This changelog references the relevant changes (bug and security fixes) done in 6.4 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v6.4.0...v6.4.1

• 6.4.41 (2026-05-27)

• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (nicolas-grekas)

• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)

• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)

• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)

• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)

• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)

• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)

• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)

• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (MatTheCat)

• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)

• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)

• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)

• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)

• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)

• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)

• bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)

• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)

• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)

• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)

• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)

• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (ousamabenyounes)

• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (MatTheCat)

• 6.4.40 (2026-05-20)

• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)

• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)

• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)

• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)

• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)

• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)

• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (alexandre-daubois)

• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (alexandre-daubois)

• bug #64258 [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-selects (nicolas-grekas)

• bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)

• security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)

• security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)

• security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)

• security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling validateOnParse (alexandre-daubois)

• security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)

• security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)

• security #cve-2026-45065 [Routing] Fix regex alternation anchoring in UrlGenerator requirement validation (alexandre-daubois)

• security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)

• security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)

• security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)

• 6.4.39 (2026-05-13)

• bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)

• bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)

• bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)

• bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)

• bug #64191 [Inflector][String] Fixed singularize traces > trace (ruudk)

• bug #64193 [Notifier] Use hash_equals() to compare webhook signatures for Vonage (alexandre-daubois)

• bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)

• bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)

• bug #64182 [Console] Fix signal handler scoping (jpollard3)

• bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)

• bug #64058 [Process] Ignore array env values before proc_open (dionisvl)

• bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)

• bug #64176 [Console] Make ConsoleSectionOutput::overwrite() atomic to fix sections + ProgressIndicator clear (Amoifr)

• bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)

• bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)

• bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)

• bug #64172 [WebProfilerBundle] Don’t try to access RawMessage::$headers (MatTheCat)

• bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)

• 6.4.38 (2026-05-06)

• bug #63761 [Scheduler] Fix checkpoint state expiring when cache has default TTL (Amoifr)

• bug #64138 [Translation] Fix TranslationPushCommand::getDomainsFromTranslatorBag (MatTheCat)

• bug #63757 [Messenger][AmazonSqs] Do not override queue-level DelaySeconds when no DelayStamp is set (psantus)

• bug #64122 [Cache] Ensure compatibility with Relay extension 0.22.0 (nicolas-grekas)

• bug #64119 [Yaml] fix flow collection drops &anchor and !!str &anchor items (ousamabenyounes)

• bug #64086 [Messenger] Move --time-limit handling to Worker for proper capping with --sleep (Toflar)

• bug #64100 [Translation] URL-encode tmp path in XliffUtils::shouldEnableEntityLoader (ousamabenyounes)

• bug #64095 [RateLimiter] Carry over reserved tokens past fixed window resets (ousamabenyounes)

• bug #64099 [Ldap] Cast default_socket_timeout to int (ousamabenyounes)

• 6.4.37 (2026-05-01)

• bug #64090 [DependencyInjection] Reject circular references through a factory builder's setup (nicolas-grekas)

• bug #64083 [Messenger] Alias the AMQP "user" connection option to "login" (lacatoire)

• bug #64084 [Messenger] Do not sleep after worker is stopped during idle cycle (Toflar)

• bug #64067 [Serializer] Move type-mismatch and uninitialized-property handling into concrete normalizers (ousamabenyounes)

• bug #64065 [Notifier][Ntfy] Fix Basic auth header by keeping base64 padding (ousamabenyounes)

• bug #64045 [Config] Allow env placeholders in NumericNode min/max checks (ousamabenyounes)

• bug #64047 [Mime] Preserve inline part filename instead of overwriting it with the Content-ID (ousamabenyounes)

• bug #64044 [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType() (ousamabenyounes)

• bug #64030 [MonologBridge] Guard against re-entrant calls in AbstractTokenProcessor (ousamabenyounes)

• bug #64060 [Cache] Normalize default_lifetime for pools wrapped by ChainAdapter (ostrolucky)

• bug #63996 [RateLimiter] Keep token bucket alive while reservation debt is unpaid (ousamabenyounes)

• bug #63975 [Lock] Avoid aborting outer PostgreSQL transaction on lock contention (lacatoire)

• bug #64046 [HttpClient] Don't share CURL_LOCK_DATA_CONNECT to honor max_host_connections (ousamabenyounes)

• bug #64036 [Validator] fix mapping properties using property hooks (mrossard)

• bug #64024 [AssetMapper] Allow spaces in version constraints (MatTheCat)

• bug #64020 [Dotenv] Strip NUL byte placeholder from values passed to putenv() (alexandre-daubois)

• bug #63982 [Messenger] Respect SentToFailureTransportStamp when failure transports are configured (ousamabenyounes)

• bug #63990 [Messenger] Do not apply --max to --stats unless explicitly set (ousamabenyounes)

• bug #63979 [Serializer] Capture constructor TypeError when collecting denormalization errors (lacatoire)

• bug #64006 [DependencyInjection] Fix hidden dependency on symfony/config in PhpDumper (GromNaN)

• bug #63981 [Routing] Honor the Request's method in UrlMatcher::matchRequest() (ousamabenyounes)

• bug #63980 [DependencyInjection] Log every build parameter removed during compilation (ousamabenyounes)

• bug #63974 [Serializer] Make BackedEnumNormalizer unconditionally return null on invalid value if allow_invalid_values is set (MatTheCat)

• bug #63964 [Cache] Ensure internal state is cleared in TagAwareAdapter::reset() … (KevinMartinsDev)

• bug #63955 [Dotenv] Fix variable corruption when loading env more than once (nicolas-grekas)

• bug #63959 [VarExporter] Don't warn for __sleep()-listed uninitialized declared properties (nicolas-grekas)

• bug #63952 [Scheduler] Respect console.command DI tag command attribute (nicolas-grekas)

• bug #63951 [DependencyInjection] Fix autowiring nullable intersection types (HypeMC)

• bug #63938 [Workflow] Fix HTML escaping in GraphvizDumper labels (alexandre-daubois)

• bug #63909 [Filesystem] Fix Path methods replacing backslashes on UNIX (Amoifr)

• bug #63922 [DependencyInjection] Fix excludeSelf not applied when using AutowireLocator (GromNaN)

• bug #63894 [Dotenv] Fix self-referencing variable resolution with suffix/prefix (Amoifr)

• bug #63883 [Serializer] Fix getAllowedAttributes() when groups contain wildcard '*' (takashiraki)

• bug #63876 [DependencyInjection] Fix instanceof autoconfiguration for anonymous classes (jlabedo)

• bug #63860 [Cache] Fix Psr16Cache::getMultiple() returning wrapper values when using TTL (nicolas-grekas)

• bug #63859 [Console] Fix shell completion when SHELL_VERBOSITY=-1 (nicolas-grekas)

• bug #63847 [EventDispatcher] Fix TraceableEventDispatcher when reset during dispatch (aschempp)

• data #63849 Remove needs-review flag for Afrikaans (af) (payene)

• 6.4.36 (2026-03-31)

• bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (nicolas-grekas)

• bug #63817 [Serializer] Fix denormalization of nested array with key types (mtarld)

• bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (lyrixx)

• bug #63806 [Ldap] Make the Adapter resettable (kira0269, nicolas-grekas)

• bug #63720 [MonologBridge] Fix ConsoleHandler losing output after nested command terminates (mp3000mp)

• bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (wazum)

• bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (pcescon)

• bug #63683 [TwigBridge] Fix image method to use DataPart content ID (pavelwitassek)

• bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (sn3mdev)

• bug #63747 [Cache] Fix Psr16Cache::getMultiple() returning ValueWrapper with TagAwareAdapter (pcescon)

• bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (pcescon)

• bug #63777 [FrameworkBundle] Fix setting router.request_context.base_url when option default_uri is defined (nicolas-grekas)

• bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (LachlanArthur)

• bug #63726 [HttpClient] Unset push response content when the push handler is released (sakozoko)

• bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (pcescon)

• bug #63724 [HttpKernel] Fix allowing invalid #[Autowire] references in controller arguments (valtzu)

• bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (shyim)

• bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (nicolas-grekas)

• bug #63676 [HttpKernel] Reset router locale to default when finishing main request (guillaumeVDP)

• bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (andyexeter)

• bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (guillaumeVDP)

• bug #63656 [Form] Fix typed property initialization in ValidatorExtension (SeverinGloeckle)

• bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (wazum)

• bug #63639 [ErrorHandler] "@method" deprecation notices are missing when interface inheritance is used (mpdude)

• bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (nicolas-grekas)

• bug #63629 Fix deprecation notices for "@method" annotations and classes with __call() (mpdude)

• bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (nicolas-grekas)

• 6.4.35 (2026-03-06)

• bug #63604 [Console] Fix ApplicationTester ignoring interactive and verbosity options when SHELL_VERBOSITY is set (nicolas-grekas)

• bug #63602 [Serializer] Fix denormalization of magic __set properties (nicolas-grekas)

• bug #63603 [HttpFoundation] Fix session cookie_lifetime not applied in mock session storage (nicolas-grekas)

• bug #63598 [UrlSanitizer] Add 'sms' to hostless schemes (hivokas)

• bug #63592 [Cache] Add timeout and slot eviction to LockRegistry stampede prevention (nicolas-grekas)

• bug #63570 [Console] Fix OUTPUT_RAW corrupting binary content on Windows (guillaumeVDP)

• bug #63584 [Mime] Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (nicolas-grekas)

• bug #63574 [FrameworkBundle] Fix stale container after reboot in KernelTestCase (nicolas-grekas)

• bug #63572 [Form] Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (nicolas-grekas)

• bug #63568 [TwigBridge] Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (nicolas-grekas)

• bug #63555 [HttpKernel] Fix int-to-float coercion for JSON #[MapRequestPayload] with pre-parsed array data (eyupcanakman)

• bug #63559 [Messenger] Flush batch handlers after inactivity timeout when worker is busy (nicolas-grekas)

• bug #63523 [Mailer][Mailjet] Fix inline attachments with custom Content-ID (99Vicky)

• bug #63550 [RateLimiter] Prevent negative token from causing integer underflow (jhogervorst)

• bug #63526 [WebProfilerBundle] Fix Symfony web debug toolbar not being displayed (zoglo)

• bug #63500 [PhpUnitBridge] Consider PSR-0/PSR-4 fallback dirs when building paths (mpdude)

• bug #63533 [DebugBundle] gracefully handle the kernel.runtime_mode.web parameter missing (xabbuh)

• bug #63534 [Validator] Regex bypass when match is false with too big input (vincent4vx)

• bug #63496 [Dotenv] Defer variable and command expansion to account for overrides from subsequent .env files (nicolas-grekas)

• bug #63506 [DependencyInjection] Fix TypeError when using a custom container base class with typed $parameterBag (nicolas-grekas)

• 6.4.34 (2026-02-26)

• bug #63492 [RateLimiter] Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (ERuban)

• bug #63491 [RateLimiter] Fix retryAfter when consuming exactly all remaining tokens in SlidingWindow (ERuban)

• bug #52413 [RateLimiter] Fix reservations outside the second fixed window (SanderSander)

• bug #57392 [Serializer][Validator] Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (antten)

• bug #54236 [Config][Routing] Fix exclude option being ignored for non-glob and PSR-4 resources (NeilPeyssard)

• bug #47424 [Filesystem] makePathRelative with existing files, remove ending / (Petar Marjanovic)

• bug #52083 [Messenger][Amqp] Don't use retry routing key when sending to failure transport (Fabien Perroquin)

• bug #63275 [Messenger] Fix re-sending failed messages to a different failure transport (bartholdbos)

• bug #63473 [DependencyInjection] Fix PriorityTaggedServiceTrait not discovering #[AsTaggedItem] on decorated services (lacatoire)

• bug #63472 [TwigBridge] Fix Bootstrap 4 form errors rendered inside <label> (asispts)

• bug #54324 [Form] Fix merging POST params and files when collection entries have mismatched indices (priyadi)

• bug #52722 [Validator] Fix type error for non-array items when Unique::fields is set (aprat84)

• bug #54703 [HttpKernel] Fix default locale ignored when Accept-Language has no enabled-locale match (karimmorel)

• bug #62681 [FrameworkBundle] Make ConfigDebugCommand use its container to resolve env vars (MatTheCat)

• bug #47432 [Console] Fix various completion edge cases (Seldaek)

• bug #63450 [Form] Fix missing resource tracking for type extensions in FormPass (ranpafin)

• bug #63454 [Security] Fix lazy firewall triggering remember me authentication on POST requests to public routes (nicolas-grekas)

• bug #63460 [Workflow] Implement missing reset() method in TraceableWorkflow (santysisi)

• bug #63456 [Console] Fix validator exception masked by MissingInputException on empty input (nicolas-grekas)

• bug #63428 [Serializer] Fix handling of constructor enum denormalization errors (vvaswani)

• bug #63438 [Console] ProgressIndicator console helper display with multiple processes (guillaumeVDP)

• bug #63436 [Console] Silence shell_exec warning in hasSttyAvailable (lacatoire)

• bug #63448 [HttpFoundation] Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (nicolas-grekas)

• bug #63437 [Cache] Wrap DoctrineDbalAdapter::doSave() in savepoint to prevent transaction poisoning (lacatoire)

• bug #63405 [Serializer] Fix passing context option to property-info (nicolas-grekas)

• bug #63400 [CssSelector] Fix memory exhaustion by adding an LRU cache to CssSelectorConverter (arcangelini)

• bug #63386 [HttpKernel] Handle invalid backed-enum values gracefully in RequestPayloadValueResolver (nicolas-grekas)

• bug #63384 [FrameworkBundle] fail gracefully when the semaphore config is used but the component is missing (xabbuh)

• bug #63379 [DependencyInjection] Prevent false unused-env errors for abstract definitions removed at compile time (nicolas-grekas)

• bug #63344 [PropertyInfo] Prioritize property type over is/has/can accessors (nicolas-grekas)

• bug #63353 [Validator] Fix comparison validator crash on extreme dates (lacatoire)

• bug #63351 [Console] Fix SymfonyStyle block output with \r\n line endings (lacatoire)

• bug #63342 [PropertyInfo] fix union with mixed handling for the legacy PropertyInfo Type (xabbuh)

• bug #63319 [HttpFoundation] BinaryFileResponse: always return 206 if Range is valid (Jimbolino)

• bug #63307 [DependencyInjection] Fix stale binding lookup in ResolveBindingsPass error message (yoeunes)

• bug #63317 [Asset] Fix JsonManifestVersionStrategy exception on missing manifest in non-strict mode (claude)

• bug #63324 [Cache] Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (ckrack)

• bug #63324 [Cache] Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (ckrack)

• bug #57292 [Yaml] Fix parsing nested mappings in sequences (HypeMC)

• bug #63306 [Cache] Revert "Fix DSN auth not passed to clusters in RedisTrait" (nicolas-grekas)

• bug #63272 [Messenger][Cache] Fix forwarding SSL settings to the redis sentinel (CientistaDaWeb)

• bug #63288 [Messenger] Optimize serialized size of ErrorDetailsStamp (nicolas-grekas)

• bug #63292 [Messenger] Fix AMQP heartbeat reconnection during in-flight message handling (wazum)

• bug #63278 [Mailer] Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (mwijngaard)

• bug #63282 [Messenger] Revert batch processing fix (HypeMC)

• bug #63259 [FrameworkBundle] Fix BrowserKitAssertionsTrait compatibility with HttpBrowser (thiagomp)

• bug #63281 [String] Treat emoji VS16 as wide in width calc (fabpot)

• bug #63279 [Serializer] Normalize static methods when they have groups (digilist)

• bug #62970 [WebProfilerBundle] Fix hot reload support (FrankenPHP) (dunglas)

• bug #63271 [DoctrineBridge] Respect schema_filter in schema listeners (wazum)

• bug #63262 [HttpFoundation] Reject invalid paths (nicolas-grekas)

• bug #58460 Fix destructor throwing while timeout was handled (Seldaek, nicolas-grekas)

• bug #63255 [FrameworkBundle] Add missing useAttributeAsKey calls (MatTheCat)

• bug #57561 [DependencyInjection] Fix ignore invalid_reference behavior param for the some services (Nguyen26052004)

• bug #54304 [HttpFoundation] When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (ArmCyber)

• bug #63238 [Console] Fall back to 0 when getCode() does not provide an integer (makomweb)

• bug #63239 [FrameworkBundle] Fix accessing the test container when using KernelTestCase in non-debug mode (nicolas-grekas)

• bug #58433 [Messenger] Avoid skipping batch handlers on flush (Erwin Houtsma)

• bug #63234 [DependencyInjection][HttpKernel] Fix parsing Target attributes on properties and on controllers (nicolas-grekas)

• bug #63231 [Translation] Fix for Crowdin Translation File Replaced with Partial Data When Pushing Default Locale Without --force (bhdnb)

• bug #63226 [Messenger] Fix calling nack() when ack() fails (nicolas-grekas)

• bug #63230 [Cache][HttpFoundation][Lock] fix engine declaration on mysql pdo table creations (tandev)

• bug #63225 [Finder] Fix SortableIterator inadvertently and inconsistently deduplicating appended iterators (nicolas-grekas)

• 6.4.33 (2026-01-28)

• bug #63212 [HttpClient] Fix dealing with truncated streams after headers arrived with CurlHttpClient (nicolas-grekas)

• bug #63208 [PropertyInfo] Fix DocBlock resolution for inherited promoted properties (yoeunes)

• bug #63170 [RateLimiter] Persist state when consuming negative tokens (jhogervorst)

• bug #63137 [HttpFoundation] Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (samy-mahmoudi)

• bug #63211 [HttpClient] Fix dealing with multiple levels of AsyncResponse decoration (nicolas-grekas)

• bug #63202 [Messenger] Only send UNLISTEN query if we are actively listening (jwage)

• security #cve-2026-24739 [Process] Fix escaping for MSYS on Windows (nicolas-grekas)

• bug #63204 [PropertyInfo] Fix resolution of self/parent types in inherited DocBlocks (yoeunes)

• bug #63195 [FrameworkBundle] Clean http_cache dir in KernelTestCase::ensureKernelShutdown() (nicolas-grekas)

• bug #63164 [Process] Fix escaping for MSYS on Windows (nicolas-grekas)

• bug #63192 [Finder] Fix appending empty iterators (nicolas-grekas)

• bug #63193 [PropertyInfo] Conflict with phpdocumentor/reflection-docblock >= 6 (branch 6.4 only) (nicolas-grekas)

• bug #63191 [Serializer] Apply #[Ignore] to the right metadata (VincentLanglet)

• 6.4.32 (2026-01-24)

• bug #63160 [DependencyInjection] Fix alias chain inversion when deprecated alias points to decorated service (amateescu)

• bug #62852 [Cache] Fix DSN auth not passed to clusters in RedisTrait (wikando-ck)

• bug #62959 [PropertyInfo] do not parse scalar as an object (xabbuh)

• bug #63136 [Serializer] Fix is/has/can accessor naming to strip prefix unless colliding (nicolas-grekas)

• bug #63144 [Form] Fix OrderedHashMap auto-increment logic with mixed keys (yoeunes)

• bug #63154 [Form] don't skip custom view transformers while normalizing submitted newlines (xabbuh)

• bug #63051 [DoctrineBridge] Fix custom type based on Uid on entity loader (IndraGunawan)

• bug #63108 [ErrorHandler] fix parsing of complexe type (jderusse)

• bug #63126 [PropertyInfo] Throw when phpdocumentor/reflection-docblock v6 is in use (branch 6.4 only) (nicolas-grekas)

• bug #63113 [Form] Fix ICU 72+ whitespace handling in DateTimeToLocalizedStringTransformer (roukmoute)

• bug #63052 [Serializer] Fix NameConverter not detecting wrong input format with allow_extra_attributes=false (xersion22)

• bug #63064 [Translation] Fix handling of empty lines in CsvFileLoader (fnogatz)

• bug #63043 [FrameworkBundle] Check for console package before register CommandDataCollector (gimler)

• bug #63016 [FrameworkBundle] Ensure a fresh container is used after cache warmup in KernelTestCase (lyrixx)

• bug #62762 [Finder] Fix Finder::append() breaking generic typing contract (jack-worman)

• bug #63004 [Process] Ignore invalid env var names (nicolas-grekas)

• bug #63005 [FrameworkBundle] Revert destination file change for secrets:decrypt-to-local (nicolas-grekas)

• bug #63012 [HttpFoundation] Fix double-prefixing of session keys when using redis/memcached (nicolas-grekas)

• bug #63001 [Scheduler] Fix array to string conversion in #[AsCronTask] arguments (serhiilabs)

• bug #62953 [Serializer] Fix removing nested values (gnoddep)

• bug #62988 [Messenger] Fix DBALv4 support by replacing trigger by explicit pg_notify() (nicolas-grekas)

• bug #62795 [FrameworkBundle] Fix mocking decorated services in tests (nicolas-grekas)

• bug #62838 [Serializer] Fix serialization of method with same name than property (VincentLanglet)

• bug #62872 [Messenger] Fix processing batches (HypeMC)

• bug #62848 [HttpKernel] Fix using HTTP Cache in worker mode (nicolas-grekas, stakovicz)

• bug #62954 [HttpClient] Fix existing headers must be replaced in CachingHttpClient (Toflar)

• bug #62884 [Form][TwigBridge] Prevent cached block prefixes from leaking across nested collections (nicolas-grekas)

• bug #62886 [PropertyAccess][PropertyInfo][Serializer] Skip methods that look like getters but return void or never (jordikroon)

• 6.4.31 (2025-12-31)

• bug #62873 [Cache] Fix namespace of chained pools when using another chain as template (nicolas-grekas)

• bug #62840 [Cache] Fix stampede protection when forcing item recomputation (nicolas-grekas)

• bug #62845 [HttpClient] Fix ever growing $maxHostConnections (nicolas-grekas)

• bug #62843 [DependencyInjection] Fix referencing build-time array parameters (nicolas-grekas)

• bug #62841 [Form] Always normalize CRLF and CR to LF in TextareaType (alexandre-daubois)

• bug #62490 [FrameworkBundle] Fix cache:pool:prune exit code on failure (yoeunes)

• bug #62813 [Console] Fix EofShortcut instruction when using a modern terminal on Windows (fperxas)

• bug #62827 [Console] Fix choice autocomplete issue when string has spaces (ayyoub-afwallah)

• bug #62797 [Serializer] Fix inconsistent field naming from accessors when using groups (nicolas-grekas)

• bug #62741 [Finder] Fix converting unanchored glob patterns to regex (nicolas-grekas)

• bug #62759 [Form] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #62796 [Security] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #62808 [Translation] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #62775 [Process] Fix dealing with broken stdin pipes (nicolas-grekas)

• bug #62793 [Cache] Fix calling the callback wrapper for ChainAdapter (nicolas-grekas)

• bug #62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (nicolas-grekas)

• bug #62803 [AssetMapper] Batch concurrent requests to prevent flooding jsdelivr (nicolas-grekas)

• bug #62810 [TwigBundle] Align TemplateIterator handling of @! original bundle templates with TwigExtension (mbessolov)

• bug #62812 [Messenger][AMQP] Fix negative delays with AMQP messenger transport (hockdudu)

• bug #62772 [PropertyInfo] Fix calling same-named method with required args instead of reading public property (makraz)

• bug #62773 [Serializer] Do not skip nested null values when denormalizing (MatTheCat)

• bug #62745 [Validator] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #61963 [Doctrine][Messenger] Remove old MySQL special handling that causes deadlocks (psihius)

• bug #62744 [TwigBridge] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #62756 [Mailer] do not use PHPUnit mock objects without configured expectations (xabbuh)

• bug #62740 [Serializer] Fix php 8.5 warning unexpected NAN value was coerced to … (aaa2000)

• bug #62758 [BrowserKit] Allow Cookie expiration to be an int (derrabus)

• bug #62396 [PropertyInfo] Fix inconsistency between isWritable and getWriteInfo (yoeunes)

• bug #62699 [HttpClient] Fix ScopingHttpClient to always pass base_uri as string instead of parsed array (santysisi)

• bug #62717 [PropertyInfo] fix @var tag support for PhpStanExtractor (qconer)

• bug #62706 [HttpClient] Fix PHP deprecation when using AmpHttpClient (nicolas-grekas)

• bug #62698 [HttpClient] Fix copy as curl for arrays with resources & unreachable host (HypeMC)

• bug #62686 [PropertyInfo] Fix PseudoType support in PhpDocTypeHelper (VincentLanglet)

• bug #62715 [DependencyInjection] Fix sharing services used only by tagged iterators (nicolas-grekas)

• bug #62714 [DependencyInjection] Handle recursive factory reentry for shared services in PhpDumper (nicolas-grekas)

• 6.4.30 (2025-12-07)

• bug #62675 [DependencyInjection] Fix dealing with errored service definitions (nicolas-grekas)

• bug #62488 [HttpKernel] Make #[Cache] respect all explicit cache directives set in controller (ayyoub-afwallah)

• bug #62665 [DependencyInjection] Revert "bug #62541 Reset resolved state when setting a parameter" (nicolas-grekas)

• bug #61962 [Console] Handle signals on text input (valx76)

• bug #62661 [Runtime] Reuse the already created Request object when the app needs one as argument and returns a kernel (nicolas-grekas)

• bug #62621 [Form] Fix moneytype step (Belhassen)

• bug #62627 [Console] Preserve --help option when a command is not found (santysisi)

• bug #62619 [Messenger] Fix PHP 8.5 deprecation for pgsqlGetNotify() in PostgreSQL transport (Shine-neko)

• bug #62612 [Yaml] Fix regression handling blank lines in unquoted scalars (yoeunes)

• bug #62645 [HttpClient] Fix sharing CurlClientState between clones of CurlHttpClient instances (nicolas-grekas)

• bug #62541 [DependencyInjection] Reset resolved state when setting a parameter (yoeunes)

• bug #62602 [Cache] Fix the creation of a redis connection with only ext-relay (stof)

• bug #62577 [PropertyInfo] treat mixed[] the same as array when getting types from docblocks (xabbuh)

• bug #62498 [FrameworkBundle] fix merging of enabled locales (dmaicher)

• bug #62551 [FrameworkBundle] register attribute loader arguments in a forward-compatible way (xabbuh)

• bug #62482 [DependencyInjection] Fix loose validation in #[Autowire] attribute (yoeunes)

• bug #62513 [FrameworkBundle] Add missing useAttributeAsKey calls (MatTheCat)

• bug #62523 [DependencyInjection] Fix state corruption in PhpFileLoader during recursive imports (yoeunes)

• bug #62536 [Cache] ensure compatibility with Relay extension 0.20.0 (xabbuh)

• bug #62506 [DependencyInjection] Fix query_string env processor for URLs without query string (yoeunes)

• bug #62503 [HttpClient] Fix releasing uploaded stream resources (nicolas-grekas)

• bug #62485 [DependencyInjection] Fix loop corruption in CheckTypeDeclarationsPass (yoeunes)

• bug #62486 [DependencyInjection] Fix invalid PHP syntax for nullable TypedReference in PhpDumper (yoeunes)

• bug #62489 [FrameworkBundle] Fix TypeError when traversing scalar values in debug:config (yoeunes)

• bug #62493 [Console] Fix exception message when abbreviation matches multiple hidden commands (yoeunes)

• bug #62471 [String] Fix normalization in trimPrefix/trimSuffix (yoeunes)

• bug #62456 [AssetMapper] Fix entrypoint status lost during update (yoeunes)

• bug #62416 [Console] Fix completion for global options values (HypeMC)

• bug #62458 [Workflow] Fix MethodMarkingStore crash with inherited uninitialized properties (yoeunes)

• bug #62459 [Routing] Fix case sensitivity for static host matching in compiled routes (yoeunes)

• bug #62461 [Routing] Fix localized prefix updates breaking aliases (yoeunes)

• bug #62460 [Routing] Fix addNamePrefix breaking aliases to external routes (yoeunes)

• bug #62449 [HttpKernel] Fix using MapRequestPayload on nullable arguments (nicolas-grekas)

• bug #62415 [HttpClient] Don't reset unused clients in data collector (HypeMC)

• bug #62437 [DependencyInjection] Fix preloading LazyClosure (nicolas-grekas)

• bug #62409 [Yaml] Align unquoted multiline scalar parsing with spec for comments (yoeunes)

• bug #62398 [Cache] Fix accepting named closures as early-expiration callbacks (nicolas-grekas)

• bug #62406 [Notifier] do not use recipient phone numbers as sender e-mail addresses (xabbuh)

• bug #62407 [FrameworkBundle] work around limitation in JsonResponse when the data is null (xabbuh)

• bug #62400 [Form] Fix EnumType choice_label logic for grouped choices (yoeunes)

• bug #62372 [Cache] Recognize saveDeferred events as writes in CacheDataCollector (yitznewton)

• bug #62335 [Console] Fix signal handlers not being cleared after command termination (yoeunes)

• bug #62348 [Translation][Lokalise] fix "Project too big for sync export" (santysisi)

• bug #62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (yoeunes)

• bug #62356 [HttpClient] Fix Warning: curl_multi_select(): timeout must be positive (Jeroeny)

• bug #62334 [PropertyInfo] Fix ReflectionExtractor handling of underscore-only property names (yoeunes)

• bug #58473 [Serializer] Fix AbstractObjectNormalizer to allow scalar values to be normalized (Hanmac, xabbuh)

• bug #62093 [Security] Fix HttpUtils::createRequest() when the context’s base URL isn’t empty (MatTheCat)

• bug #62007 [Serializer] fix inherited properties normalization (Link1515)

• bug #62286 [Cache] compatibility with ext-redis 6.3 (xabbuh)

• bug #62321 [Serializer] Fix BackedEnumNormalizer behavior with partial denormalization (yoeunes)

• bug #62344 [OptionsResolver] Fix missing prototype key in nested error paths (yoeunes)

• bug #62346 [Clock] Align MockClock::sleep() behavior with NativeClock for negative values (yoeunes)

• bug #62347 [OptionsResolver] Ensure remove() also unsets deprecation status (yoeunes)

• bug #62359 [Yaml] Fix parsing of unquoted multiline scalars with comments or blank lines (yoeunes)

• bug #62350 [ExpressionLanguage] Compile numbers with var_export in Compiler::repr for thread-safety (yoeunes)

• 6.4.29 (2025-11-12)

• security #cve-2025-64500 [HttpFoundation] Fix parsing pathinfo with no leading slash (nicolas-grekas)

• 6.4.28 (2025-11-06)

• bug #62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (nicolas-grekas)

• bug #62171 [Messenger] Fix commands writing to STDERR instead of STDOUT (wazum)

• bug #62315 Keep body size limit for AMP redirects (villermen)

• bug #62091 [BrowserKit] The BrowserKit history with parameter separator without slash. (biozshock)

• bug #62290 [Routing] Fix matching the "0" URL (cs278)

• bug #62285 [HttpClient] Reject 3xx pushed responses (nicolas-grekas)

• bug #62267 [Config] Use the empty string instead of null as an array offset (santysisi)

• bug #62246 [HttpFoundation] Allow Request::setFormat() to override predefined formats (longwave)

• bug #62242 [MonologBridge] Accept HttpExceptionInterface in HttpCodeActivationStrategy (GromNaN)

• bug #62222 [Cache] fix ext-redis 6.2.0 compatibility (xabbuh)

• bug #62201 [HtmlSanitizer] Remove srcdoc from allowed attributes (Spomky)

• 6.4.27 (2025-10-28)

• bug #62145 [Mailer] Fix parsing message ids in SMTP responses (hacfi)

• bug #62096 [Cache] fix compatibility with Relay 0.12.1 (xabbuh)

• bug #62078 [FrameworkBundle] Fix secrets:encrypt-from-local (nicolas-grekas)

• bug #62028 [Validator] Update regular expression in URL validator (mjaschen)

• bug #62054 [AssetMapper] Fix parsing @import that don't use url() (nicolas-grekas)

• bug #62041 [DebugBundle] Wire DumpDataCollector's webMode argument (HypeMC)

• bug #62038 [Translation][Loco] filter should be empty when filtering on all domains (atomiix)

• bug #62003 [Serializer] Fix unexpected type in denormalization errors when float|int union type used in constructor with non numeric string in form-data request (d-mitrofanov-v)

• bug #61990 [Cache][RedisTagAwareAdapter] Add Predis2 Replication Interface check (BrianMwit)

• bug #61960 [WebProfilerBundle] ”finish” errored requests (MatTheCat)

• bug #61945 [Cache] fix compatibility with Relay 0.12 (xabbuh)

• bug #61928 [Form] keep labels from configured choices (xabbuh)

• bug #61889 [Serializer] Fix discriminator class mapping with allow_extra_attributes=false (chris54721)

• bug #61861 [Console] Ensure terminal is usable after termination signal (johnstevenson)

• bug #61876 [Mailer][MailJet] Fix forbidden headers case-sensitive comparison (benjamintoussaint)

• bug #61875 [Form] do not cast too big floats to int (xabbuh)

• 6.4.26 (2025-09-27)

• bug #61856 [Console] do not pass the empty string to ord() (xabbuh)

• bug #61855 [DoctrineBridge][Yaml] don't cast strings exceeding the min/max int ranges (xabbuh)

• bug #61844 do not coerce NAN to other types (xabbuh)

• bug #61825 [DoctrineBridge] Make EntityUserProviders pass attributes to their loader (MatTheCat)

• bug #61793 [AssetMapper] Prevent duplicate entries in module preloads (xDeSwa)

• bug #61757 [FrameworkBundle] Perform-no-deep-merging on workflow transitions' from/to configs (nicolas-grekas)

• bug #61766 Fix ord()-related PHP 8.5 deprecations (nicolas-grekas)

• bug #61368 [HttpKernel] Refine Vary header check to skip special handling of 'Accept-Language' when it's the only entry and '_vary_by_language' is true in CacheAttributeListener (santysisi)

• bug #61746 [Serializer] Fix unknown type in denormalization errors when union type used in constructor (d-mitrofanov-v)

• bug #61724 [Console] Fix handling of \E in Bash completion (HypeMC)

• bug #61518 [HttpKernel] Handle an array vary header in the http cache store for write (philpichet)

• bug #61736 [PhpUnitBridge] do not try to modify the result of a PhptTestCase (xabbuh)

• bug #61731 [PhpUnitBridge] Fix gathering deprecation in phpt (nicolas-grekas)

• bug #61729 [PhpUnitBridge] Silence deprecation of __sleep/wakeup() (nicolas-grekas)

• bug #61727 Replace __sleep/wakeup() by __(un)serialize() for throwing and internal usages (nicolas-grekas)

• bug #61693 [Console] Don’t append a new line to test inputs ending with an EOT (MatTheCat)

• bug #61596 [FrameworkBundle] Normalize workflow places separately (KevinVanSonsbeek)

• bug #61690 [Console] Don’t automatically append EOT to multiline test inputs (MatTheCat)

• bug #61667 [Config] Fix GlobResource pattern with trailing slash (HypeMC)

• bug #61659 [Security] Fix HttpUtils::createRequest() when the base request is forwarded (MatTheCat)

• bug #61645 Replace backtick operator, deprecated in PHP 8.5, with shell_exec() (iluuu1994)

• bug #61097 [Serializer] Fix normalizing objects with accessors having the same name as a property (RafaelKr)

• bug #61614 [SecurityBundle] Prevent accessing the tracked token storage when collecting data (MatTheCat)

• bug #61605 [Cache] Fix internal representation of non-static values (nicolas-grekas)

• bug #61599 [Cache] Make TagAwareAdapter registrable as a service (a.dmitryuk)

• bug #61595 [Security] Pass attributes to nested ChainUserProviders (valtzu)

• bug #61232 [Messenger] Firebird Database - incompatibility with expected lowercase columns (DSsatwareAG)

• bug #61583 [DoctrineBridge] Fix exception catch when deleting temporary table in the sameDatabaseChecker (GromNaN)

• bug #61585 [HttpFoundation][SQLSRV] Change column type from TEXT to STRING (Matt-PMCT)

• bug #61571 [Serializer] Fix dealing with asymmetric visilibity for properties (santysisi)

• bug #61573 [Inflector][String] Fix edge cases (OskarStark)

• bug #61548 [Security] Fix attribute-based chained user providers (valtzu)

• 6.4.25 (2025-08-29)

• bug #61520 [Yaml] Fix scope resolution operator in flow mapping keys (MatTheCat)

• bug #61534 [HttpClient] Fix PHP 8.5 deprecation using str_increment() (nicolas-grekas)

• bug #61529 [FrameworkBundle] Don’t collect CLI profiles if the profiler is disabled (MatTheCat)

• bug #61501 [Console] Fix testing multiline question (MatTheCat)

• bug #61503 [String] Fix nodes singular (ruudk)

• feature #61486 [Security] Ignore target route when exiting impersonation (MatTheCat)

• bug #61459 [String] Fix issues singular (ruudk)

• bug #61426 [Intl] Take timezoneTypes’ ianaMap into account (MatTheCat)

• bug #61453 [VarExporter] Fix serializing classes with __serialize() returning unprefixed private properties (nicolas-grekas)

• bug #61447 [String] specific fix to avoid 'outag' when inflecting 'outages' (PhilETaylor)

• bug #61115 [FrameworkBundle] Make cache:warmup warm up read-only caches (MatTheCat)

• bug #61401 [Process] Enhance hasSystemCallBeenInterrupted function for non-english locale (christianseel)

• bug #61405 Remove calls to no-op functions, deprecated in PHP 8.5 (nicolas-grekas)

• bug #61402 Remove calls to deprecated methods of SplObjectStorage (nicolas-grekas)

• bug #61355 [WebProfilerBundle] Fix toolbar not rendering after replacing it (aleho)

• bug #58547 [HtmlSanitizer] Fix force_attributes not replacing existing attribute in initial data (tgalopin)

• bug #61291 [Messenger] Remove fix NoAutoAckStamp handling in Worker::flush() (wazum)

• bug #61304 [PhpUnitBridge] Call Reflection*::setAccessible() only for PHP < 8.1 (W0rma)

• bug #61319 [Console] [Table] Don't split grapheme clusters (schlndh)

• 6.4.24 (2025-07-31)

• bug #61276 [DependencyInjection] Escape parameters before resolving env placeholders (MatTheCat)

• bug #61268 [Console] [Table] Fix unnecessary wrapping (schlndh)

• bug #61085 [Lock] Fix using fractional TTLs (manuelderuiter)

• bug #61271 [Messenger] disable detecting modified indexes with DBAL 4.3 (xabbuh)

• bug #61242 [Console] [Table] Fix invalid UTF-8 due to text wrapping (schlndh)

• bug #61234 [Cache] RedisTrait::doFetch should use pipeline with GET's instead of MGET for Relay\Cluster (dorrogeray)

• bug #61246 [VarDumper] Use unique identifier for RequestContextProvider (ToshY)

• bug #58995 [Config] Do not generate unreachable configuration paths (bobvandevijver)

• bug #60867 [WebProfilerBundle] Fix missing indent on non php files opended in the profiler (phcorp)

• bug #61223 [Mailer][Brevo] Update Webhook IPs (jarbey)

• bug #61201 [Console] Fix JSON description for negatable input flags (nicolas-grekas)

• bug #61220 [Cache] fix compatibility with different Relay versions (xabbuh)

• bug #61158 [FrameworkBundle] Add missing html5-allow-no-tld to XSD file (nicolas-grekas)

• bug #61144 [VarDumper] Fix dumping on systems that don't have a working iconv (nicolas-grekas)

• bug #61138 [Console] fix profiler with overridden run() method (vinceAmstoutz)

• bug #61079 [Config] Fix support for attributes on class constants and enum cases (ruudk)

• bug #61111 [Translation] fix support of TranslatableInterface in IdentityTranslator (VincentLanglet)

• bug #61117 [Validator] fix handling required options (xabbuh)

• bug #61106 Fix @var phpdoc (fabpot)

• bug #61091 [Lock] [MongoDB] Enforce readPreference=primary and writeConcern=majority (notrix)

• bug #61105 [FrameworkBundle] fix phpdoc in MicroKernelTrait (santysisi)

• bug #61076 [ExpressionLanguage] Fix dumping of null safe operator (ivantsepp)

• bug #61028 [Serializer] Fix readonly property initialization from incorrect scope (santysisi)

• bug #61073 [VarExporter] Dump implicit-nullable types as explicit to prevent the corresponding deprecation (nicolas-grekas)

• bug #61062 [Brevo Mailer] Webhook IP Addresses have changed (richardhj)

• bug #60975 [Form] Fix precision loss when rounding large integers in NumberToLocalizedStringTransformer (OskarStark)

• bug #60953 [DoctrineBridge] Restore compatibility with Doctrine ODM (pepeh)

• bug #60958 [Serializer] remove return type from AbstractObjectNormalizer::getAllowedAttributes() (xabbuh)

• bug #60507 [Console][Messenger] Fix: Allow UnrecoverableExceptionInterface to bypass retry in RunCommandMessageHandler (santysisi)

• 6.4.23 (2025-06-28)

• bug #60044 [Console] Table counts wrong column width when using colspan and setColumnMaxWidth() (vladimir-vv)

• bug #60042 [Console] Table counts wrong number of padding symbols in renderCell() method when cell contain unicode variant selector (vladimir-vv)

• bug #60594 [Cache] Fix using a ChainAdapter as an adapter for a pool (IndraGunawan)

• bug #60413 [Serializer] Fix collect_denormalization_errors flag in defaultContext (dmbrson)

• bug #60908 [Uid] Improve entropy of the increment for UUIDv7 (nicolas-grekas)

• bug #60914 [Console] Fix command option mode (InputOption::VALUE_REQUIRED) (gharlan)

• bug #60919 [VarDumper] Avoid deprecated call in PgSqlCaster (vrana)

• bug #60888 [Intl] Fix locale validator when canonicalize is true (rdavaillaud)

• bug #60885 [Notifier] Update fake SMS transports to use contracts event dispatcher (paulferrett)

• bug #60859 [TwigBundle] fix preload unlinked class BinaryOperatorExpressionParser (Grummfy)

• bug #60772 [Mailer] [Transport] Send clone of RawMessage instance in RoundRobinTransport (jnoordsij)

• bug #60842 [DependencyInjection] Fix generating adapters of functional interfaces (nicolas-grekas)

• bug #60809 [Serializer] Fix TraceableSerializer when called from a callable inside array_map (OrestisZag)

• bug #60511 [Serializer] Add support for discriminator map in property normalizer (ruudk)

• bug #60780 [FrameworkBundle] Fix argument not provided to add_bus_name_stamp_middleware (maxbaldanza)

• bug #60826 [DependencyInjection] Fix inlining when public services are involved (nicolas-grekas)

• bug #60806 [HttpClient] Limit curl's connection cache size (nicolas-grekas)

• bug #60705 [FrameworkBundle] Fix allow loose as an email validation mode (rhel-eo)

• bug #60759 [Messenger] Fix float value for worker memory limit (ro0NL)

• bug #60785 [Security] Handle non-callable implementations of FirewallListenerInterface (MatTheCat)

• bug #60781 [DomCrawler] Allow selecting buttons by their value (MatTheCat)

• bug #60775 [Validator] flip excluded properties with keys with Doctrine-style constraint config (xabbuh)

• bug #60779 Silence E_DEPRECATED and E_USER_DEPRECATED (nicolas-grekas)

• bug #60502 [HttpCache] Hit the backend only once after waiting for the cache lock (mpdude)

• bug #60771 [Runtime] fix compatibility with Symfony 7.4 (xabbuh)

• bug #60676 [Form] Fix handling the empty string in NumberToLocalizedStringTransformer (gnat42)

• bug #60694 [Intl] Add missing currency (NOK) localization (en_NO) (llupa)

• bug #60711 [Intl] Ensure data consistency between alpha and numeric codes (llupa)

• bug #60724 [VarDumper] Fix dumping LazyObjectState when using VarExporter v8 (nicolas-grekas)

• bug #60693 [FrameworkBundle] ensureKernelShutdown in tearDownAfterClass (cquintana92)

• bug #60564 [FrameworkBundle] ensureKernelShutdown in tearDownAfterClass (cquintana92)

• bug #60640 [Mailer] use STARTTLS for SMTP with MailerSend (xabbuh)

• bug #60648 [Yaml] fix support for years outside of the 32b range on x86 arch on PHP 8.4 (nicolas-grekas)

• bug #60616 skip interactive questions asked by Composer (xabbuh)

• bug #60584 [DependencyInjection] Make YamlDumper quote resolved env vars if necessary (MatTheCat)

• bug #60588 [Notifier][Clicksend] Fix lack of recipient in case DSN does not have optional LIST_ID param (alifanau)

• bug #60547 [HttpFoundation] Fixed 'Via' header regex (thecaliskan)

• 6.4.22 (2025-05-29)

• bug #60549 [Translation] Add intl-icu fallback for MessageCatalogue metadata (pontus-mp)

• bug #60571 [ErrorHandler] Do not transform file to link if it does not exist (lyrixx)

• bug #60494 [Messenger] fix: Add argument as integer (overexpOG)

• bug #60524 [Notifier] Fix Clicksend transport (BafS)

• bug #60478 [Validator] add missing $extensions and $extensionsMessage to the Image constraint (xabbuh)

• bug #60423 [DependencyInjection] Make DefinitionErrorExceptionPass consider IGNORE_ON_UNINITIALIZED_REFERENCE and RUNTIME_EXCEPTION_ON_INVALID_REFERENCE the same (MatTheCat)

• bug #60421 [VarExporter] Fixed lazy-loading ghost objects generation with property hooks (cheack)

• bug #60266 [Security] Exclude remember_me from default login authenticators (santysisi)

• bug #60400 [Config] Fix generated comment for multiline "info" (GromNaN)

• bug #60260 [Serializer] Prevent Cannot traverse an already closed generator error by materializing Traversable input (santysisi)

• bug #60292 [HttpFoundation] Encode path in X-Accel-Redirect header (Athorcis)

• bug #60379 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (Seldaek)

• bug #60373 [FrameworkBundle] Ensure Email class exists before using it (Kocal)

• bug #60365 [FrameworkBundle] ensure that all supported e-mail validation modes can be configured (xabbuh)

• bug #60350 [Security][LoginLink] Throw InvalidLoginLinkException on invalid parameters (davidszkiba)

• bug #60340 [String] fix EmojiTransliterator return type compatibility with PHP 8.5 (xabbuh)

• 6.4.21 (2025-05-02)

• bug #60288 [VarExporter] dump default value for property hooks if present (xabbuh)

• bug #60268 [Contracts] Fix ServiceSubscriberTrait for nullable service (StevenRenaux)

• bug #60256 [Mailer][Postmark] drop the Date header using the API transport (xabbuh)

• bug #60258 [VarExporter] Fix: Use correct closure call for property-specific logic in $notByRef (Hakayashii, denjas)

• bug #60269 [Notifier] [Discord] Fix value limits (norkunas)

• bug #60248 [Messenger] Revert " Add call to gc_collect_cycles() after each message is handled" (jwage)

• bug #60236 [String] Support nexus -> nexuses pluralization (KorvinSzanto)

• bug #60194 [Workflow] Fix dispatch of entered event when the subject is already in this marking (lyrixx)

• bug #60172 [Cache] Fix invalidating on save failures with Array|ApcuAdapter (nicolas-grekas)

• bug #60122 [Cache] ArrayAdapter serialization exception clean $expiries (bastien-wink)

• bug #60167 [Cache] Fix proxying third party PSR-6 cache items (Dmitry Danilson)

• bug #60165 [HttpKernel] Do not ignore enum in controller arguments when it has an #[Autowire] attribute (ruudk)

• bug #60168 [Console] Correctly convert SIGSYS to its name (cs278)

• bug #60166 [Security] fix(security): fix OIDC user identifier (vincentchalamon)

• bug #60124 [Validator] : fix url validation when punycode is on tld but not on domain (joelwurtz)

• bug #60057 [Mailer] Fix Trying to access array offset on value of type null error by adding null checking (khushaalan)

• bug #60094 [DoctrineBridge] Fix support for entities that leverage native lazy objects (nicolas-grekas)

• bug #60094 [DoctrineBridge] Fix support for entities that leverage native lazy objects (nicolas-grekas)

• 6.4.20 (2025-03-28)

• bug #60054 [Form] Use duplicate_preferred_choices to set value of ChoiceType (aleho)

• bug #59858 Update JsDelivrEsmResolver::IMPORT_REGEX to support dynamic imports (natepage)

• bug #60019 [HttpKernel] Fix TraceableEventDispatcher when the Stopwatch service has been reset (lyrixx)

• bug #59975 [HttpKernel] Only remove E_WARNING from error level during kernel init (fritzmg)

• bug #59988 [FrameworkBundle] Remove redundant name attribute from default_context (HypeMC)

• bug #59949 [Process] Use a pipe for stderr in pty mode to avoid mixed output between stdout and stderr (joelwurtz)

• bug #59940 [Cache] Fix missing cache data in profiler (dcmbrs)

• bug #59965 [VarExporter] Fix support for hooks and asymmetric visibility (nicolas-grekas)

• bug #59874 [Console] fix progress bar messing output in section when there is an EOL (joelwurtz)

• bug #59888 [PhpUnitBridge] don't trigger "internal" deprecations for PHPUnit Stub objects (xabbuh)

• bug #59830 [Yaml] drop comments while lexing unquoted strings (xabbuh)

• bug #59884 [VarExporter] Fix support for asymmetric visibility (nicolas-grekas)

• bug #59881 [VarExporter] Fix support for abstract properties (nicolas-grekas)

• bug #59841 [Cache] fix cache data collector on late collect (dcmbrs)

• 6.4.19 (2025-02-26)

• bug #59198 [Messenger] Filter out non-consumable receivers when registering ConsumeMessagesCommand (wazum)

• bug #59781 [Mailer] fix multiple transports default injection (fkropfhamer)

• bug #59836 [Mailer][Postmark] Set CID for attachments when it exists (IssamRaouf)

• bug #59840 Fix PHP warning in GetSetMethodNormalizer when a "set()" method is defined (Pepperoni1337)

• bug #59810 [DependencyInjection] Defer check for circular references instead of skipping them (biozshock)

• bug #59811 [Validator] Synchronize IBAN formats (alexandre-daubois)

• bug #59796 [Mime] use address for body at PathHeader (tinect)

• bug #59803 [Semaphore] allow redis cluster/sentinel dsn (smoench)

• bug #59779 [DomCrawler] Bug #43921 Check for null parent nodes in the case of orphaned branches (ttk)

• bug #59776 [WebProfilerBundle] fix rendering notifier message options (xabbuh)

• bug #59769 Enable JSON_PRESERVE_ZERO_FRACTION in jsonRequest method (raffaelecarelle)

• bug #59774 [TwigBridge] Fix compatibility with Twig 3.21 (alexandre-daubois)

• bug #59761 [VarExporter] Fix lazy objects with hooked properties (nicolas-grekas)

• bug #59763 [HttpClient] Don't send any default content-type when the body is empty (nicolas-grekas)

• bug #59747 [Translation] check empty notes (davidvancl)

• bug #59751 [Cache] Tests for Redis Replication with cache (DemigodCode)

• bug #59752 [BrowserKit] Fix submitting forms with empty file fields (nicolas-grekas)

• bug #59033 [WebProfilerBundle] Fix interception for non conventional redirects (Huluti)

• bug #59713 [DependencyInjection] Do not preload functions (biozshock)

• bug #59723 [DependencyInjection] Fix cloned lazy services not sharing their dependencies when dumped with PhpDumper (pvandommelen)

• bug #59727 [HttpClient] Fix activity tracking leading to negative timeout errors (nicolas-grekas)

• bug #59262 [DependencyInjection] Fix env default processor with scalar node (tBibaut)

• bug #59640 [Security] Return null instead of empty username to fix deprecation notice (phasdev)

• bug #59596 [Mime] use isRendered method to ensure we can avoid rendering an email twice (walva)

• bug #59689 [HttpClient] Fix buffering AsyncResponse with no passthru (nicolas-grekas)

• bug #59654 [HttpClient] Fix uploading files > 2GB (nicolas-grekas)

• 6.4.18 (2025-01-29)

• bug #58889 [Serializer] Handle default context in Serializer (Valmonzo)

• bug #59631 [HttpClient] Fix processing a NativeResponse after its client has been reset (Jean-Beru)

• bug #59590 [Security] Throw an explicit error when refreshing a token with a null user (alexandre-daubois)

• bug #59625 [FrameworkBundle] Add missing not-compromised-password entry in XSD (alexandre-daubois)

• bug #59610 [Mailer] Ensure TransportExceptionInterface populates stream debug data (bytestream)

• bug #59598 [Mime] Fix body validity check in Email when using Message::setBody() (alexandre-daubois)

• bug #59544 [AssetMapper] Fix CssCompiler matches url in comments (smnandre)

• bug #59575 [DoctrineBridge] Add support for doctrine/persistence 4 (greg0ire)

• bug #59399 [DomCrawler] Make ChoiceFormField::isDisabled return true for unchecked disabled checkboxes (MatTheCat)

• bug #59581 [Cache] Don't clear system caches on cache:clear (nicolas-grekas)

• bug #59579 [FrameworkBundle] Fix patching refs to the tmp warmup dir in files generated by optional cache warmers (nicolas-grekas)

• bug #59525 [HtmlSanitizer] Fix access to undefined keys in UrlSanitizer (Antoine Beyet)

• bug #59538 [VarDumper] fix dumped markup (xabbuh)

• bug #59515 [FrameworkBundle] Fix wiring ConsoleProfilerListener (nicolas-grekas)

• bug #59486 [Validator] Update sr_Cyrl 120:This value is not a valid slug. (kaznovac)

• bug #59403 [FrameworkBundle][HttpFoundation] Reset Request's formats using the service resetter (nicolas-grekas)

• bug #59404 [Mailer] Fix SMTP stream EOF handling on Windows by using feof() (skmedix)

• bug #59390 [VarDumper] Fix blank strings display (MatTheCat)

• bug #59446 [Routing] Fix configuring a single route's hosts (MatTheCat)

• bug #58901 [HttpClient] Ignore RuntimeExceptions thrown when rewinding the PSR-7 created in HttplugWaitLoop::createPsr7Response (KurtThiemann)

• bug #59046 [HttpClient] Fix Undefined array key connection (PhilETaylor)

• bug #59055 [HttpFoundation] Fixed IpUtils::anonymize exception when using IPv6 link-local addresses with RFC4007 scoping (jbtronics)

• bug #59256 [Mailer] Fix Sendmail memory leak (rch7)

• bug #59375 [RemoteEvent][Webhook] fix SendgridPayloadConverter category support (ericabouaf)

• bug #59367 [PropertyInfo] Make sure that SerializerExtractor returns null for invalid class metadata (wuchen90)

• bug #59376 [RemoteEvent][Webhook] Fix SendgridRequestParser and SendgridPayloadConverter (ericabouaf)

• bug #59381 [Yaml] fix inline notation with inline comment (alexpott)

• bug #59352 [Messenger] Fix TransportMessageIdStamp not always added (HypeMC)

• bug #59185 [DoctrineBridge] Fix compatibility to Doctrine persistence 2.5 in Doctrine Bridge 6.4 to avoid Projects stuck on 6.3 (alexander-schranz)

• bug #59245 [PropertyInfo] Fix add missing composer conflict (mtarld)

• bug #59292 [WebProfilerBundle] Fix event delegation on links inside toggles (MatTheCat)

• bug #59362 [Doctrine][Messenger] Prevents multiple TransportMessageIdStamp being stored in envelope (rtreffler)

• bug #59323 [Serializer] Fix exception thrown by YamlEncoder (VincentLanglet)

• bug #59293 [AssetMapper] Fix JavaScript compiler creates self-referencing imports (smnandre)

• bug #59349 [Yaml] reject inline notations followed by invalid content (xabbuh)

• bug #59363 [VarDumper] Fix displaying closure's "this" from anonymous classes (nicolas-grekas)

• bug #59364 [ErrorHandler] Don't trigger "internal" deprecations for anonymous LazyClosure instances (nicolas-grekas)

• bug #59221 [PropertyAccess] Fix compatibility with PHP 8.4 asymmetric visibility (Florian-Merle)

• bug #59357 [HttpKernel] Don't override existing LoggerInterface autowiring alias in LoggerPass (nicolas-grekas)

• bug #59347 [Security] Fix triggering session tracking from ContextListener (nicolas-grekas)

• bug #59188 [HttpClient] Fix reset() not called on decorated clients (HypeMC)

• bug #59343 [Security] Adjust parameter order in exception message (Link1515)

• bug #59312 [Yaml] Fix parsing of unquoted strings in Parser::lexUnquotedString() to ignore spaces (Link1515)

• bug #59334 [ErrorHandler] [A11y] Simple proposal for color updates on error stack traces against colorblindness (DocFX)

• 6.4.17 (2024-12-31)

• bug #59304 [PropertyInfo] Remove @internal from PropertyReadInfo and PropertyWriteInfo (Dario Guarracino)

• bug #59318 [Finder] Fix using == as default operator in DateComparator (MatTheCat)

• bug #59321 [HtmlSanitizer] reject URLs containing whitespaces (xabbuh)

• bug #59250 [HttpClient] Fix a typo in NoPrivateNetworkHttpClient (Jontsa)

• bug #59103 [Messenger] ensure exception on rollback does not hide previous exception (nikophil)

• bug #59226 [FrameworkBundle] require the writer to implement getFormats() in the translation:extract (xabbuh)

• bug #59213 [FrameworkBundle] don't require fake notifier transports to be installed as non-dev dependencies (xabbuh)

• bug #59160 [BeanstalkMessenger] Round delay to an integer to avoid deprecation warning (plantas)

• bug #59012 [PropertyInfo] Fix interface handling in PhpStanTypeHelper (janedbal)

• bug #59134 [HttpKernel] Denormalize request data using the csv format when using "#[MapQueryString]" or "#[MapRequestPayload]" (except for content data) (ovidiuenache)

• bug #59140 [WebProfilerBundle] fix: white-space in highlighted code (chr-hertel)

• bug #59124 [FrameworkBundle] fix: notifier push channel bus abstract arg (raphael-geffroy)

• bug #59069 [Console] Fix division by 0 error (Rindula)

• bug #59070 [PropertyInfo] evaluate access flags for properties with asymmetric visibility (xabbuh)

• bug #59062 [HttpClient] Always set CURLOPT_CUSTOMREQUEST to the correct HTTP method in CurlHttpClient (KurtThiemann)

• bug #59023 [HttpClient] Fix streaming and redirecting with NoPrivateNetworkHttpClient (nicolas-grekas)

• 6.4.16 (2024-11-27)

• bug #59013 [HttpClient] Fix checking for private IPs before connecting (nicolas-grekas)

• bug #58562 [HttpClient] Close gracefull when the server closes the connection abruptly (discordier)

• bug #59007 [Dotenv] read runtime config from composer.json in debug dotenv command (xabbuh)

• bug #58963 [PropertyInfo] Fix write visibility for Asymmetric Visibility and Virtual Properties (xabbuh, pan93412)

• bug #58983 [Translation] [Bridge][Lokalise] Fix empty keys array in PUT, DELETE requests causing Lokalise API error (DominicLuidold)

• bug #58956 [DoctrineBridge] Fix Connection::createSchemaManager() for Doctrine DBAL v2 (neodevcode)

• bug #58959 [PropertyInfo] consider write property visibility to decide whether a property is writable (xabbuh)

• bug #58964 [TwigBridge] do not add child nodes to EmptyNode instances (xabbuh)

• bug #58952 [Cache] silence warnings issued by Redis Sentinel on connection issues (xabbuh)

• bug #58859 [AssetMapper] ignore missing directory in isVendor() (alexislefebvre)

• bug #58917 [OptionsResolver] Allow Union/Intersection Types in Resolved Closures (zanbaldwin)

• bug #58822 [DependencyInjection] Fix checking for interfaces in ContainerBuilder::getReflectionClass() (donquixote)

• bug #58865 Dynamically fix compatibility with doctrine/data-fixtures v2 (greg0ire)

• bug #58921 [HttpKernel] Ensure HttpCache::getTraceKey() does not throw exception (lyrixx)

• bug #58908 [DoctrineBridge] don't call EntityManager::initializeObject() with scalar values (xabbuh)

• bug #58938 [Cache] make RelayProxyTrait compatible with relay extension 0.9.0 (xabbuh)

• bug #58924 [HttpClient] Fix empty hosts in option "resolve" (nicolas-grekas)

• bug #58915 [HttpClient] Fix option "resolve" with IPv6 addresses (nicolas-grekas)

• bug #58919 [WebProfilerBundle] Twig deprecations (mazodude)

• bug #58914 [HttpClient] Fix option "bindto" with IPv6 addresses (nicolas-grekas)

• bug #58875 [HttpClient] Removed body size limit (Carl Julian Sauter)

• bug #58862 [Notifier] Fix GoIpTransport (nicolas-grekas)

• bug #58860 [HttpClient] Fix catching some invalid Location headers (nicolas-grekas)

• bug #58836 Work around parse_url() bug (bis) (nicolas-grekas)

• bug #58818 [Messenger] silence PHP warnings issued by Redis::connect() (xabbuh)

• bug #58828 [PhpUnitBridge] fix dumping tests to skip with data providers (xabbuh)

• bug #58842 [Routing] Fix: lost priority when defining hosts in configuration (BeBlood)

• bug #58850 [HttpClient] fix PHP 7.2 compatibility (xabbuh)

• 6.4.15 (2024-11-13)

• security #cve-2024-50342 [HttpClient] Resolve hostnames in NoPrivateNetworkHttpClient (nicolas-grekas)

• security #cve-2024-51996 [Security] Check owner of persisted remember-me cookie (jderusse)

• bug #58799 [String] Fix some spellings in EnglishInflector (alexandre-daubois)

• bug #56868 [Serializer] fixed object normalizer for a class with cancel method (er1z)

• bug #58601 [RateLimiter] Fix bucket size reduced when previously created with bigger size (Orkin)

• bug #58659 [AssetMapper] Fix JavaScriptImportPathCompiler regex for non-latin characters (GregRbs92)

• bug #58658 [Twitter][Notifier] Fix post INIT upload (matyo91)

• bug #58763 [Messenger][RateLimiter] fix additional message handled when using a rate limiter (Jean-Beru)

• bug #58791 [RateLimiter] handle error results of DateTime::modify() (xabbuh)

• bug #58800 [PropertyInfo] fix support for phpstan/phpdoc-parser 2 (xabbuh)

• 6.4.14 (2024-11-06)

• bug #58772 [DoctrineBridge] Backport detection fix of Xml/Yaml driver in DoctrineExtension (MatTheCat)

• security #cve-2024-51736 [Process] Use PATH before CD to load the shell on Windows (nicolas-grekas)

• security #cve-2024-50342 [HttpClient] Filter private IPs before connecting when Host == IP (nicolas-grekas)

• security #cve-2024-50345 [HttpFoundation] Reject URIs that contain invalid characters (nicolas-grekas)

• security #cve-2024-50340 [Runtime] Do not read from argv on non-CLI SAPIs (wouterj)

• bug #58765 [VarDumper] fix detecting anonymous exception classes on Windows and PHP 7 (xabbuh)

• bug #58757 [RateLimiter] Fix DateInterval normalization (danydev)

• bug #58754 [Security] Store original token in token storage when implicitly exiting impersonation (wouterj)

• bug #58753 [Cache] Fix clear() when using Predis (nicolas-grekas)

• bug #58713 [Config] Handle Phar absolute path in FileLocator (alexandre-daubois)

• bug #58728 [WebProfilerBundle] Re-add missing Profiler shortcuts on Profiler homepage (welcoMattic)

• bug #58739 [WebProfilerBoundle] form data collector check passed and resolved options are defined (vltrof)

• bug #58752 [Process] Fix escaping /X arguments on Windows (nicolas-grekas)

• bug #58735 [Process] Return built-in cmd.exe commands directly in ExecutableFinder (Seldaek)

• bug #58723 [Process] Properly deal with not-found executables on Windows (nicolas-grekas)

• bug #58711 [Process] Fix handling empty path found in the PATH env var with ExecutableFinder (nicolas-grekas)

• bug #58704 [HttpClient] fix for HttpClientDataCollector fails if proc_open is disabled via php.ini (ZaneCEO)

• 6.4.13 (2024-10-27)

• bug #58669 [Cache] Revert "Initialize RedisAdapter cursor to 0" (nicolas-grekas)

• bug #58649 [TwigBridge] ensure compatibility with Twig 3.15 (xabbuh)

• bug #58661 [Cache] Initialize RedisAdapter cursor to 0 (thomas-hiron)

• bug #58593 [Mime] fix encoding issue with UTF-8 addresses containing doubles spaces (0xb4lint)

• bug #58636 [Notifier] Improve Telegrams markdown escaping (codedge)

• bug #58615 [Validator] [Choice] Fix callback option if not array returned (symfonyaml)

• bug #58618 [DependencyInjection] Fix linting factories implemented via __callStatic (KevinVanSonsbeek)

• bug #58619 [HttpFoundation][Lock] Ensure compatibility with ext-mongodb v2 (GromNaN)

• bug #58627 Minor fixes around parse_url() checks (nicolas-grekas)

• bug #58617 [DependencyInjection] Fix replacing abstract arguments with bindings (nicolas-grekas)

• bug #58623 [Intl] do not access typed property before initialization (xabbuh)

• bug #58613 Symfony 5.4 LTS will get security fixes until Feb 2029 thanks to Ibexa' sponsoring (nicolas-grekas)

• bug #58523 [DoctrineBridge] fix: DoctrineTokenProvider not oracle compatible (jjjb03)

• bug #58569 [Mailer][MailJet] Fix parameters for TrackClicks and TrackOpens (torohill)

• bug #58557 [Doctrine][Messenger] Oracle sequences are suffixed with _seq (clem-rwan)

• bug #58525 [Notifier] silence warnings triggered when malformed XML is parsed (xabbuh)

• bug #58550 [Scheduler] silence PHP warning when an invalid date interval format string is used (xabbuh)

• bug #58492 [MonologBridge] Fix PHP deprecation with preg_match() (simoheinonen)

• bug #58449 [Form] Support intl.use_exceptions/error_level in NumberToLocalizedStringTransformer (bram123)

• bug #54566 [Doctrine][Messenger] Use common sequence name to get id from Oracle (rjd22)

• bug #58459 [FrameworkBundle] Fix displayed stack trace when session is used on stateless routes (nicolas-grekas)

• bug #58255 [Serializer] Fix ObjectNormalizer gives warnings on normalizing with public static property (André Laugks)

• bug #58306 [Serializer] Collect denormalization errors for variadic params (mtarld)

• bug #58376 [HttpKernel] Correctly merge max-age/s-maxage and Expires headers (aschempp)

• bug #58299 [DependencyInjection] Fix XmlFileLoader not respecting when env for services (Bradley Zeggelaar)

• bug #58332 [Console] Suppress proc_open errors within Terminal::readFromProcess (fritzmg)

• bug #58343 [HttpClient] Add crypto_method to scoped client options (HypeMC)

• bug #58395 [TwigBridge] Fixed a parameterized choice label translation (7-zete-7)

• bug #58409 [Translation] Fix extracting of message from ->trans() method with named params (tugmaks)

• bug #58404 [TwigBridge] Remove usage of Node() instantiations (fabpot)

• bug #58377 [Emoji] Update data to support emoji 16 (lyrixx)

• bug #58393 [Dotenv] Default value can be empty (HypeMC)

• bug #58400 [Mailer] Fix exception message on invalid event in SendgridPayloadConverter (alexandre-daubois)

• bug #58372 Tweak error/exception handler registration (nicolas-grekas)

• bug #58365 [Cache] silence warnings issued by Redis Sentinel on connection issues (xabbuh)

• 6.4.12 (2024-09-21)

• bug #58339 [Notifier] allow the Novu bridge to be used with symfony/notifier 7.x (xabbuh)

• bug #58327 [FrameworkBundle] Do not access the container when the kernel is shut down (jderusse)

• bug #58316 [Form] Don't call the constructor of LogicalOr (derrabus)

• bug #58290 [FrameworkBundle] fix XSD to allow to configure locks without resources (xabbuh)

• bug #58291 [Process] Fix finding executables independently of open_basedir (BlackbitDevs)

• bug #58279 [Yaml] parse empty sequence elements as null (xabbuh)

• bug #58289 [HttpKernel] Skip logging uncaught exceptions in ErrorHandler, assume $kernel->terminateWithException() will do it (nicolas-grekas)

• bug #58185 [Filesystem] make sure temp files can be cleaned up on Windows (xabbuh)

• bug #58226 [Serializer] Fix for method named get() (mihai-stancu)

• bug #58242 [Notifier][TurboSMS] Process partial accepted response from transport (ZhukV)

• bug #58260 [Cache] Fix RedisSentinel param types (Paweł Stasicki)

• bug #58278 [HttpClient] Fix setting CURLMOPT_MAXCONNECTS (HypeMC)

• bug #58274 [Dotenv] throw a meaningful exception when parsing dotenv files with BOM (xabbuh)

• bug #58240 [FrameworkBundle] Fix service reset between tests (HypeMC)

• bug #58266 [HttpKernel] pass CSV escape characters explicitly (xabbuh)

• bug #58181 [HttpFoundation] Update links for X-Accel-Redirect and fail properly when X-Accel-Mapping is missing (nicolas-grekas)

• bug #58195 [Process] Fix the removal of host-specific configuration when managing the ini settings in PhpSubprocess (M-arcus)

• bug #58218 Work around parse_url() bug (nicolas-grekas)

• bug #58207 [TwigBridge] Avoid calling deprecated mergeGlobals() (derrabus)

• bug #58198 [TwigBundle] Add support for resetting globals between HTTP requests (fabpot)

• bug #58169 [Cache] Fix compatibility with Redis 6.1.0 pre-releases (cedric-anne)

• bug #58143 [Ldap] Fix extension deprecation (alexandre-daubois)

• 6.4.11 (2024-08-30)

• bug #58110 [PropertyAccess] Fix handling property names with a . (alexandre-daubois)

• bug #58127 [Validator] synchronize IBAN formats (xabbuh)

• bug #58112 fix Twig 3.12 compatibility (xabbuh)

• bug #58078 [TwigBridge] Fix Twig deprecation notice (yceruto)

• bug #58000 [DependencyInjection] Fix issue between decorator and service locator index (lyrixx)

• bug #58044 [HttpClient] Do not overwrite the host to request when using option "resolve" (xabbuh)

• bug #58046 [AssetMapper] Fix JsDeliver import regexp (smnandre)

• bug #57298 [DependencyInjection] Fix handling of repeated #[Autoconfigure] attributes (alexandre-daubois)

• bug #57493 [SecurityBundle] Make security schema deterministic (MatTheCat)

• bug #58025 [Mailer] [Brevo] Support the unique_proxy_open event (richardhj)

• bug #58015 [HttpKernel] ESI fragment content may be missing in conditional requests (mpdude)

• bug #58017 [SecurityBundle] Revert adding _stateless attribute to the request when firewall is stateless and the attribute is not already set (MatTheCat)

• bug #58020 [TwigBridge] fix compatibility with Twig 3.12 and 4.0 (xabbuh)

• bug #58002 [Security] Revert stateless check for ContextListener (VincentLanglet)

• bug #58010 [PsrHttpMessageBridge] Fix conversion of partitioned cookies in the PSR-7 bridge (stof)

• bug #57853 [Console] Fix side-effects from running bash completions (Seldaek)

• bug #57997 [Console][PhpUnitBridge][VarDumper] Fix handling NO_COLOR env var (nicolas-grekas)

• bug #57944 [DoctrineBridge] Fix the LockStoreSchemaListener (MatTheCat)

• bug #57984 [Validator] Add D regex modifier in relevant validators (alexandre-daubois)

• bug #57981 [HttpClient] reject malformed URLs with a meaningful exception (xabbuh)

• bug #57968 [Yaml] 🐛 throw ParseException on invalid date (homersimpsons)

• bug #57925 [Validator] reset the validation context after validating nested constraints (xabbuh)

• bug #57920 [Form] Fix handling empty data in ValueToDuplicatesTransformer (xabbuh)

• bug #57917 [HttpKernel] [WebProfileBundle] Fix Routing panel for URLs with a colon (akeylimepie)

• bug #57885 [Cache] fix compatibility with redis extension 6.0.3+ (xabbuh)

• bug #57861 [Form] NumberType: Fix parsing of numbers in exponential notation with negative exponent (jbtronics)

• bug #57921 [Finder] do not duplicate directory separators (xabbuh)

• bug #57875 [String] Fixed Quorum plural, and Quora singular in EnglishInflector (Dean151)

• bug #57895 [Finder] do not duplicate directory separators (xabbuh)

• bug #57905 [Validator] allow more unicode characters in URL paths (xabbuh)

• bug #57899 [String] [EnglishInflector] Fix words ending with le, e.g., articles (aleho)

• bug #57896 [Mime] Fix RawMessage constructor argument type (alexandre-daubois)

• bug #57887 [Uid] Ensure UuidV1 is created in lowercase (smnandre)

• bug #57870 [HttpClient] Disable HTTP/2 PUSH by default when using curl (nicolas-grekas)

• bug #57625 [DoctrineBridge] Make EntityValueResolver return null if a composite ID value is null (MatTheCat)

• 6.4.10 (2024-07-26)

• bug #57803 [FrameworkBundle] move adding detailed JSON error messages to the validate phase (xabbuh)

• bug #57815 [Console][PhpUnitBridge][VarDumper] Fix NO_COLOR empty value handling (alexandre-daubois)

• bug #57828 [Translation] Fix CSV escape char in CsvFileLoader on PHP >= 7.4 (alexandre-daubois)

• bug #57812 [Validator] treat uninitialized properties referenced by property paths as null (xabbuh)

• bug #57816 [DoctrineBridge] fix messenger bus dispatch inside an active transaction (IndraGunawan)

• bug #57799 [ErrorHandler][VarDumper] Remove PHP 8.4 deprecations (alexandre-daubois)

• bug #57772 [WebProfilerBundle] Add word wrap in tables in dialog to see all the text in workflow listeners dialog (SpartakusMd)

• bug #57802 [PropertyInfo] Fix nullable value returned from extractFromMutator on CollectionType (benjilebon)

• bug #57832 [DependencyInjection] Do not try to load default method name on interface (lyrixx)

• bug #57748 [SecurityBundle] use firewall-specific user checkers when manually logging in users (xabbuh)

• bug #57753 [ErrorHandler] restrict the maximum length of the X-Debug-Exception header (xabbuh)

• bug #57674 [Cache] Improve dbindex DSN parameter parsing (constantable)

• bug #57679 [WebProfilerBundle] Change incorrect check for the stateless request attribute (themasch)

• bug #57663 [Cache] use copy() instead of rename() on Windows (xabbuh)

• bug #57617 [PropertyInfo] Handle collection in PhpStan same as PhpDoc (mtarld)

• bug #54057 [Messenger] Passing actual Envelope to WorkerMessageRetriedEvent (daffoxdev)

• bug #57645 [Routing] Discard in-memory cache of routes when writing the file-based cache (mpdude)

• bug #57621 [Mailer]  force HTTP 1.1 for Mailgun API requests (xabbuh)

• bug #57616 [String] Revert "Fixed u()->snake(), b()->snake() and s()->snake() methods" (nicolas-grekas)

• bug #57593 [SecurityBundle] Compare paths after realpath() has been applied to both (xabbuh)

• bug #57594 [String] Normalize underscores in snake() (xabbuh)

• bug #57585 [HttpFoundation] Fix MockArraySessionStorage to generate more conform ids (Seldaek)

• bug #57589 [FrameworkBundle] fix AssetMapper usage without assets enabled (xabbuh)

• 6.4.9 (2024-06-28)

• bug #57553 [HttpKernel] Enable optional cache-warmers when cache-dir != build-dir (nicolas-grekas)

• bug #57497 [String] Fixed u()->snake(), b()->snake() and s()->snake() methods (arczinosek)

• bug #57574 [Filesystem] Fix Filesystem::remove() on Windows (nicolas-grekas)

• bug #57572 [DoctrineBridge] Fix compat with DI >= 6.4 (nicolas-grekas)

• bug #57538 [String] Add alias case to EnglishInflector (alexandre-daubois)

• bug #57533 [FrameworkBundle] Throw runtime exception when trying to use asset-mapper while http-client is disabled (nicolas-grekas)

• bug #57520 [SecurityBundle] Remove unused memory users’ name attribute from the XSD (MatTheCat)

• feature #57557 Ibexa is sponsoring Symfony 5.4, thanks to them! \o/ (nicolas-grekas)

• bug #57569 [HttpClient][Mailer] Revert "Let curl handle transfer encoding", use HTTP/1.1 for Mailgun (nicolas-grekas)

• bug #57499 [Mailer] Add additional headers in Scaleway bridge (MrMicky-FR)

• bug #57460 [VarExporter] fix contravariance problem with __unserialize() in lazy proxy (nikophil)

• bug #57397 [VarDumper] Fix FFI caster test (alexandre-daubois)

• bug #57453 [HttpClient] Fix parsing SSE (fancyweb)

• bug #57467 [SecurityBundle] Add provider XML attribute to the authenticators it’s missing from (MatTheCat)

• bug #57384 [Notifier] Fix thread key in GoogleChat bridge (romain-jacquart)

• bug #57372 [HttpKernel][Security] Fix accessing session for stateless request (VincentLanglet)

• bug #57112 [Messenger] Handle AMQPConnectionException when publishing a message (jwage)

• bug #57341 [Serializer] properly handle invalid data for false/true types (xabbuh)

• bug #57187 [Serializer] Fix ObjectNormalizer with property path (HypeMC)

• bug #57355 [ErrorHandler] Fix rendered exception code highlighting on PHP 8.3 (tscni)

• bug #57310 [DependencyInjection] Fix ternary in AutowireCallable attribute (alamirault)

• bug #57273 [FrameworkBundle] Fix setting default context for certain normalizers (HypeMC)

• bug #57395 [Notifier]  send the recipient phone number as an array (xabbuh)

• bug #52699 [Serializer] [PropertyAccessor] Ignore non-collection interface generics (mtarld)

• bug #54634 [String] Fix #54611 pluralization of -on ending words + singularization of -a ending foreign words (Geordie, DesLynx)

• bug #57213 [Validator] [UniqueValidator] Use correct variable as parameter in (custom) error message (seho-nl, Sebastien Hoek)

• bug #54920 [Messenger] Comply with Amazon SQS requirements for message body (VincentLanglet)

• bug #57321 [AssetMapper] fix npm version constraint conversion (Jean-Beru)

• bug #57110 [PhpUnitBridge] Fix error handler triggered outside of tests (HypeMC)

• bug #57297 [FrameworkBundle] not registered definitions must not be modified (xabbuh)

• bug #57234 [String] Fix Inflector for 'hardware' (podhy)

• bug #57224 [Mime] Use streams instead of loading raw message generator into memory (bytestream)

• 6.4.8 (2024-06-02)

• bug #57284 [Mime] Fix TextPart using an unknown File (fabpot)

• bug #57282 [Scheduler] Throw an exception when no dispatcher has been passed to a Schedule (fabpot)

• bug #57275 Fix autoload configs to avoid warnings when building optimized autoloaders (Seldaek)

• bug #54572 [Mailer] Fix sendmail transport failure handling and interactive mode (bobvandevijver)

• bug #57228 [Mime] fix PHP 7 compatibility (xabbuh)

• bug #57065 [Mime] Fixed Mime\Message::ensureValidity() when a required header is set, but has an empty body (rhertogh)

• bug #57109 [Notifier] keep boolean options when their value is false (xabbuh)

• bug #54971 [Serializer] Cache readability/writability computation (mtarld)

• bug #56488 [VarExporter] Fix exporting default values involving global constants (kylekatarnls)

• bug #49186 [Serializer] Improve exception message in UnwrappingDenormalizer (andersonamuller)

• bug #54694 [PropertyInfo] Update DoctrineExtractor for new DBAL 4 BIGINT type (llupa)

• bug #54913 [Serializer] Fix CurrentType for missing property (ElisDN)

• bug #54797 [PhpUnitBridge] Fix DeprecationErrorHandler with PhpUnit 10 (HypeMC)

• bug #54878 [Filesystem] Fix dumpFile stat failed error hitting custom handler (acoulton)

• bug #54924 [Validator] IBAN Check digits should always between 2 and 98 (karstennilsen)

• bug #54919 [ErrorHandler] Do not call xdebug_get_function_stack() with xdebug >= 3.0 when not in develop mode (fmata)

• bug #54910 [HttpFoundation]  filter out empty HTTP header parts (xabbuh)

• bug #54888 [String] Fix folded in compat mode (smnandre)

• bug #54863 [Process] Return false when open_basedir prevents access to /dev/tty (mjauvin)

• bug #54860 [HttpClient] Revert fixing curl default options (alexandre-daubois)

• bug #54850 [VarExporter] fix ProxyHelper::generateLazyProxy() when a method returns null (nikophil)

• bug #54842 [Messenger] Don't drop stamps when message validation fails (valtzu)

• bug #54838 [WebProfilerBundle] Fix assignment to constant variable (HypeMC)

• bug #54837 [Mailer] [Sendgrid] Use DataPart::getContentId() when DataPart::setContentId() is used (SherinBloemendaal)

• bug #54839 Fix exception thrown during LDAP_MODIFY_BATCH_REMOVE_ALL batch operations (phasdev)

• bug #54834 [Validator] Check Locale class existence before using it (alexandre-daubois)

• bug #54830 [HttpClient] Fix cURL default options for PHP 8.4 (alexandre-daubois)

• bug #54828 [Serializer] Fix GetSetMethodNormalizer not working with setters with optional args (HypeMC)

• bug #54816 [Cache] Fix support for predis/predis:^2.0 (mfettig)

• bug #54804 [Serializer] separate the property info and write info extractors (xabbuh)

• bug #54800 [WebProfilerBundle] fix compatibility with Twig 3.10 (xabbuh)

• bug #54794 [Strings][EnglishInflector] Fix incorrect pluralisation of 'Album' (timporter)

• bug #54714 [Serializer] convert empty CSV header names into numeric keys (xabbuh)

• bug #54775 [Messenger] accept AbstractAsset instances when filtering schemas (xabbuh)

• bug #54758 [Validator] handle edge cases when constructing constraints with named arguments (xabbuh)

• bug #54759 [Filesystem] better distinguish URL schemes and Windows drive letters (xabbuh)

• bug #54791 [FrameworkBundle] move wiring of the property info extractor to the ObjectNormalizer (xabbuh)

• bug #54760 [Validator] handle union and intersection types for cascaded validations (xabbuh)

• bug #54776 [Cache] fix: remove unwanted cast to int (Arend Hummeling)

• bug #54700 [Dotenv] show overridden vars too when running debug:dotenv (HMRDevil)

• 6.4.7 (2024-04-29)

• bug #54699 [DoctrineBridge] Update AbstractSchemaListener to adjust more database params (ywisax)

• bug #54691 [Finder] Also consider .git inside the basedir of in() directory (nickvergessen)

• bug #54724 [AssetMapper] Check asset/vendor directory is writable (smnandre)

• bug #54750 [Validator] detect wrong usages of minMessage/maxMessage in options (xabbuh)

• bug #54751 [Validator]  detect wrong e-mail validation modes (xabbuh)

• bug #54723 [Form] read form values using the chain data accessor (xabbuh)

• bug #54706 [Yaml] call substr() with integer offsets (xabbuh)

• bug #54675 [PropertyInfo] Fix PHPStan properties type in trait (mtarld)

• bug #54673 [Messenger] explicitly cast boolean SSL stream options (xabbuh)

• bug #54665 Add test for AccessTokenHeaderRegex and adjust regex (Spomky)

• bug #54635 [Serializer] Revert "Fix object normalizer when properties has the same name as their accessor" - it was a BC Break (NeilPeyssard)

• bug #54625 [Intl] Remove resources data from classmap generation (shyim)

• bug #54598 [TwigBridge]  implement NodeVisitorInterface instead of extending AbstractNodeVisitor (xabbuh)

• bug #54072 [HttpKernel] Fix datacollector caster for reference object property (ebuildy)

• bug #54395 [Serializer] Fixing PHP warning in the ObjectNormalizer with MaxDepth enabled (jaydiablo)

• bug #54564 [Translation] Skip state=needs-translation entries only when source == target (nicolas-grekas)

• bug #54579 [Cache] Always select database for persistent redis connections (uncaught)

• bug #54059 [Security] Validate that CSRF token in form login is string similar to username/password (glaubinix)

• bug #54530 [Clock] initialize the current time with midnight before modifying the date (xabbuh)

• bug #54547 [HttpKernel] Force non lazy controller services (smnandre)

• bug #54517 [HttpClient] Let curl handle transfer encoding (michaelhue)

• bug #52917 [Serializer] Fix unexpected allowed attributes (mtarld)

• bug #54063 [FrameworkBundle] Fix registration of the bundle path to translation (FlyingDR)

• bug #54392 [Messenger] Make Doctrine connection ignore unrelated tables on setup (MatTheCat)

• bug #54513 [HtmlSanitizer] Ignore Processing Instructions (smnandre)

• bug #54506 [HttpFoundation] Set content-type header in RedirectResponse (smnandre)

• bug #52698 [Serializer] Fix XML scalar to object denormalization (mtarld)

• bug #54485 [Serializer] Ignore when using #[Ignore] on a non-accessor (nicolas-grekas)

• bug #54105 [Messenger] Improve deadlock handling on ack() and reject() (jwage)

• bug #54242 [HttpClient] [EventSourceHttpClient] Fix consuming SSEs with \r\n separator (fancyweb)

• bug #54487 [Validator] Accept Stringable in ExecutionContext::build/addViolation() (alexandre-daubois)

• bug #54456 [DomCrawler] Encode html entities only if nessecary (ausi)

• bug #54484 [Serializer] reset backed_enum priority, and re-prioritise translatable (GwendolenLynch)

• bug #54471 [Filesystem] Strengthen the check of file permissions in dumpFile (alexandre-daubois)

• bug #54403 [FrameworkBundle] [Command] Fix #54402: Suppress PHP warning when is_readable() tries to access dirs outside of open_basedir restrictions (Jeldrik Geraedts)

• bug #54440 [Console] return null when message with name is not set (xabbuh)

• bug #54468 [Translation] Fix LocaleSwitcher throws when intl not loaded (smnandre)

• 6.4.6 (2024-04-03)

• bug #54400 [HttpClient] stop all server processes after tests have run (xabbuh)

• bug #54435 [Console] respect multi-byte characters when rendering vertical-style tables (xabbuh)

• bug #54419 Fix TypeError on ProgressBar (Fan2Shrek)

• bug #54425 [TwigBridge] Remove whitespaces from block form_help output (rosier)

• bug #53969 [Mailer] include message id provided by the MTA when dispatching the SentMessageEvent (xabbuh)

• bug #54315 [Serializer] Fixed BackedEnumNormalizer priority for translatable enum (IndraGunawan)

• bug #54372 [Config] Fix YamlReferenceDumper handling of array examples (MatTheCat)

• bug #54362 [Filesystem] preserve the file modification time when mirroring directories (xabbuh)

• bug #54121 [Messenger] Catch TableNotFoundException in MySQL delete (acbramley)

• bug #54271 [DoctrineBridge] Fix deprecation warning with ORM 3 when guessing field lengths (eltharin)

• bug #54306 Throw TransformationFailedException when there is a null bytes injection (sormes)

• bug #54148 [Serializer] Fix object normalizer when properties has the same name as their accessor (NeilPeyssard)

• bug #54305 [Cache][Lock] Identify missing table in pgsql correctly and address failing integration tests (arifszn)

• bug #54199 [Mailer] [Brevo] Check that tags is present in payload before calling setTags (palgalik)

• bug #54292 [FrameworkBundle] Fix mailer config with XML (lyrixx)

• bug #54298 [Filesystem] Fix str_contains deprecation (NeilPeyssard)

• bug #54248 [Security] Correctly initialize the voter property (aschempp)

• bug #54273 [DependencyInjection] fix XmlDumper when a tag contains also a 'name' property (lyrixx)

• bug #54191 [Validator] add missing invalid extension error entry (xabbuh)

• bug #54194 [PropertyAccess] Fix checking for missing properties (nicolas-grekas)

• bug #54201 [Lock] Check the correct SQLSTATE error code for MySQL (edomato)

• bug #54252 [Lock] compatiblity with redis cluster 7 (bastnic)

• bug #54124 [Messenger] trigger retry logic when message is a redelivery (nikophil)

• bug #54254 [HttpKernel] Fix creating ReflectionMethod with only one argument (alexandre-daubois)

• bug #54219 [Validator] Allow BICs’ first four characters to be digits (MatTheCat)

• bug #54239 [Mailer] Fix sendmail transport not handling failure (aboks)

• bug #54207 [HttpClient] Lazily initialize CurlClientState (arjenm)

• bug #53865 [Workflow]Fix Marking when it must contains more than one tokens (lyrixx)

• bug #54137 [Validator] UniqueValidator - normalize before reducing keys (Brajk19)

• bug #54187 [FrameworkBundle] Fix PHP 8.4 deprecation on ReflectionMethod (alexandre-daubois)

• bug #54167 [Messenger] [Amqp] Handle AMQPConnectionException when publishing a message. (jwage)

• bug #54146 [HttpClient] Preserve float in JsonMockResponse (Jibbarth)

• 6.4.5 (2024-03-04)

• bug #54113 [AssetMapper] Throw exception in Javascript compiler when PCRE error (smnandre)

• bug #54129 [Clock] Add attributes to support PHPUnit 10 + 11 (ruudk)

• bug #54079 [AssetMapper] Fix JavaScriptImportPathCompiler regression in regex (PhilETaylor)

• bug #54102 [HttpClient] Fix deprecation on PHP 8.3 (nicolas-grekas)

• bug #54089 [Mailer] [Brevo] Remove tags from mandatory event arguments (palgalik)

• bug #54081 [DoctrineBridge] Safeguard dynamic access to Doctrine metadata properties (derrabus)

• bug #54080 [Routing] Enhance error handling in StaticPrefixCollection for compatibility with libpcre2-10.43 (Lustmored)

• 6.4.4 (2024-02-27)

• bug #53985 [HttpKernel] Allow tagged controllers in ControllerResolver (marein)

• bug #54054 [VarExporter] Bugfix/workaround jit issue (verfriemelt-dot-org)

• bug #54050 [Messenger] Revert "Resend failed retries back to failure transport " (ro0NL)

• bug #54045 [Config][Messenger][Security] Don't turn deprecations into exceptions when unserializing (nicolas-grekas)

• bug #54035 [DependencyInjection] Fix computing error messages involving service locators (nicolas-grekas)

• bug #53959 [Serializer] Fix unknown types normalization type when know type (Myks92)

• bug #53960 [Messenger] the 'use_notify' option is on the factory, not on the postgres connection (dbu)

• bug #54031 [ErrorHandler] Fix parsing messages that contain anonymous classes on PHP >= 8.3.3 (nicolas-grekas)

• bug #54014 [AssetMapper] Fix enquoted string pattern (smnandre)

• bug #54010 [Translation] Fix extracting qualified t() function calls (rvanvelzen)

• bug #53967 [ErrorHandler] return the unchanged text if preg_replace_callback() fails (xabbuh)

• bug #54009 [Console] Fix display of vertical Table on Windows OS (VincentLanglet)

• bug #54001 [Console] Fix display of Table on Windows OS (VincentLanglet)

• bug #53989 [FrameworkBundle] Fix config builder with extensions extended in build() (HypeMC)

• bug #54004 [WebProfilerBundle] disable turbo in web profiler toolbar to avoid link prefetching (davidgorges)

• bug #54006 [Process] Fix the command -v exception (kayw-geek)

• bug #53975 [Cache] explicitly cast boolean SSL stream options (xabbuh)

• bug #53926 [TwigBridge] foundation 5 layout: use form_label_content block for checkbox and radio labels (wetternest)

• bug #53913 [TwigBridge] Fix compat with Twig v3.9 (nicolas-grekas)

• bug #53819 [Doctrine Messenger] Fix support for pgsql + pgbouncer. (jwage)

• bug #53944 [Messenger] Gracefully fallback to empty queue config (Wirone)

• bug #53935 [Mailer] [Mailgun] Fix expecting payload without tags or user variables (norkunas)

• bug #53934 [Mailer] Fix signed emails breaking the profiler (HypeMC)

• bug #53924 [FrameworkBundle] Check if the _route attribute exists on the request (xvilo)

• bug #53910 [Messenger] Fix SQS visibility_timeout type (valtzu)

• bug #53891 [PropertyAccess] Fixes getValue() on an unitialized object property on a lazy ghost (priyadi)

• bug #53889 [HttpClient] Make retry strategy work again (Nyholm)

• bug #53906 [VarDumper] Fix serialization of stubs with null or uninitialized values (derrabus)

• bug #53890 [VarExporter] Uniform unitialized property error message under ghost and non-ghost objects (priyadi)

• bug #53893 [AssetMapper] Ignore comment lines in JavaScriptImportPathCompiler (smnandre)

• bug #53826 [DomCrawler][Form] Fix the exclusion of (mpiot)

• bug #53869 [Mailer][Postmark][Webhook] Fix webhook testing in dockerized setups (aleho)

• bug #53755 [Validator] Fix fields without constraints in Collection (xabbuh, HypeMC)

• bug #53821 [Process] Fix Inconsistent Exit Status in proc_get_status for PHP Versions Below 8.3 (Luc45)

• bug #53829 [Mailer][Postmark][Webhook] Accept different date formats (aleho)

• bug #53870 [Dotenv] Specify envKey while loading variables with the dotenv:dump (scruwi)

• bug #53876 [DependencyInjection] fix unable to make lazy service from readonly class (kor3k)

• bug #53733 [HttpFoundation] Prevent duplicated headers when using Early Hints (dunglas)

• bug #53817 [Scheduler] Fix messenger receiver with no alias (HypeMC)

• bug #53842 [VarDumper] Fix configuring CliDumper with SYMFONY_IDE env var (nicolas-grekas)

• bug #53824 [Mailer][Postmark][Webhook] Don't require tag and metadata (aleho)

• bug #53846 [Cache] Fix BC layer with pre-6.1 cache items (nicolas-grekas)

• bug #53792 [FrameworkBundle] Fix eager-loading of env vars in ConfigBuilderCacheWarmer (nicolas-grekas)

• bug #53785 [FrameworkBundle] Prevent silenced warning by checking if /proc/mount exists (shyim)

• bug #53730 [Messenger] [Beanstalkd] fix tube stats when it's empty (eminjk)

• bug #53754 [DoctrineBridge] forward-compatibility with field mappings in Doctrine ORM 4 (xabbuh)

• bug #53751 [AssetMapper] Improve import_polyfill configuration error (smnandre)

• bug #53704 Fix client side connection timeout breaks mail authentication (bytestream)

• bug #53744 [SecurityBundle] add missing partition attribute to the schema definition (xabbuh)

• bug #53707 [Console] Fix color support for TTY output (theofidry)

• bug #53712 [Mailer] Fix usage of stream_set_timeout in case of microseconds (aleksejs1)

• bug #53715 [String] Fix plural of word ending by pus (Fan2Shrek)

• bug #53711 [Console] Allow false as a $shortcut in InputOption (jayminsilicon)

• bug #53716 [Mailer] [Mailgun] Fix payload converter getReason (norkunas)

• bug #53703 [HttpFoundation] Fix clearing CHIPS cookies (misaert)

• bug #53701 [AssetMapper] Fix exception if assets directory is missing in production (rynhndrcksn)

• bug #53652 [AssetMapper] Fix JavaScript compiler load imports from JS strings (smnandre)

• 6.4.3 (2024-01-31)

• bug #52913 [Routing] Fixed priority getting lost when setting localized prefix (pritasil)

• bug #53681 [DoctrineBridge]  Fix detection of Xml/Yaml driver in DoctrineExtension (GromNaN)

• bug #53183 [Messenger] PhpSerializer: TypeError should throw MessageDecodingFailedException (B-Galati)

• bug #52131 [HttpKernel] Fix RequestPayloadValueResolver handling error with no ExpectedTypes (Jeroeny)

• bug #51559 [DependencyInjection] #[Autowire] attribute should have precedence over bindings (HypeMC)

• bug #53678 [Mime] Fix serializing uninitialized RawMessage::$message to null (nicolas-grekas)

• bug #53634 [Notifer][Smsapi] Set messageId of SentMessage (tomasz-kusy)

• bug #53501 [DependencyInjection] support lazy evaluated exception messages with Xdebug 3 (xabbuh)

• bug #53672 [FrameworkBundle] ConfigBuilderCacheWarmer should be non-optional (nicolas-grekas)

• bug #52994 [MonologBridge] Fix context data and display extra data (louismariegaborit)

• bug #53671 [HttpClient] Fix pausing responses before they start when using curl (nicolas-grekas)

• bug #53594 [Notifier] Updated the NTFY notifier to run without a user parameter (lostfocus)

• bug #53620 [Validator] Fix option filenameMaxLength to the File constraint (Image) (mindaugasvcs)

• bug #53624 [Translation] Fix constant domain resolution in PhpAstExtractor (VincentLanglet)

• bug #53663 [TwigBridge] separate child and parent context in NotificationEmail on writes (xabbuh)

• bug #53667 [Mailer] [Mailgun] Fix sender header encoding (spajxo)

• bug #53631 [DependencyInjection] Fix loading all env vars from secrets when only a subset is needed (nicolas-grekas)

• bug #53656 [Form] Use self-closing <input /> syntax again, reverting #47715 (mpdude)

• bug #53653 [Mailer] [Scaleway] Fix attachment handling (madbob)

• bug #53157 [Mailer] Throw TransportException when unable to read from socket (xdanik)

• bug #53361 [Serializer] Take unnamed variadic parameters into account when denormalizing (thijsBreker)

• bug #53530 [Serializer] Rewrite AbstractObjectNormalizer::createChildContext() to use the provided cache_key from original context when creating child contexts (amne)

• bug #53506 [HttpClient] Fix error chunk creation in passthru (rmikalkenas)

• bug #53260 [AssetMapper] Handle assets with non-ascii characters in dev server (fbourigault)

• bug #53357 [Translation] Fix TranslationNodeVisitor with constant domain (VincentLanglet)

• bug #53525 [Messenger] [AMQP] Throw exception on nack callback (kvrushifa)

• bug #53432 [HttpFoundation] Request without content-type or content-length header should result in null values, not empty strings (priyadi)

• bug #53593 [Cache] Fix possible infinite loop in CachePoolPass (HypeMC)

• bug #53588 [Translation] fix multi-byte code area to convert (xabbuh)

• bug #53572 [FrameworkBundle] grab a service from the container only if it exists (xabbuh)

• bug #53565 [Mime] Fix undefined array key 0 when empty sender (0x346e3730)

• bug #53516 [Console] Allow '0' as a $shortcut in InputOption.php (lawsonjl-ornl)

• bug #53576 [Console] Only execute additional checks for color support if the output (theofidry)

• bug #53582 [TwigBundle] Fix configuration when "paths" is null (smnandre)

• bug #53575 [Mailer] register the MailPaceTransportFactory (xabbuh)

• bug #53581 [String] fix aircraft inflection (renanbr)

• bug #53509 [Security] Fix AuthenticationUtils::getLastUsername() returning null (alexandre-daubois)

• bug #53567 [String] Correct inflection of axis (Vladislav Iurciuc)

• bug #53537 [VarDumper] Fix missing colors initialization in CliDumper (nicolas-grekas)

• bug #53481 [Process] Fix executable finder when the command starts with a dash (kayw-geek)

• bug #53006 [ErrorHandler] Don't format binary strings (aleho)

• bug #53453 [Translation] add support for nikic/php-parser 5.0 (xabbuh)

• bug #53434 [ErrorHandler] fix rendering exception pages without the HttpKernel component (xabbuh)

• bug #53441 [Messenger] Amazon SQS Delay has a max of 15 minutes (alamirault)

• bug #53414 [Serializer] GetSetMethodNormalizer: fix BC break with #[Ignore] attribute (nikophil)

• bug #53383 [Validator] re-allow an empty list of fields (xabbuh)

• bug #53418 [FrameworkBundle][Notifier] Fix service registration (MessageBird + TurboSms) (smnandre)

• bug #53381 [Form] Fix assigning data in PostSetDataEvent and PostSubmitEvent (fancyweb)

• bug #53350 [Validator] fix the exception being thrown (xabbuh)

• bug #52930 [Messenger] Fix Redis messenger scheme comparison (freswa)

• bug #52874 [Scheduler] Separate id and description in message providers (valtzu)

• bug #53341 [FrameworkBundle] append instead of replacing potentially non-existent named-arguments (xabbuh)

• bug #53320 [Cache][DependencyInjection][Lock][Mailer][Messenger][Notifier][Translation] Url decode username and passwords from parse_url() results (alexandre-daubois)

• bug #53108 [Serializer] Fix using deserialization path 5.4 (HypeMC)

• 6.4.2 (2023-12-30)

• bug #53282 [RateLimiter] Fix RateLimit->getRetryAfter() return value when consuming 0 or last tokens (wouterj, ERuban)

• bug #53054 [Cache] Fix expiration time for CouchbaseCollection (alexandre-daubois)

• bug #53259 [RateLimit] Test and fix peeking behavior on rate limit policies (wouterj)

• bug #52406 [Validator] Fix Constraints\Email::ERROR_NAMES (mathroc)

• bug #53140 [Serializer] Skip uninitialized properties with deep_object_to_populate (mtarld)

• bug #53195 [HttpKernel] Fix default locale is ignored when set_locale_from_accept_language is used (jkobus)

• bug #52928 [Dotenv] Allow environment variables starting with an underscore (xabbuh)

• bug #53243 [Mailer][Postmark] Add missing changelog for webhook support (OskarStark)

• bug #53232 [Notifier] [Smsc] Require login and password (OskarStark)

• bug #53225 [WebProfilerBundle] Fix the design of the compact toolbar button (javiereguiluz)

• bug #52869 [AssetMapper] Improve link generation script (smnandre)

• bug #53203 [Intl] [Emoji] Fix emoji files (remove wrong characters / add missing data) (smnandre)

• bug #53178 [Translation][Crowdin] Use project language mapping (andrii-bodnar)

• bug #53187 [Messenger] Fix using negative delay (J-roen)

• bug #53133 [Validator] Fix using known option names as field names (HypeMC)

• bug #53172 [SecurityBundle] Prevent to login/logout without a request context (symfonyaml)

• bug #52881 [DoctrineBridge] Global query time always at 0.00 ms on profiler (Maxime THIRY)

• bug #53173 [FrameworkBundle] add missing webhook services for Brevo and Mailjet (xabbuh)

• bug #53153 [WebProfilerBundle] Fix JS error when evaluating scripts (jderusse)

• feature #53150 [Contracts] Allow psr/container 1.1 again (derrabus)

• bug #52998 [Notifier] [Bridges] Provide EventDispatcher and HttpClient to the transport (rdavaillaud)

• bug #52817 [Serializer] Do not instantiate object if it is not instantiable (maxbaldanza)

• bug #53003 [AssetMapper] Fix URL pattern when importing es-module-shims (hashbanged)

• bug #53079 [DoctrineBridge] Add check for lazy object interface (maxbaldanza)

• bug #53061 [Mailer] [Mailjet] Disable tls for mailjet as it should use STARTTLS (RFreij)

• bug #53115 [Serializer] Fix partial denormalization with missing constructor arguments (HypeMC)

• bug #53128 Change ProxyCacheWarmer::warmUp signature (llupa)

• bug #53120 [Translation] add the Phrase translation provider to the UnsupportedSchemeException (xabbuh)

• bug #53125 [Mailer] add the MailPace transport to the UnsupportedSchemeException (xabbuh)

• bug #53081 [Serializer] Keep stack trace for enum value denormalizer error (kylekatarnls)

• bug #53107 [HttpKernel] Don't validate partially denormalized object (HypeMC)

• bug #52891 [HttpKernel] Fix request attribute value ignored with pinned resolvers (HypeMC)

• bug #53057 [HttpKernel] Move @internal from AbstractSessionListener class to its methods and properties (Florian-Merle)

• bug #52990 [TwigBridge] don't use deprecated and internal Twig functions (xabbuh)

• bug #53004 [FrameworkBundle] Add missing webhook parsers (alexandre-daubois)

• bug #53007 [FrameworkBundle] Fix webhook parser service removal and add notifier parser service removal (alexandre-daubois)

• bug #52996 [Validator] add missing translation (xabbuh)

• bug #52979 [WebProfilerBundle] Fix "Copy as cURL" dark style (HypeMC)

• bug #52978 [Webhook] [Framework] Added missing XML attribute in config XSD (TimoBakx)

• bug #52584 [WebProfilerBundle] Fix intercept external redirects (HeahDude)

• bug #52964 [ExpressionLanguage] Fix null coalescing propagation (fancyweb)

• bug #52963 [FrameworkBundle] Fix profiling commands without router (HeahDude)

• bug #52966 [FrameworkBundle] Fix profiling command in web context (HeahDude)

• bug #52937 [WebProfilerBundle] Fix "Copy as cURL" (HypeMC)

• bug #52940 [Console] Fix color support check on non-Windows platforms (theofidry)

• bug #52896 [Messenger] Avoid reconnecting active Redis connections. (BusterNeece)

• bug #52923 Avoid incompatibility with symfony/console 7 (jdecool)

• bug #52927 [Dotenv] Properly handle SYMFONY_DOTENV_VARS being the empty string (xabbuh)

• bug #52935 [Validator] Missing translations for Slovak (sk) #51954 (Jan Vernarsky)

• bug #52941 [Console] Fix xterm detection (theofidry)

• bug #52795 [FrameworkBundle]  do not overwrite an application's default serialization context (xabbuh)

• bug #52870 [SecurityBundle] Fix redeclaration of InternalSecurity class when opcache preload is active (kaznovac)

• bug #52885 [Serializer] fix nullable int cannot be serialized (nikophil)

• bug #52886 [HttpKernel] Catch TypeError if the wrong type is used in BackedEnumValueResolver (alexandre-daubois)

• bug #52878 [WebProfiler] Fix unclosed JS script cannot be parsed (smnandre)

• bug #52867 [Validator] Only trigger deprecation when Validator annotations are used (HypeMC)

• bug #52864 [HttpClient][Mailer][Process] always pass microseconds to usleep as integers (xabbuh)

• 6.4.1 (2023-12-01)

• bug #52814 [Workflow] Add getEnabledTransition() to TraceableWorkflow (alexandre-daubois)

• bug #52852 [Serializer] Fix TranslatableNormalizer when the Translator is disabled (Jean-Beru)

• bug #52836 [DependencyInjection] Fix parsing named autowiring aliases that contain underscores (nicolas-grekas)

• bug #52804 [Serializer] Fix support of plain object types denormalization (andersonamuller)

• bug #52845 [Routing] Restore aliases removal in RouteCollection::remove() (fancyweb)

• bug #52846 [PhpUnitBridge]  run composer update for compatibility with PHPUnit versions shipping composer.lock (xabbuh)

• bug #52823 add parameter types in query builder (javiercno)

• bug #52825 [AssetMapper] Upgrade asset mapper to 6.4 fails due to invalid entries "downloaded_to" and "preload" (redflo)

• bug #52808 [DependencyInjection] Fix dumping containers with null-referenced services (nicolas-grekas)

• bug #52797 [VarExporter] Fix lazy ghost trait when using nullsafe operator (nicolas-grekas)

• bug #52806 [Routing] Fix removing aliases pointing to removed route in RouteCollection::remove() (fancyweb)

• bug #52805 [Routing] Fix conflicting FQCN aliases with route name (fancyweb)

• 6.4.0 (2023-11-29)

• bug #52786 [Serializer] Revert allowed attributes fix (mtarld)

• bug #52765 [Translation] Remove @internal from abstract testcases (OskarStark)

• bug #52780 [DependencyInjection] don't check parameter values if they are not set (xabbuh)

• bug #52762 [VarExporter] Work around php/php-src#12695 for lazy objects, fixing nullsafe-related behavior (nicolas-grekas)

• bug #52759 [VarExporter] Fix serializing objects that implement __sleep() and that are made lazy (nicolas-grekas)

• bug #52767 [Serializer] Fix normalization relying on allowed attributes only (mtarld)

• bug #52727 [String] Fix Inflector for 'icon' (podhy)

• 6.4.0-RC2 (2023-11-26)

• bug #52724 [Security] make secret required for DefaultLoginRateLimiter (RobertMe)

• bug #52617 [AssetMapper] Fix resolving jsdeliver default + other exports from modules (ogizanagi)

• feature #52712 [AssetMapper] Exclude dot files (weaverryan)

• bug #52725 [AssetMapper] Fix: also download files referenced by url() in CSS (weaverryan)

• bug #52702 [AssetMapper] Fix eager imports are not deduplicated (smnandre)

• bug #52719 [Mime] Add TemplatedEmail::$locale to the serialized props (mkrauser)

• bug #52677 [Translation] [Lokalise] Fix language format on Lokalise Provider (welcoMattic)

• bug #52715 [Cache] fix detecting the database server version (xabbuh)

• bug #52688 [Cache] Add url decoding of password in RedisTrait DSN (alexandre-daubois)

• bug #52172 [Serializer] Fix denormalizing empty string into object|null parameter (Jeroeny)

• bug #52693 [Messenger] Fix message handlers with multiple from_transports (valtzu)

• bug #52684 [PropertyInfo] Fixed promoted property type detection for PhpStanExtractor (LastDragon-ru)

• bug #52681 [Serializer] Fix support for DiscriminatorMap in PropertyNormalizer (mtarld)

• bug #52680 [Serializer] Fix access to private properties/getters when using the @Ignore annotation (mtarld)

• bug #52713 [Serializer] Fix deserialization_path missing using contructor (mtarld)

• bug #52683 [Serializer] Fix constructor deserialization path (mtarld)

• bug #52707 [HttpKernel] Fix logging deprecations to the "php" channel when channel "deprecation" is not defined (nicolas-grekas)

• bug #52589 [Serializer] Fix XML attributes not added on empty node (mtarld)

• bug #52686 [Cache] fix detecting the server version with Doctrine DBAL 4 (xabbuh)

• bug #52629 [Messenger] Fix support for Redis Sentinel using php-redis 6.0.0 (pepeh)

• bug #52656 [FrameworkBundle] Add TemplateController to the list of allowed controllers for fragments (nicolas-grekas)

• bug #52459 [Cache][HttpFoundation][Lock] Fix PDO store not creating table + add tests (HypeMC)

• bug #52626 [Serializer] Fix denormalizing date intervals having both weeks and days (oneNevan)

• bug #52578 [Serializer] Fix denormalize constructor arguments (mtarld)

• bug #52526 Add some more non-countable English nouns (paullallier)

• bug #52604 [FrameworkBundle] register the virtual request stack together with common profiling services (xabbuh)

• bug #52039 [Scheduler] Continue with stored Checkpoint::$time on lock (Jeroeny)

• bug #52631 [DomCrawler] Revert "bug #52579 UriResolver support path with colons" (lyrixx)

• bug #52618 [VarExporter] Fix handling mangled property names returned by __sleep() (nicolas-grekas)

• 6.4.0-RC1 (2023-11-15)

• bug #52588 [Messenger] Use extension_loaded call to check if pcntl extension is loaded, as SIGTERM might be set be swoole (Sergii Dolgushev)

• bug #52567 [AssetMapper] Fixing js sourceMappingURL extraction when sourceMappingURL used in code (weaverryan)

• bug #52579 [DomCrawler] UriResolver support path with colons (vdauchy)

• bug #52581 [Messenger] attach all required parameters to query (xabbuh)

• feature #52568 [VarExporter] Deprecate per-property lazy-initializers (nicolas-grekas)

• feature #52560 [Mailer] Update default Mailjet port (Katario)

• 6.4.0-BETA3 (2023-11-10)

• bug #51666 [RateLimiter] CompoundLimiter was accepting requests even when some limiters already consumed all tokens (10n)

• bug #52524 [AssetMapper] Only download a CSS file if it is explicitly advertised (weaverryan)

• bug #52523 [AssetMapper] avoid caching MappedAsset inside JavaScript Import (weaverryan)

• bug #52519 [AssetMapper] If assets are served from a subdirectory or CDN, also adjust importmap keys (weaverryan)

• bug #52508 [AssetMapper] Fix jsdelivr import parsing with no imported value (weaverryan)

• security #cve-2023-46734 [TwigBridge] Ensure CodeExtension's filters properly escape their input (nicolas-grekas, GromNaN)

• security #cve-2023-46735 [Webhook] Remove user-submitted type from HTTP response (nicolas-grekas)

• security #cve-2023-46733 [Security] Fix possible session fixation when only the token changes (RobertMe)

• bug #52514 [FrameworkBundle] Don't reference SYMFONY_IDE env var in non-debug mode (nicolas-grekas)

• bug #52506 [SecurityBundle] wire the secret for Symfony 6.4 compatibility (xabbuh)

• bug #52496 [VarDumper] Accept mixed key on DsPairStub (marc-mabe)

• bug #52502 [Config] Prefixing FileExistenceResource::__toString() to avoid conflict with FileResource (weaverryan)

• bug #52491 [String] Method toByteString conversion using iconv is unreachable (Vincentv92)

• bug #52488 [HttpKernel] Fix PHP deprecation (nicolas-grekas)

• bug #52469 Check whether secrets are empty and mark them all as sensitive (nicolas-grekas)

• feature #52471 [HttpKernel] Add ControllerResolver::allowControllers() to define which callables are legit controllers when the _check_controller_is_allowed request attribute is set (nicolas-grekas)

• bug #52476 [Messenger] fix compatibility with Doctrine DBAL 4 (xabbuh)

• bug #52434 [Console][FrameworkBundle] Fix missing profile option for console commands (keulinho)

• bug #52474 [HttpFoundation] ensure string type with mbstring func overloading enabled (xabbuh)

• bug #52472 [HttpClient][WebProfilerBundle] Do not generate cURL command when files are uploaded (MatTheCat)

• bug #52457 [Cache][HttpFoundation][Lock] Fix empty username/password for PDO PostgreSQL (HypeMC)

• bug #52443 [Yaml] Fix uid binary parsing (mRoca)

• feature #52449 [TwigBridge] Mark CodeExtension as @internal (fabpot)

• bug #52429 [HttpClient] Replace escapeshellarg to prevent overpassing ARG_MAX (alexandre-daubois)

• bug #52442 Disable the "Copy as cURL" button when the debug info are disabled (stof)

• bug #52444 Remove full DSNs from exception messages (nicolas-grekas)

• feature #52336 [HttpFoundation][Lock] Makes MongoDB adapters usable with ext-mongodb only (GromNaN)

• bug #52428 [HttpKernel] Preventing error 500 when function putenv is disabled (ShaiMagal)

• bug #52427 [Console][Process] do not let context classes extend the message classes (xabbuh)

• bug #52408 [Yaml] Fix block scalar array parsing (NickSdot)

• bug #52132 [Console] Fix horizontal table top border is incorrectly rendered (OskarStark)

• bug #52368 [AssetMapper] Fixing bug where JSCompiler used non-absolute importmap entry path (weaverryan)

• bug #52367 [Uid] Fix UuidV7 collisions within the same ms (nicolas-grekas)

• bug #52287 [FrameworkBundle] Fix deprecation layer for "enable_annotations" in validation and serializer configuration (lyrixx)

• bug #52222 [MonologBridge] Fix support for monolog 3.0 (louismariegaborit)

• 6.4.0-BETA2 (2023-10-29)

• bug #52329 [HttpClient] Psr18Client: parse HTTP Reason Phrase for Response (Hanmac)

• bug #52323 [AssetMapper] Allowing circular references in JavaScriptImportPathCompiler (weaverryan)

• bug #52331 [AssetMapper] Fix file deleting errors & remove nullable MappedAsset on JS import (weaverryan)

• bug #52332 [Yaml] Fix deprecated passing null to trim() (javaDeveloperKid)

• bug #52349 [AssetMapper] Fix in-file imports to resolve via filesystem (weaverryan)

• bug #52343 [Intl] Update the ICU data to 74.1 (jderusse)

• bug #52347 [Form] Fix merging form data and files (ter) (Jan Pintr)

• bug #52330 [AssetMapper] Fixing memory bug where we stored way more file content than needed (weaverryan)

• bug #52325 [AssetMapper] jsdelivr "no version" import syntax (weaverryan)

• bug #52307 [Scheduler] Save checkpoint in a finally block (FrancoisPog)

• feature #52193 [PhpUnitBridge] Allow setting the locale using SYMFONY_PHPUNIT_LOCALE env var (VincentLanglet)

• bug #52290 [DebugBundle] ignore a not-existing virtual request stack (xabbuh)

• bug #52308 [SecurityBundle] Fix missing login-link element in xsd schema (fancyweb)

• bug #51331 [Messenger] add handler description as array key to HandlerFailedException::getWrappedExceptions() (kbond)

• bug #51992 [Serializer] Fix using DateIntervalNormalizer with union types (Jeroeny)

• bug #52276 DB table locks on messenger_messages with many failures (bn-jdcook)

• bug #52232 [Messenger] declare constructor argument as optional for backwards compatibility (xabbuh)

• bug #52254 [AssetMapper] Adding import-parsing case where import contains a path (weaverryan)

• bug #52283 [Serializer] Handle default context when denormalizing timestamps in DateTimeNormalizer (mtarld)

• bug #52272 [VarDump] Fix order of dumped properties - parent goes first (lyrixx)

• bug #52274 [FrameworkBundle] re-introduce conflict rule with WebProfilerBundle < 6.4 (xabbuh)

• bug #52268 [Mailer][Notifier] Update Sendinblue / Brevo API host (Stephanie)

• bug #52255 [Form] Skip merging params & files if there are no files in the first place (dmaicher, priyadi)

• bug #52234  add return type hints to EntityFactory (xabbuh)

• bug #52229 [FrameworkBundle] Fix CommandDataCollector is always registered (smnandre)

• bug #52218 [FrameworkBundle] Add conflict with WebProfilerBundle < 6.4 (HeahDude)

• 6.4.0-BETA1 (2023-10-21)

• feature #51847 [AssetMapper] Allowing for files to be written to some non-local location (weaverryan)

• feature #52079 [HttpKernel] Add parameters kernel.runtime_mode and kernel.runtime_mode.*, all set from env var APP_RUNTIME_MODE (nicolas-grekas)

• feature #51348 [FrameworkBundle][Validator] Allow implementing validation groups provider outside DTOs (Yonel Ceruto)

• feature #51577 [Notifier][Novu] Implement overrides (wouter-toppy)

• feature #51211 [Workflow] List place and transition listeners in profiler (lyrixx)

• feature #51220 [Workflow] Add a TraceableWorkflow (lyrixx)

• feature #52120 [AssetMapper] Split ImportmapManager into 2 (weaverryan)

• feature #51849 [AssetMapper] Warn of missing or incompat dependencies (weaverryan)

• feature #52032 [FrameworkBundle][Routing][Translation][Workflow] Move some compiler passes from FrameworkBundle to components (fancyweb)

• feature #52166 [HtmlSanitizer] Add support for sanitizing unlimited length of HTML document (lyrixx)

• feature #48095 [Messenger] [Sqs] Add AddFifoStamp middleware (tyx)

• feature #52160 [DoctrineBridge] Change argument $lastUsed of DoctrineTokenProvider::updateToken() to accept DateTimeInterface (nicolas-grekas)

• feature #52140 [Translation] Add argument $buildDir to DataCollectorTranslator::warmUp() (nicolas-grekas)

• feature #52047 [HttpFoundation][Runtime] Add $flush parameter to Response::send() (fancyweb)

• feature #51470 [FrameworkBundle][Serializer] Deprecate annotations (alexandre-daubois)

• feature #51483 [FrameworkBundle][Routing] Deprecate annotations (alexandre-daubois)

• feature #47416 [Console][FrameworkBundle][HttpKernel][WebProfilerBundle] Enable profiling commands (HeahDude)

• feature #50391 [FrameworkBundle][HttpKernel] Introduce $buildDir argument to WarmableInterface::warmup to warm read-only artefacts in build_dir (Okhoshi)

• feature #52087 [Scheduler] Add FailureEvent (alli83)

• feature #51828 [AssetMapper] Put importmap in polyfill so it can be hosted locally easily (weaverryan)

• feature #52024 [AssetMapper] Add a "package specifier" to importmap in case import name != package+path (weaverryan)

• feature #50734 [ErrorHandler] Improve fileLinkFormat handling (nlemoine)

• feature #52002 [HttpFoundation] Cookies Having Independent Partitioned State (CHIPS) (fabricecw)

• feature #51805 [Scheduler] pre_run and post_run events (alli83)

• feature #51926 [Mime] Forbid messages that are generators to be used more than once (fabpot)

• feature #50946 [Routing][SecurityBundle] Add LogoutRouteLoader (MatTheCat)

• feature #52038 [Console] Dispatch ConsoleTerminateEvent when exiting on signal (HeahDude)

• feature #49893 [Serializer] Add XmlEncoder::CDATA_WRAPPING context option (AndoniLarz)

• feature #50877 [Finder] Add early directory prunning filter support (mvorisek)

• feature #51829 [AssetMapper] Automatically preload CSS files if WebLink available (weaverryan)

• feature #51011 [FrameworkBundle] Add parameters deprecations to the output of debug:container command (HeahDude)

• feature #51888 [WebProfiler] Profiler improvements / extract Font from stylesheet (smnandre)

• feature #51058 [FrameworkBundle] Add --exclude option to the cache:pool:clear command (MatTheCat)

• feature #51845 [AssetMapper] Add outdated command (Maelan LE BORGNE)

• feature #51976 [Workflow] Revert deprecation about Registry (lyrixx)

• feature #50537 [Console] Add placeholders to ProgressBar for exact times (maxbeckers)

• feature #51717 [Notifier] [Telegram] Extend options for location, document, audio, video, venue, photo, animation, sticker & contact (igrizzli)

• feature #49044 [Messenger] Mention the transport which failed during the setup command (thePanz)

• feature #51786 [AssetMapper] Always downloading vendor files (weaverryan)

• feature #51832 [DependencyInjection] Add #[AutowireIterator] attribute and improve #[AutowireLocator] (nicolas-grekas, kbond)

• feature #50934 [Form] Add duplicate_preferred_choices option to ChoiceType (arnaud-deabreu)

• feature #51650 [AssetMapper] Add audit command (Jean-Beru)

• feature #51800 [DoctrineBridge] Pass Request to EntityValueResolver's expression (HypeMC)

• feature #51848 [Messenger] Resend failed retries back to failure transport (ro0NL)

• feature #51811 Add "dev" keyword to symfony/symfony package (nicolas-grekas)

• feature #51276 [Notifier] Transport possible to have null (StaffNowa)

• feature #50662 [FrameworkBundle] Add HttpClientAssertionsTrait which provide shortcuts to assert HTTP calls was triggered (welcoMattic)

• feature #50392 Move UriSigner from HttpKernel to HttpFoundation package (alexander-schranz)

• feature #51804 [Security] Make impersonation_path() argument mandatory and add impersonation_url() (alexandre-daubois)

• feature #50127 [TwigBridge] Add FormLayoutTestCase class (ker0x)

• feature #50030 Add new twig bridge function to generate impersonation path (PhilETaylor)

• feature #50109 [FrameworkBundle] Add --show-aliases option to debug:router command (fancyweb)

• feature #50141 Allow sending scheduled messages through the slack API (Insanfly)

• feature #50321 [TwigBridge] Add AppVariable::getEnabledLocales() (jmsche)

• feature #51676 [RateLimiter] Add SlidingWindowLimiter::reserve() (Jeroeny)

• feature #51538 [HttpFoundation] Support root-level Generator in StreamedJsonResponse (Jeroeny)

• feature #51653 [Messenger] Add WrappedExceptionsInterface for nested exceptions (Jeroeny)

• feature #51690 [Mime] Add TemplatedEmail::locale() to set the locale for the email rendering (alexander-schranz)

• feature #51525 [Messenger][Scheduler] Add AsCronTask & AsPeriodicTask attributes (valtzu)

• feature #51795 [Scheduler] Make debug:scheduler output more useful (fabpot)

• feature #51793 [FrameworkBundle] Change BrowserKitAssertionsTrait::getClient() to be protected (fabpot)

• feature #44629 [FrameworkBundle] Allow BrowserKit relative URL redirect assert (julienfalque)

• feature #51756 [Messenger] RejectRedeliveredMessageException should not be retried (nikophil)

• feature #51779 [Serializer] Make ProblemNormalizer give details about Messenger’s ValidationFailedException (MatTheCat)

• feature #51772 [WebProfilerBundle] Support ! negation operator in url filter (SzymonKaminski)

• feature #51729 [AssetMapper] Allow simple, relative paths in importmap.php (weaverryan)

• feature #51697 [PropertyInfo] Make isWriteable() more consistent with isReadable() when checking snake_case properties (jbtronics)

• feature #51543 [AssetMapper] Add support for CSS files in the importmap (weaverryan)

• feature #51593 [Messenger] Add the --all option to the messenger:failed:remove command (alexandre-daubois)

• feature #51542 [Scheduler] Trigger unique messages at runtime (Jeroeny)

• feature #51415 [Clock] Add DatePoint: an immutable DateTime implementation with stricter error handling and return types (nicolas-grekas)

• feature #51553 [Scheduler] Allow modifying the schedule at runtime and recalculate heap (Jeroeny)

• feature #51712 Deprecate Kernel::stripComments() (alamirault)

• feature #51687 [Messenger] Add support for multiple Redis Sentinel hosts (digilist)

• feature #51153 [Translation] Add --as-tree option to translation:pull command (syffer)

• feature #51601 [Mime] Allow to add some headers as a strings (Oipnet)

• feature #51684 [Translation] Give current locale to LocaleSwitcher::runWithLocale()'s callback (alexander-schranz)

• feature #51651 [Scheduler] Fix stateful scheduler (valtzu)

• feature #51638 [FrameworkBundle] [Test] add token attributes in KernelBrowser::loginUser() (Valmonzo)

• feature #51558 [HttpClient] Enable using EventSourceHttpClient::connect() for both GET and POST (wivaku)

• feature #51476 [Serializer] Allow Context to target classes (mtarld)

• feature #50438 [Validator] Add is_valid function to Expression constraint (verdet23, DEVizzent)

• feature #51585 [Security] Add badge resolution to profiler (Jean-Beru)

• feature #51523 [AssetMapper] Allow specifying packages to update with importmap:update (jmsche)

• feature #50705 [Mailer][Webhook] Add Sendgrid webhook support (WoutervanderLoopNL)

• feature #51450 [Mailer] [Smtp] Add DSN param peer_fingerprint for fingerprint verification (xdavidwu)

• feature #51484 [Workflow] deprecate GuardEvent::getContext method (hhamon)

• feature #51351 [AssetMapper] Add command to download missing downloaded packages (jmsche)

• feature #51454 [Validator] Un-deprecate passing an annotation reader to AnnotationLoader (derrabus)

• feature #51434 [Security] [Throttling] Hide username and client ip in logs (Spomky)

• feature #51425 [FrameworkBundle][Validator] Deprecate annotation occurrences (alexandre-daubois)

• feature #51392 [DependencyInjection] add #[AutowireLocator] attribute (kbond)

• feature #51365 [Clock] Add $modifier argument to the now() helper (nicolas-grekas)

• feature #51327 [FrameworkBundle] Add AbstractController::renderBlock() and renderBlockView() (nicolas-grekas)

• feature #51357 [FrameworkBundle] Deprecate not setting some options (uid, validation) (Jean-Beru)

• feature #51325 [FrameworkBundle] Deprecate not setting some options (Jean-Beru)

• feature #51412 [Clock] Throw DateMalformedStringException/DateInvalidTimeZoneException when appropriate (nicolas-grekas)

• feature #51368 [DomCrawler] Added argument $default to method Crawler::attr() (Rastishka)

• feature #51315 [Notifier][Webhook] Add Vonage support (smnandre)

• feature #51349 [Notifier] Add GoIP bridge (ahmedghanem00)

• feature #51332 [SecurityBundle] Deprecate the require_previous_session config option (alamirault)

• feature #51284 [FrameworkBundle][HttpKernel][MonologBridge] Revisit wiring of debug loggers (nicolas-grekas)

• feature #50306 [DomCrawler][FrameworkBundle] Add assertAnySelectorText* (SVillette)

• feature #51263 [Scheduler] Add --all to debug:schedule (fabpot)

• feature #50939 [SecurityBundle] Add $badges argument to Security::login (MatTheCat)

• feature #50951 [FrameworkBundle] Support APP_BUILD_DIR (ro0NL)

• feature #51264 [RemoteEvent][Webhook] Add Brevo support (blaugueux)

• feature #50502 [RemoteEvent][Webhook] Add Mailjet support (blaugueux)

• feature #51250 Remove remaining experimental classes (fabpot)

• feature #51249 [RemoteEvent] Mark component as non experimental (fabpot)

• feature #51248 [Webhook] Mark component as non experimental (fabpot)

• feature #51247 [AssetMapper] Mark component as non experimental (fabpot)

• feature #51246 [Scheduler] Mark component as non experimental (fabpot)

• feature #51245 [Scheduler] Only use toString if defined for message (fabpot)

• feature #51244 [Scheduler] Add --date to schedule:debug (fabpot)

• feature #51210 [Workflow] Add PHP attributes to register listeners and guards (lyrixx)

• feature #48485 [Process] Introducing a new PhpSubprocess handler (Toflar)

• feature #51215 [FrameworkBundle] Enable json_decode_detailed_errors in dev by default (ostrolucky)

• feature #51004 [HttpKernel] Support backed enums in #[MapQueryParameter] (andersmateusz)

• feature #51230 [Scheduler] add ScheduledStamp to RedispatchMessage (kbond)

• feature #51218 [Workflow] Support multiline descriptions in PlantUML (valtzu)

• feature #51073 [Intl] Add support for ISO 3166-1 numeric codes (benr77)

• feature #51191 [Mime] Update mimetypes (fabpot)

• feature #47422 [Process] Support using Process::findExecutable() independently of open_basedir (BlackbitDevs)

• feature #48907 [Validator] Validate time without seconds (xepozz)

• feature #51204 [Workflow] Add a profiler (lyrixx)

• feature #47715 [Form] Removing self-closing slash from <input> (ThomasLandauer)

• feature #50212 [FrameworkBundle][Serializer] Add TranslatableNormalizer (Jean-Beru)

• feature #50767 [HttpKernel] RequestPayloadValueResolver Add support for custom http status code (zim32)

• feature #51172 [Serializer] Add support for seld/jsonlint (ostrolucky)

• feature #49231 [Translation] Phrase translation provider (wickedOne)

• feature #50974 [Workflow] Add support for storing the marking in a property (lyrixx)

• feature #51092 [Scheduler] make ScheduledStamp "send-able" (kbond)

• feature #51197 [PsrHttpMessageBridge] Support php-http/discovery for auto-detecting PSR-17 factories (derrabus)

• feature #48841 [BrowserKit] Add argument $serverParameters to click() and clickLink() (syl20b)

• feature #49594 [Serializer] Groups annotation/attribute on class (Brajk19)

• feature #50879 [Notifier] support local development for sns by adding sslmode option (Ferror)

• feature #51152 [Scheduler] Add AbstractTriggerDecorator (kbond)

• feature #49814 [Console][Messenger] add RunCommandMessage and RunCommandMessageHandler (kbond)

• feature #50978 [Messenger] Allow accessing all options on a handler descriptor (ruudk)

• feature #50911 [HttpKernel] Enhance exception if possible (lyrixx)

• feature #50136 [Notifier] [SpotHit] Support smslong and smslongnbr API parameters (camillebaronnet)

• feature #50907 [Validator] Update Type constraint, add number, finite-float and finite-number validations (guillaume-a)

• feature #51130 [VarDumper] Dump uninitialized properties (nicolas-grekas)

• feature #51144 [Templating] deprecate the component (kbond)

• feature #51014 [Mailer] Add Scaleway bridge (MrMicky-FR)

• feature #51167 [PsrHttpMessageBridge] Remove ArgumentValueResolverInterface from PsrServerRequestResolver (derrabus)

• feature #51100 [PsrHttpMessageBridge] Import the bridge into the monorepo (fabpot, dunglas, KorvinSzanto, xabbuh, aimeos, ahundiak, Danielss89, rougin, csunolgomez, Jérôme Parmentier, mtibben, Nyholm, ajgarlag, uphlewis, samnela, grachevko, nicolas-grekas, tinyroy, danizord, Daniel Degasperi, rbaarsma, Ekman, 4rthem, derrabus, mleczakm, iluuu1994, Tobion, chalasr, lemon-juice, franmomu, cidosx, erikn69, AurelienPillevesse)

• feature #49815 [HttpClient][Messenger] add PingWebhookMessage and PingWebhookMessageHandler (kbond)

• feature #49813 [Messenger][Process] add RunProcessMessage and RunProcessMessageHandler (kbond)

• feature #51148 [FrameworkBundle] Simplify marking store configuration (nicolas-grekas)

• feature #51128 [SecurityBundle] Allow an array of pattern in firewall configuration (lyrixx, chalasr)

• feature #119 Implement ValueResolverInterface (derrabus)

• feature #117 Leverage Request::getPayload() to populate the parsed body of PSR-7 requests (AurelienPillevesse)

• feature #50931 [Form] Support Translatable Enum (Seb33300)

• feature #49358 [Routing] Deprecate annotations in favor of attributes (derrabus)

• feature #50982 [Validator] Deprecate annotations in favor of attributes (derrabus)

• feature #50983 [Serializer] Deprecate annotations in favor of attributes (derrabus)

• feature #51043 [Form] Deprecate FormEvent::setData() for events that do not allow it (HeahDude)

• feature #50888 [FrameworkBundle] Deprecate doctrine/annotations integration (derrabus)

• feature #50997 [Messenger] Deprecate StopWorkerOnSignalsListener (HypeMC)

• feature #50290 [Security] Make PersistentToken immutable and tell TokenProviderInterface::updateToken() implementations should accept DateTimeInterface (nicolas-grekas)

• feature #50883 [TwigBundle] Allow omitting the autoescape_service_method option when autoescape_service is set to an invokable service id (nicolas-grekas)

• feature #50718 [DependencyInjection] Improve reporting named autowiring aliases (nicolas-grekas)

• feature #50295 [PropertyAccess] Auto-cast from/to DateTime/Immutable when appropriate (nicolas-grekas)

• feature #50420 [Console] add support for catching \Throwable errors (lyrixx)

• feature #50148 [Mailer] Add X-Infobip-Track header to be able to disable tracking (ndousson)

• feature #50200 [Mailer] Adds assertEmailSubjectContains and assertEmailSubjectNotContains methods (johanadivare)

• feature #50302 [Mailer] New Brevo mailer bridge (formerly Sendinblue) (PEtanguy)

• feature #50296 [Notifier] Add Brevo bridge (formerly Sendinblue) (PEtanguy)

• feature #50842 Add missing return types to magic methods (wouterj)

• feature #50868 [SecurityBundle] Deprecate Security::* consts and other cleanups (nicolas-grekas)

• feature #50770 [TwigBridge] Allow to change element for form_help block (seb-jean)

• feature #50814 [HttpClient] Allow custom working directory in TestHttpServer (ro0NL)

• feature #46426 [Form] deprecate using the date and time types with date objects with not-matching timezones (xabbuh)

• feature #50791 [DependencyInjection] Add defined prefix for env var processor (GaryPEGEOT)

• feature #50754 [HttpKernel] when configuring the container add services_{env} with php extension (helyakin)

• feature #50425 [Validator] Allow single constraint to be passed to the constraints option of the When constraint (alexandre-daubois)

• feature #50396 [Validator] Allow single integer for the versions option of the Uuid constraint (alexandre-daubois)

• feature #50621 [FrameworkBundle][Workflow] Add metadata dumping support for GraphvizDumper (Louis-Proffit)

• feature #50170 [Notifier] Added redlink notifier (plotkabytes)

• feature #50615 [DependencyInjection] Deprecate ContainerAwareInterface, ContainerAwareTrait and ContainerAwareLoader (alexandre-daubois)

• feature #50084 [Routing] Add FQCN and FQCN::method aliases when applicable (fancyweb)

• feature #50691 [Console] Aligned multiline text in vertical table (jaytaph)

• feature #50131 [Notifier] add Ntfy bridge (mikaelkael)

• feature #50663 [Console] Add SignalMap to map signal value to its name (lyrixx)

• feature #50414 [Notifier] Add Novu bridge (wouter-toppy)

• feature #50240 [HttpClient] Add max_retries option to RetryableHttpClient (danielburger1337)

• feature #50572 [Scheduler] Allow setting cron expression next run date timezone (danielburger1337)

• feature #50579 [DoctrineBridge] Deprecate using the old DBAL logger system (derrabus)

• feature #50335 [HttpKernel] Add optional $className param to ControllerEvent::getAttributes() (HypeMC)

• feature #113 Bump psr/http-message version (erikn69)

• feature #114 Drop support for Symfony 4 (derrabus)

• feature #100 Allow Symfony 6 (chalasr)

• feature #89 PSR HTTP message converters for controllers (derrabus)

• feature #75 Remove deprecated code (fabpot)

• feature #66 Add support for streamed Symfony request (Ekman)

• feature #50 Add support for streamed response (danizord)

• feature #62 bump to PHP 7.1 (nicolas-grekas)

• feature #43 Create PSR-7 messages using PSR-17 factories (ajgarlag)

• feature #45 Fixed broken build (Nyholm)

• feature #1 Initial support (dunglas)