This week, Symfony 6.4.45, 7.4.18, and 8.1.6 were released with numerous bug fixes and hardening improvements. Meanwhile, we introduced symfony lsp:check, a new command that brings Symfony-aware diagnostics to your CI pipeline, catching unknown routes, missing templates, and configuration errors. Finally, we announced that you'll be able to meet the Symfony Core Team at the API Platform Conference 2026 in Lille on September 17–18.

Symfony development highlights

This week, 191 pull requests were merged (158 in code and 33 in docs) and 44 issues were closed (25 in code and 19 in docs). Excluding merges, 58 authors made additions and deletions. See details for code and docs.

6.4 changelog:

  • d8f8099: [Form] stop capturing Options in the upload_max_size_message closure
  • 892055e: [FrameworkBundle] describe the webhook routing secret in the config reference
  • 4309470: [Mailer] mark the Sendgrid webhook secret as sensitive
  • 075471f: [Notifier] reject an empty secret in the Twilio webhook parser
  • 5c090b9: [Webhook] reject a malformed request body with a 406 instead of a 500
  • 9f41173: [Mime] do not treat an "@" inside the domain as the addr-spec separator
  • 7420a8d: [Mailer, Sendgrid] verify the webhook signature before parsing the payload
  • 7a5183e: [HttpFoundation] match paths with the DOTALL modifier
  • cb30648: [Notifier, Vonage] verify the payload_hash claim of signed webhooks
  • 26456f2: [Mime] never emit a raw control character in a header
  • 3e26161: [Messenger] fix a crash when a Redis stream entry is not a JSON object
  • 5230b74: [Console] test the shell completion scripts and fix the escaping
  • 5439381: [Process] use an absolute path for the cmd.exe fallback on Windows
  • d5eef83: [Form] accept UTC-equivalent timezones for date and time model data
  • 8d7540c: [Finder] fix prune filters not applied to nested directories and with path excludes
  • f94fd8f: [Console] fix the bash completion on macOS and cover more option modes
  • 283abf9: [Console] fix the bash completion of "--option=value" and of an aliased command
  • ce4f440: [Console] do not evaluate the command line in the zsh completion
  • 4fd61ee: [WebProfilerBundle] fix a TypeError when the ajax toolbar panel is missing from the page
  • 788ace9: [String] fix singularization of words ending in -ives
  • 4c18bb5: [HttpFoundation] fix hitting the PCRE size limit with many trusted host patterns
  • cb0d402: [PropertyInfo] do not prefer a method returning the declaring class as the property accessor
  • 7ae77ca: [Mime] reject header names containing non-printable or non-ASCII characters
  • 701c938: [HtmlSanitizer] drop relative URLs whose first path segment contains a colon instead of throwing

7.4 changelog:

  • 6285a43: [Mailer, Notifier] mark webhook secrets as sensitive
  • 8c84e00: [Mailer, Notifier] reject an empty secret in the AhaSend, Mailchimp and Sweego webhook parsers
  • e0f5a76: [Mailer] reject an empty secret in the Mailtrap, MailerSend and Sweego webhook parsers
  • 3791801: [Mailer, Notifier] verify webhook signatures before parsing the payload
  • 21241f1: [JsonStreamer] fix generator stream exhaustion on chunked file reading
  • 1ebccec: [Notifier] fix typo in Bluesky transport exception message
  • 7a7cb11: [String] fix localeTitle() titlecasing only the first word when the locale has no transliterator

8.1 changelog:

  • 177a6c7: [VarDumper] fix dumping class names to the dump server
  • 75ee906: [Scheduler] fix duplicated schedule message when multiple methods in a class use #[AsCronTask]
  • 00d1505: [Console] fix signal handling of invokable commands registered through the container
  • 7c52a22: [Console] make method-level #[AsCommand] names relative to the class-level one

8.2 changelog:

  • 4393cdb: [Mailer] reject an empty secret in the Azure webhook parser
  • 647af27: [Mailer, Mime] update the RFC references and document what Address validates
  • 4ebe3e5: [FrameworkBundle] add "framework.webhook.no_private_network" and "framework.webhook.http_client" options
  • 50b0d81: [Messenger] support raw Redis stream messages
  • 5605faf: [Mailer, Notifier] deprecate reading a non-boolean value with Dsn::getBooleanOption()
  • bce08b3: [Mailer] support tags in the MailerSend transports
  • 07709d2: [Lock, Messenger, Notifier] add the "ssl" DSN option to select the HTTP scheme
  • d09510b: [Form] add the "form.post_validate" event
  • 81fb59e: [Tui] add KeyBindingWidget
  • 99f824c: [Tui] add CollapsibleWidget
  • e2fda34: [Tui] keep a widget's listeners across detach, and add off() to release them
  • 262451a: [Security] add an OIDC Authorization Code Flow authenticator
  • 8144a9f: [Tui] add tab widget
  • 340586b: [Serializer] support extensible discriminator map via child attribute
  • 57d450b: [Form] use the POST_VALIDATE event in PasswordHasherExtension
  • 6d46a24: [Mailer, Mime] add RFC 6854 group support to mailbox list headers
  • 5617fa0: [Messenger] add claim check support
  • 0449d5c: [Yaml, FrameworkBundle] add JSON Schema validation to the lint:yaml command
  • f3c0b6a: [HttpKernel, RateLimiter] add option to expose X-RateLimit-* headers for the #[RateLimit] attribute
  • fd64a46: [Messenger] add AMPHP SQL messenger transport
  • 9fb98ad: [Messenger] add SQS system attributes of received messages to AmazonSqsReceivedStamp
  • 4612d33: [Finder] add root-relative directory excludes via / prefix in exclude()
  • d2be782: [FrameworkBundle] remove dev requirement on symfony/amp-sql-messenger
  • a6d9bac: [Config, FrameworkBundle, Yaml] fix schema violation lines and the list form of keyed maps
  • 03097ea: [Console] declare docblock types for parameters of addArgument() and addOption()
  • 0f33c88: [Security] add OIDC token-endpoint client authentication methods
  • f80cfe3: [SecurityBundle] always register the OIDC login callback route loader
  • 0ae9a49: [Yaml] walk the document to resolve schema violation lines
  • 7b08227: [Translation] add translation:update-xliff-sources command
  • 3798b58: [Form] add #[AsFormType] and #[FormField] attributes to define form types on data classes
  • eae2b16: [Security] verify the OIDC ID token signature against the provider JWKS
  • a7e7eb8: [SecurityBundle] require the OIDC ID token signature verification for public clients
  • f3509f0: [Security, SecurityBundle] add OIDC PKCE, max_age, authorization-request and start-route options
  • 3f96455: [Security, SecurityBundle] add OIDC claims source, user-identifier mapping and RP-Initiated Logout
  • cdc6c0b: [Messenger] force quit messenger:consume and messenger:failed:retry on repeated SIGINT
  • d991fc9: [Security] allow AuthorizationChecker::isGrantedForUser to check for guest permissions
  • 718e281: [Mailer] add RemoteTemplateEmail to send emails rendered from provider-hosted templates
  • 7ab6d43: [Mailer] add RemoteTemplateEmail support to the remaining bridges with provider-hosted templates
  • 3370aa2: [Form] add an allow_array_submission option to let PRE_SUBMIT listeners transform submitted arrays
  • 68f2352: [Filesystem] deprecate passing an empty string as the base path to Path::isBasePath()
  • c820a90: [Cache] add MongoDB cache adapters
  • 2f26170: [Security] tell why an authenticator did not support the request in the profiler
  • 9f992bb: [Cache, Lock, Messenger] track the Symfony component in the MongoDB driver handshake
  • 77eda6f: [RateLimiter] stop consuming from the remaining limiters once one rejects the hit
  • 4520f5e: [RateLimiter] allow overriding the key of a compound limiter's sub-limiters
  • 470440a: [Mailer] add PufferPost bridge
  • e747895: [Messenger] add routing information to the debug:messenger command
  • 4deeb4f: [Security] deprecate passing more than one attribute to AccessDecisionManager::decide()
  • ecf1cb6: [String] add a $regexp argument to the case conversion methods
  • e154713: [Security] add a current_user() function to the expression language provider
  • cda9102: [String] fix ByteString::title() titlecasing only the first word of a match

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Symfony Developer at Steward
    Part-time / Temporary - $8,700 – $13,000 / month
    Full remote
    View details
  • Symfony Developer at ATH
    Contract / Freelance - €25 – €50 / hour
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Call to Action

Published in #A week of symfony