CHANGELOG for 8.1.x
===================

This changelog references the relevant changes (bug and security fixes) done
in 8.1 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1

* 8.1.0 (2026-05-29)

 * feature #64398 Shopware is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64397 Mailtrap is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * bug #64376 [Translation] Fix XLIFF 2 catalog metadata (MatTheCat)
 * bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (nicolas-grekas)
 * bug #64388 [Yaml] Fix parsing inline anchored values (nicolas-grekas)
 * bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
 * bug #64389 Migrate `configureSchema()` to DBAL's editor API (nicolas-grekas)
 * bug #64102 Remove usage of `Kernel::VERSION` (fabpot)

* 8.1.0-RC1 (2026-05-27)

 * security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (nicolas-grekas)
 * security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>, <img>, and the URL inside <meta http-equiv="refresh"> content (nicolas-grekas)
 * security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)
 * security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)
 * security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)
 * security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)
 * security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)
 * bug #64356 [Tui] Throw when ext-zip is not installed and one tries to load a zipped figlet (nicolas-grekas)
 * bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)
 * bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)
 * bug #64348 [FrameworkBundle] Allow to pass `doctrine_open_transaction_logger`’s entity manager name positionally (MatTheCat)
 * feature #64334 [Form] Add `handle_missing_data` option to opt into MissingDataHandler for absent forms (hlecorche)
 * bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (nicolas-grekas)
 * bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (nicolas-grekas)
 * bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (signor-pedro)
 * bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)
 * bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)
 * bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)
 * bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)
 * bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)
 * bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)
 * bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)
 * bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)
 * bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)
 * bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)
 * bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)
 * bug #64208 [AssetMapper] Rewrite relative paths in `export ... from` statements (ousamabenyounes)
 * bug #64311 [DependencyInjection] Fix `service()` as invokable factory in array-based PHP config (nicolas-grekas)
 * feature #64312 [FrameworkBundle][Validator] Add `framework.validation.property_metadata_existence_check` config (nicolas-grekas)
 * bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both `WARNING` and `warning` (MatTheCat)
 * bug #64260 [HttpClient] Various fixes and hardenings (Lctrs)
 * bug #64234 [Tui] Fix unattached widget element styles (masskrdjn)
 * bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (nicolas-grekas)
 * bug #64223 [Tui] Fix invisible border with null color in BorderPattern's inverse strategies (sblondeau)

* 8.1.0-BETA3 (2026-05-20)

 * security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)
 * security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (nicolas-grekas)
 * security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)
 * security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)
 * security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)
 * security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)
 * security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)
 * security #cve-2026-45066 [HtmlSanitizer] Fix `allowLinkHosts`/`allowMediaHosts` bypass via URL parser differentials and `<area>` misclassification (alexandre-daubois)
 * security #cve-2026-45069 [Security] Add missing claims in `OidcTokenHandler` (alexandre-daubois)
 * bug #64301 [TwigBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64300 [TwigBridge] Fix daisyUI form layout and AppVariable locale filtering (nicolas-grekas)
 * bug #64296 [Serializer] Improve normalizer error reporting and deprecations (nicolas-grekas)
 * bug #64297 [Tui] Various fixes and hardenings (nicolas-grekas)
 * bug #64299 [TypeInfo] Harden ObjectShapeType (nicolas-grekas)
 * bug #64294 [RateLimiter] Harden calendar-aligned fixed window mode (nicolas-grekas)
 * bug #64291 [MonologBridge] Harden MailerHandler subject truncation (nicolas-grekas)
 * bug #64290 [Security] Various fixes and hardenings (nicolas-grekas)
 * bug #64287 [Translation] Various fixes and hardenings (nicolas-grekas)
 * bug #64286 [WebProfilerBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64283 [Lock] Various fixes and hardenings (nicolas-grekas)
 * bug #64285 [WebLink] Add missing `Link::AS_*` constants for `rel=preload` / `rel=modulepreload` (nicolas-grekas)
 * feature #64284 [PasswordHasher] Support stdin input and refine warning in security:hash-password (nicolas-grekas)
 * bug #64273 [HttpKernel] Various fixes and hardenings (nicolas-grekas)
 * bug #64276 [Runtime] Various fixes and hardenings (nicolas-grekas)
 * bug #64280 [Workflow] Various fixes and hardenings (nicolas-grekas)
 * bug #64275 [Routing] Fix missing HostTrait in ContentLoaderTrait (nicolas-grekas)
 * bug #64274 [SecurityBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64272 [Mailer] Preserve the sent message object as is when sending it (nicolas-grekas)
 * bug #64243 [HttpClient] Various fixes and hardenings (nicolas-grekas)
 * bug #64269 [HttpFoundation] Various fixes and hardenings (nicolas-grekas)
 * bug #64268 [FrameworkBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64263 [ExpressionLanguage] Various fixes and hardenings (nicolas-grekas)
 * bug #64262 [EventDispatcher] Various fixes and hardenings (nicolas-grekas)
 * bug #64256 [DomCrawler] Various fixes and hardenings (nicolas-grekas)
 * bug #64254 [DependencyInjection] Various fixes and hardenings (nicolas-grekas)
 * bug #64252 [AssetMapper] Various fixes and hardenings (nicolas-grekas)
 * bug #64251 [ObjectMapper] Various fixes and hardenings (nicolas-grekas)
 * bug #64250 [CssSelector] Various fixes and hardenings (nicolas-grekas)
 * bug #64249 [Form] Various fixes and hardenings (nicolas-grekas)
 * bug #64248 [Mailer] Various fixes and hardenings (nicolas-grekas)
 * bug #64239 [Validator] Various fixes and hardenings (nicolas-grekas)
 * bug #64237 [Messenger] Various fixes and hardenings (nicolas-grekas)
 * bug #64242 [TwigBridge] Require Twig to 3.25 for `EscaperRuntime` service definition (GromNaN)
 * bug #64258 [DomCrawler] Fix `ChoiceFormField::addChoice()` clobbering values on multi-selects (nicolas-grekas)
 * bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (nicolas-grekas)
 * bug #64207 [MonologBridge] Fix `interactive_only` not preventing propagation (philbates35)
 * bug #64241 [JsonStreamer] Various fixes and hardenings (nicolas-grekas)
 * bug #64255 [DoctrineBridge] Various fixes and hardenings (nicolas-grekas)
 * bug #64246 [Console] Various fixes and hardenings (nicolas-grekas)
 * bug #64244 [Semaphore] Various fixes and hardenings (nicolas-grekas)
 * bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)
 * bug #64215 [Runtime] Fix TypeError when resolving untyped arguments (nicolas-grekas)
 * security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)
 * security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)
 * security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)
 * security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse` (alexandre-daubois)
 * security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)
 * security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)
 * security #cve-2026-45065 [Routing] Fix regex alternation anchoring in `UrlGenerator` requirement validation (alexandre-daubois)
 * security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)
 * security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)
 * security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)
 * security #cve-2026-45755 [Mailer][Mailtrap] Reject webhooks with missing or invalid HMAC signature (alexandre-daubois)
 * security #cve-2026-45756 [JsonPath] Cap regex backtracking in `match()`/`search()` to prevent ReDoS (alexandre-daubois)
 * security #cve-2026-45074 [Security] Require configuring trusted hosts when using CAS authentication (nicolas-grekas)
 * security #cve-2026-45075 [Security][HttpKernel] Fix HEAD requests bypassing methods filter in `IsGranted`, `IsCsrfTokenValid` and `IsSignatureValid` attributes (nicolas-grekas)
 * bug #64213 [Security] Fix impersonation being deauthenticated on every request (nicolas-grekas)

* 8.1.0-BETA2 (2026-05-13)

 * bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)
 * bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)
 * bug #64197 [Messenger] Ensure SigningSerializer won't decode before verifying the signature (nicolas-grekas)
 * bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)
 * bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)
 * bug #64191 [Inflector][String] Fixed singularize `traces` > `trace` (ruudk)
 * bug #64192 [Mailer] Use `hash_equals()` to compare webhook signatures for AhaSend (alexandre-daubois)
 * bug #64193 [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage (alexandre-daubois)
 * bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)
 * bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)
 * feature #61936 [Messenger] Allow to respect retry strategy with `RecoverableMessageHandlingException` (VincentLanglet)
 * bug #64182 [Console] Fix signal handler scoping (jpollard3)
 * bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)
 * bug #64058 [Process] Ignore array env values before proc_open (dionisvl)
 * bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)
 * bug #64176 [Console] Make `ConsoleSectionOutput::overwrite()` atomic to fix sections + ProgressIndicator clear (Amoifr)
 * feature #63770 [HttpClient] Add custom DNS resolution using a decorator (peter17)
 * bug #64158 [Form] Fix array_flip() warning in expanded+multiple ChoiceType on partial submit (SAY-5)
 * feature #64156 [Validator] Add findByCodes() to ConstraintViolationListInterface (michaelthieulin)
 * feature #64160 [HttpClient] Add $allowList argument to NoPrivateNetworkHttpClient (Amoifr)
 * feature #64163 [HttpClient] Log stale-if-error fallback in CachingHttpClient (ousamabenyounes)
 * bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)
 * bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)
 * bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)
 * bug #64172 [WebProfilerBundle] Don’t try to access `RawMessage::$headers` (MatTheCat)
 * bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)
 * feature #60298 [Messenger][Amqp] delayed quorum queues (Miquel Fontana, miquel-angel)
 * bug #64167 [Console] Add missing `symfony/polyfill-php85` dependency (Amoifr)

* 8.1.0-BETA1 (2026-05-06)

 * feature #63751 [DependencyInjection][HttpKernel] Add support for resetting non-shared services (Pechynho)
 * feature #63689 [Routing] Allow collection prefixes to disable trailing slash on root (vvaswani)
 * feature #62127 [RateLimiter] Add calendar-aligned mode to FixedWindowLimiter (Crovitche-1623)
 * feature #64118 [Security] Revert "Add per-username login rate-limit to prevent brute-force attacks" (wouterj)
 * feature #64094 [Messenger] Deprecate `StopWorkerOnTimeLimitListener` in favor of time_limit worker option (Toflar)
 * feature #64104 [Security] Add per-username login rate-limit to prevent brute-force attacks (ayyoub-afwallah)
 * feature #63862 [Console] Use ECH sequence for block padding (Amoifr)
 * feature #64087 [HttpKernel][VarDumper][WebProfilerBundle] Forward CSP nonce to dump() instead of disabling CSP (Amoifr)
 * feature #64079 [ErrorHandler] Trigger `@method` deprecation notices for abstract classes (lacatoire)
 * feature #46654 [Serializer] Add `COLLECT_EXTRA_ATTRIBUTES_ERRORS` and full deserialization path (NorthBlue333)
 * feature #62112 [Console] Add support for OSC 9;4 escape sequence for progress reporting (canvural)
 * feature #52173 [Serializer] Add `AbstractObjectNormalizer::ENABLE_TYPE_CONVERSION` for scalar type transformation (Jeroeny)
 * feature #60008 [HttpFoundation] Add SessionHasFlashMessage test constraint (Pierstoval)
 * feature #63810 [VarDumper] Dump class-strings as class stubs with source location and static properties (lyrixx)
 * feature #63929 [TwigBundle] Add `twig.safe_class` resource tag to register safe classes for the escaper (GromNaN)
 * feature #62801 [Notifier][Prelude] Add bridge  (zairigimad)
 * feature #63727 [Form] Use `translation_domain` for expanded `ChoiceType` placeholder (eyupcanakman)
 * feature #63762 [VarDumper] Add CSP nonce support to HtmlDumper (Amoifr)
 * feature #63809 [Workflow] Add support for dumping listeners in Graphviz diagrams (lyrixx)
 * feature #63879 [JsonStreamer] Add `DateTimeZone` value object support (mtarld)
 * feature #63905 [FrameworkBundle] Add --sort option to debug:router command (Michael Thieulin)
 * feature #63907 [RateLimiter] Add `#[RateLimit]` attribute to rate limit controllers declaratively (ayyoub-afwallah)
 * feature #63925 [MonologBridge] Add `$subjectMaxLength` option to MailerHandler (Amoifr)
 * feature #63945 [Validator] Make constraint validators reentrant instead of being stateful (stof)
 * feature #64055 [Runtime] Add FRANKENPHP_RESET_KERNEL to reset the kernel between requests (nicolas-grekas)
 * feature #63988 [DependencyInjection] Support autowiring env vars as closures or `Stringable` when using `#[Autowire(env: 'FOO')]` (nicolas-grekas)
 * feature #64070 [Messenger] Release deduplication lock on definitive failure (ousamabenyounes)
 * feature #63778 [Tui] Add the component (fabpot)
 * feature #64049 [VarExporter] Deprecate Hydrator and Instantiator classes (nicolas-grekas)
 * feature #64009  Improve phpdoc types (stof)
 * feature #63910 [DependencyInjection] Allow inline Definition as factory and configurator (GromNaN)
 * feature #63943 [WebProfilerBundle] Improve toolbar accessibility for screen reader (Nitram1123)
 * feature #63912 [JsonStreamer] Improve error message when unable to encode (GaryPEGEOT)
 * feature #63695 [VarExporter] Make `DeepCloner::__serialize()` return a pure array and add `toArray()`/`fromArray()` (nicolas-grekas)
 * feature #63880 [DependencyInjection] Add #[RequiredBundle], ServicesBundle and ConsoleBundle (nicolas-grekas)
 * feature #63877 [DependencyInjection] Add AddBehaviorDescribingTagsPass (nicolas-grekas)
 * feature #63875 [EventDispatcher] Add hot-path and no-preload support to AddEventAliasesPass (nicolas-grekas)
 * feature #63710 [DependencyInjection] Add Kernel and Bundle infrastructure for HTTP-less DI-powered apps (nicolas-grekas)
 * feature #63771 [Security] Add `enforce_key_usage_verification` option to OIDC discovery (ruudk)
 * feature #60334 [Twig] Add daisyUI form layout (Oviglo)
 * feature #63742 [JsonStreamer] Add `DateInterval` value object support (mtarld)
 * feature #63745 [FrameworkBundle][HttpKernel] Deprecate `Bundle::registerCommands()` (derrabus)
 * feature #63735 [JsonStreamer] Support date time timezone (mtarld)
 * feature #63714 [Console] Add validation constraints support to `#[MapInput]` (chalasr)
 * feature #63709 [Console] Add optional PSR container parameter to `Application` (nicolas-grekas)
 * feature #57598 [Console] Expose the original input arguments and options and to unparse options (theofidry)
 * feature #52134 [HttpKernel] Add option to map empty data with `MapQueryString` and `MapRequestPayload` (Jeroeny)
 * feature #41574 [Messenger] Add AmqpPriorityStamp for per-message priority on AMQP transport (Valentin Nazarov)
 * feature #63661 [Runtime] Add FrankenPhpWorkerResponseRunner for simple response return (guillaume-sainthillier)
 * feature #63666 [Messenger] Allow configuring the service reset interval in the `messenger:consume` command via the `--no-reset` option (nicolas-grekas)
 * feature #63665 [Messenger] Add `MessageExecutionStrategyInterface` and refactor `Worker` to use it (nicolas-grekas)
 * feature #63662 [Messenger] Add a `--fetch-size` option to the `messenger:consume` command to control how many messages are fetched per iteration (nicolas-grekas)
 * feature #63663 [Contracts] Add `ContainerAwareInterface` (nicolas-grekas)
 * feature #63631 [Form] Add `labels` option to DateType to customize year/month/day sub-field labels (guillaumeVDP)
 * feature #62823 [JsonPath] Add custom function support (alexandre-daubois)
 * feature #63590 [DependencyInjection] Add support for using service stacks as decorators (nicolas-grekas)
 * feature #63595 [ObjectMapper] Add `IsNotNull` built-in condition (Nayte91)
 * feature #63612 [VarExporter] Add `DeepCloner` for COW-friendly deep cloning (nicolas-grekas)
 * feature #51379 [HttpKernel] Adding new `#[MapRequestHeader]` attribute and resolver (StevenRenaux)
 * feature #63585 [Security] Deprecate erase_credentials config, container parameter and AuthenticatorManager constructor argument (guillaumeVDP)
 * feature #62029 [Mailer][SES] Allow configuring port and tls options (adars)
 * feature #63615 [Uid] Pass invalid UID value to `InvalidArgumentException` for better debug (rela589n)
 * feature #63339 [JsonStreamer] Handle value objects (mtarld)
 * feature #63383 [ObjectMapper] Allow class FQDN arrays as TargetClass and SourceClass param (rrajkomar)
 * feature #63520 [FrameworkBundle] Allow configuring Webhook's header names and signing algo (lacatoire)
 * feature #63593 [Uid] Add Uuid47Transformer support for UUIDv7/v4 conversion (nicolas-grekas)
 * feature #63528 [TypeInfo] Resolve tentative return types (valtzu)
 * feature #63546 [Console] Add outline-style block methods to SymfonyStyle (guillaumeVDP)
 * feature #63581 [FrameworkBundle][Messenger] Deprecate "senders" nesting level in routing config (W0rma)
 * feature #63441 [HttpClient] Default CachingHttpClient's $maxTtl to 86400s to prevent eternal cache items (Lctrs, nicolas-grekas)
 * feature #63541 [HttpFoundation] Deprecate setting public properties of `Request` and `Response` objects directly (nicolas-grekas)
 * feature #63552 [Runtime] Add `SymfonyRuntime::resolveType()` for customizing how types are resolved in extending runtimes (Kingdutch)
 * feature #63481 [ErrorHandler] Allow namespace remapping in DebugClassLoader to relax the "same vendor" constraint (mpdude)
 * feature #63524 [Translation][Crowdin] Replace deprecated Upload Translations method with Import Translations (bhdnb)
 * feature #63505 [FrameworkBundle] Deprecate `terminate_on_cache_hit` http_cache option (Mynyx)
 * feature #63538 [Console] Sort suggested commands alphabetically (javiereguiluz)
 * feature #63537 [Console] Replace executeCommand() by runCommand() when testing commands (javiereguiluz)
 * feature #45553 [Translation] Extract locale fallback computation into a dedicated class (mpdude)
 * feature #63433 [HttpClient] Add `GuzzleHttpHandler` that allows using Symfony HttpClient as a Guzzle handler (nicolas-grekas)
 * feature #63465 [Translation] Add support for XLIFF PGS (Plural, Gender, and Select Module) (alexandre-daubois)
 * feature #62888 [Messenger] Route decode failures through failure handling (nicolas-grekas)
 * feature #63453 [Console][WebProfilerBundle] Trace argument value resolvers (chalasr)
 * feature #52055 [Console] Deprecate combining incompatible mode flags in `InputArgument` and `InputOption` (jnoordsij)
 * feature #52058 [Console] Allow setting a boolean default value on `InputOption::VALUE_NEGATABLE` options (jnoordsij)
 * feature #45081 [Form] Add support for submitting forms with unchecked checkboxes in request handlers (filiplikavcan)
 * feature #63443 [Console] Add customization to SymfonyStyle progressBar (guillaumeVDP)
 * feature #63451 [PropertyInfo] Add support for property hook settable types (alexandre-daubois)
 * feature #63455 [Translation] Add support for XLIFF versions 2.1 and 2.2 (alexandre-daubois)
 * feature #63427 [WebLink] : Adding `const`s for `as` attributes (ThomasLandauer)
 * feature #63426 [DependencyInjection] Deprecate named autowiring alias that don't use `#[Target]` (nicolas-grekas)
 * feature #63429 [FrameworkBundle] Add `MicroKernelTrait::$allowedEnvs` to enforce allowed values for `APP_ENV` (vincentpabst)
 * feature #61494 [Console] Allow to test the different streams at the same time with a new result-based testing API for `CommandTester` (theofidry)
 * feature #63371 [Form] Add uid_format option to EntityType (lacatoire)
 * feature #61462 [Messenger] Add `ListableReceiverInterface` support to `RedisReceiver` (mudassaralichouhan)
 * feature #49388 [CssSelector] Add `:has()` support (franckranaivo)
 * feature #63242 [FrameworkBundle] Add decoration stack to `debug:container` command (ayyoub-afwallah)
 * feature #63373 [HttpFoundation] Add `BinaryFileResponse::shouldDeleteFileAfterSend()` (lacatoire)
 * feature #49518  Create `#[Serialize]` Attribute to serialize Controller Result (Koc)
 * feature #63355 [Validator] Add ValidatorBuilder::enablePropertyMetadataExistenceCheck() (lacatoire)
 * feature #63335 [TwigBridge] Add form_flow_* helper functions (ker0x)
 * feature #63356 [FrameworkBundle] Configure custom marshaller per cache pool (mvanduijker)
 * feature #63359 [Console] Allow passing Validator constraints to `QuestionHelper` and `#[Ask]` (chalasr)
 * feature #54817 [HttpKernel] Support variadic with `#[MapRequestPayload]` (DjordyKoert)
 * feature #63360 [Validator] Add clock-awareness to comparison and range validators (lacatoire)
 * feature #63346 [Messenger][AMQP] Allow disabling default queue binding via queues option (xammmue)
 * feature #52265 [HttpClient] Configure `MockClient` if mock_response_factory has been set on a scoped client (tarjei)
 * feature #63293 [Console] Add image support to `QuestionHelper` and `#[Ask]` (chalasr)
 * feature #47969 [Filesystem] rename `Filesystem::mirror()` option `copy_on_windows` to `follow_symlinks` (maxbeckers)
 * feature #58871 [Form] `BirthdayType` has automatic `attr` when `widget` is `single_text` (nicolas-grekas)
 * feature #59202 [Semaphore] Add a semaphore store based on locks (alexander-schranz)
 * feature #47666 [Messenger] Move PostgreSQL LISTEN/NOTIFY blocking to worker idle event listener (d-ph)
 * feature #62638 [DependencyInjection] Add tag decoration support (mtarld)
 * feature #62320 [WebProfiler] add cURL copy/paste to request tab (darkweak)
 * feature #63214 [Form] Allow `ViolationMapperInterface` injection for `ValidatorExtension` and `FormTypeValidatorExtension` (ktherage)
 * feature #63304 [Contracts][DependencyInjection] Support hooked properties in ServiceMethodsSubscriberTrait (derrabus)
 * feature #63277 [Messenger] Add idle timeout option to `BatchHandlerTrait` (HypeMC)
 * feature #61458 [HttpKernel] Validate typed request attribute values before calling controllers (mudassaralichouhan)
 * feature #63274 [HttpKernel] Add `ControllerEvent::evaluate()` et al. to help with evaluating expressions or closures in controller attributes (nicolas-grekas)
 * feature #63032 [HttpKernel] Dispatch events named after controller attributes (nicolas-grekas)
 * feature #63263 [FrameworkBundle][Lock] Scope semaphore and flock stores by project dir by default (nicolas-grekas)
 * feature #61457 [FrameworkBundle] Deprecate container parameters router.request_context.scheme and .host (stollr)
 * feature #63092 [HttpKernel] Expose controller metadata throughout the request lifecycle (nicolas-grekas)
 * feature #58273  Allow usage of expressions for defining validation groups in `#[MapRequestPayload]` (Brajk19)
 * feature #63201 [Security] Add `this` to `#[IsGranted]` subject expression vars when available (valtzu)
 * feature #63181 [DependencyInjection] Add `target` parameter to `#[AsAlias]` attribute (ayyoub-afwallah)
 * feature #53559 [DomCrawler] Allow to add choices to single select (norkunas)
 * feature #53998 [Security] Add retrieval of parent role names (PierreCapel)
 * feature #62875 [Messenger] Add regex support for transport name matching in `messenger:consume` command (santysisi)
 * feature #58732 [Finder] Allow finder to set the `UNIX_PATH` flag when recursing directories (Shane McKinley)
 * feature #62754 [ExpressionLanguage] Add support for null-safe syntax for array access (cancan101)
 * feature #57365 [Validator] Add `Xml` constraint (sfmok)
 * feature #58966 [Serializer] Trigger deprecation when could not parse date with default format (alexndlm)
 * feature #57769 [Notifier] [Telegram] Add support for local API server (ahmedghanem00)
 * feature #57653 [FrameworkBundle] Allow default action in HtmlSanitizer configuration (Neirda24)
 * feature #54866 [Messenger] Added the ability to force `RedisCluster` (adideas)
 * feature #63130 [Console] Add TesterTrait::assertCommandFailed and TesterTrait::assertCommandIsInvalid helpers (darovic)
 * feature #63095 [FrameworkBundle] Add shortcut to run console command in tests (Koc)
 * feature #63097 [Security] Decouple `SameOriginCsrfTokenManager` from event listening (jprivet-dev)
 * feature #62599 [FrameworkBundle][JsonStreamer] Add default options (mtarld)
 * feature #63061 [Messenger] Add support for custom `type` in `Serializer` Transport (lyrixx)
 * feature #62885 [TypeInfo] Allow resolving object shapes (bnf)
 * feature #63183 [Console] Allow object as default for input options and arguments (chalasr)
 * feature #63157 [Security] Add support for enums in `SignatureHasher::computeSignatureHash()` (nicolas-grekas)
 * feature #63024 [ObjectMapper] Add `targetClass` on `MapCollection` transform (soyuka)
 * feature #63111 [DependencyInjection] Add argument `exclude` to `ContainerConfigurator::import()` (tilaven)
 * feature #63135 [Scheduler] Add option to order recurring messages by next run date in debug command (yoye)
 * feature #62434 [HttpKernel] deprecate the `Extension` class (xabbuh)
 * feature #63059 [Semaphore] Add `SemaphoreKeyNormalizer` (clegginabox)
 * feature #62909 [FrameworkBundle] Enable mocking non-shared services in tests (HypeMC)
 * feature #62751 [HttpClient] Add support of the persistent cURL handles (Koc)
 * feature #63121 [Translation][FramworkBundle] Allow using env vars in the list of enabled locales (nicolas-grekas)
 * feature #62566 [FrameworkBundle] Add `AbstractController::createFormFlowBuilder` (silasjoisten)
 * feature #62917 [Console] Add ArgumentResolver (chalasr)
 * feature #63090 [HttpKernel] Return attributes as a flat list when using `Controller[Arguments]Event::getAttributes(*)` (nicolas-grekas)
 * feature #63039 [PhpUnitBridge] add logic for checking for dist.xml, xml.dist and xml phpunit config (gennadigennadigennadi)
 * feature #62941 [HttpKernel] Allow the `Cache` attribute to be applied conditionally (HypeMC)
 * feature #62511 [ObjectMapper] merge nested properties when targeting the same class (soyuka)
 * feature #62835 [DependencyInjection] Allow environment variables with `.` in them (Max Baldanza)
 * feature #62957 [ObjectMapper] Throw exception for invalid transform callable (calm329, Asenar)
 * feature #62522 [FrameworkBundle][ObjectMapper] Add automatic class-map array based on map attributes (Orkin)
 * feature #63023 [Uid] Add argument `$format` to `Ulid::isValid()` (mms-uret)
 * feature #62854 [HttpClient] Add support for the `max_connect_duration` option (alexandre-daubois)
 * feature #62940 [HttpKernel] Allow using closures with the `Cache` attribute (HypeMC)
 * feature #62925 [HttpKernel] Deserialize `UploadedFile` for `#[MapRequestPayload]` (Grafikart)
 * feature #62911 [Console] Add `#[AskChoice]` attribute for interactive choice questions (yceruto)
 * feature #62939 [HttpKernel] Improve `Cache` attribute expression vars (HypeMC)
 * feature #62850 [HttpKernel] Decouple controller attributes from source code and add `ResponseEvent::getControllerAttributes()` (nicolas-grekas)
 * feature #62567 [Console] Add support for method-based commands (yceruto)
 * feature #62538 [HttpKernel] Add support for `SOURCE_DATE_EPOCH` environment variable (Charles-Édouard Coste)
 * feature #62824 [DependencyInjection][SecurityBundle] Leverage `#[AsTaggedItem]` for voters (ayyoub-afwallah)
 * feature #62339 [DependencyInjection] Deprecate default index/priority methods when defining tagged locators/iterators (nicolas-grekas)
 * feature #62792 [DoctrineBridge] Deprecate `RegisterMappingsPass::$aliasMap` (GromNaN)
 * feature #62800 [HttpKernel] Add support for bundles as compiler passes (yceruto)
 * feature #62578 [Form] Add reset button in `NavigatorFlowType` (Nayte91)
 * feature #62572 [Messenger] Use clock in `DelayStamp` and `RedeliveryStamp` instead of native time classes and methods (bluemmb)
 * feature #62483 [DependencyInjection] Deprecate invalid options when using `from_callable` (yoeunes)
 * feature #60372 [Mailer][SendGrid] add support for scheduling delivery via `send_at` API parameter (Mickael GOETZ, MrMitch)
 * feature #62322 [Security] add missing `Clear-Site-Data` directives (xabbuh)
 * feature #62390 [Mailer] Add support of ipPoolId for infobip mailer transport (jbdelhommeau)