* 4.0.4 (2018-01-29)

* bug #25922 [HttpFoundation] Use the correct syntax for session gc based on Pdo driver (tanasecosminromeo)

* bug #25933 Disable CSP header on exception pages only in debug (ostrolucky)

* bug #25926 [Form] Fixed Button::setParent() when already submitted (HeahDude)

* bug #25927 [Form] Fixed submitting disabled buttons (HeahDude)

* bug #25397 [Console] Provide a DX where an array could be passed (Simperfit)

* bug #25858 [DI] Fix initialization of legacy containers by delaying include_once (nicolas-grekas)

* bug #25891 [DependencyInjection] allow null values for root nodes in YAML configs (xabbuh)

* bug #24864 Have weak_vendors ignore deprecations from outside (greg0ire)

* bug #25873 [Console] Fix using finally where the catch can also fail (nicolas-grekas)

* bug #25848 [Validator] add missing parent isset and add test (Simperfit)

* bug #25869 [Process] Skip environment variables with false value in Process (francoispluchino)

* bug #25864 [Yaml] don't split lines on carriage returns when dumping (xabbuh)

* bug #25863 [Yaml] trim spaces from unquoted scalar values (xabbuh)

* bug #25861 do not conflict with egulias/email-validator 2.0+ (xabbuh)

* bug #25851 [Validator] Conflict with egulias/email-validator 2.0 (emodric)

* bug #25837 [SecurityBundle] Don't register in memory users as services (chalasr)

* bug #25835 [HttpKernel] DebugHandlersListener should always replace the existing exception handler (nicolas-grekas)

* bug #25829 [Debug] Always decorate existing exception handlers to deal with fatal errors (nicolas-grekas)

* bug #25823 [Security] Notify that symfony/expression-language is not installed if ExpressionLanguage is used (giovannialbero1992)

* bug #25824 Fixing a bug where the dump() function depended on bundle ordering (weaverryan)

* bug #25763 [OptionsResolver] Fix options resolver with array allowed types (mcg-web)

* bug #25789 Enableable ArrayNodeDefinition is disabled for empty configuration (kejwmen)

* bug #25822 [Cache] Fix handling of apcu_fetch() edgy behavior (nicolas-grekas)

* bug #25816 Problem in phar see mergerequest #25579 (betzholz)

* bug #25781 [Form] Disallow transform dates beyond the year 9999 (curry684)

* bug #25287 [Serializer] DateTimeNormalizer handling of null and empty values (returning it instead of new object) (Simperfit)

* bug #25249 [Form] Avoid button label translation when it's set to false (TeLiXj)

* bug #25127 [TwigBridge] Pass the form-check-inline in parent (Simperfit)

* bug #25812 Copied NO language files to the new NB locale (derrabus)

* bug #25753 [Console] Fix restoring exception handler (nicolas-grekas, fancyweb)

* bug #25801 [Router] Skip anonymous classes when loading annotated routes (pierredup)

* bug #25508 [FrameworkBundle] Auto-enable CSRF if the component *+ session* are loaded (nicolas-grekas)

* bug #25657 [Security] Fix fatal error on non string username (chalasr)

* bug #25791 [Routing] Make sure we only build routes once (sroze)

* bug #25799 Fixed Request::__toString ignoring cookies (Toflar)

* bug #25755 [Debug] prevent infinite loop with faulty exception handlers (nicolas-grekas)

* bug #25771 [Validator] 19 digits VISA card numbers are valid (xabbuh)

* bug #25751 [FrameworkBundle] Add the missing `enabled` session attribute (sroze)

* bug #25750 [HttpKernel] Turn bad hosts into 400 instead of 500 (nicolas-grekas)

* bug #25699 [HttpKernel] Fix session handling: decouple "save" from setting response "private" (nicolas-grekas)

* bug #25490 [Serializer] Fixed throwing exception with option JSON_PARTIAL_OUTPUT_ON_ERROR (diversantvlz)

* bug #25737 [TwigBridge] swap filter/function and package names (xabbuh)

* bug #25731 [HttpFoundation] Always call proxied handler::destroy() in StrictSessionHandler (nicolas-grekas)

* bug #25733 [HttpKernel] Fix compile error when a legacy container is fresh again (nicolas-grekas)

* bug #25709 Tweaked some styles in the profiler tables (javiereguiluz)

* bug #25719 [HttpKernel] Uses cookies to track the requests redirection (sroze)

* bug #25696 [FrameworkBundle] Fix using "annotations.cached_reader" in after-removing passes (nicolas-grekas)

* feature #25669 [Security] Fail gracefully if the security token cannot be unserialized from the session (thewilkybarkid)

* bug #25700 Run simple-phpunit with --no-suggest option (ro0NL)