* 8.0.9 (2026-05-01)

* bug #64090 [DependencyInjection] Reject circular references through a factory builder's setup (nicolas-grekas)

* bug #64088 [Uid] Fix compat with ext-ds v2 (nicolas-grekas)

* bug #64083 [Messenger] Alias the AMQP "user" connection option to "login" (lacatoire)

* bug #64084 [Messenger] Do not sleep after worker is stopped during idle cycle (Toflar)

* bug #63653 Fix default boolean values `SweegoTransportFactory` (qdequippe)

* bug #64043 [Form] Preserve collection children added by PRE_SET_DATA listeners (dargor980)

* bug #64042 [Config] Fix array-shape generator dropping alternative types on nested PrototypedArrayNode (Amoifr)

* bug #64025 [DoctrineBridge] Catch any driver exception in the same-database check (lacatoire)

* bug #64023 [FrameworkBundle] Fix mailer package check for bridges whose composer name does not match the service id (lacatoire)

* bug #63992 [Messenger] Keep deduplication lock when handler throws (ousamabenyounes)

* bug #63993 [Mailer][Postmark] Handle alternate error payload shapes for Payload Too Large (ousamabenyounes)

* bug #64067 [Serializer] Move type-mismatch and uninitialized-property handling into concrete normalizers (ousamabenyounes)

* bug #64065 [Notifier][Ntfy] Fix Basic auth header by keeping base64 padding (ousamabenyounes)

* bug #64045 [Config] Allow env placeholders in NumericNode min/max checks (ousamabenyounes)

* bug #64047 [Mime] Preserve inline part filename instead of overwriting it with the Content-ID (ousamabenyounes)

* bug #64044 [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType() (ousamabenyounes)

* bug #64030 [MonologBridge] Guard against re-entrant calls in AbstractTokenProcessor (ousamabenyounes)

* bug #64060 [Cache] Normalize default_lifetime for pools wrapped by ChainAdapter (ostrolucky)

* bug #63996 [RateLimiter] Keep token bucket alive while reservation debt is unpaid (ousamabenyounes)

* bug #63975 [Lock] Avoid aborting outer PostgreSQL transaction on lock contention (lacatoire)

* bug #64046 [HttpClient] Don't share CURL_LOCK_DATA_CONNECT to honor max_host_connections (ousamabenyounes)

* bug #64036 [Validator] fix mapping properties using property hooks (mrossard)

* bug #64024 [AssetMapper] Allow spaces in version constraints (MatTheCat)

* bug #64020 [Dotenv] Strip NUL byte placeholder from values passed to `putenv()` (alexandre-daubois)

* bug #63991 [FrameworkBundle] Strip --no-fill marker from every translation domain (ousamabenyounes)

* bug #63982 [Messenger] Respect SentToFailureTransportStamp when failure transports are configured (ousamabenyounes)

* bug #63990 [Messenger] Do not apply --max to --stats unless explicitly set (ousamabenyounes)

* bug #63979 [Serializer] Capture constructor TypeError when collecting denormalization errors (lacatoire)

* bug #64006 [DependencyInjection] Fix hidden dependency on symfony/config in PhpDumper (GromNaN)

* bug #63983 [Security] Throw BadCredentialsException on empty JSON login username/password (ousamabenyounes)

* bug #63981 [Routing] Honor the Request's method in UrlMatcher::matchRequest() (ousamabenyounes)

* bug #63980 [DependencyInjection] Log every build parameter removed during compilation (ousamabenyounes)

* bug #63974 [Serializer] Make `BackedEnumNormalizer` unconditionally return `null` on invalid value if `allow_invalid_values` is set (MatTheCat)

* bug #63964 [Cache] Ensure internal state is cleared in TagAwareAdapter::reset() … (KevinMartinsDev)

* bug #63955 [Dotenv] Fix variable corruption when loading env more than once (nicolas-grekas)

* bug #63959 [VarExporter] Don't warn for __sleep()-listed uninitialized declared properties (nicolas-grekas)

* bug #63918 [TypeInfo] Fix collectUses() to support grouped use imports (Amoifr)

* bug #63952 [Scheduler] Respect `console.command` DI tag `command` attribute (nicolas-grekas)

* bug #63951 [DependencyInjection] Fix autowiring nullable intersection types (HypeMC)

* bug #63948 [Scheduler] Support command aliases (ambroisemaupate)

* bug #63923 [CssSelector] Fix :is() and :where() combining conditions with parent selector (lacatoire)

* bug #63938 [Workflow] Fix HTML escaping in `GraphvizDumper` labels (alexandre-daubois)

* bug #63930 [WebProfilerBundle] Fix toolbar toggle button accessibility (Nitram1123)

* bug #63889 [ObjectMapper] Auto-inject ObjectMapper into ObjectMapperAwareInterface transforms (Amoifr)

* bug #63915 [Mailer] Fix handling of webhook.test verification event from MailerSend webhook (mwansinck)

* bug #63909 [Filesystem] Fix Path methods replacing backslashes on UNIX (Amoifr)

* bug #63922 [DependencyInjection] Fix excludeSelf not applied when using AutowireLocator (GromNaN)

* bug #63894 [Dotenv] Fix self-referencing variable resolution with suffix/prefix (Amoifr)

* bug #63883 [Serializer] Fix getAllowedAttributes() when groups contain wildcard '*' (takashiraki)

* bug #63876 [DependencyInjection] Fix instanceof autoconfiguration for anonymous classes (jlabedo)

* bug #63860 [Cache] Fix Psr16Cache::getMultiple() returning wrapper values when using TTL (nicolas-grekas)

* bug #63859 [Console] Fix shell completion when SHELL_VERBOSITY=-1 (nicolas-grekas)

* bug #63847 [EventDispatcher] Fix TraceableEventDispatcher when reset during dispatch (aschempp)

* data #63849 Remove needs-review flag for Afrikaans (af) (payene)