve schema violation lines
7b08227: [Translation] add translation:update-xliff-sources command
3798b58: [Form] add #[AsFormType] and #[FormField] attributes to define form types on data classes
eae2b16: [Security] verify the OIDC ID token signature against the provider JWKS
a7e7eb8: [SecurityBundle] require the OIDC ID token signature verification for public clients
f3509f0: [Security, SecurityBundle] add OIDC PKCE, max_age, authorization-request and start-route options
3f96455: [Security, SecurityBundle] add OIDC claims source, user-identifier mapping and RP-Initiated Logout
cdc6c0b: [Messenger] force quit messenger:consume and messenger:failed:retry on repeated SIGINT
d991fc9: [Security] allow AuthorizationChecker::isGrantedForUser to check for guest permissions
718e281: [Mailer] add RemoteTemplateEmail to send emails rendered from provider-hosted templates
7ab6d43: [Mailer] add RemoteTemplateEmail support to the remaining bridges with provider-hosted templates
3370aa2: [Form] add an allow_array_submission option to let PRE_SUBMIT listeners transform submitted arrays
68f2352: [Filesystem] deprecate passing an empty string as the base path to Path::isBasePath()
c820a90: [Cache] add MongoDB cache adapters
2f26170: [Security] tell why an authenticator did not support the request in the profiler
9f992bb: [Cache, Lock, Messenger] track the Symfony component in the MongoDB driver handshake
77eda6f: [RateLimiter] stop consuming from the remaining limiters once one rejects the hit
4520f5e: [RateLimiter] allow overriding the key of a compound limiter's sub-limiters
470440a: [Mailer] add PufferPost bridge
e747895: [Messenger] add routing information to the debug:messenger command
4deeb4f: [Security] deprecate passing more than one attribute to AccessDecisionManager::decide()
ecf1cb6: [String] add a $regexp argument to the case conversion methods
e154713: [Security] add a current_user() function to the expression language provider
cda9102: [String] fix ByteString::title() titlecasing only the first word of a match

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

Symfony Developer at Steward
Part-time / Temporary - $8,700 – $13,000 / month
Full remote
View details
Symfony Developer at ATH
Contract / Freelance - €25 – €50 / hour
Full remote
View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

New course announced: Symfony Security: Going Further
(Video) Symfony Security: The Basics: Creating a Registration Form
(Video) Symfony Security: The Basics: Security Events: Tracking the Last Login

They talked about us

Upcoming Symfony Events

Symfony Meetup Köln: Cologne, Germany (September 24, 2026)
Sylius France Community Meetup by ACSEO: Aix en Provence, France (September 28, 2026)

Call to Action

Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Sponsor the Symfony project.

Meet the Symfony Core Team at the API Platform Conference 2026!

Cécile HAMEREL — Wed, 02 Sep 2026 16:30:00 +0200

The API Platform Conference, the international event dedicated to the API Platform framework and its ecosystem, will take place in two weeks in Lille, France, on September 17–18, 2026. Nearly 30 talks are scheduled, in both French and English, covering case studies around API Platform as well as tools and frameworks related to this project, created in 2015 and now a leading solution for building modern and efficient APIs. This year again, Symfony is a proud community partner of the event: meet us on the exhibition floor!

Among all the speakers and sessions planned during these two days, seven Symfony Core Team members will once again take the stage:

Kévin Dunglas, API Platform's creator, will open the conference with the opening keynote.
Nicolas Grekas, Symfony's principal core team member, will deliver a talk on Thursday, right after Soyuka's Keynote. Details on his session are still to be announced.
Robin Chalas will present From Zend Framework 1 to API Platform 4: Migration Recipe, a real-world migration case study covering legacy modernization and AI-assisted tooling.
Alexandre Daubois will show how to observe FrankenPHP, putting DX at the service of performance, live and without configuration.
Mathieu Santostefano will help you keep secure APIs without losing your mind, covering OAuth2, OIDC, JWT, and Keycloak.
Mathias Arlaud will revisit DDD x API Platform, 4 years later, covering hexagonal architecture and message-oriented patterns.
Florent Morselli will cover HTTP headers as the first line of defense for APIs and the frontend, with CSP, CORS, COOP, and COEP examples in Symfony and API Platform.

More information about the speakers and schedule can be found on the event's website.

The program leans hard into where PHP is heading next: FrankenPHP performance and tooling, AI agents and MCP as new API consumers, and honest feedback from teams running API Platform in production. Don't miss your chance to attend this incredible event, and make sure to secure your seat before tickets run out.

Any questions about the API Platform Conference 2026? Get in touch with Les-Tilleuls.coop, the event organizers.

Sponsor the Symfony project.

Introducing symfony lsp:check: Symfony-Aware Diagnostics in Your CI

Fabien Potencier — Mon, 31 Aug 2026 14:03:00 +0200

A Symfony application is full of strings that mean something: route names, template paths, translation keys, service ids, bundle configuration keys. To PHP, they are strings like any others. Your CI pipeline verifies types with PHPStan or Psalm, style with PHP-CS-Fixer and behavior with PHPUnit, but nothing alerts you if you make a typo like redirectToRoute('order_confirmaton').

The latest version of the Symfony Language Tools closes that gap. The new check command runs a headless version of the Symfony-aware diagnostics from the editor integrations: against saved files, from the command line, in CI. It works for every Symfony application, whether or not anyone on the team uses an editor integration.

Your CI Doesn't Know Symfony

Symfony reports these mistakes late, or never: mistyped route names, missing templates, missing translation keys. They survive static analysis and code review because, as far as types are concerned, everything is fine. Even the PHPStan Symfony extension, which makes PHP analysis container-aware, works at the type level and inside PHP files; templates, translations, routes and configuration files stay out of its reach.

The editor integrations catch these mistakes while you type, but an editor does not review a pull request and is not attached when a script or a coding agent modifies the application. These checks belong in CI, next to the tools you already run.

One Command in Symfony CLI

If you use the Symfony CLI (version 5.20.0 or newer), you already have the checker. Run it from the root of your workspace:

        
        $ symfony lsp:check

Project .: runtime metadata, environment dev, complete
.:src/Controller/CheckoutController.php:14:40: error [route.not_found] Route "order_confirmaton" does not exist in the selected environment.
.:templates/checkout/confirmation.html.twig:1:8: error [translation.not_found] Translation "checkout.confirmed" does not exist in domain "messages".
.:templates/checkout/confirmation.html.twig:2:13: error [template.not_found] Template "checkout/summary.html.twig" does not exist in the selected environment.
Summary: 3 diagnostics, 3 active, 0 baseline matches, 0 stale baseline entries, 3 blocking
    

Symfony CLI downloads the latest stable Symfony Language Tools automatically or you can download it from GitHub Releases and run symfony-lsp check; both invocations accept the same options.

Without arguments, the command discovers Symfony applications and checks all supported project files; pass files, directories or patterns to focus the analysis:

        
        $ symfony lsp:check src/ templates/
$ symfony lsp:check 'config/**/*.yaml'

The command reports Symfony-specific problems only, 30 diagnostic codes today (symfony lsp:check --list-codes):

unknown routes and missing required route parameters;
missing templates and Twig components;
unknown arguments of Twig functions and filters;
missing translation keys, domains and message placeholders;
unknown services and parameters;
unknown console argument and option names;
invalid bundle configuration keys, types and enums;
unknown or incompatible environment variable processors;
unknown Messenger buses and transports, and invalid handler signatures;
unknown validation constraint options;
unknown Stimulus controllers and importmap entrypoints;
unknown security firewalls and user providers;
unknown form options and invalid event listener methods.

Runtime analysis is enabled by default: the checker boots each application in the selected Symfony environment and loads the same routes, services, bundle configuration and other runtime metadata as the editor integrations, so diagnostics reflect your real application, not a guess based on conventions. Through Symfony CLI, it also inherits the project-aware symfony php selection of PHP version and configuration. When a CI job must not execute application code, use source-only mode:

$ symfony lsp:check --source-only

Reports say which analysis mode was used, and a runtime or indexing failure marks the result as incomplete instead of silently falling back to source-only analysis.

Reports Built for CI

The default report is a deterministic, human-readable list of projects, diagnostics and summary counts; three structured formats target other tools:

        
        $ symfony lsp:check --format=json > diagnostics.json
$ symfony lsp:check --format=github
$ symfony lsp:check --format=sarif > symfony-lsp.sarif
    

The GitHub format emits workflow annotations directly on files and lines. A minimal GitHub Actions job:

        
        # .github/workflows/symfony-diagnostics.yaml
name: Symfony diagnostics

on: [push, pull_request]

jobs:
    check:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@v7
            - uses: shivammathur/setup-php@v2
              with:
                  php-version: '8.4'
                  tools: symfony-cli
            - run: composer install --no-progress
            - run: symfony lsp:check --format=github
    

The SARIF 2.1 report can be uploaded to code-scanning systems and includes stable fingerprints, so findings can be tracked between runs.

Exit statuses distinguish findings from failures in the checker itself:

0: analysis completed without blocking diagnostics;
10: analysis completed with blocking diagnostics;
11: invocation, configuration, selection, code policy or baseline is invalid;
12: analysis is incomplete because of an indexing, timeout, process or internal failure.

A failing diagnostic provider does not discard the other providers' findings: the partial report remains available, but the incomplete status and exit code 12 prevent CI from treating it as clean.

Adopt the Checker Gradually

An existing application may already contain known diagnostics. An occurrence-specific baseline enforces new findings without hiding the existing ones:

        
        $ symfony lsp:check --generate-baseline
$ symfony lsp:check --baseline=.symfony-lsp-baseline.json

Matches remain visible but do not block, survive unrelated line movement and distinguish repeated occurrences of the same diagnostic. Refresh the baseline explicitly with --refresh-baseline, or add --strict-baseline to require stale entries to be removed.

You can also choose which diagnostic codes block CI without filtering the report:

$ symfony lsp:check --fail-on=route.not_found,translation.not_found

Unknown codes are rejected, so a renamed or removed code cannot silently weaken the policy.

The checker and the editor integrations share the .symfony-lsp.json project configuration. Path exclusions are useful for embedded fixtures and generated sources, and missing-translation diagnostics are opt-in, as in the editor:

        
        {
    "version": 1,
    "translationDiagnostics": true,
    "excludePaths": [
        "tests/Fixtures/**",
        "generated/"
    ]
}
    

See the headless diagnostics guide for output schemas, baseline behavior, privacy guarantees, caching and the complete command-line reference, and the project configuration guide for the shared settings.

Built for Agents Too

Coding agents write a growing share of your Symfony code, and they work the way CI does: no editor attached, validating their changes with command-line tools. Give them this one. An agent that runs symfony lsp:check after each change catches its own invented route names, stale template references and broken configuration before a human reviews the diff.

The command is designed for that loop: deterministic reports, stable exit codes, machine-readable formats with precise positions and a discoverable diagnostic contract. A human and an agent running the same check see exactly the same findings.

Add It to Your Pipeline

Start with a local symfony lsp:check, add a baseline if the application needs one, then choose the output format and blocking policy that fit your pipeline. Editor users keep the diagnostics they already have; now the rest of the team, the CI and your agents get them too.

If the checker reports something it should not, misses a Symfony pattern used by your application or cannot boot the project reliably, report it on the issue tracker.

Sponsor the Symfony project.

Symfony 8.1.6 released

Fabien Potencier — Sun, 30 Aug 2026 23:44:04 +0200

Symfony 8.1.6 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 8.1.5

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
bug #65697 [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
minor #65665 [Validator] fix comment for Url requireTld argument (@dmitryuk)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65657 [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
bug #65656 [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65640 [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65632 [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
bug #65613 [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
data #64370 Release v5.4.53

Sponsor the Symfony project.

Symfony 7.4.18 released

Fabien Potencier — Sun, 30 Aug 2026 23:39:49 +0200

Symfony 7.4.18 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Changelog Since Symfony 7.4.17

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
data #64370 Release v5.4.53

Sponsor the Symfony project.

Symfony 6.4.45 released

Fabien Potencier — Sun, 30 Aug 2026 23:23:32 +0200

Symfony 6.4.45 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Changelog Since Symfony 6.4.44

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
bug #65728 [Routing] Fix matching the "0" URL (@cs278)
bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
minor #65646 Review translations for Estonian (et) (@erkia)
bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
minor #65587 [Validator] Review Urdu translations (@UmairRathore)
bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
data #64370 Release v5.4.53

Sponsor the Symfony project.

A Week of Symfony #1026 (August 24–30, 2026)

Javier Eguiluz — Sun, 30 Aug 2026 09:43:00 +0200

This week, Symfony development activity focused mostly on bug fixes, while the community celebrated a busy first week for Symfony Language Tools and the release of Symfony Reprise 1.0.0.

Symfony development highlights

This week, 112 pull requests were merged (72 in code and 40 in docs) and 68 issues were closed (40 in code and 28 in docs). Excluding merges, 44 authors made additions and deletions. See details for code and docs.

6.4 changelog:

757b06e: [PropertyInfo] do not prefer a static named constructor as the property accessor
0cb81e0: [PropertyInfo] do not prefer a static named constructor as the property mutator
38bc4c0: [Cache] fix authenticating to the master when using Redis Sentinel
f0146f7: [HttpKernel] fix regression when a locale aware service is never initialized
19a9f0c: [Console, FrameworkBundle] fix profiling a command stopped at ConsoleEvents::COMMAND
9814363: [Notifier] fix escaping of MarkdownV2 markup in TelegramTransport
ba62bf3: [Yaml] quote strings that look like octal numbers when dumping
1b0bfd1: [Serializer] fix max depth counting for subclasses that inherit MaxDepth metadata
00d9875: [Cache] respect max_execution_time in LockRegistry's wait loop
7ddd4df: [HtmlSanitizer] accept percent-encoded line breaks and tabs in the query of hostless URLs
338724d: [VarDumper] account for PHP 8.6 deprecating SplFileObject::getCsvControl()
773f277: [Mailer] use the configured secret to authenticate Postmark webhooks
eb0a2ae: [HtmlSanitizer] keep rejecting denied URL characters when percent-decoding yields malformed UTF-8
099ba8d: [Security] apply "signature_properties" when a remember-me token provider is used

7.4 changelog:

dc566db: [Lock] delete a DynamoDb lock only when the caller holds it
2bb496b: [SecurityBundle] make the remember-me cookie follow the session cookie defaults
6121e1a: [Messenger] cover the headers that describe the message with the SigningSerializer signature
c3a4933: [Mailer] reject Mailomat webhook requests with a stale timestamp

8.1 changelog:

e7fac28: [HttpClient] fix GuzzleHttpHandler consuming responses out of band
bf5c07f: [Serializer] let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted
efc7bee: [Tui] fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts
49889f2: [VarExporter] fix fatal error when loading code exported by versions < 8.1

8.2 changelog:

9e3449f: [Messenger] stop deduplicating the messages sent to a FIFO SQS queue on their content by default
cb4d4a2: [FrameworkBundle] suggest more packages for unknown commands
524a899: [Console] allow dropping multiple files
d334117: [ErrorHandler] fix what the exception page announces to assistive technologies
93fcc92: [HttpFoundation] expand PRIVATE_SUBNETS with five not-globally-reachable ranges

Newest issues and pull requests

Symfony CLI

Symfony CLI is a must-have tool when developing Symfony applications on your local machine. It includes the Symfony Local Server, the best way to run local Symfony applications. This week Symfony CLI released its new 5.20.0 version with the following changes:

Set up Buildx for release attestations (@fabpot)
Add Symfony LSP support (@fabpot)
Widen archive timeout test margins to avoid flaky metadata timeouts (@fabpot)
Use Sigstore bundles for release signing (@fabpot)
Simplify external tool validation (@fabpot)
Set up Buildx for release attestations (@fabpot)
Reject overflowing archive sizes (@fabpot)
Preserve older Upsun CLI fallbacks (@fabpot)
Preserve LSP arguments for case-insensitive commands (@fabpot)
Generalize managed external tool installation (@fabpot)
Cover zip extraction size overflow rejection (@fabpot)
Add Symfony diagnostics check command (@fabpot)

Symfony Jobs

These are some of the most recent Symfony job offers:

Symfony Developer at Steward
Part-time / Temporary - $8,700 – $13,000 / month
Full remote
View details
Symfony Developer at ATH
Contract / Freelance - €25 – €50 / hour
Full remote
View details
Lead Symfony Developer at DocuPet
Full-time - CA$140,000 – CA$180,000 / year
Full remote
View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Symfony/PHP Meetup Cologne by SensioLabs: Cologne, Germany (September 24, 2026)
Sylius France Community Meetup by ACSEO: Aix en Provence, France (September 28, 2026)

Call to Action

Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Sponsor the Symfony project.

Symfony Reprise 1.0.0 released

Hugo Alliaume — Wed, 26 Aug 2026 16:41:00 +0200

Reprise was introduced on this blog a few weeks ago, and the pitch has not changed: it is a thin plugin, not a build tool. Vite and Rsbuild do the real work (bundling, hashing, source maps, HMR, the dev server); Reprise only adds the Symfony glue they leave out, the entrypoints.json and manifest.json files and the Twig tags that render them, the way Webpack Encore did.

That narrow scope is why 1.0 can land this soon. The bundlers underneath are mature and battle-tested, and Reprise's own surface is small, so a few stabilizing releases (0.6.1 through 0.8.0) were enough to settle it. Reprise 1.0.0 makes it official: the experimental notice is gone, and the public API now follows semantic versioning and Symfony's backward compatibility promise.

A backward compatibility promise

1.0 is not a new pile of features, it is a commitment. Everything an application depends on is now covered by semantic versioning and Symfony's backward compatibility promise: within a major version the public API stays stable, and anything that has to change is deprecated first and removed only in the next major.

Stabilizing toward 1.0

Contributed by Hugo Alliaume and Loïck Piera in #67 , #68 , #69 , #70 , #72 , #81 , #82 and #93

Most of the work since the announcement was not visible in the API: end-to-end tests with Vitest and Playwright now exercise both bundlers against a real Symfony backend on every CI run, the playground was rebuilt as a proper Reprise and Symfony UX showcase, and Subresource Integrity got two fixes, on the preloaded Link headers and on module-script preloading.

The first contribution from outside the maintainer landed here too, a per-entry opt-out of copied-filename hashing for assets that need a stable path on disk. The Webpack Encore migration guide now names every Encore method, mapping each one to its Reprise feature or to the bundler that handles it natively.

Reprise is 1.0, but still young. If you are on Encore and eyeing Vite or Rsbuild, or starting a new project on a modern bundler, this is a good moment to try it on something real:

        
        $ composer require symfony/reprise
$ npm install @symfony/reprise --save-dev

Then wire the plugin into your Vite or Rsbuild config, as the installation guide shows.

Feedback, issues and contributions are more than welcome on Reprise on GitHub 🚀

Sponsor the Symfony project.

Symfony Language Tools: A Busy First Week

Fabien Potencier — Sun, 23 Aug 2026 13:04:00 +0200

On August 17, we announced Symfony Language Tools, the official Symfony language server.

Six days and ten releases later, version 0.16 is out. We have added a lot of features: the server now understands applications that look less like Symfony Demo and more like yours.

Twig Knows Your PHP

Custom Twig functions and filters used to be opaque strings. Symfony Language Tools now connects the ones defined by your application to their PHP implementations.

Type a function or filter name to get completion. Hover it to see the PHP signature and its documentation. Use Go to Definition to open the callable, or Find All References to list its usages across templates.

Named arguments work too. The server understands parameters injected by Twig, completes the remaining ones and reports unknown names.

The implementation is deliberately conservative. Dynamic names and callables are ignored.

Typed Twig Templates

Twig's types tag can now describe the variables expected by a template:

        
        {% types {
    ## The product displayed on this page.
    product: 'App\\Entity\\Product',
    featured?: 'boolean',
} %}
    

Completion and hover include the declared type, whether the variable is optional and its documentation.

Components from Bundles

Twig component support now reads the effective runtime registry. It recognizes anonymous components, custom renderers and components shipped by installed bundles.

That includes components such as ux:icon. Completion knows their names and Go to Definition opens the vendor class when it is available locally.

Decorated Twig loaders and bundle-provided Stimulus registries are supported as well.

Real Applications as Tests

The first version was tested against the Symfony applications that power symfony.com and its subdomains.

The test matrix is now public. Every relevant change runs the server against pinned revisions of Kimai, Mautic, Sulu Demo, Sylius, Shopware and Symfony Demo. Together, they cover Symfony 6.4, 7.4 and 8.1.

The server indexes each application from cold and warm states, boots it and runs real completion, hover, navigation, references, code actions and rename requests.

These applications quickly exposed assumptions hidden by small fixtures. The result is support for XML service definitions, INI translation catalogs, Doctrine XML and YAML mappings, public assets, themed Twig loaders, non-standard kernels and configuration shorthands.

XML Services

Symfony Language Tools now indexes services, aliases, parameters, decorators, tags and references declared in XML.

Navigation, references and rename work across XML, YAML and PHP. Completion in XML is not supported yet.

Doctrine Beyond Attributes

Doctrine support originally relied on PHP attributes. Runtime metadata now adds entities and fields declared through XML or YAML mappings, including entities shipped by dependencies.

Field completion, hover and navigation therefore work on many more projects.

Plain Old Public Assets

Not every application uses AssetMapper. The asset() integration now falls back to files under public/, so Webpack Encore and other build pipelines get completion and navigation too.

Unknown paths are not reported as errors as Symfony asset packages can have their own fallback logic.

Your PHP Can Stay in Docker

The language server is self-contained, but runtime indexing needs to boot your application. So it meant a compatible PHP executable on the host.

Not anymore. Configure the PHP command and the path of the project inside the container:

        
        {
    "symfonyLsp.phpCommand": [
        "docker", "compose", "exec", "-T", "php", "php"
    ],
    "symfonyLsp.containerProjectRoot": "/app"
}
    

The application boots inside Docker while navigation continues to open files on the host. The same mechanism works with a virtual machine or any isolated PHP command.

Project discovery also understands more layouts: kernels outside the App namespace, legacy app/AppKernel.php applications, Symfony Runtime front controllers and FrameworkBundle installed transitively.

More Editors

VS Code and Neovim were available on day one. Zed now has an official extension for Linux and macOS. It downloads the appropriate server automatically and runs alongside Zed's PHP language server.

OpenCode can also start Symfony Language Tools as a custom language server. Its coding agent gets Symfony-aware diagnostics, hover, navigation and references. OpenCode does not request every interactive LSP feature yet, but it is already a useful combination.

The standalone server remains available for any other LSP client. On Windows, VS Code now connects to the bundled server over a local socket automatically. The VS Code package can also be installed in VSCodium from the release VSIX.

Saying Less

A language server must know when to say nothing. False positives are annoying, but false edits are dangerous.

This week, Symfony Language Tools learned to ignore many more uncertain cases:

PHP and Twig comments;
Twig verbatim blocks;
dynamic Stimulus controller expressions;
dynamic Twig callable options;
unpacked or dynamic translation parameter maps;
files owned by dependencies.

Rename and quick fixes are now kept inside application-owned files. Quick fixes also use the unsaved editor contents and versioned edits.

There is more: internationalized routes use their canonical names.

Runtime indexing now tolerates noisy consoles, large metadata snapshots and kernel shutdown failures. When a refresh fails, the last valid metadata remains available.

Indexing at Scale

The source index is now streamed to its persistent store instead of keeping a second complete copy in memory. Parser results are reused; ignored and unreadable files are skipped; garbage collection runs during large scans.

CI generates projects with 1,500 and 6,000 source files to enforce linear scaling and per-file memory budgets. The server memory limit is configurable, with a default ceiling of 2 GB.

Live indexing is safer too. A file saved during a full scan can no longer be overwritten by an older result. Removing a workspace folder cancels its work and releases its indexes. New directories, changed ignore rules and composer.lock updates are detected without restarting the editor.

The Tree-sitter parser is now compiled into the server executable as well. One binary, one process.

Still a Beta

Version 0.16 is a large step, but Symfony Language Tools is still a beta. We are releasing often because every real application teaches the server something a fixture did not.

Install the update, open your application and tell us where it gets confused on the issue tracker.

Sponsor the Symfony project.