# Symfony: what changed from 7 to 8

- Product: Symfony (https://whatsnew.fyi/product/symfony)
- Vendor: Symfony
- Range: changelog entries numbered after v7.4.18 up to and including v8.1.6, stable releases only
- Entries below: 9 releases (newest first)
- Resolved: 7 is v7.4.18 and 8 is v8.1.6, the newest stable release of each major we track
- Carrying security changes: 1 · CVEs mentioned: 0 · Mentioning breaking changes: 0 · Removing or deprecating something: 0
- Page: https://whatsnew.fyi/product/symfony/compare/7...8

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (115 changes, grouped by kind)

### Added

#### v8.1.4 (2026-08-07)

- Added missing Slovak translations in Form and Validator

### Changed

#### v8.1.6 (2026-08-30)

- Combine trusted host patterns into a single regexp in HttpFoundation

#### v8.1.5 (2026-08-22)

- Review the German translations for the EntityExists and Ulid messages
- Review Croatian translations

#### v8.1.3 (2026-07-29)

- Detect the null byte rendering instead of pinning a PHP version in VarExporter (also in v8.0.16)
- Relax PropertyAccess version constraint in Serializer

#### v8.0.15 (2026-07-29)

- Add support for relay 0.40

### Fixed

#### v8.1.6 (2026-08-30)

- Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros
- Read only the doc block of a promoted property in getTypeFromConstructor()
- Enforce the element type of nested scalar collections in Serializer
- Cap the burst size and the duration computed from it in RateLimiter (also in v8.1.4)
- Don't send the original Host header on cross-authority redirects (also in v8.1.2; v8.0.15)
- Reject 3xx pushed responses in HttpClient
- Drop trace args from FlattenException normalization in Messenger
- Ignore invalid env var names and non-scalar env values in Process
- Stop leaking CGI/FastCGI request-context vars to subprocesses in Process
- Avoid failing when PersistentRememberMeHandler handles a malformed cookie
- Reject malformed login link parameters instead of throwing a TypeError in Security
- Remove the legacy nested unserialize() call from token and exception classes in Security
- Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store
- Ignore the session id that PHP kept from a previous request in HttpKernel
- Fix TypeError in UriSigner when the hash parameter is not a string

#### v8.1.5 (2026-08-22)

- Fix denormalizing mime messages typed as RawMessage
- Match check paths given as a route alias
- Fix the mailer panel crashing when an attached file was deleted
- Tell apart handler services that share the same class
- Fix auto-mapping strategies being ignored on inherited properties
- Map violations to child forms named after the snake cased property
- Fix :disabled and :enabled inside nested fieldsets
- Fix resolving constants defined on interfaces
- Do not resolve core utility parameters as command input
- Fix caching responses that cannot provide their content
- Fix rendering and parsing dates before the Gregorian cutover
- Fix leaking an exception handler when not replacing the error handler
- Reject canceled scheduled messages so async transports do not redeliver them
- Keep escaping when resolving values against a resolved parameter bag
- Apply the configured rounding mode when no scale is set
- Restore the locale that was in use before a sub-request
- Fix lint:container skipping services matched by tagged iterators
- Do not inherit translation parameters for translatable labels and help messages

#### v8.1.4 (2026-08-07)

- Honor the expiry date of currencies that have no start date in Intl
- Distinguish active_at from not_active_at in the CurrencyType choice list cache in Form
- Don't return a non-callable from getPhpUnitErrorHandler() in PhpUnitBridge
- Treat a UriSigner expiration of 0 as a date, not as no expiry in HttpFoundation
- Fix failing reset methods preventing later services from resetting in HttpKernel
- Do not report a non-public mutator as writable in PropertyInfo
- Keep ANSI codes ordered when slicing across a color change in Tui
- Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 in HttpClient
- Escape backslashes in Address::getEncodedName() in Mime
- Fix target property mappings dropped when the source carries metadata in ObjectMapper
- Align union member order between the legacy and TypeInfo paths in Serializer
- Don't keep partially-configured shared services when their setup fails in DependencyInjection
- Fix compatibility with DBAL < 4.5 in DoctrineBridge
- Render raw HTML in MarkdownWidget instead of dropping it in Tui
- Skip nested mapping when no target fits the destination property type in ObjectMapper
- Fix cache:clear failing when the cache dir is rebuilt concurrently in FrameworkBundle
- Fix the class-level mapping of another target being applied in ObjectMapper
- Resolve factories on service_container against the concrete container class in DependencyInjection

#### v8.1.3 (2026-07-29)

- Revert stripping of Proxy-Authorization on cross-authority redirects in HttpClient

#### v8.0.16 (2026-07-29)

- Revert stripping Proxy-Authorization on cross-authority redirects in HttpClient

#### v8.1.2 (2026-07-29)

- Add limits for filter expression length and depth in JsonCrawler (also in v8.0.15)
- Fail when an https proxy is configured but libcurl cannot use it (also in v8.0.15)
- Drop the unbounded process-global key cache in Splitter (also in v8.0.15)
- Check the denormalized class is a Mime part in MimeMessageNormalizer (also in v8.0.15)
- Always constrain redirect targets to the current host, even without sessions (also in v8.0.15)
- Validate the characters allowed in a cookie path and domain (also in v8.0.15)
- Don't crash on a non-string signature in UriSigner (also in v8.0.15)
- Fix newline handling in server event fields (also in v8.0.15)
- Strip Proxy-Authorization on cross-authority redirects (also in v8.0.15)
- Add support for relay 0.40
- Reject non-singular queries in filter comparisons (also in v8.0.15)
- Fix evaluating filter expressions wrapped in several parentheses (also in v8.0.15)
- Fix retry field being dropped across server event streams (also in v8.0.15)
- Restore reading container.behavior_describing_tags in DecoratorServicePass
- Fix the escaping of the generated curl command (also in v8.0.15)
- Prefer serialized name over raw property key (also in v8.0.15)
- Consistently return null for out-of-range offsets (also in v8.0.15)
- Fix the curl command when a cookie holds an array
- Do not trigger legacy Type deprecation on getType() (also in v8.0.15)

#### v8.0.15 (2026-07-29)

- Fix nested map() reconstructing an existing target
- Fix fatal TypeError when sending a RawMessage via an API transport

#### v8.1.1 (2026-06-27)

- Fix GetSetMethodNormalizer denormalization of constructor only objects (also in v8.0.14)
- Honor csv_headers context when no_headers is true in Serializer (also in v8.0.14)
- Ensure RelayProxy compatibility with Relay extension 0.30.0 (also in v8.0.14)
- Fix Ignore attribute on a getter ignoring a same-name property
- Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (also in v8.0.14)
- Fix recursion into stream wrapper subdirectories on Windows in Finder (also in v8.0.14)
- Avoid TypeError and improve DX when null groups in Validator (also in v8.0.14)
- Fix denormalization of already-instantiated nested objects
- Fix mapping of private properties from parent classes in ObjectMapper (also in v8.0.14)
- Fix self-referencing property mapping in ObjectMapper
- Handle N targets per source in reverse class map in ObjectMapper
- Fix state leak in LogoutUrlGenerator in async environments
- Restore compatibility with DBAL 4.5
- Add ContainerAwareInterface back, deprecated
- Detect env placeholders in resolved route parameter values in FrameworkBundle (also in v8.0.14)
- Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient (also in v8.0.14)
- Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES
- Add argument allowNamedClosure to DeepClone to fit ext-deepclone v0.8
- Make existing-object mapping behavior consistent in ObjectMapper (also in v8.0.14)
- Set recipients from envelope instead of email headers in Mailer MicrosoftGraphApi bridge

#### v8.0.14 (2026-06-27)

- Fix #[Ignore] on a getter ignoring a same-name property
- Fix stale dev asset cache in long-running runtimes in AssetMapper
- Fix denormalization of already-instantiated nested objects in Serializer
- Fix state leak in LogoutUrlGenerator in async environments in SecurityBundle
- Restore compat with DBAL 4.5
- Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES in Mailer
- Migrate table definitions to DBAL's TableEditor API
- Set recipients from $envelope instead of the $email headers in Mailer
- Fix fatal errors on unreadable source properties in ObjectMapper
- Harden __toString trampolines via __unserialize()

### Security

#### v8.1.6 (2026-08-30)

- Reject decompression bombs in HttpClient
- Reject https:// proxies that curl would connect to in cleartext
- Reject an unquoted "@" in the local part of an email address in Mime
- Restrict redirections to the current host when sessions are disabled in SecurityBundle

## Release notes

### v8.1.6

- Date: 2026-08-30
- Version: v8.1.6
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.6
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.6

- **fixed** — Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros
- **security** — Reject decompression bombs in HttpClient
- **changed** — Combine trusted host patterns into a single regexp in HttpFoundation
- **fixed** — Read only the doc block of a promoted property in getTypeFromConstructor()
- **fixed** — Enforce the element type of nested scalar collections in Serializer
- **security** — Reject https:// proxies that curl would connect to in cleartext
- **fixed** — Cap the burst size and the duration computed from it in RateLimiter
- **fixed** — Don't send the original Host header on cross-authority redirects
- **fixed** — Reject 3xx pushed responses in HttpClient
- **fixed** — Drop trace args from FlattenException normalization in Messenger
- **security** — Reject an unquoted "@" in the local part of an email address in Mime
- **fixed** — Ignore invalid env var names and non-scalar env values in Process
- **fixed** — Stop leaking CGI/FastCGI request-context vars to subprocesses in Process
- **fixed** — Avoid failing when PersistentRememberMeHandler handles a malformed cookie
- **fixed** — Reject malformed login link parameters instead of throwing a TypeError in Security
- **fixed** — Remove the legacy nested unserialize() call from token and exception classes in Security
- **security** — Restrict redirections to the current host when sessions are disabled in SecurityBundle
- **fixed** — Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store
- **fixed** — Ignore the session id that PHP kept from a previous request in HttpKernel
- **fixed** — Fix TypeError in UriSigner when the hash parameter is not a string

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.5...v8.1.6)

 * bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
 * bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
 * bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
 * bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
 * bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
 * bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
 * bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
 * bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
 * bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
 * bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
 * bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
 * bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
 * bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
 * bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
 * bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
 * bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
 * bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
 * bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
 * bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
 * bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
 * bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
 * bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
 * bug #65728 [Routing] Fix matching the "0" URL (@cs278)
 * bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
 * bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
 * bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
 * bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
 * bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
 * minor #65724  Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
 * bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
 * bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
 * bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
 * bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
 * bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
 * bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
 * bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
 * bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
 * bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
 * bug #65686 [

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.6]_

### v8.1.5

- Date: 2026-08-22
- Version: v8.1.5
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.5
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.5

- **fixed** — Fix denormalizing mime messages typed as RawMessage
- **fixed** — Match check paths given as a route alias
- **changed** — Review the German translations for the EntityExists and Ulid messages
- **fixed** — Fix the mailer panel crashing when an attached file was deleted
- **fixed** — Tell apart handler services that share the same class
- **changed** — Review Croatian translations
- **fixed** — Fix auto-mapping strategies being ignored on inherited properties
- **fixed** — Map violations to child forms named after the snake cased property
- **fixed** — Fix :disabled and :enabled inside nested fieldsets
- **fixed** — Fix resolving constants defined on interfaces
- **fixed** — Do not resolve core utility parameters as command input
- **fixed** — Fix caching responses that cannot provide their content
- **fixed** — Fix rendering and parsing dates before the Gregorian cutover
- **fixed** — Fix leaking an exception handler when not replacing the error handler
- **fixed** — Reject canceled scheduled messages so async transports do not redeliver them
- **fixed** — Keep escaping when resolving values against a resolved parameter bag
- **fixed** — Apply the configured rounding mode when no scale is set
- **fixed** — Restore the locale that was in use before a sub-request
- **fixed** — Fix lint:container skipping services matched by tagged iterators
- **fixed** — Do not inherit translation parameters for translatable labels and help messages

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.4...v8.1.5)

 * bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (@nicolas-grekas)
 * bug #65524 [Security] Match check paths given as a route alias (@nicolas-grekas)
 * minor #65585 [Validator] Review the German translations for the EntityExists and Ulid messages (@wazum)
 * bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (@nicolas-grekas)
 * bug #65514 [Messenger] Tell apart handler services that share the same class (@nicolas-grekas)
 * minor #65583 [Validator] Review Croatian translations (@HypeMC)
 * bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (@nicolas-grekas)
 * bug #65584 [Form] Map violations to child forms named after the snake cased property (@nicolas-grekas)
 * bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (@nicolas-grekas)
 * bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (@llupa)
 * bug #65455 [Console] Do not resolve core utility parameters as command input (@lazerg)
 * bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (@nicolas-grekas)
 * bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (@nicolas-grekas)
 * bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (@nicolas-grekas)
 * bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (@nicolas-grekas)
 * bug #65532 [DependencyInjection] Keep  escaping when resolving values against a resolved parameter bag (@nicolas-grekas)
 * bug #65530 [Form] Apply the configured rounding mode when no scale is set (@nicolas-grekas)
 * bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (@nicolas-grekas)
 * bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (@nicolas-grekas)
 * bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (@nicolas-grekas)
 * bug #65519 [DomCrawler] Detect the charset from meta tags only (@nicolas-grekas)
 * bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (@nicolas-grekas)
 * bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (@nicolas-grekas)
 * bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (@nicolas-grekas)
 * bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
 * bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (@nicolas-grekas)
 * bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (@nicolas-grekas)
 * bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
 * bug #65508 [Intl] Follow the ICU parent locale when falling back (@nicolas-grekas)
 * bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (@nicolas-grekas)
 * bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (@nicolas-grekas)
 * bug #65502 [Security] Refresh the impersonator while impersonating (@nicolas-grekas)
 * bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (@nicolas-grekas)
 * bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (@nicolas-grekas)
 * bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (@nicolas-grekas)
 * bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (@nicolas-grekas)
 * bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (@nicolas-grekas)
 * bug #65498 [Process] Do not wait for output when the input iterator has more d

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.5]_

### v8.1.4

- Date: 2026-08-07
- Version: v8.1.4
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.4
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.4

- **fixed** — Cap the burst size and the duration computed from it in RateLimiter
- **fixed** — Honor the expiry date of currencies that have no start date in Intl
- **fixed** — Distinguish active_at from not_active_at in the CurrencyType choice list cache in Form
- **fixed** — Don't return a non-callable from getPhpUnitErrorHandler() in PhpUnitBridge
- **fixed** — Treat a UriSigner expiration of 0 as a date, not as no expiry in HttpFoundation
- **fixed** — Fix failing reset methods preventing later services from resetting in HttpKernel
- **fixed** — Do not report a non-public mutator as writable in PropertyInfo
- **fixed** — Keep ANSI codes ordered when slicing across a color change in Tui
- **fixed** — Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 in HttpClient
- **fixed** — Escape backslashes in Address::getEncodedName() in Mime
- **fixed** — Fix target property mappings dropped when the source carries metadata in ObjectMapper
- **fixed** — Align union member order between the legacy and TypeInfo paths in Serializer
- **fixed** — Don't keep partially-configured shared services when their setup fails in DependencyInjection
- **fixed** — Fix compatibility with DBAL < 4.5 in DoctrineBridge
- **added** — Added missing Slovak translations in Form and Validator
- **fixed** — Render raw HTML in MarkdownWidget instead of dropping it in Tui
- **fixed** — Skip nested mapping when no target fits the destination property type in ObjectMapper
- **fixed** — Fix cache:clear failing when the cache dir is rebuilt concurrently in FrameworkBundle
- **fixed** — Fix the class-level mapping of another target being applied in ObjectMapper
- **fixed** — Resolve factories on service_container against the concrete container class in DependencyInjection

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.3...v8.1.4)

 * bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
 * bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
 * bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
 * bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
 * bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
 * bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
 * bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
 * bug #65174 [Tui] Keep ANSI codes ordered when slicing across a color change (@smnandre)
 * bug #65177 [HttpClient] Fix `GuzzleHttpHandler` crashing with `guzzlehttp/guzzle` ^8.0 (@peter17)
 * bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
 * bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
 * bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
 * bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
 * bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
 * minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
 * bug #65150 [Tui] Render raw HTML in MarkdownWidget instead of dropping it (@lazerg)
 * bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
 * bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
 * bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
 * bug #65149 [DependencyInjection] Resolve factories on "service_container" against the concrete container class (@lazerg)
 * bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
 * bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
 * bug #65122 [Messenger] Re-send original payload when retrying undecodable messages (@SystematicCZ)
 * bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
 * bug #65120 [DependencyInjection] Fix `#[Autoconfigure]` being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
 * bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
 * bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
 * bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
 * bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
 * bug #65105 [Uid] Fix the weak-secret guard in Uuid47Transformer for secrets longer than 16 bytes (@semx)
 * bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
 * bug #65085 [Messenger] Stop the PostgreSQL transport from blocking the worker loop (@bzajacc)
 * bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
 * bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
 * bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
 * bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
 * minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
 * bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
 * minor #65070 [Notifier][Tele

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.4]_

### v8.1.3

- Date: 2026-07-29
- Version: v8.1.3
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.3
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.3

- **changed** — Detect the null byte rendering instead of pinning a PHP version in VarExporter
- **changed** — Relax PropertyAccess version constraint in Serializer
- **fixed** — Revert stripping of Proxy-Authorization on cross-authority redirects in HttpClient

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.2...v8.1.3)

 * minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
 * minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus)
 * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

### v8.0.16

- Date: 2026-07-29
- Version: v8.0.16
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.16
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.16

- **changed** — Detect the null byte rendering instead of pinning a PHP version in VarExporter
- **fixed** — Revert stripping Proxy-Authorization on cross-authority redirects in HttpClient

**Changelog** (https://github.com/symfony/symfony/compare/v8.0.15...v8.0.16)

 * minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
 * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

### v8.1.2

- Date: 2026-07-29
- Version: v8.1.2
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.2
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.2

- **fixed** — Add limits for filter expression length and depth in JsonCrawler
- **fixed** — Fail when an https proxy is configured but libcurl cannot use it
- **fixed** — Drop the unbounded process-global key cache in Splitter
- **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer
- **fixed** — Always constrain redirect targets to the current host, even without sessions
- **fixed** — Validate the characters allowed in a cookie path and domain
- **fixed** — Don't crash on a non-string signature in UriSigner
- **fixed** — Fix newline handling in server event fields
- **fixed** — Strip Proxy-Authorization on cross-authority redirects
- **fixed** — Add support for relay 0.40
- **fixed** — Reject non-singular queries in filter comparisons
- **fixed** — Fix evaluating filter expressions wrapped in several parentheses
- **fixed** — Fix retry field being dropped across server event streams
- **fixed** — Restore reading container.behavior_describing_tags in DecoratorServicePass
- **fixed** — Fix the escaping of the generated curl command
- **fixed** — Don't send the original Host header on cross-authority redirects
- **fixed** — Prefer serialized name over raw property key
- **fixed** — Consistently return null for out-of-range offsets
- **fixed** — Fix the curl command when a cookie holds an array
- **fixed** — Do not trigger legacy Type deprecation on getType()

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.1...v8.1.2)

 * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois)
 * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas)
 * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas)
 * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
 * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas)
 * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
 * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
 * bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas)
 * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas)
 * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas)
 * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas)
 * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas)
 * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas)
 * bug #64999 [DependencyInjection] Restore reading "container.behavior_describing_tags" in DecoratorServicePass (@nicolas-grekas)
 * bug #65008 [HttpKernel] Fix the escaping of the generated curl command (@nicolas-grekas)
 * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas)
 * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
 * minor #65000  Review Italian validator translations (@JJordan0C)
 * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes)
 * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz)
 * bug #64986 [HttpKernel] Fix the curl command when a cookie holds an array (@maximilian-walter)
 * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz)
 * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan)
 * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki)
 * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox)
 * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas)
 * bug #64978 [Messenger] Reject a serialized type name that is another message's class name (@nicolas-grekas)
 * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev)
 * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert)
 * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies)
 * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas)
 * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx)
 * bug #64903 [Console] Reduce buffer reallocations in FileInputHelper paste detection (@jorgsowa)
 * bug #64661 [FrameworkBundle] Register the argument resolver in ConsoleCommandAssertionsTrait::runCommand (@fracsi)
 * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas)
 * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy)
 * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy)
 * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy)
 * bug #64957 [Cache] Fix "Class Relay\Relay n

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.2]_

### v8.0.15

- Date: 2026-07-29
- Version: v8.0.15
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.15
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.15

- **fixed** — Add limits for filter expression length and depth in JsonCrawler
- **fixed** — Fail when an https proxy is configured but libcurl cannot use it
- **fixed** — Drop the unbounded process-global key cache in Splitter
- **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer
- **fixed** — Always constrain redirect targets to the current host, even without sessions
- **fixed** — Validate the characters allowed in a cookie path and domain
- **fixed** — Don't crash on a non-string signature in UriSigner
- **fixed** — Fix newline handling in server event fields
- **fixed** — Strip Proxy-Authorization on cross-authority redirects
- **changed** — Add support for relay 0.40
- **fixed** — Reject non-singular queries in filter comparisons
- **fixed** — Fix evaluating filter expressions wrapped in several parentheses
- **fixed** — Fix retry field being dropped across server event streams
- **fixed** — Fix the escaping of the generated curl command
- **fixed** — Don't send the original Host header on cross-authority redirects
- **fixed** — Prefer serialized name over raw property key
- **fixed** — Consistently return null for out-of-range offsets
- **fixed** — Do not trigger legacy Type deprecation on getType()
- **fixed** — Fix nested map() reconstructing an existing target
- **fixed** — Fix fatal TypeError when sending a RawMessage via an API transport

**Changelog** (https://github.com/symfony/symfony/compare/v8.0.14...v8.0.15)

 * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois)
 * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas)
 * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas)
 * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
 * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas)
 * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
 * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
 * bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas)
 * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas)
 * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas)
 * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas)
 * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas)
 * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas)
 * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas)
 * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
 * minor #65000  Review Italian validator translations (@JJordan0C)
 * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes)
 * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz)
 * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz)
 * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan)
 * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki)
 * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox)
 * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas)
 * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev)
 * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert)
 * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies)
 * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas)
 * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx)
 * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas)
 * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy)
 * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy)
 * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy)
 * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay)
 * minor #64950 [Form][Validator] Updated danish translations (@jekuaitk)
 * bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (@Amoifr)
 * bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (@Amoifr)
 * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal)
 * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
 * bug #64670 [Config] Accept env placeholders for scalar alternatives in generated arr

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.0.15]_

### v8.1.1

- Date: 2026-06-27
- Version: v8.1.1
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.1
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.1

- **fixed** — Fix GetSetMethodNormalizer denormalization of constructor only objects
- **fixed** — Honor csv_headers context when no_headers is true in Serializer
- **fixed** — Ensure RelayProxy compatibility with Relay extension 0.30.0
- **fixed** — Fix Ignore attribute on a getter ignoring a same-name property
- **fixed** — Ensure RelayClusterProxy compatibility with Relay extension 0.30.0
- **fixed** — Fix recursion into stream wrapper subdirectories on Windows in Finder
- **fixed** — Avoid TypeError and improve DX when null groups in Validator
- **fixed** — Fix denormalization of already-instantiated nested objects
- **fixed** — Fix mapping of private properties from parent classes in ObjectMapper
- **fixed** — Fix self-referencing property mapping in ObjectMapper
- **fixed** — Handle N targets per source in reverse class map in ObjectMapper
- **fixed** — Fix state leak in LogoutUrlGenerator in async environments
- **fixed** — Restore compatibility with DBAL 4.5
- **fixed** — Add ContainerAwareInterface back, deprecated
- **fixed** — Detect env placeholders in resolved route parameter values in FrameworkBundle
- **fixed** — Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient
- **fixed** — Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES
- **fixed** — Add argument allowNamedClosure to DeepClone to fit ext-deepclone v0.8
- **fixed** — Make existing-object mapping behavior consistent in ObjectMapper
- **fixed** — Set recipients from envelope instead of email headers in Mailer MicrosoftGraphApi bridge

**Changelog** (https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1)

 * data #64731 Release v8.1.1
 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld)
 * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
 * minor #64717  Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
 * minor #64715  Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
 * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
 * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
 * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
 * minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
 * minor #64690  Replace Python script with PHP in the sync translations skill (@fabpot)
 * minor #64676  Add symfony-sync-translations skill (@fabpot)
 * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
 * minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
 * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes)
 * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
 * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
 * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
 * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
 * minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated `_fragment` URI (@nicolas-grekas)
 * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
 * minor #64643 [ObjectMapper] Fix reverse class mapping of private properties from parent classes (@Amoifr)
 * bug #64640  Messenger commands don't yet make use of listable Redis capabilities (@dpi)
 * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
 * bug #64637 [Messenger] Fix `#[AsMessage]` on abstract classes (@MatTheCat)
 * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
 * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
 * bug #64589 [ObjectMapper] Fix self-referencing property mapping (@GaryPEGEOT)
 * bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (@soyuka)
 * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
 * minor #64599  Bump the github-actions group with 2 updates (@dependabot[bot])
 * minor #64620 [Translation] Create Crowdin files before uploading translations (@MatTheCat)
 * data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
 * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
 * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
 * minor #64629 [DependencyInjection] Fix deprecation when handling tagged iterator YAML short syntax (@MatTheCat)
 * bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (@nicolas-grekas)
 * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
 * bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (@nicolas-grekas)
 * minor #64616  Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
 * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
 * data #64597  Review Indonesian (id) translations (@sawirricardo)
 * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
 * data #64607 [Translat

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.1]_

### v8.0.14

- Date: 2026-06-27
- Version: v8.0.14
- Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.14
- Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.14

- **fixed** — Fix GetSetMethodNormalizer denormalization of constructor only objects
- **fixed** — Honor csv_headers context when no_headers is true in Serializer
- **fixed** — Ensure RelayProxy compatibility with Relay extension 0.30.0
- **fixed** — Fix #[Ignore] on a getter ignoring a same-name property
- **fixed** — Ensure RelayClusterProxy compatibility with Relay extension 0.30.0
- **fixed** — Fix recursion into stream wrapper subdirectories on Windows in Finder
- **fixed** — Avoid TypeError and improve DX when null groups in Validator
- **fixed** — Fix stale dev asset cache in long-running runtimes in AssetMapper
- **fixed** — Fix denormalization of already-instantiated nested objects in Serializer
- **fixed** — Fix mapping of private properties from parent classes in ObjectMapper
- **fixed** — Fix state leak in LogoutUrlGenerator in async environments in SecurityBundle
- **fixed** — Restore compat with DBAL 4.5
- **fixed** — Detect env placeholders in resolved route parameter values in FrameworkBundle
- **fixed** — Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient
- **fixed** — Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES in Mailer
- **fixed** — Migrate table definitions to DBAL's TableEditor API
- **fixed** — Make existing-object mapping behavior consistent in ObjectMapper
- **fixed** — Set recipients from $envelope instead of the $email headers in Mailer
- **fixed** — Fix fatal errors on unreadable source properties in ObjectMapper
- **fixed** — Harden __toString trampolines via __unserialize()

**Changelog** (https://github.com/symfony/symfony/compare/v8.0.13...v8.0.14)

 * data #64730 Release v8.0.14
 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld)
 * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat)
 * minor #64717  Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot])
 * minor #64715  Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot])
 * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro)
 * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer)
 * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov)
 * minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35)
 * minor #64690  Replace Python script with PHP in the sync translations skill (@fabpot)
 * minor #64676  Add symfony-sync-translations skill (@fabpot)
 * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot)
 * minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
 * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes)
 * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas)
 * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman)
 * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr)
 * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman)
 * minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated `_fragment` URI (@nicolas-grekas)
 * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault)
 * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik)
 * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy)
 * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr)
 * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
 * minor #64599  Bump the github-actions group with 2 updates (@dependabot[bot])
 * data #64602 [Form][Validator] Review Hungarian translations (@antalaron)
 * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov)
 * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas)
 * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr)
 * minor #64616  Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas)
 * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp)
 * data #64597  Review Indonesian (id) translations (@sawirricardo)
 * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr)
 * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07)
 * minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias)
 * minor #64556  Add contributor skills for security review, hardening rules and triage (@nicolas-grekas)
 * bug #64588  Migrate table definitions to DBAL's `TableEditor` API (@nicolas-grekas)
 * bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond)
 * bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss)
 * bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas)
 * data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz)
 * data #64564  Remove review state from Serbian translations (@Trysha-rbrn)
 * data #64565  Remove

_[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.0.14]_