This changelog references the relevant changes (bug and security fixes) done in 8.1 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1

• 8.1.0 (2026-05-29)

• feature #64398 Shopware is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64397 Mailtrap is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (MatTheCat)

• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (nicolas-grekas)

• bug #64388 [Yaml] Fix parsing inline anchored values (nicolas-grekas)

• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)

• bug #64389 Migrate configureSchema() to DBAL's editor API (nicolas-grekas)

• bug #64102 Remove usage of Kernel::VERSION (fabpot)

• 8.1.0-RC1 (2026-05-27)

• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (nicolas-grekas)

• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (nicolas-grekas)

• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)

• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)

• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)

• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)

• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)

• bug #64356 [Tui] Throw when ext-zip is not installed and one tries to load a zipped figlet (nicolas-grekas)

• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)

• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)

• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (MatTheCat)

• feature #64334 [Form] Add handle_missing_data option to opt into MissingDataHandler for absent forms (hlecorche)

• bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (nicolas-grekas)

• bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (nicolas-grekas)

• bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (signor-pedro)

• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)

• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)

• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)

• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)

• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)

• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)

• bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)

• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)

• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)

• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)

• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)

• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (ousamabenyounes)

• bug #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (nicolas-grekas)

• feature #64312 [FrameworkBundle][Validator] Add framework.validation.property_metadata_existence_check config (nicolas-grekas)

• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (MatTheCat)

• bug #64260 [HttpClient] Various fixes and hardenings (Lctrs)

• bug #64234 [Tui] Fix unattached widget element styles (masskrdjn)

• bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (nicolas-grekas)

• bug #64223 [Tui] Fix invisible border with null color in BorderPattern's inverse strategies (sblondeau)

• 8.1.0-BETA3 (2026-05-20)

• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)

• security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (nicolas-grekas)

• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)

• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)

• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)

• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)

• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)

• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (alexandre-daubois)

• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (alexandre-daubois)

• bug #64301 [TwigBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64300 [TwigBridge] Fix daisyUI form layout and AppVariable locale filtering (nicolas-grekas)

• bug #64296 [Serializer] Improve normalizer error reporting and deprecations (nicolas-grekas)

• bug #64297 [Tui] Various fixes and hardenings (nicolas-grekas)

• bug #64299 [TypeInfo] Harden ObjectShapeType (nicolas-grekas)

• bug #64294 [RateLimiter] Harden calendar-aligned fixed window mode (nicolas-grekas)

• bug #64291 [MonologBridge] Harden MailerHandler subject truncation (nicolas-grekas)

• bug #64290 [Security] Various fixes and hardenings (nicolas-grekas)

• bug #64287 [Translation] Various fixes and hardenings (nicolas-grekas)

• bug #64286 [WebProfilerBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64283 [Lock] Various fixes and hardenings (nicolas-grekas)

• bug #64285 [WebLink] Add missing Link::AS_* constants for rel=preload / rel=modulepreload (nicolas-grekas)

• feature #64284 [PasswordHasher] Support stdin input and refine warning in security:hash-password (nicolas-grekas)

• bug #64273 [HttpKernel] Various fixes and hardenings (nicolas-grekas)

• bug #64276 [Runtime] Various fixes and hardenings (nicolas-grekas)

• bug #64280 [Workflow] Various fixes and hardenings (nicolas-grekas)

• bug #64275 [Routing] Fix missing HostTrait in ContentLoaderTrait (nicolas-grekas)

• bug #64274 [SecurityBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64272 [Mailer] Preserve the sent message object as is when sending it (nicolas-grekas)

• bug #64243 [HttpClient] Various fixes and hardenings (nicolas-grekas)

• bug #64269 [HttpFoundation] Various fixes and hardenings (nicolas-grekas)

• bug #64268 [FrameworkBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64263 [ExpressionLanguage] Various fixes and hardenings (nicolas-grekas)

• bug #64262 [EventDispatcher] Various fixes and hardenings (nicolas-grekas)

• bug #64256 [DomCrawler] Various fixes and hardenings (nicolas-grekas)

• bug #64254 [DependencyInjection] Various fixes and hardenings (nicolas-grekas)

• bug #64252 [AssetMapper] Various fixes and hardenings (nicolas-grekas)

• bug #64251 [ObjectMapper] Various fixes and hardenings (nicolas-grekas)

• bug #64250 [CssSelector] Various fixes and hardenings (nicolas-grekas)

• bug #64249 [Form] Various fixes and hardenings (nicolas-grekas)

• bug #64248 [Mailer] Various fixes and hardenings (nicolas-grekas)

• bug #64239 [Validator] Various fixes and hardenings (nicolas-grekas)

• bug #64237 [Messenger] Various fixes and hardenings (nicolas-grekas)

• bug #64242 [TwigBridge] Require Twig to 3.25 for EscaperRuntime service definition (GromNaN)

• bug #64258 [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-selects (nicolas-grekas)

• bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (nicolas-grekas)

• bug #64207 [MonologBridge] Fix interactive_only not preventing propagation (philbates35)

• bug #64241 [JsonStreamer] Various fixes and hardenings (nicolas-grekas)

• bug #64255 [DoctrineBridge] Various fixes and hardenings (nicolas-grekas)

• bug #64246 [Console] Various fixes and hardenings (nicolas-grekas)

• bug #64244 [Semaphore] Various fixes and hardenings (nicolas-grekas)

• bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)

• bug #64215 [Runtime] Fix TypeError when resolving untyped arguments (nicolas-grekas)

• security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)

• security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)

• security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)

• security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling validateOnParse (alexandre-daubois)

• security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)

• security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)

• security #cve-2026-45065 [Routing] Fix regex alternation anchoring in UrlGenerator requirement validation (alexandre-daubois)

• security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)

• security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)

• security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)

• security #cve-2026-45755 [Mailer][Mailtrap] Reject webhooks with missing or invalid HMAC signature (alexandre-daubois)

• security #cve-2026-45756 [JsonPath] Cap regex backtracking in match()/search() to prevent ReDoS (alexandre-daubois)

• security #cve-2026-45074 [Security] Require configuring trusted hosts when using CAS authentication (nicolas-grekas)

• security #cve-2026-45075 [Security][HttpKernel] Fix HEAD requests bypassing methods filter in IsGranted, IsCsrfTokenValid and IsSignatureValid attributes (nicolas-grekas)

• bug #64213 [Security] Fix impersonation being deauthenticated on every request (nicolas-grekas)

• 8.1.0-BETA2 (2026-05-13)

• bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)

• bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)

• bug #64197 [Messenger] Ensure SigningSerializer won't decode before verifying the signature (nicolas-grekas)

• bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)

• bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)

• bug #64191 [Inflector][String] Fixed singularize traces > trace (ruudk)

• bug #64192 [Mailer] Use hash_equals() to compare webhook signatures for AhaSend (alexandre-daubois)

• bug #64193 [Notifier] Use hash_equals() to compare webhook signatures for Vonage (alexandre-daubois)

• bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)

• bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)

• feature #61936 [Messenger] Allow to respect retry strategy with RecoverableMessageHandlingException (VincentLanglet)

• bug #64182 [Console] Fix signal handler scoping (jpollard3)

• bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)

• bug #64058 [Process] Ignore array env values before proc_open (dionisvl)

• bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)

• bug #64176 [Console] Make ConsoleSectionOutput::overwrite() atomic to fix sections + ProgressIndicator clear (Amoifr)

• feature #63770 [HttpClient] Add custom DNS resolution using a decorator (peter17)

• bug #64158 [Form] Fix array_flip() warning in expanded+multiple ChoiceType on partial submit (SAY-5)

• feature #64156 [Validator] Add findByCodes() to ConstraintViolationListInterface (michaelthieulin)

• feature #64160 [HttpClient] Add $allowList argument to NoPrivateNetworkHttpClient (Amoifr)

• feature #64163 [HttpClient] Log stale-if-error fallback in CachingHttpClient (ousamabenyounes)

• bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)

• bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)

• bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)

• bug #64172 [WebProfilerBundle] Don’t try to access RawMessage::$headers (MatTheCat)

• bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)

• feature #60298 [Messenger][Amqp] delayed quorum queues (Miquel Fontana, miquel-angel)

• bug #64167 [Console] Add missing symfony/polyfill-php85 dependency (Amoifr)

• 8.1.0-BETA1 (2026-05-06)

• feature #63751 [DependencyInjection][HttpKernel] Add support for resetting non-shared services (Pechynho)

• feature #63689 [Routing] Allow collection prefixes to disable trailing slash on root (vvaswani)

• feature #62127 [RateLimiter] Add calendar-aligned mode to FixedWindowLimiter (Crovitche-1623)

• feature #64118 [Security] Revert "Add per-username login rate-limit to prevent brute-force attacks" (wouterj)

• feature #64094 [Messenger] Deprecate StopWorkerOnTimeLimitListener in favor of time_limit worker option (Toflar)

• feature #64104 [Security] Add per-username login rate-limit to prevent brute-force attacks (ayyoub-afwallah)

• feature #63862 [Console] Use ECH sequence for block padding (Amoifr)

• feature #64087 [HttpKernel][VarDumper][WebProfilerBundle] Forward CSP nonce to dump() instead of disabling CSP (Amoifr)

• feature #64079 [ErrorHandler] Trigger @method deprecation notices for abstract classes (lacatoire)

• feature #46654 [Serializer] Add COLLECT_EXTRA_ATTRIBUTES_ERRORS and full deserialization path (NorthBlue333)

• feature #62112 [Console] Add support for OSC 9;4 escape sequence for progress reporting (canvural)

• feature #52173 [Serializer] Add AbstractObjectNormalizer::ENABLE_TYPE_CONVERSION for scalar type transformation (Jeroeny)

• feature #60008 [HttpFoundation] Add SessionHasFlashMessage test constraint (Pierstoval)

• feature #63810 [VarDumper] Dump class-strings as class stubs with source location and static properties (lyrixx)

• feature #63929 [TwigBundle] Add twig.safe_class resource tag to register safe classes for the escaper (GromNaN)

• feature #62801 [Notifier][Prelude] Add bridge (zairigimad)

• feature #63727 [Form] Use translation_domain for expanded ChoiceType placeholder (eyupcanakman)

• feature #63762 [VarDumper] Add CSP nonce support to HtmlDumper (Amoifr)

• feature #63809 [Workflow] Add support for dumping listeners in Graphviz diagrams (lyrixx)

• feature #63879 [JsonStreamer] Add DateTimeZone value object support (mtarld)

• feature #63905 [FrameworkBundle] Add --sort option to debug:router command (Michael Thieulin)

• feature #63907 [RateLimiter] Add #[RateLimit] attribute to rate limit controllers declaratively (ayyoub-afwallah)

• feature #63925 [MonologBridge] Add $subjectMaxLength option to MailerHandler (Amoifr)

• feature #63945 [Validator] Make constraint validators reentrant instead of being stateful (stof)

• feature #64055 [Runtime] Add FRANKENPHP_RESET_KERNEL to reset the kernel between requests (nicolas-grekas)

• feature #63988 [DependencyInjection] Support autowiring env vars as closures or Stringable when using #[Autowire(env: 'FOO')] (nicolas-grekas)

• feature #64070 [Messenger] Release deduplication lock on definitive failure (ousamabenyounes)

• feature #63778 [Tui] Add the component (fabpot)

• feature #64049 [VarExporter] Deprecate Hydrator and Instantiator classes (nicolas-grekas)

• feature #64009 Improve phpdoc types (stof)

• feature #63910 [DependencyInjection] Allow inline Definition as factory and configurator (GromNaN)

• feature #63943 [WebProfilerBundle] Improve toolbar accessibility for screen reader (Nitram1123)

• feature #63912 [JsonStreamer] Improve error message when unable to encode (GaryPEGEOT)

• feature #63695 [VarExporter] Make DeepCloner::__serialize() return a pure array and add toArray()/fromArray() (nicolas-grekas)

• feature #63880 [DependencyInjection] Add #[RequiredBundle], ServicesBundle and ConsoleBundle (nicolas-grekas)

• feature #63877 [DependencyInjection] Add AddBehaviorDescribingTagsPass (nicolas-grekas)

• feature #63875 [EventDispatcher] Add hot-path and no-preload support to AddEventAliasesPass (nicolas-grekas)

• feature #63710 [DependencyInjection] Add Kernel and Bundle infrastructure for HTTP-less DI-powered apps (nicolas-grekas)

• feature #63771 [Security] Add enforce_key_usage_verification option to OIDC discovery (ruudk)

• feature #60334 [Twig] Add daisyUI form layout (Oviglo)

• feature #63742 [JsonStreamer] Add DateInterval value object support (mtarld)

• feature #63745 [FrameworkBundle][HttpKernel] Deprecate Bundle::registerCommands() (derrabus)

• feature #63735 [JsonStreamer] Support date time timezone (mtarld)

• feature #63714 [Console] Add validation constraints support to #[MapInput] (chalasr)

• feature #63709 [Console] Add optional PSR container parameter to Application (nicolas-grekas)

• feature #57598 [Console] Expose the original input arguments and options and to unparse options (theofidry)

• feature #52134 [HttpKernel] Add option to map empty data with MapQueryString and MapRequestPayload (Jeroeny)

• feature #41574 [Messenger] Add AmqpPriorityStamp for per-message priority on AMQP transport (Valentin Nazarov)

• feature #63661 [Runtime] Add FrankenPhpWorkerResponseRunner for simple response return (guillaume-sainthillier)

• feature #63666 [Messenger] Allow configuring the service reset interval in the messenger:consume command via the --no-reset option (nicolas-grekas)

• feature #63665 [Messenger] Add MessageExecutionStrategyInterface and refactor Worker to use it (nicolas-grekas)

• feature #63662 [Messenger] Add a --fetch-size option to the messenger:consume command to control how many messages are fetched per iteration (nicolas-grekas)

• feature #63663 [Contracts] Add ContainerAwareInterface (nicolas-grekas)

• feature #63631 [Form] Add labels option to DateType to customize year/month/day sub-field labels (guillaumeVDP)

• feature #62823 [JsonPath] Add custom function support (alexandre-daubois)

• feature #63590 [DependencyInjection] Add support for using service stacks as decorators (nicolas-grekas)

• feature #63595 [ObjectMapper] Add IsNotNull built-in condition (Nayte91)

• feature #63612 [VarExporter] Add DeepCloner for COW-friendly deep cloning (nicolas-grekas)

• feature #51379 [HttpKernel] Adding new #[MapRequestHeader] attribute and resolver (StevenRenaux)

• feature #63585 [Security] Deprecate erase_credentials config, container parameter and AuthenticatorManager constructor argument (guillaumeVDP)

• feature #62029 [Mailer][SES] Allow configuring port and tls options (adars)

• feature #63615 [Uid] Pass invalid UID value to InvalidArgumentException for better debug (rela589n)

• feature #63339 [JsonStreamer] Handle value objects (mtarld)

• feature #63383 [ObjectMapper] Allow class FQDN arrays as TargetClass and SourceClass param (rrajkomar)

• feature #63520 [FrameworkBundle] Allow configuring Webhook's header names and signing algo (lacatoire)

• feature #63593 [Uid] Add Uuid47Transformer support for UUIDv7/v4 conversion (nicolas-grekas)

• feature #63528 [TypeInfo] Resolve tentative return types (valtzu)

• feature #63546 [Console] Add outline-style block methods to SymfonyStyle (guillaumeVDP)

• feature #63581 [FrameworkBundle][Messenger] Deprecate "senders" nesting level in routing config (W0rma)

• feature #63441 [HttpClient] Default CachingHttpClient's $maxTtl to 86400s to prevent eternal cache items (Lctrs, nicolas-grekas)

• feature #63541 [HttpFoundation] Deprecate setting public properties of Request and Response objects directly (nicolas-grekas)

• feature #63552 [Runtime] Add SymfonyRuntime::resolveType() for customizing how types are resolved in extending runtimes (Kingdutch)

• feature #63481 [ErrorHandler] Allow namespace remapping in DebugClassLoader to relax the "same vendor" constraint (mpdude)

• feature #63524 [Translation][Crowdin] Replace deprecated Upload Translations method with Import Translations (bhdnb)

• feature #63505 [FrameworkBundle] Deprecate terminate_on_cache_hit http_cache option (Mynyx)

• feature #63538 [Console] Sort suggested commands alphabetically (javiereguiluz)

• feature #63537 [Console] Replace executeCommand() by runCommand() when testing commands (javiereguiluz)

• feature #45553 [Translation] Extract locale fallback computation into a dedicated class (mpdude)

• feature #63433 [HttpClient] Add GuzzleHttpHandler that allows using Symfony HttpClient as a Guzzle handler (nicolas-grekas)

• feature #63465 [Translation] Add support for XLIFF PGS (Plural, Gender, and Select Module) (alexandre-daubois)

• feature #62888 [Messenger] Route decode failures through failure handling (nicolas-grekas)

• feature #63453 [Console][WebProfilerBundle] Trace argument value resolvers (chalasr)

• feature #52055 [Console] Deprecate combining incompatible mode flags in InputArgument and InputOption (jnoordsij)

• feature #52058 [Console] Allow setting a boolean default value on InputOption::VALUE_NEGATABLE options (jnoordsij)

• feature #45081 [Form] Add support for submitting forms with unchecked checkboxes in request handlers (filiplikavcan)

• feature #63443 [Console] Add customization to SymfonyStyle progressBar (guillaumeVDP)

• feature #63451 [PropertyInfo] Add support for property hook settable types (alexandre-daubois)

• feature #63455 [Translation] Add support for XLIFF versions 2.1 and 2.2 (alexandre-daubois)

• feature #63427 [WebLink] : Adding consts for as attributes (ThomasLandauer)

• feature #63426 [DependencyInjection] Deprecate named autowiring alias that don't use #[Target] (nicolas-grekas)

• feature #63429 [FrameworkBundle] Add MicroKernelTrait::$allowedEnvs to enforce allowed values for APP_ENV (vincentpabst)

• feature #61494 [Console] Allow to test the different streams at the same time with a new result-based testing API for CommandTester (theofidry)

• feature #63371 [Form] Add uid_format option to EntityType (lacatoire)

• feature #61462 [Messenger] Add ListableReceiverInterface support to RedisReceiver (mudassaralichouhan)

• feature #49388 [CssSelector] Add :has() support (franckranaivo)

• feature #63242 [FrameworkBundle] Add decoration stack to debug:container command (ayyoub-afwallah)

• feature #63373 [HttpFoundation] Add BinaryFileResponse::shouldDeleteFileAfterSend() (lacatoire)

• feature #49518 Create #[Serialize] Attribute to serialize Controller Result (Koc)

• feature #63355 [Validator] Add ValidatorBuilder::enablePropertyMetadataExistenceCheck() (lacatoire)

• feature #63335 [TwigBridge] Add form_flow_* helper functions (ker0x)

• feature #63356 [FrameworkBundle] Configure custom marshaller per cache pool (mvanduijker)

• feature #63359 [Console] Allow passing Validator constraints to QuestionHelper and #[Ask] (chalasr)

• feature #54817 [HttpKernel] Support variadic with #[MapRequestPayload] (DjordyKoert)

• feature #63360 [Validator] Add clock-awareness to comparison and range validators (lacatoire)

• feature #63346 [Messenger][AMQP] Allow disabling default queue binding via queues option (xammmue)

• feature #52265 [HttpClient] Configure MockClient if mock_response_factory has been set on a scoped client (tarjei)

• feature #63293 [Console] Add image support to QuestionHelper and #[Ask] (chalasr)

• feature #47969 [Filesystem] rename Filesystem::mirror() option copy_on_windows to follow_symlinks (maxbeckers)

• feature #58871 [Form] BirthdayType has automatic attr when widget is single_text (nicolas-grekas)

• feature #59202 [Semaphore] Add a semaphore store based on locks (alexander-schranz)

• feature #47666 [Messenger] Move PostgreSQL LISTEN/NOTIFY blocking to worker idle event listener (d-ph)

• feature #62638 [DependencyInjection] Add tag decoration support (mtarld)

• feature #62320 [WebProfiler] add cURL copy/paste to request tab (darkweak)

• feature #63214 [Form] Allow ViolationMapperInterface injection for ValidatorExtension and FormTypeValidatorExtension (ktherage)

• feature #63304 [Contracts][DependencyInjection] Support hooked properties in ServiceMethodsSubscriberTrait (derrabus)

• feature #63277 [Messenger] Add idle timeout option to BatchHandlerTrait (HypeMC)

• feature #61458 [HttpKernel] Validate typed request attribute values before calling controllers (mudassaralichouhan)

• feature #63274 [HttpKernel] Add ControllerEvent::evaluate() et al. to help with evaluating expressions or closures in controller attributes (nicolas-grekas)

• feature #63032 [HttpKernel] Dispatch events named after controller attributes (nicolas-grekas)

• feature #63263 [FrameworkBundle][Lock] Scope semaphore and flock stores by project dir by default (nicolas-grekas)

• feature #61457 [FrameworkBundle] Deprecate container parameters router.request_context.scheme and .host (stollr)

• feature #63092 [HttpKernel] Expose controller metadata throughout the request lifecycle (nicolas-grekas)

• feature #58273 Allow usage of expressions for defining validation groups in #[MapRequestPayload] (Brajk19)

• feature #63201 [Security] Add this to #[IsGranted] subject expression vars when available (valtzu)

• feature #63181 [DependencyInjection] Add target parameter to #[AsAlias] attribute (ayyoub-afwallah)

• feature #53559 [DomCrawler] Allow to add choices to single select (norkunas)

• feature #53998 [Security] Add retrieval of parent role names (PierreCapel)

• feature #62875 [Messenger] Add regex support for transport name matching in messenger:consume command (santysisi)

• feature #58732 [Finder] Allow finder to set the UNIX_PATH flag when recursing directories (Shane McKinley)

• feature #62754 [ExpressionLanguage] Add support for null-safe syntax for array access (cancan101)

• feature #57365 [Validator] Add Xml constraint (sfmok)

• feature #58966 [Serializer] Trigger deprecation when could not parse date with default format (alexndlm)

• feature #57769 [Notifier] [Telegram] Add support for local API server (ahmedghanem00)

• feature #57653 [FrameworkBundle] Allow default action in HtmlSanitizer configuration (Neirda24)

• feature #54866 [Messenger] Added the ability to force RedisCluster (adideas)

• feature #63130 [Console] Add TesterTrait::assertCommandFailed and TesterTrait::assertCommandIsInvalid helpers (darovic)

• feature #63095 [FrameworkBundle] Add shortcut to run console command in tests (Koc)

• feature #63097 [Security] Decouple SameOriginCsrfTokenManager from event listening (jprivet-dev)

• feature #62599 [FrameworkBundle][JsonStreamer] Add default options (mtarld)

• feature #63061 [Messenger] Add support for custom type in Serializer Transport (lyrixx)

• feature #62885 [TypeInfo] Allow resolving object shapes (bnf)

• feature #63183 [Console] Allow object as default for input options and arguments (chalasr)

• feature #63157 [Security] Add support for enums in SignatureHasher::computeSignatureHash() (nicolas-grekas)

• feature #63024 [ObjectMapper] Add targetClass on MapCollection transform (soyuka)

• feature #63111 [DependencyInjection] Add argument exclude to ContainerConfigurator::import() (tilaven)

• feature #63135 [Scheduler] Add option to order recurring messages by next run date in debug command (yoye)

• feature #62434 [HttpKernel] deprecate the Extension class (xabbuh)

• feature #63059 [Semaphore] Add SemaphoreKeyNormalizer (clegginabox)

• feature #62909 [FrameworkBundle] Enable mocking non-shared services in tests (HypeMC)

• feature #62751 [HttpClient] Add support of the persistent cURL handles (Koc)

• feature #63121 [Translation][FramworkBundle] Allow using env vars in the list of enabled locales (nicolas-grekas)

• feature #62566 [FrameworkBundle] Add AbstractController::createFormFlowBuilder (silasjoisten)

• feature #62917 [Console] Add ArgumentResolver (chalasr)

• feature #63090 [HttpKernel] Return attributes as a flat list when using Controller[Arguments]Event::getAttributes(*) (nicolas-grekas)

• feature #63039 [PhpUnitBridge] add logic for checking for dist.xml, xml.dist and xml phpunit config (gennadigennadigennadi)

• feature #62941 [HttpKernel] Allow the Cache attribute to be applied conditionally (HypeMC)

• feature #62511 [ObjectMapper] merge nested properties when targeting the same class (soyuka)

• feature #62835 [DependencyInjection] Allow environment variables with . in them (Max Baldanza)

• feature #62957 [ObjectMapper] Throw exception for invalid transform callable (calm329, Asenar)

• feature #62522 [FrameworkBundle][ObjectMapper] Add automatic class-map array based on map attributes (Orkin)

• feature #63023 [Uid] Add argument $format to Ulid::isValid() (mms-uret)

• feature #62854 [HttpClient] Add support for the max_connect_duration option (alexandre-daubois)

• feature #62940 [HttpKernel] Allow using closures with the Cache attribute (HypeMC)

• feature #62925 [HttpKernel] Deserialize UploadedFile for #[MapRequestPayload] (Grafikart)

• feature #62911 [Console] Add #[AskChoice] attribute for interactive choice questions (yceruto)

• feature #62939 [HttpKernel] Improve Cache attribute expression vars (HypeMC)

• feature #62850 [HttpKernel] Decouple controller attributes from source code and add ResponseEvent::getControllerAttributes() (nicolas-grekas)

• feature #62567 [Console] Add support for method-based commands (yceruto)

• feature #62538 [HttpKernel] Add support for SOURCE_DATE_EPOCH environment variable (Charles-Édouard Coste)

• feature #62824 [DependencyInjection][SecurityBundle] Leverage #[AsTaggedItem] for voters (ayyoub-afwallah)

• feature #62339 [DependencyInjection] Deprecate default index/priority methods when defining tagged locators/iterators (nicolas-grekas)

• feature #62792 [DoctrineBridge] Deprecate RegisterMappingsPass::$aliasMap (GromNaN)

• feature #62800 [HttpKernel] Add support for bundles as compiler passes (yceruto)

• feature #62578 [Form] Add reset button in NavigatorFlowType (Nayte91)

• feature #62572 [Messenger] Use clock in DelayStamp and RedeliveryStamp instead of native time classes and methods (bluemmb)

• feature #62483 [DependencyInjection] Deprecate invalid options when using from_callable (yoeunes)

• feature #60372 [Mailer][SendGrid] add support for scheduling delivery via send_at API parameter (Mickael GOETZ, MrMitch)

• feature #62322 [Security] add missing Clear-Site-Data directives (xabbuh)

• feature #62390 [Mailer] Add support of ipPoolId for infobip mailer transport (jbdelhommeau)