What changed in Symfony from 7 to 8

Changelog (https://github.com/symfony/symfony/compare/v8.1.5...v8.1.6)

• bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
• bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
• bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65728 [Routing] Fix matching the "0" URL (@cs278)
• bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug #65721 [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
• bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
• bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
• bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
• bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
• bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
• bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
• bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
• bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• bug #65697 [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
• minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
• minor #65665 [Validator] fix comment for Url requireTld argument (@dmitryuk)
• bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor #65657 [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
• bug #65656 [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
• minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor #65646 Review translations for Estonian (et) (@erkia)
• bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug #65640 [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
• bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
• minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
• minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug #65632 [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
• bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• bug #65613 [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
• minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
• bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor #65587 [Validator] Review Urdu translations (@UmairRathore)
• bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
• bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
• data #64370 Release v5.4.53

Changelog (https://github.com/symfony/symfony/compare/v8.1.4...v8.1.5)

• bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas)
• bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas)
• minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum)
• bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (@nicolas-grekas)
• bug #65514 [Messenger] Tell apart handler services that share the same class (@nicolas-grekas)
• minor #65583 [Validator] Review Croatian translations (@HypeMC)
• bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (@nicolas-grekas)
• bug #65584 [Form] Map violations to child forms named after the snake cased property (@nicolas-grekas)
• bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (@nicolas-grekas)
• bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (@llupa)
• bug #65455 [Console] Do not resolve core utility parameters as command input (@lazerg)
• bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (@nicolas-grekas)
• bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (@nicolas-grekas)
• bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (@nicolas-grekas)
• bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (@nicolas-grekas)
• bug #65532 [DependencyInjection] Keep escaping when resolving values against a resolved parameter bag (@nicolas-grekas)
• bug #65530 [Form] Apply the configured rounding mode when no scale is set (@nicolas-grekas)
• bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (@nicolas-grekas)
• bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (@nicolas-grekas)
• bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (@nicolas-grekas)
• bug #65519 [DomCrawler] Detect the charset from meta tags only (@nicolas-grekas)
• bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (@nicolas-grekas)
• bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (@nicolas-grekas)
• bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (@nicolas-grekas)
• bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (@nicolas-grekas)
• bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (@nicolas-grekas)
• bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug #65508 [Intl] Follow the ICU parent locale when falling back (@nicolas-grekas)
• bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (@nicolas-grekas)
• bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (@nicolas-grekas)
• bug #65502 [Security] Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (@nicolas-grekas)
• bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (@nicolas-grekas)
• bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (@nicolas-grekas)
• bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (@nicolas-grekas)
• bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (@nicolas-grekas)
• bug #65498 [Process] Do not wait for output when the input iterator has more data (@nicolas-grekas)
• bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (@nicolas-grekas)
• bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (@nicolas-grekas)
• bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (@nicolas-grekas)
• bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (@nicolas-grekas)
• bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (@nicolas-grekas)
• bug #65487 [Messenger] Fail when messenger:consume is given no receiver (@nicolas-grekas)
• bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (@nicolas-grekas)
• bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (@nicolas-grekas)
• bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (@nicolas-grekas)
• bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (@nicolas-grekas)
• bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (@nicolas-grekas)
• bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (@nicolas-grekas)
• bug #65479 [Form] Fix generating the CSRF token when the form attributes are replaced (@nicolas-grekas)
• bug #65474 [DependencyInjection] Fix compiling nested service locators (@nicolas-grekas)
• bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (@nicolas-grekas)
• bug #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (@nicolas-grekas)
• minor #65574 [Validator] Update Albanian translations (@llupa)
• bug #65528 [Security] Track session usage when a lazy firewall reads the token (@nicolas-grekas)
• bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (@nicolas-grekas)
• bug #65523 [PropertyInfo] Use the same mutator method for types and write info (@nicolas-grekas)
• bug #65520 [BrowserKit] Return the most specific cookie when several ones match (@nicolas-grekas)
• bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (@nicolas-grekas)
• bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (@nicolas-grekas)
• bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (@nicolas-grekas)
• minor #65577 Add skill to merge PRs (@nicolas-grekas)
• minor #65571 [Validator] Review Brazilian Portuguese translations (@henriquejsza)
• bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (@nicolas-grekas)
• minor #65572 [Validator] Review French translations (@Amoifr)
• bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (@lazerg)
• bug #65500 [Console] Keep backslashes preceding < and > when escaping text (@nicolas-grekas)
• bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (@nicolas-grekas)
• bug #65477 [Finder] Do not report dangling symlinks as both files and directories (@nicolas-grekas)
• bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (@nicolas-grekas)
• bug #65471 [Console] Fix clearing more lines than a section holds (@nicolas-grekas)
• bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (@nicolas-grekas)
• bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (@nicolas-grekas)
• bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (@nicolas-grekas)
• bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (@lazerg)
• bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (@nicolas-grekas)
• bug #65535 [Tui] Stop delivering the rest of an over-cap paste as key events (@nicolas-grekas, @fabpot)
• bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (@nicolas-grekas)
• bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (@wazum)
• bug #65475 [ErrorHandler] Don't autoload when resolving "@return" class constants (@nicolas-grekas)
• bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (@nicolas-grekas)
• bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (@nicolas-grekas)
• bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (@nicolas-grekas)
• minor #65453 [Validator] Add the EntityExists and Ulid message translation units (@nicolas-grekas)
• bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (@lazerg)
• bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (@nicolas-grekas)
• bug #65441 [DependencyInjection] Skip abstract classes and interfaces in findTaggedResourceIds() (@nicolas-grekas)
• bug #65416 [Tui] Batch of bug fixes (@sadiqk2, @nicolas-grekas)
• bug #65291 [Serializer] Enforce the element type of scalar collections (@nicolas-grekas)
• bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (@nicolas-grekas)
• bug #65429 [Cache] Fix numeric string keys being cast to integers (@nicolas-grekas)
• bug #65425 [Yaml] Fix parsing an alias followed by a comment (@eyupcanakman)
• bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (@nicolas-grekas)
• bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (@Nitram1123)
• bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)
• bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (@nicolas-grekas)
• bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (@eyupcanakman)
• bug #65388 [Notifier][Mercure] Add support for Mercure 0.8 (@lazerg)
• bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (@nicolas-grekas)
• bug #65391 [DomCrawler] Read the whole content of a textarea (@nicolas-grekas)
• bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (@nicolas-grekas)
• bug #65385 [ObjectMapper] Allow #[Map] on abstract classes (@nicolas-grekas)
• bug #65379 [DoctrineBridge] Fix explicit MapEntity mapping being overwritten by a route mapping (@nicolas-grekas)
• bug #65365 [Yaml] Restore the default dump output for sequences of mappings (@eissasoubhi)
• bug #65366 [ObjectMapper] Only honor an explicitly inbound target #[Map] for the same-name copy (@soyuka)
• bug #65376 [Validator] Allow a literal # in the fragment part of Url (@lazerg)
• minor #65378 Add an agent skill for authoring pull requests (@nicolas-grekas)
• bug #65371 [Translation] Read CSV translations without SplFileObject (@nicolas-grekas)
• bug #65372 [HttpFoundation] Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65367 Fix PHP 8.6 deprecations (@nicolas-grekas)
• bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (@tomsommer)
• bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (@ousamabenyounes)
• bug #65347 [Tui] Ignore arbitrary hex lengths Color cannot use (@sadiqk2)
• bug #65354 [Serializer] Throw on XML data without a root node (@nicolas-grekas)
• bug #65344 [Tui] Keep horizontal layout inside the available columns (@sadiqk2)
• bug #65341 [Tui] Enforce the paste cap when the end marker is split across reads (@sadiqk2)
• bug #65330 [Tui] Stop a column slice at a wide character instead of taking later columns (@sadiqk2)
• bug #65331 [Tui] Match ctrl+alt+ in its CSI u encoding too (@sadiqk2)
• bug #65321 [Console] Resolve UIDs whatever their format (@MatTheCat)
• bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (@nicolas-grekas)
• bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (@nicolas-grekas)
• bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (@nicolas-grekas)
• minor #65310 [HttpClient] Remove unused code in AsyncResponse::__destruct() (@lyrixx)
• bug #65309 [VarExporter] Split Exporter::export() so it stops crashing the PHP 8.5 JIT compiler (@petrdobr)
• bug #65305 [Messenger] Handle synchronous batch nack (@eissasoubhi)
• bug #65303 [FrameworkBundle] Do not leak the response body from assertResponseRedirects() when not verbose (@nicolas-grekas)
• bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (@eissasoubhi)
• bug #65294 [ObjectMapper] Fix reusing an already mapped object for a different target (@ousamabenyounes)
• bug #62352 [Serializer] Convert the elements of scalar collections (@nicolas-grekas)
• minor #65290 [FrameworkBundle] Tolerate a newer DependencyInjection InstanceofType shape in the reference fixture (@nicolas-grekas)
• bug #65288 [Cache] Fix stampede protection not being disabled on CLI (@nicolas-grekas)
• bug #65280 [FrameworkBundle] Wire the webhook request parser with the configured header names (@nicolas-grekas)
• bug #65274 [Mailer][Notifier] Avoid retaining messages without the profiler (@eissasoubhi)
• bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (@nicolas-grekas)
• bug #65276 [Tui] Clamp borders that do not fit their container (@nicolas-grekas)
• bug #65271 [DependencyInjection] Fix circular references through expressions (@eissasoubhi)
• bug #65273 [Notifier][Sevenio] Fix successful sends being reported as failures (@lazerg)
• bug #65266 [Tui] Track descendant positions of cached horizontal layout children (@fabpot)
• bug #65275 [PropertyInfo] Ignore methods that only look like accessors (@nicolas-grekas)
• bug #65268 [Tui] Reuse cached subtrees during vertical layout (@fabpot)
• bug #65263 [Console] Keep falsy answers when collecting an array with #[Ask] (@sadiqk2)
• bug #65264 [Mime] Do not drop the last line of a resource-backed message (@sadiqk2)
• bug #65265 [Uid] Compare times by value in MockUuidFactory (@sadiqk2)
• bug #65262 [AssetMapper] Include front controller in dev asset URLs (@eissasoubhi)
• bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (@bhavin-nakrani)
• bug #65255 [Tui] Fix column width accounting (@sadiqk2)
• bug #65254 [Tui] Fix stdin framing and key id decoding (@sadiqk2)
• bug #65258 [Console] Restore the catchExceptions state after running a command message (@KevinMartinsDev)
• bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65250 [DependencyInjection] Fix class-level tag attributes being overridden by interface-level ones (@nicolas-grekas)
• bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (@javiereguiluz)
• bug #65240 [WebProfilerBundle] move macros to the template root (@xabbuh)
• bug #65242 [Console] Fix parsing #[Target] attribute on arguments of invokable commands (@HypeMC)
• bug #65245 [Tui] Treat a zero terminal size as unknown (@Bosun18)
• bug #65244 [Tui] Fix stop() scrolling the top of the frame off the screen (@Bosun18)
• bug #65239 [Console] Fix terminator handling in the image protocols (@nicolas-grekas)
• bug #65196 [Console] Fix decoding chunked Kitty graphics payloads (@sadiqk2)
• bug #65197 [Console] Fix writing one-shot iterables to a CombinedOutput (@sadiqk2)

Changelog (https://github.com/symfony/symfony/compare/v8.1.3...v8.1.4)

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65174 [Tui] Keep ANSI codes ordered when slicing across a color change (@smnandre)
• bug #65177 [HttpClient] Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 (@peter17)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65150 [Tui] Render raw HTML in MarkdownWidget instead of dropping it (@lazerg)
• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
• bug #65149 [DependencyInjection] Resolve factories on "service_container" against the concrete container class (@lazerg)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65122 [Messenger] Re-send original payload when retrying undecodable messages (@SystematicCZ)
• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
• bug #65105 [Uid] Fix the weak-secret guard in Uuid47Transformer for secrets longer than 16 bytes (@semx)
• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
• bug #65085 [Messenger] Stop the PostgreSQL transport from blocking the worker loop (@bzajacc)
• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (@alexisLefebvre)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #64696 [Config] Generate unsealed array shapes for any normalizers (@ousamabenyounes)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (@nicolas-grekas)

Changelog (https://github.com/symfony/symfony/compare/v8.1.2...v8.1.3)

• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

Changelog (https://github.com/symfony/symfony/compare/v8.0.15...v8.0.16)

• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

Changelog (https://github.com/symfony/symfony/compare/v8.1.1...v8.1.2)

• bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois)
• bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas)
• bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas)
• bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas)
• bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas)
• bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas)
• bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas)
• bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas)
• bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas)
• bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas)
• bug #64999 [DependencyInjection] Restore reading "container.behavior_describing_tags" in DecoratorServicePass (@nicolas-grekas)
• bug #65008 [HttpKernel] Fix the escaping of the generated curl command (@nicolas-grekas)
• bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas)
• bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• minor #65000 Review Italian validator translations (@JJordan0C)
• bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes)
• bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz)
• bug #64986 [HttpKernel] Fix the curl command when a cookie holds an array (@maximilian-walter)
• bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz)
• minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan)
• bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki)
• bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox)
• bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas)
• bug #64978 [Messenger] Reject a serialized type name that is another message's class name (@nicolas-grekas)
• bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev)
• bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert)
• bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies)
• bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas)
• bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx)
• bug #64903 [Console] Reduce buffer reallocations in FileInputHelper paste detection (@jorgsowa)
• bug #64661 [FrameworkBundle] Register the argument resolver in ConsoleCommandAssertionsTrait::runCommand (@fracsi)
• bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas)
• bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy)
• bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy)
• bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy)
• bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay)
• minor #64950 [Form][Validator] Updated danish translations (@jekuaitk)
• bug #64863 [FrameworkBundle] Keep transport decorators when mock_response_factory is set (@alexndlm)
• bug #64864 [HttpKernel] Keep converting scalars of a form payload that carries an uploaded file (@Amoifr)
• bug #64825 [PhpUnitBridge] fix finding given config file name (@YumeNikki101)
• bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (@Amoifr)
• bug #64781 [ObjectMapper] Keep the class-level transform/if of the target's #[Map] in the reverse class-map factory (@Orkin)
• minor #64664 [Form] Document the hidden placeholder of required ChoiceType fields (@lacatoire)
• bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (@Amoifr)
• bug #64868 [Messenger] Avoid redispatching messages from completed batches (@Gaitholabi)
• bug #64835 [WebProfilerBundle] Fix crash when injecting the toolbar in a BinaryFileResponse (@Fuck4ik)
• bug #64659 [Console] Strip terminal control characters from displayed file names (@iliaal)
• bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal)
• bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64670 [Config] Accept env placeholders for scalar alternatives in generated array-shapes (@yvh)
• bug #64938 [Messenger] Do not reject unknown types when no message requires signing (@pokki-deploy)
• bug #64935 [PropertyInfo] Ignore mutators with several required parameters (@pokki-deploy)
• bug #64937 [Validator] Allow Traverse to be inherited (@MatTheCat)
• minor #64940 [Validator] Fix missing Tagalog (tl) translations (@QuantumBreakz)
• minor #64943 [Filesystem] Handle PHP 8.6 removing function arguments in error messages (@MatTheCat)
• bug #64654 [Validator] Merge target's own constraints when using #[ExtendsValidationFor] (@pokki-deploy)
• bug #64708 [DependencyInjection] Fix lazy + factory service with a leading-backslash class on PHP 8.4 (@Amoifr)
• minor #64740 [Serializer] Skip XmlEncoderTest::testEncodeException() when using libxml ≥ 2.13 (@MatTheCat)
• bug #64751 [FrameworkBundle] Make WebTestCase enable web mode by default (@MatTheCat)
• bug #64770 [ObjectMapper] Fix explicit #[Map(target:)] being overwritten by a same-name source property (@danielpilot)
• bug #64801 [Validator] Allow null groups in ConstraintValidatorTestCase (@sjh9714)
• bug #64828 [DependencyInjection] Add supported literal option not_found for imports.[*].ignore_errors in services.schema and AppReference (@kaznovac)
• bug #64831 [FrameworkBundle] Fix valkey cache adapters ignoring default_valkey_provider (@lazerg)
• minor #64845 [Validator] Add return type annotations to Validation::createCallable() (@rela589n)
• bug #64848 [ObjectMapper] Fix per-property #[Map(source:)] being ignored when the target property name also exists on the source (@Amoifr)
• bug #64934 [HttpClient] Do not stream empty PSR-18 request bodies (@pokki-deploy)
• bug #64931 [TwigBridge] prevent implicit string casts for translatable message objects (@xabbuh)
• bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (@Amoifr)
• bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (@pkranjcecx)
• bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (@pokki-deploy)
• bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (@Amoifr)
• bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (@jnahmias)
• bug #64727 [Routing] Detect circular references in object route parameters (@Amoifr)
• bug #64932 Do not expose the BundleAdapter class in the kernel.bundles parameter (@mpdude)
• bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (@eyupcanakman)
• minor #64816 Allow Twig 4 (@xabbuh)
• bug #64843 [Console] Fix table borders around colspan cells and header-less tables (@wazum)
• bug #64930 Handle PHP 8.6 removing function arguments in error messages (@MatTheCat)
• bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (@semx)
• bug #64822 [Config] Escape "*/" in generated array-shape comments (@lazerg)
• bug #64857 [Config] Escape comment-closing sequence in generated config builders (@sadiqk2)
• bug #64886 [Console] Fix two ValueError crashes on multibyte / multi-column widths (@sadiqk2)
• bug #64887 [Cache] Initialize PhpArrayAdapter before classifying keys in deleteItems() (@sadiqk2)
• bug #64897 [Messenger][AmazonSqs] Fix fatal on shutdown when the in-flight receive cannot be resumed (@vadimgodev)
• bug #64904 [ErrorHandler] Fix fatal error without args triggering an error when calling getTraceFromString (@timacdonald)
• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (@guillaumedelre)
• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (@guillaumedelre)
• bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strings (@eyupcanakman)
• bug #64668 [DependencyInjection] Fix env var reported as never used for a removed autowired service (@eyupcanakman)
• minor #64882 [Form][Security][Validator] Finalize Urdu (ur) translations (@sadiqk2)
• bug #64915 [Yaml] Fix parsing and dumping of NaN (@semx)
• bug #64918 [String] Fix AsciiSlugger::getLocale() TypeError with no locale set (@eyupcanakman)
• bug #64920 [Validator] add missing inherited options to Video constraint (@xabbuh)
• minor #64900 Fix deprecation info about Response::sendHeaders in UPDGRADE-7.4.md (@pableu)
• bug #64891 [TwigBridge] ensure that a label with value "0" is rendered (@xabbuh)
• bug #64889 [HttpClient] Replace the native "dechunk" stream filter with a pure PHP implementation (@nicolas-grekas)
• bug #64898 [Cache] Remove obsolete return instruction from classes constructors (@cedric-anne)
• bug #64895 [Dotenv] Allow multiple underscores at start (@Sajito)
• bug #64884 Fix/webprofiler mailer macros 6.4 (@HecFranco)
• bug #64877 [Validator] Reject misplaced "X" character in ISBN-10 validation (@semx)
• bug #64856 [Console] Fall back to "stty sane" when restoring the captured terminal state fails (@lyrixx)
• minor #64736 i18n(fr): improve French validator translations (symfony#64680) (@Boomwerk)
• bug #64649 [Serializer] Fix support check for nested array items (@nicolas-grekas)
• minor #64821 [Form][Security][Validator] Review Bosnian (bs) translations (@pkranjcecx)
• minor #64854 [Validator] Add missing French (fr) translation for cron expression (@sadiqk2)
• bug #64827 jitter shouldn't make scheduler miss runs (@mrossard)
• minor #64834 [Validator] Review Russian (ru) translation (@Fuck4ik)
• bug #64840 [Tui] Repaint the full screen on resize so multiplexer reattaches are not blank (@fabpot)
• bug #64849 [Console] Fix SymfonyStyle questions when using output sections (@javiereguiluz)
• minor #64809 [Validator] fix Basque IBAN placeholder casing in BIC mismatch message (@munzzyy)
• minor #64808 [Validator] fix Turkish placeholder name in divisible-by message (@munzzyy)
• minor #64807 [Validator] fix Galician placeholder name in collection divisible-by message (@munzzyy)
• minor #64806 [Validator] fix Azerbaijani placeholder name in divisible-by message (@munzzyy)
• minor #64805 [Validator] fix Traditional Chinese min/max placeholder swap in image messages (@munzzyy)
• minor #64804 [Validator] fix Finnish height placeholder in image constraint message (@munzzyy)
• minor #64803 [Validator] fix Welsh height placeholder in image constraint messages (@munzzyy)
• minor #64810 [Validator] fix Arabic ratio placeholder in image ratio-too-small message (@munzzyy)
• minor #64811 [Security][Validator] fix broken Armenian placeholders (@munzzyy)
• bug #64797 [Notifier] add handling for the Prelude bridge to UnsupportedSchemeException (@xabbuh)
• bug #64815 [Cache] Remove always-true method_exists() check in FilesystemCommonTrait::__destruct() (@munzzyy)
• bug #64794 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (@MatTheCat)
• minor #64796 [Validator] fix Finnish translation for BIC/IBAN mismatch message (@munzzyy)
• bug #64778 [Console] Fix #[MapDateTime] arguments resolved as strings by BuiltinTypeValueResolver (@serhiilabs)
• minor #64793 [Validator] Review Arabic translation (@ayyoub-afwallah)
• minor #64792 [Form][Validator] Review Brazilian Portuguese translations (@joao-ramajo)
• bug #64791 [Tui] Fix wrapping lines that end with whitespace followed by ANSI codes exceeding the width (@fabpot)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 [HttpFoundation] Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• minor #64784 [Form][Validator] Review Uzbek (uz) translations (@lazerg)
• bug #64739 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (@MatTheCat)
• minor #64713 [Translation][Validator] Update Chinese (zh-TW) translations (@Link1515)
• minor #64737 [Form][Security][Validator] Improve Croatian translations (@HypeMC)
• minor #64755 [Validator] Review Albanian translations (@gazi04)
• bug #64752 [Yaml] Fix parsing of integers with a leading plus sign (@eyupcanakman)
• minor #64744 [Contracts] Set splitsh tag_skip strategy to no_commit (@fabpot)
• minor #64742 [Form][Validator] review German translations (@xabbuh)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)
• bug #64734 [Filesystem] Trim trailing whitespace from the tempnam() prefix (@Amoifr)
• bug #64732 [String] Fix splice() on multibyte strings (@eyupcanakman)
• minor #64733 [Validator] Review Croatian translations (@HypeMC)
• data #64730 Release v8.0.14
• data #64729 Release v7.4.14
• data #64728 Release v6.4.42

Changelog (https://github.com/symfony/symfony/compare/v8.0.14...v8.0.15)

• bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois)
• bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas)
• bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas)
• bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas)
• bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas)
• bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas)
• bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas)
• bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas)
• bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas)
• bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas)
• bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas)
• bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• minor #65000 Review Italian validator translations (@JJordan0C)
• bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes)
• bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz)
• bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz)
• minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan)
• bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki)
• bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox)
• bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas)
• bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev)
• bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert)
• bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies)
• bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas)
• bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx)
• bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas)
• bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy)
• bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy)
• bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy)
• bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay)
• minor #64950 [Form][Validator] Updated danish translations (@jekuaitk)
• bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (@Amoifr)
• bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (@Amoifr)
• bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal)
• bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64670 [Config] Accept env placeholders for scalar alternatives in generated array-shapes (@yvh)
• bug #64938 [Messenger] Do not reject unknown types when no message requires signing (@pokki-deploy)
• bug #64935 [PropertyInfo] Ignore mutators with several required parameters (@pokki-deploy)
• bug #64937 [Validator] Allow Traverse to be inherited (@MatTheCat)
• minor #64940 [Validator] Fix missing Tagalog (tl) translations (@QuantumBreakz)
• minor #64943 [Filesystem] Handle PHP 8.6 removing function arguments in error messages (@MatTheCat)
• bug #64654 [Validator] Merge target's own constraints when using #[ExtendsValidationFor] (@pokki-deploy)
• bug #64708 [DependencyInjection] Fix lazy + factory service with a leading-backslash class on PHP 8.4 (@Amoifr)
• minor #64740 [Serializer] Skip XmlEncoderTest::testEncodeException() when using libxml ≥ 2.13 (@MatTheCat)
• bug #64751 [FrameworkBundle] Make WebTestCase enable web mode by default (@MatTheCat)
• bug #64770 [ObjectMapper] Fix explicit #[Map(target:)] being overwritten by a same-name source property (@danielpilot)
• bug #64801 [Validator] Allow null groups in ConstraintValidatorTestCase (@sjh9714)
• bug #64828 [DependencyInjection] Add supported literal option not_found for imports.[*].ignore_errors in services.schema and AppReference (@kaznovac)
• bug #64831 [FrameworkBundle] Fix valkey cache adapters ignoring default_valkey_provider (@lazerg)
• minor #64845 [Validator] Add return type annotations to Validation::createCallable() (@rela589n)
• bug #64848 [ObjectMapper] Fix per-property #[Map(source:)] being ignored when the target property name also exists on the source (@Amoifr)
• bug #64934 [HttpClient] Do not stream empty PSR-18 request bodies (@pokki-deploy)
• bug #64931 [TwigBridge] prevent implicit string casts for translatable message objects (@xabbuh)
• bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (@Amoifr)
• bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (@pkranjcecx)
• bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (@pokki-deploy)
• bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (@Amoifr)
• bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (@jnahmias)
• bug #64727 [Routing] Detect circular references in object route parameters (@Amoifr)
• bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (@eyupcanakman)
• minor #64816 Allow Twig 4 (@xabbuh)
• bug #64843 [Console] Fix table borders around colspan cells and header-less tables (@wazum)
• bug #64930 Handle PHP 8.6 removing function arguments in error messages (@MatTheCat)
• bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (@semx)
• bug #64822 [Config] Escape "*/" in generated array-shape comments (@lazerg)
• bug #64857 [Config] Escape comment-closing sequence in generated config builders (@sadiqk2)
• bug #64886 [Console] Fix two ValueError crashes on multibyte / multi-column widths (@sadiqk2)
• bug #64887 [Cache] Initialize PhpArrayAdapter before classifying keys in deleteItems() (@sadiqk2)
• bug #64897 [Messenger][AmazonSqs] Fix fatal on shutdown when the in-flight receive cannot be resumed (@vadimgodev)
• bug #64904 [ErrorHandler] Fix fatal error without args triggering an error when calling getTraceFromString (@timacdonald)
• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (@guillaumedelre)
• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (@guillaumedelre)
• bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strings (@eyupcanakman)
• bug #64668 [DependencyInjection] Fix env var reported as never used for a removed autowired service (@eyupcanakman)
• minor #64882 [Form][Security][Validator] Finalize Urdu (ur) translations (@sadiqk2)
• bug #64915 [Yaml] Fix parsing and dumping of NaN (@semx)
• bug #64918 [String] Fix AsciiSlugger::getLocale() TypeError with no locale set (@eyupcanakman)
• bug #64920 [Validator] add missing inherited options to Video constraint (@xabbuh)
• minor #64900 Fix deprecation info about Response::sendHeaders in UPDGRADE-7.4.md (@pableu)
• bug #64891 [TwigBridge] ensure that a label with value "0" is rendered (@xabbuh)
• bug #64889 [HttpClient] Replace the native "dechunk" stream filter with a pure PHP implementation (@nicolas-grekas)
• bug #64898 [Cache] Remove obsolete return instruction from classes constructors (@cedric-anne)
• bug #64895 [Dotenv] Allow multiple underscores at start (@Sajito)
• bug #64884 Fix/webprofiler mailer macros 6.4 (@HecFranco)
• bug #64877 [Validator] Reject misplaced "X" character in ISBN-10 validation (@semx)
• bug #64856 [Console] Fall back to "stty sane" when restoring the captured terminal state fails (@lyrixx)
• minor #64736 i18n(fr): improve French validator translations (symfony#64680) (@Boomwerk)
• bug #64649 [Serializer] Fix support check for nested array items (@nicolas-grekas)
• minor #64821 [Form][Security][Validator] Review Bosnian (bs) translations (@pkranjcecx)
• minor #64854 [Validator] Add missing French (fr) translation for cron expression (@sadiqk2)
• bug #64827 jitter shouldn't make scheduler miss runs (@mrossard)
• minor #64834 [Validator] Review Russian (ru) translation (@Fuck4ik)
• bug #64849 [Console] Fix SymfonyStyle questions when using output sections (@javiereguiluz)
• minor #64809 [Validator] fix Basque IBAN placeholder casing in BIC mismatch message (@munzzyy)
• minor #64808 [Validator] fix Turkish placeholder name in divisible-by message (@munzzyy)
• minor #64807 [Validator] fix Galician placeholder name in collection divisible-by message (@munzzyy)
• minor #64806 [Validator] fix Azerbaijani placeholder name in divisible-by message (@munzzyy)
• minor #64805 [Validator] fix Traditional Chinese min/max placeholder swap in image messages (@munzzyy)
• minor #64804 [Validator] fix Finnish height placeholder in image constraint message (@munzzyy)
• minor #64803 [Validator] fix Welsh height placeholder in image constraint messages (@munzzyy)
• minor #64810 [Validator] fix Arabic ratio placeholder in image ratio-too-small message (@munzzyy)
• minor #64811 [Security][Validator] fix broken Armenian placeholders (@munzzyy)
• bug #64815 [Cache] Remove always-true method_exists() check in FilesystemCommonTrait::__destruct() (@munzzyy)
• bug #64794 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (@MatTheCat)
• minor #64796 [Validator] fix Finnish translation for BIC/IBAN mismatch message (@munzzyy)
• minor #64793 [Validator] Review Arabic translation (@ayyoub-afwallah)
• minor #64792 [Form][Validator] Review Brazilian Portuguese translations (@joao-ramajo)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 [HttpFoundation] Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• minor #64784 [Form][Validator] Review Uzbek (uz) translations (@lazerg)
• bug #64739 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (@MatTheCat)
• minor #64713 [Translation][Validator] Update Chinese (zh-TW) translations (@Link1515)
• minor #64737 [Form][Security][Validator] Improve Croatian translations (@HypeMC)
• minor #64755 [Validator] Review Albanian translations (@gazi04)
• bug #64752 [Yaml] Fix parsing of integers with a leading plus sign (@eyupcanakman)
• minor #64744 [Contracts] Set splitsh tag_skip strategy to no_commit (@fabpot)
• minor #64742 [Form][Validator] review German translations (@xabbuh)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)
• bug #64734 [Filesystem] Trim trailing whitespace from the tempnam() prefix (@Amoifr)
• bug #64732 [String] Fix splice() on multibyte strings (@eyupcanakman)
• minor #64733 [Validator] Review Croatian translations (@HypeMC)
• data #64729 Release v7.4.14
• data #64728 Release v6.4.42

Changelog (https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1)

• data #64731 Release v8.1.1
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• minor #64643 [ObjectMapper] Fix reverse class mapping of private properties from parent classes (@Amoifr)
• bug #64640 Messenger commands don't yet make use of listable Redis capabilities (@dpi)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64637 [Messenger] Fix #[AsMessage] on abstract classes (@MatTheCat)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
• bug #64589 [ObjectMapper] Fix self-referencing property mapping (@GaryPEGEOT)
• bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (@soyuka)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
• minor #64620 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• minor #64629 [DependencyInjection] Fix deprecation when handling tagged iterator YAML short syntax (@MatTheCat)
• bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (@nicolas-grekas)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• bug #64595 [Cache][VarExporter] Add argument $allowNamedClosure to DeepClone to fit ext-deepclone v0.8 (@nicolas-grekas)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
• bug #64466 [ObjectMapper] Fix reverse class map throwing on unreadable source (@yoye)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• bug #64572 [DependencyInjection] Fix decorating an event listener no longer replacing it (@nicolas-grekas)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• bug #64555 [FrameworkBundle] Fix custom config directory being ignored when registering bundles (@nicolas-grekas)
• bug #64560 [FrameworkBundle] Avoid resolving all env vars when building the router request context (@nicolas-grekas)
• bug #64558 [Security] Make RoleHierarchy::getReachableRoleNames() return a list again (@nicolas-grekas)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64552 [Cache][FrameworkBundle] Fix warming up caches that hold a closure (@nicolas-grekas)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• bug #64362 [Tui] Fix vertical align (@sblondeau)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• bug #64474 [HttpKernel] Allow leading zeros in int request attributes (@ousamabenyounes)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64523 [DependencyInjection] Keep behavior-describing tags 'proxy' and 'container.service_subscriber.locator' on decorated services (@ousamabenyounes)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• bug #64536 [Form] Don't re-add deleted collection entries on submit (@eyupcanakman)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• bug #64534 [Tui] Avoid splitting Unicode ellipsis when truncating (rahul chavan)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• bug #64527 [Tui] Truncate InputWidget prompt when wider than available columns (@ousamabenyounes)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
• minor #64417 [DependencyInjection] Improve TaggedIteratorArgument deprecation warning (@jbafford)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• minor #64437 [HttpKernel] Add @template on ControllerAttributeEvent (@lyrixx)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• bug #64441 [FrameworkBundle] Fix dumping the debug container on cache:clear/cache:warmup (@nicolas-grekas)
• bug #64443 [DomCrawler] Remove final keyword on ChoiceFormField::addChoice() (@syl20b)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64449 [HttpKernel] Fix #[MapRequestPayload] being handled before #[IsGranted] (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64426 [HttpKernel] Fix TypeError in ResponseEvent when argument resolution throws (@nicolas-grekas)
• bug #64420 [FrameworkBundle] Fix "allow_no_handlers" being ignored on message buses (@damien-bp)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• minor #64403 Update CHANGELOG-8.1.md (@yauhenko)
• minor #64416 Clarify #[Target] attribute in UPGRADE-8.1 (@jbafford)

Changelog (https://github.com/symfony/symfony/compare/v8.0.13...v8.0.14)

• data #64730 Release v8.0.14
• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (@mtarld)
• minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
• minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
• minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
• data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
• data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
• minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
• minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot)
• minor #64676 Add symfony-sync-translations skill (@fabpot)
• data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
• minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64120 [Serializer] honor csv_headers context when no_headers is true (@ousamabenyounes)
• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
• minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated _fragment URI (@nicolas-grekas)
• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot])
• data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
• data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
• minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
• data #64597 Review Indonesian (id) translations (@sawirricardo)
• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
• minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
• minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
• data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
• data #64564 Remove review state from Serbian translations (@Trysha-rbrn)
• data #64565 Remove review state from Russian translations #64512 (@centaur-vova)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas)
• bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
• data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer)
• data #64551 [Form] reviewed Polish translation unit 129 (@thunderer)
• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas)
• minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas)
• data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy)
• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes)
• data #64542 [Form][Validator] Update Spanish translations (@ThiagoMirandaLiotto)
• data #64543 [Form][Validator] Review Croatian translations (@HypeMC)
• minor #64537 [CI] Make the PHPStan job report only new errors (@nicolas-grekas)
• data #64526 [Form][Validator] Review and correct Arabic translation (@ayyoub-afwallah)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)
• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (@ousamabenyounes)
• bug #64475 [AssetMapper] Render an empty import map as a JSON object (@ousamabenyounes)
• minor #64473 [Translation] Fix test failing without the intl extension (@nicolas-grekas)
• minor #64472 [Mailer][Mailchimp] Fix tests on low-deps (@nicolas-grekas)
• bug #64458 [Webhook] Fix Content-Type key in createRequest method (@MarijnDoeve)
• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (@MatTheCat)
• bug #64424 [Form] Translate TranslatableInterface label in violation messages (@Amoifr)
• minor #64453 Remove review state from Serbian translations (@Trysha-rbrn)
• bug #64359 [Validator] Support SVG dimensions with units (@Will-thom)
• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• minor #64435 Update installation command for Stopwatch component (@abdounikarim)
• data #64451 [Form] Add missing translation for invalid UUID (@jmsche)
• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (@Trysha-rbrn)
• data #64446 [Validator] Add translated messages for the XML constraint (@nicolas-grekas)
• bug #64375 [Notifier] Send message to MS-Teams via Workflow (@gassan)
• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (@ibrambe)
• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (@MatTheCat)
• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (@nicolas-grekas)
• bug #64388 [Yaml] Fix parsing inline anchored values (@nicolas-grekas)
• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)
• bug #64102 Remove usage of Kernel::VERSION (@fabpot)
• data #64372 Release v7.4.13
• data #64371 Release v6.4.41