This week, Symfony 6.4.45, 7.4.18, and 8.1.6 were released with numerous bug fixes and hardening improvements. Meanwhile, we introduced symfony lsp:check, a new command that brings Symfony-aware diagnostics to your CI pipeline, catching unknown routes, missing templates, and configuration errors. Finally, we announced that you'll be able to meet the Symfony Core Team at the API Platform Conference 2026 in Lille on September 17–18.
Symfony development highlights
This week, 191 pull requests were merged (158 in code and 33 in docs) and 44 issues were closed (25 in code and 19 in docs). Excluding merges, 58 authors made additions and deletions. See details for code and docs.
- d8f8099: [Form] stop capturing Options in the upload_max_size_message closure
- 892055e: [FrameworkBundle] describe the webhook routing secret in the config reference
- 4309470: [Mailer] mark the Sendgrid webhook secret as sensitive
- 075471f: [Notifier] reject an empty secret in the Twilio webhook parser
- 5c090b9: [Webhook] reject a malformed request body with a 406 instead of a 500
- 9f41173: [Mime] do not treat an "@" inside the domain as the addr-spec separator
- 7420a8d: [Mailer, Sendgrid] verify the webhook signature before parsing the payload
- 7a5183e: [HttpFoundation] match paths with the DOTALL modifier
- cb30648: [Notifier, Vonage] verify the payload_hash claim of signed webhooks
- 26456f2: [Mime] never emit a raw control character in a header
- 3e26161: [Messenger] fix a crash when a Redis stream entry is not a JSON object
- 5230b74: [Console] test the shell completion scripts and fix the escaping
- 5439381: [Process] use an absolute path for the cmd.exe fallback on Windows
- d5eef83: [Form] accept UTC-equivalent timezones for date and time model data
- 8d7540c: [Finder] fix prune filters not applied to nested directories and with path excludes
- f94fd8f: [Console] fix the bash completion on macOS and cover more option modes
- 283abf9: [Console] fix the bash completion of "--option=value" and of an aliased command
- ce4f440: [Console] do not evaluate the command line in the zsh completion
- 4fd61ee: [WebProfilerBundle] fix a TypeError when the ajax toolbar panel is missing from the page
- 788ace9: [String] fix singularization of words ending in -ives
- 4c18bb5: [HttpFoundation] fix hitting the PCRE size limit with many trusted host patterns
- cb0d402: [PropertyInfo] do not prefer a method returning the declaring class as the property accessor
- 7ae77ca: [Mime] reject header names containing non-printable or non-ASCII characters
- 701c938: [HtmlSanitizer] drop relative URLs whose first path segment contains a colon instead of throwing
- 6285a43: [Mailer, Notifier] mark webhook secrets as sensitive
- 8c84e00: [Mailer, Notifier] reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers
- e0f5a76: [Mailer] reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers
- 3791801: [Mailer, Notifier] verify webhook signatures before parsing the payload
- 21241f1: [JsonStreamer] fix generator stream exhaustion on chunked file reading
- 1ebccec: [Notifier] fix typo in Bluesky transport exception message
- 7a7cb11: [String] fix localeTitle() titlecasing only the first word when the locale has no transliterator
- 177a6c7: [VarDumper] fix dumping class names to the dump server
- 75ee906: [Scheduler] fix duplicated schedule message when multiple methods in a class use #[AsCronTask]
- 00d1505: [Console] fix signal handling of invokable commands registered through the container
- 7c52a22: [Console] make method-level #[AsCommand] names relative to the class-level one
- 4393cdb: [Mailer] reject an empty secret in the Azure webhook parser
- 647af27: [Mailer, Mime] update the RFC references and document what Address validates
- 4ebe3e5: [FrameworkBundle] add "framework.webhook.no_private_network" and "framework.webhook.http_client" options
- 50b0d81: [Messenger] support raw Redis stream messages
- 5605faf: [Mailer, Notifier] deprecate reading a non-boolean value with Dsn::getBooleanOption()
- bce08b3: [Mailer] support tags in the MailerSend transports
- 07709d2: [Lock, Messenger, Notifier] add the "ssl" DSN option to select the HTTP scheme
- d09510b: [Form] add the "form.post_validate" event
- 81fb59e: [Tui] add KeyBindingWidget
- 99f824c: [Tui] add CollapsibleWidget
- e2fda34: [Tui] keep a widget's listeners across detach, and add off() to release them
- 262451a: [Security] add an OIDC Authorization Code Flow authenticator
- 8144a9f: [Tui] add tab widget
- 340586b: [Serializer] support extensible discriminator map via child attribute
- 57d450b: [Form] use the POST_VALIDATE event in PasswordHasherExtension
- 6d46a24: [Mailer, Mime] add RFC 6854 group support to mailbox list headers
- 5617fa0: [Messenger] add claim check support
- 0449d5c: [Yaml, FrameworkBundle] add JSON Schema validation to the lint:yaml command
- f3c0b6a: [HttpKernel, RateLimiter] add option to expose X-RateLimit-* headers for the #[RateLimit] attribute
- fd64a46: [Messenger] add AMPHP SQL messenger transport
- 9fb98ad: [Messenger] add SQS system attributes of received messages to AmazonSqsReceivedStamp
- 4612d33: [Finder] add root-relative directory excludes via / prefix in exclude()
- d2be782: [FrameworkBundle] remove dev requirement on symfony/amp-sql-messenger
- a6d9bac: [Config, FrameworkBundle, Yaml] fix schema violation lines and the list form of keyed maps
- 03097ea: [Console] declare docblock types for parameters of addArgument() and addOption()
- 0f33c88: [Security] add OIDC token-endpoint client authentication methods
- f80cfe3: [SecurityBundle] always register the OIDC login callback route loader
- 0ae9a49: [Yaml] walk the document to resolve schema violation lines
- 7b08227: [Translation] add translation:update-xliff-sources command
- 3798b58: [Form] add #[AsFormType] and #[FormField] attributes to define form types on data classes
- eae2b16: [Security] verify the OIDC ID token signature against the provider JWKS
- a7e7eb8: [SecurityBundle] require the OIDC ID token signature verification for public clients
- f3509f0: [Security, SecurityBundle] add OIDC PKCE, max_age, authorization-request and start-route options
- 3f96455: [Security, SecurityBundle] add OIDC claims source, user-identifier mapping and RP-Initiated Logout
- cdc6c0b: [Messenger] force quit messenger:consume and messenger:failed:retry on repeated SIGINT
- d991fc9: [Security] allow AuthorizationChecker::isGrantedForUser to check for guest permissions
- 718e281: [Mailer] add RemoteTemplateEmail to send emails rendered from provider-hosted templates
- 7ab6d43: [Mailer] add RemoteTemplateEmail support to the remaining bridges with provider-hosted templates
- 3370aa2: [Form] add an allow_array_submission option to let PRE_SUBMIT listeners transform submitted arrays
- 68f2352: [Filesystem] deprecate passing an empty string as the base path to Path::isBasePath()
- c820a90: [Cache] add MongoDB cache adapters
- 2f26170: [Security] tell why an authenticator did not support the request in the profiler
- 9f992bb: [Cache, Lock, Messenger] track the Symfony component in the MongoDB driver handshake
- 77eda6f: [RateLimiter] stop consuming from the remaining limiters once one rejects the hit
- 4520f5e: [RateLimiter] allow overriding the key of a compound limiter's sub-limiters
- 470440a: [Mailer] add PufferPost bridge
- e747895: [Messenger] add routing information to the debug:messenger command
- 4deeb4f: [Security] deprecate passing more than one attribute to AccessDecisionManager::decide()
- ecf1cb6: [String] add a $regexp argument to the case conversion methods
- e154713: [Security] add a current_user() function to the expression language provider
- cda9102: [String] fix ByteString::title() titlecasing only the first word of a match
Newest issues and pull requests
- [Console] Add docker-style sub-commands, resolved as command trees from registered names
- [Console] Register class-level #[AsCommand] groups and let the attribute list options
Symfony Jobs
These are some of the most recent Symfony job offers:
- Symfony Developer at Steward
Part-time / Temporary - $8,700 – $13,000 / month
Full remote
View details - Symfony Developer at ATH
Contract / Freelance - €25 – €50 / hour
Full remote
View details
You can publish a Symfony job offer for free on symfony.com.
SymfonyCasts Updates
SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.
This week, SymfonyCasts published the following updates:
- New course announced: Symfony Security: Going Further
- (Video) Symfony Security: The Basics: Creating a Registration Form
- (Video) Symfony Security: The Basics: Security Events: Tracking the Last Login
They talked about us
- Precognition in Symfony: validating a request without running the controller
- Blind Index: Searching an Encrypted Column Without Decrypting It
- Postgres RLS in Symfony: with one tenant in the fixture, your isolation suite passes with no policy at all
- Six Months Later, the Bundle Is Still Alive
- 100% line coverage did not catch the one bug that mattered
- When HTTP Retries Become Dangerous: Idempotency in Symfony Without the Fairy Tales
- When X-Forwarded-For Lies, aka the Client IP Problem Behind CloudFront, AWS WAF and Symfony
- L'autocomplétion zsh avec Composer et Symfony console
- FrankenPHP : ce que ça change, et ce qu’il ne faut pas oublier
Upcoming Symfony Events
- Symfony Meetup Köln: Cologne, Germany (September 24, 2026)
- Sylius France Community Meetup by ACSEO: Aix en Provence, France (September 28, 2026)
Call to Action
- Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
- Subscribe to the Symfony blog RSS and never miss a Symfony story again.