# Symfony changelog > A set of reusable PHP components and a web framework. - Vendor: Symfony - Category: Frameworks & Libraries - Official site: https://symfony.com - Tracked by: What's New (https://whatsnew.fyi/product/symfony) - Harvested from: GitHub (symfony/symfony) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. ## Releases ### v8.1.3 - Date: 2026-07-29 - Version: v8.1.3 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.3 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.3 - **changed** — Detect the null byte rendering instead of pinning a PHP version in VarExporter - **changed** — Relax PropertyAccess version constraint in Serializer - **fixed** — Revert stripping of Proxy-Authorization on cross-authority redirects in HttpClient **Changelog** (https://github.com/symfony/symfony/compare/v8.1.2...v8.1.3) * minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) * minor #65042 [Serializer] Relax PropertyAccess version constraint (@derrabus) * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell) ### v8.0.16 - Date: 2026-07-29 - Version: v8.0.16 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.16 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.16 - **changed** — Detect the null byte rendering instead of pinning a PHP version in VarExporter - **fixed** — Revert stripping Proxy-Authorization on cross-authority redirects in HttpClient **Changelog** (https://github.com/symfony/symfony/compare/v8.0.15...v8.0.16) * minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas) * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell) ### v8.1.2 - Date: 2026-07-29 - Version: v8.1.2 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.2 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.2 - **fixed** — Add limits for filter expression length and depth in JsonCrawler - **fixed** — Fail when an https proxy is configured but libcurl cannot use it - **fixed** — Drop the unbounded process-global key cache in Splitter - **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer - **fixed** — Always constrain redirect targets to the current host, even without sessions - **fixed** — Validate the characters allowed in a cookie path and domain - **fixed** — Don't crash on a non-string signature in UriSigner - **fixed** — Fix newline handling in server event fields - **fixed** — Strip Proxy-Authorization on cross-authority redirects - **fixed** — Add support for relay 0.40 - **fixed** — Reject non-singular queries in filter comparisons - **fixed** — Fix evaluating filter expressions wrapped in several parentheses - **fixed** — Fix retry field being dropped across server event streams - **fixed** — Restore reading container.behavior_describing_tags in DecoratorServicePass - **fixed** — Fix the escaping of the generated curl command - **fixed** — Don't send the original Host header on cross-authority redirects - **fixed** — Prefer serialized name over raw property key - **fixed** — Consistently return null for out-of-range offsets - **fixed** — Fix the curl command when a cookie holds an array - **fixed** — Do not trigger legacy Type deprecation on getType() **Changelog** (https://github.com/symfony/symfony/compare/v8.1.1...v8.1.2) * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas) * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas) * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas) * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas) * bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas) * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas) * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas) * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas) * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas) * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas) * bug #64999 [DependencyInjection] Restore reading "container.behavior_describing_tags" in DecoratorServicePass (@nicolas-grekas) * bug #65008 [HttpKernel] Fix the escaping of the generated curl command (@nicolas-grekas) * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas) * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas) * minor #65000 Review Italian validator translations (@JJordan0C) * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes) * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz) * bug #64986 [HttpKernel] Fix the curl command when a cookie holds an array (@maximilian-walter) * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz) * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan) * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki) * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox) * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas) * bug #64978 [Messenger] Reject a serialized type name that is another message's class name (@nicolas-grekas) * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev) * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert) * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies) * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas) * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx) * bug #64903 [Console] Reduce buffer reallocations in FileInputHelper paste detection (@jorgsowa) * bug #64661 [FrameworkBundle] Register the argument resolver in ConsoleCommandAssertionsTrait::runCommand (@fracsi) * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas) * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy) * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy) * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy) * bug #64957 [Cache] Fix "Class Relay\Relay n _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.2]_ ### v8.0.15 - Date: 2026-07-29 - Version: v8.0.15 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.15 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.15 - **fixed** — Add limits for filter expression length and depth in JsonCrawler - **fixed** — Fail when an https proxy is configured but libcurl cannot use it - **fixed** — Drop the unbounded process-global key cache in Splitter - **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer - **fixed** — Always constrain redirect targets to the current host, even without sessions - **fixed** — Validate the characters allowed in a cookie path and domain - **fixed** — Don't crash on a non-string signature in UriSigner - **fixed** — Fix newline handling in server event fields - **fixed** — Strip Proxy-Authorization on cross-authority redirects - **changed** — Add support for relay 0.40 - **fixed** — Reject non-singular queries in filter comparisons - **fixed** — Fix evaluating filter expressions wrapped in several parentheses - **fixed** — Fix retry field being dropped across server event streams - **fixed** — Fix the escaping of the generated curl command - **fixed** — Don't send the original Host header on cross-authority redirects - **fixed** — Prefer serialized name over raw property key - **fixed** — Consistently return null for out-of-range offsets - **fixed** — Do not trigger legacy Type deprecation on getType() - **fixed** — Fix nested map() reconstructing an existing target - **fixed** — Fix fatal TypeError when sending a RawMessage via an API transport **Changelog** (https://github.com/symfony/symfony/compare/v8.0.14...v8.0.15) * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas) * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas) * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas) * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas) * bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas) * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas) * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas) * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas) * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas) * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas) * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas) * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas) * minor #65000 Review Italian validator translations (@JJordan0C) * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes) * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz) * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz) * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan) * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki) * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox) * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas) * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev) * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert) * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies) * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas) * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx) * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas) * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy) * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy) * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy) * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay) * minor #64950 [Form][Validator] Updated danish translations (@jekuaitk) * bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (@Amoifr) * bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (@Amoifr) * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal) * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr) * bug #64670 [Config] Accept env placeholders for scalar alternatives in generated arr _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.0.15]_ ### v7.4.15 - Date: 2026-07-29 - Version: v7.4.15 - Original notes: https://github.com/symfony/symfony/releases/tag/v7.4.15 - Permalink: https://whatsnew.fyi/product/symfony/releases/v7.4.15 - **fixed** — Add limits for filter expression length and depth in JsonCrawler - **fixed** — Fail when an https proxy is configured but libcurl cannot use it - **fixed** — Drop the unbounded process-global key cache in Splitter - **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer - **fixed** — Always constrain redirect targets to the current host, even without sessions - **fixed** — Validate the characters allowed in a cookie path and domain - **fixed** — Don't crash on a non-string signature in UriSigner - **fixed** — Fix newline handling in server event fields - **fixed** — Strip Proxy-Authorization on cross-authority redirects - **added** — Add support for relay 0.40 - **fixed** — Reject non-singular queries in filter comparisons - **fixed** — Fix evaluating filter expressions wrapped in several parentheses - **fixed** — Fix retry field being dropped across server event streams - **fixed** — Fix the escaping of the generated curl command - **fixed** — Don't send the original Host header on cross-authority redirects - **fixed** — Prefer serialized name over raw property key - **fixed** — Consistently return null for out-of-range offsets - **fixed** — Do not trigger legacy Type deprecation on getType() - **fixed** — Fix nested map() reconstructing an existing target - **fixed** — Fix fatal TypeError when sending a RawMessage via an API transport **Changelog** (https://github.com/symfony/symfony/compare/v7.4.14...v7.4.15) * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (@alexandre-daubois) * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (@nicolas-grekas) * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas) * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas) * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas) * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas) * bug #65020 [HttpFoundation] Fix newline handling in server event fields (@nicolas-grekas) * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas) * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas) * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (@nicolas-grekas) * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (@nicolas-grekas) * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (@nicolas-grekas) * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas) * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas) * minor #65000 Review Italian validator translations (@JJordan0C) * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes) * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz) * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (@saifulferoz) * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan) * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (@takashiraki) * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox) * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas) * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev) * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (@misaert) * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (@bendavies) * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas) * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx) * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas) * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy) * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy) * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy) * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay) * minor #64950 [Form][Validator] Updated danish translations (@jekuaitk) * bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (@Amoifr) * bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (@Amoifr) * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal) * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr) * bug #64670 [Config] Accept env placeholders for scalar alternatives in generated arr _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v7.4.15]_ ### v6.4.43 - Date: 2026-07-29 - Version: v6.4.43 - Original notes: https://github.com/symfony/symfony/releases/tag/v6.4.43 - Permalink: https://whatsnew.fyi/product/symfony/releases/v6.4.43 - **fixed** — Fail when an HTTPS proxy is configured but libcurl cannot use it in HttpClient - **fixed** — Check the denormalized class is a Mime part in MimeMessageNormalizer - **fixed** — Always constrain redirect targets to the current host in SecurityBundle, even without sessions - **fixed** — Validate the characters allowed in a cookie path and domain in HttpFoundation - **fixed** — Don't crash on a non-string signature in UriSigner - **fixed** — Strip Proxy-Authorization on cross-authority redirects in HttpClient - **changed** — Add support for Relay 0.40 in Cache - **fixed** — Fix the escaping of the generated curl command in HttpClient - **fixed** — Don't send the original Host header on cross-authority redirects in HttpClient - **fixed** — Prefer serialized name over raw property key in Serializer - **fixed** — Consistently return null for out-of-range offsets in String - **fixed** — Fix fatal TypeError when sending a RawMessage via an API transport in Mailer - **fixed** — Let the LDAP and non-LDAP variants of an authenticator share a firewall in SecurityBundle - **fixed** — Decorate stdout and stderr independently when a formatter is injected in Console - **fixed** — Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports - **fixed** — Do not reset in ConsoleCommandProcessor in Bridge/Monolog - **fixed** — Don't parse external env var values when resolving .env references in Dotenv - **fixed** — Reset the mapped asset factory between requests in AssetMapper - **fixed** — Avoid re-expanding bare importmap entries in AssetMapper - **fixed** — Do not read subclass discriminator attributes from base objects in Serializer **Changelog** (https://github.com/symfony/symfony/compare/v6.4.42...v6.4.43) * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (@nicolas-grekas) * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas) * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (@nicolas-grekas) * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (@nicolas-grekas) * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (@nicolas-grekas) * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (@nicolas-grekas) * bug #65011 [Cache] Add support for relay 0.40 (@nicolas-grekas) * bug #65009 [HttpClient] Fix the escaping of the generated curl command (@nicolas-grekas) * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas) * minor #65000 Review Italian validator translations (@JJordan0C) * bug #64995 [Serializer] Prefer serialized name over raw property key (@ousamabenyounes) * bug #64992 [String] Consistently return null for out-of-range offsets (@javiereguiluz) * minor #64981 [Form][Validator] Review Turkish (tr) translations (@mmustafaAydogan) * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (@Baylox) * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (@nicolas-grekas) * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (@jprivet-dev) * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (@voodooism, @nicolas-grekas) * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (@lyrixx) * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (@nicolas-grekas) * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (@pokki-deploy) * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (@pokki-deploy) * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (@pokki-deploy) * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (@rjmackay) * minor #64950 [Form][Validator] Updated danish translations (@jekuaitk) * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (@iliaal) * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr) * bug #64935 [PropertyInfo] Ignore mutators with several required parameters (@pokki-deploy) * bug #64937 [Validator] Allow `Traverse` to be inherited (@MatTheCat) * minor #64940 [Validator] Fix missing Tagalog (tl) translations (@QuantumBreakz) * bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (@Amoifr) * bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (@pkranjcecx) * bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (@pokki-deploy) * bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (@Amoifr) * bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (@jnahmias) * bug #64727 [Routing] Detect circular references in object route parameters (@Amoifr) * bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (@eyupcanakman) * minor #64816 Allow Twig 4 (@xabbuh) * bug #64843 [Console] Fix table borders around colspan cells and header-less tables (@wazum) * bug #64930 Handle PHP 8.6 removing function arguments in error messages (@MatTheCat) * bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (@semx) * bug #64 _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v6.4.43]_ ### v8.1.1 - Date: 2026-06-27 - Version: v8.1.1 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.1.1 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.1.1 - **fixed** — Fix GetSetMethodNormalizer denormalization of constructor only objects - **fixed** — Honor csv_headers context when no_headers is true in Serializer - **fixed** — Ensure RelayProxy compatibility with Relay extension 0.30.0 - **fixed** — Fix Ignore attribute on a getter ignoring a same-name property - **fixed** — Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 - **fixed** — Fix recursion into stream wrapper subdirectories on Windows in Finder - **fixed** — Avoid TypeError and improve DX when null groups in Validator - **fixed** — Fix denormalization of already-instantiated nested objects - **fixed** — Fix mapping of private properties from parent classes in ObjectMapper - **fixed** — Fix self-referencing property mapping in ObjectMapper - **fixed** — Handle N targets per source in reverse class map in ObjectMapper - **fixed** — Fix state leak in LogoutUrlGenerator in async environments - **fixed** — Restore compatibility with DBAL 4.5 - **fixed** — Add ContainerAwareInterface back, deprecated - **fixed** — Detect env placeholders in resolved route parameter values in FrameworkBundle - **fixed** — Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient - **fixed** — Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES - **fixed** — Add argument allowNamedClosure to DeepClone to fit ext-deepclone v0.8 - **fixed** — Make existing-object mapping behavior consistent in ObjectMapper - **fixed** — Set recipients from envelope instead of email headers in Mailer MicrosoftGraphApi bridge **Changelog** (https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1) * data #64731 Release v8.1.1 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld) * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) * minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) * minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot]) * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro) * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer) * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov) * minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35) * minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot) * minor #64676 Add symfony-sync-translations skill (@fabpot) * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot) * minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko) * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes) * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas) * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman) * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr) * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman) * minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated `_fragment` URI (@nicolas-grekas) * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault) * minor #64643 [ObjectMapper] Fix reverse class mapping of private properties from parent classes (@Amoifr) * bug #64640 Messenger commands don't yet make use of listable Redis capabilities (@dpi) * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik) * bug #64637 [Messenger] Fix `#[AsMessage]` on abstract classes (@MatTheCat) * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy) * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr) * bug #64589 [ObjectMapper] Fix self-referencing property mapping (@GaryPEGEOT) * bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (@soyuka) * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas) * minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot]) * minor #64620 [Translation] Create Crowdin files before uploading translations (@MatTheCat) * data #64602 [Form][Validator] Review Hungarian translations (@antalaron) * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov) * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas) * minor #64629 [DependencyInjection] Fix deprecation when handling tagged iterator YAML short syntax (@MatTheCat) * bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (@nicolas-grekas) * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr) * bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (@nicolas-grekas) * minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas) * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp) * data #64597 Review Indonesian (id) translations (@sawirricardo) * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr) * data #64607 [Translat _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.1.1]_ ### v8.0.14 - Date: 2026-06-27 - Version: v8.0.14 - Original notes: https://github.com/symfony/symfony/releases/tag/v8.0.14 - Permalink: https://whatsnew.fyi/product/symfony/releases/v8.0.14 - **fixed** — Fix GetSetMethodNormalizer denormalization of constructor only objects - **fixed** — Honor csv_headers context when no_headers is true in Serializer - **fixed** — Ensure RelayProxy compatibility with Relay extension 0.30.0 - **fixed** — Fix #[Ignore] on a getter ignoring a same-name property - **fixed** — Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 - **fixed** — Fix recursion into stream wrapper subdirectories on Windows in Finder - **fixed** — Avoid TypeError and improve DX when null groups in Validator - **fixed** — Fix stale dev asset cache in long-running runtimes in AssetMapper - **fixed** — Fix denormalization of already-instantiated nested objects in Serializer - **fixed** — Fix mapping of private properties from parent classes in ObjectMapper - **fixed** — Fix state leak in LogoutUrlGenerator in async environments in SecurityBundle - **fixed** — Restore compat with DBAL 4.5 - **fixed** — Detect env placeholders in resolved route parameter values in FrameworkBundle - **fixed** — Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient - **fixed** — Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES in Mailer - **fixed** — Migrate table definitions to DBAL's TableEditor API - **fixed** — Make existing-object mapping behavior consistent in ObjectMapper - **fixed** — Set recipients from $envelope instead of the $email headers in Mailer - **fixed** — Fix fatal errors on unreadable source properties in ObjectMapper - **fixed** — Harden __toString trampolines via __unserialize() **Changelog** (https://github.com/symfony/symfony/compare/v8.0.13...v8.0.14) * data #64730 Release v8.0.14 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld) * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) * minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) * minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot]) * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro) * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer) * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov) * minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35) * minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot) * minor #64676 Add symfony-sync-translations skill (@fabpot) * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot) * minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko) * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes) * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas) * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman) * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr) * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman) * minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated `_fragment` URI (@nicolas-grekas) * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault) * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik) * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy) * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr) * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas) * minor #64599 Bump the github-actions group with 2 updates (@dependabot[bot]) * data #64602 [Form][Validator] Review Hungarian translations (@antalaron) * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov) * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas) * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr) * minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas) * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp) * data #64597 Review Indonesian (id) translations (@sawirricardo) * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr) * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07) * minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias) * minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas) * bug #64588 Migrate table definitions to DBAL's `TableEditor` API (@nicolas-grekas) * bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond) * bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss) * bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas) * data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz) * data #64564 Remove review state from Serbian translations (@Trysha-rbrn) * data #64565 Remove _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v8.0.14]_ ### v7.4.14 - Date: 2026-06-27 - Version: v7.4.14 - Original notes: https://github.com/symfony/symfony/releases/tag/v7.4.14 - Permalink: https://whatsnew.fyi/product/symfony/releases/v7.4.14 - **fixed** — Fix GetSetMethodNormalizer denormalization of constructor only objects in Serializer - **fixed** — Honor csv_headers context when no_headers is true in Serializer - **fixed** — Ensure RelayProxy compatibility with Relay extension 0.30.0 in Cache - **fixed** — Fix #[Ignore] on a getter ignoring a same-name property in Serializer - **fixed** — Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 in Cache - **fixed** — Fix recursion into stream wrapper subdirectories on Windows in Finder - **fixed** — Avoid TypeError and improve DX when null groups in Validator - **fixed** — Fix stale dev asset cache in long-running runtimes in AssetMapper - **fixed** — Fix denormalization of already-instantiated nested objects in Serializer - **fixed** — Fix mapping of private properties from parent classes in ObjectMapper - **fixed** — Fix state leak in LogoutUrlGenerator in async environments in SecurityBundle - **fixed** — Restore compat with DBAL 4.5 in Cache, DoctrineBridge, HttpFoundation, Lock, and Messenger - **fixed** — Detect env placeholders in resolved route parameter values in FrameworkBundle - **fixed** — Prevent re-yielding of the first chunk after reconnect in EventSourceHttpClient - **fixed** — Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES in Mailer - **fixed** — Migrate table definitions to DBAL's TableEditor API - **fixed** — Make existing-object mapping behavior consistent in ObjectMapper - **fixed** — Set recipients from $envelope instead of the $email headers in Mailer, Bridge, and MicrosoftGraphApi - **fixed** — Fix fatal errors on unreadable source properties in ObjectMapper - **fixed** — Harden __toString trampolines via __unserialize() - **fixed** — Fix exporting objects that cannot be instantiated empty in VarExporter - **fixed** — Reject __toString trampolines in TemplatedEmail::__unserialize() in TwigBridge - **fixed** — Restore null-on-invalid for nullable #[Autowire(service:)] controller args in HttpKernel - **fixed** — Render formatter tags in ChoiceQuestion default value in Console - **fixed** — Keep collection value type for iterable constructor parameters in Serializer - **fixed** — Render an empty import map as a JSON object in AssetMapper - **fixed** — Fix Content-Type key in createRequest method in Webhook - **changed** — Use mb_convert_encoding() instead of mb_convert_variables() in Console **Changelog** (https://github.com/symfony/symfony/compare/v7.4.13...v7.4.14) * data #64729 Release v7.4.14 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld) * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) * minor #64717 Bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group (@dependabot[bot]) * minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot]) * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro) * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer) * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov) * minor #64694 [FrameworkBundle] Fix service _instanceof type (@philbates35) * minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot) * minor #64676 Add symfony-sync-translations skill (@fabpot) * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot) * minor #64663 [Security] Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko) * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes) * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas) * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman) * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (@Amoifr) * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman) * minor #64647 [FrameworkBundle][TwigBridge] Relax test assertions for generated `_fragment` URI (@nicolas-grekas) * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault) * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik) * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy) * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (@Amoifr) * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas) * data #64602 [Form][Validator] Review Hungarian translations (@antalaron) * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov) * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas) * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr) * minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas) * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp) * data #64597 Review Indonesian (id) translations (@sawirricardo) * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (@Amoifr) * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07) * minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias) * minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas) * bug #64588 Migrate table definitions to DBAL's `TableEditor` API (@nicolas-grekas) * bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (@kbond) * bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (@Pelagoss) * bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (@nicolas-grekas) * data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz) * data #64564 Remove review state from Serbian translations (@Trysha-rbrn) * data #64565 Remove review state from Russian translations #64512 (@centaur-vova) * bug #64566 Har _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v7.4.14]_ ### v6.4.42 - Date: 2026-06-27 - Version: v6.4.42 - Original notes: https://github.com/symfony/symfony/releases/tag/v6.4.42 - Permalink: https://whatsnew.fyi/product/symfony/releases/v6.4.42 - **fixed** — [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects - **fixed** — [Serializer] Honor csv_headers context when no_headers is true - **fixed** — [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 - **fixed** — [Serializer] Fix #[Ignore] on a getter ignoring a same-name property - **fixed** — [Finder] Fix recursion into stream wrapper subdirectories on Windows - **fixed** — [Validator] Avoid TypeError and improve DX when null groups - **fixed** — [AssetMapper] Fix stale dev asset cache in long-running runtimes - **fixed** — [Serializer] Fix denormalization of already-instantiated nested objects - **fixed** — [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments - **fixed** — [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 - **fixed** — [FrameworkBundle] Detect env placeholders in resolved route parameter values - **fixed** — [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect - **fixed** — [VarExporter] Fix exporting objects that cannot be instantiated empty - **fixed** — [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() - **fixed** — [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args - **fixed** — [Console] Render formatter tags in ChoiceQuestion default value - **fixed** — [AssetMapper] Render an empty import map as a JSON object - **fixed** — [Webhook] Fix Content-Type key in createRequest method - **fixed** — [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS - **fixed** — [Translation] Copy domains metadata when moving messages to intl ones **Changelog** (https://github.com/symfony/symfony/compare/v6.4.41...v6.4.42) * data #64728 Release v6.4.42 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (@mtarld) * minor #64721 [Finder] Update tests to pass on Windows (@MatTheCat) * minor #64715 Bump the github-actions group across 1 directory with 2 updates (@dependabot[bot]) * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (@salvador-castro) * data #64698 [Validator] reviewed Polish translation unit 146 (@thunderer) * data #64711 [Validator] Ukrainian translation update (@VladyslavChernyshov) * minor #64690 Replace Python script with PHP in the sync translations skill (@fabpot) * minor #64676 Add symfony-sync-translations skill (@fabpot) * data #64675 [Validator] Add translated messages for the Cron constraint (@fabpot) * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (@ousamabenyounes) * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (@nicolas-grekas) * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (@eyupcanakman) * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (@eyupcanakman) * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (@alamirault) * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (@adrianrudnik) * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (@pokki-deploy) * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas) * data #64602 [Form][Validator] Review Hungarian translations (@antalaron) * data #64626 [Form][Validator] Ukrainian translation review and update (@VladyslavChernyshov) * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (@nicolas-grekas) * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (@Amoifr) * minor #64616 Add skill to help with targetting PRs to their appropriate branch (@nicolas-grekas) * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (@nacorp) * data #64597 Review Indonesian (id) translations (@sawirricardo) * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (@Jerdon07) * minor #64614 [Console] use mb_convert_encoding() instead of mb_convert_variables() (@Girgias) * minor #64556 Add contributor skills for security review, hardening rules and triage (@nicolas-grekas) * data #64578 [Form][Validator] Review Bulgarian (bg) translations (@moynzzz) * data #64564 Remove review state from Serbian translations (@Trysha-rbrn) * data #64565 Remove review state from Russian translations #64512 (@centaur-vova) * bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas) * bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (@nicolas-grekas) * bug #64557 [Translation] Create Crowdin files before uploading translations (@MatTheCat) * data #64550 [Validator] reviewed Polish translation units 143-145 (@thunderer) * data #64551 [Form] reviewed Polish translation unit 129 (@thunderer) * bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (@nicolas-grekas) * minor #64546 [GHA] Add PHPStan rules to spot non-constant-time comparisons to hash_hmac() and __toString-based trampolines (@nicolas-grekas) * data #64544 [Validator] Review French (fr) translations for XML constraints (@lacatoire) * minor #64476 Unsafe unserialize phpstan rule (@jack-worman) * bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (@ousamabenyounes, @pokki-deploy) * bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (@ousamabenyounes) * data #64542 [Form][Val _[Truncated at 4000 characters — full notes: https://github.com/symfony/symfony/releases/tag/v6.4.42]_