This week, Symfony introduced standalone bundles for the framework features (MessengerBundle, HttpClientBundle, PropertyInfoBundle, etc.), added Docker-style console subcommands, and expanded OAuth2 and OpenID Connect support. In addition, we announced the workshop lineup and some of the talks for SymfonyCon Warsaw 2026.

Symfony development highlights

This week, 135 pull requests were merged (111 in code and 24 in docs) and 57 issues were closed (44 in code and 13 in docs). Excluding merges, 33 authors made additions and deletions. See details for code and docs.

6.4 changelog:

  • 7639c32: [FrameworkBundle] fix the "framework.remote-event" config node being impossible to set
  • ac532cb: [Validator] drop unreachable territory keys from IBAN formats
  • 7aef69f: [FrameworkBundle] fix HTTP client request assertion matching
  • e27347d: [Cache] don't close lock handles that are still in use when evicting a slot
  • bf867d5: [Serializer] don't reuse list items with deep_object_to_populate
  • ab53e54: [Messenger] fix sub-second delays being ignored by the in-memory transport
  • 2ece1b4: [Security] read the OIDC verified claims as booleans
  • 24fbf84: [HttpClient] suppress warnings from failed DNS lookups
  • ccce7db: [Security] do not follow redirects on the OIDC UserInfo endpoint
  • 5229781: [Finder] fix ignoreVCSIgnored() when the search directory is reached through a symlink
  • 59f2f7f: [Finder] fix building the gitignore regex for files with many patterns
  • 3b025e1: [Mailer] reconnect when the server closed the transmission channel
  • ed616f8: [FrameworkBundle] fix the fatal when a cache pool cannot be cleared
  • 7b5f902: [Finder] only treat a leading hash as a gitignore comment and strip trailing spaces only
  • 1e963a2: [Console] keep messages containing malformed UTF-8 when wrapping
  • 5e923dd: [DoctrineBridge, FrameworkBundle, HttpKernel, TwigBundle] escape percent signs in kernel path parameters
  • aefdd89: [String] keep the case of a leading acronym in ByteString::camel()

7.4 changelog:

  • 17b5084: [Security] answer 401 instead of 500 when the introspection request fails
  • 665e8b0: [Security] read the "active" member of an introspection response as a boolean
  • 9d20102: [FrameworkBundle] fix referencing "lock.factory" when no default lock resource is configured
  • c866f35: [FrameworkBundle] fix configuring the S/MIME encrypter cipher
  • 73507c0: [Security] read the OAuth2 verified claims as booleans
  • da418a7: [Messenger] fix Beanstalkd reconnect mechanism
  • f975612: [Messenger] fix Beanstalkd keepalive when triggered during another command
  • 3385153: [Security] do not follow redirects on the OIDC JWKS, OAuth2 introspection and CAS validation endpoints

8.1 changelog:

  • 8fc561e: [FrameworkBundle] fix container compilation when a JsonPath function is registered
  • 05ab489: [SecurityBundle] make two tests survive the FrameworkBundle split of the branch above
  • 05450df: [Tui] measure malformed UTF-8 instead of throwing
  • 1e00f6c: [Tui] fix cursor jumps and partial rendering of overheight frames
  • 81cf254: [Tui] scroll overheight frames that grow instead of repainting the viewport
  • 49b2223: [DependencyInjection] Deep-clone only the mutable parts of a prototype definition

8.2 changelog:

  • 8eed7c2: [PropertyAccess] add wildcard reads
  • c2f0eeb: [Mailer, Sweego] add support for CC and BCC recipients
  • 2bf00a9: [Security] renew the OIDC access token with the refresh token grant
  • 9200ad2: [Security, SecurityBundle] serve the RFC 9728 protected resource metadata of an access_token firewall
  • b074009: [Security, SecurityBundle] require OAuth2 scopes on resources protected by an access token
  • a0a3d6d: [Security, SecurityBundle] make the OAuth2 introspection token handler usable
  • d2e0f17: [Security, SecurityBundle] add RFC 9701 signed introspection responses
  • d8cb689: [SecurityBundle] default the access token signature algorithms to RS256
  • 1595734: [Security, SecurityBundle] read the introspection signature keys from the authorization server metadata
  • 47ddd22: [Security, SecurityBundle] inject the OAuth2 client authentication into the OIDC client
  • ea16f2e: [Console] add docker-style sub-commands, resolved as command trees from registered names
  • a979086: [SecurityBundle] add an "http_client" option to the "oidc_login" authenticator
  • 38c4888: [Security] harden the oidc_login authenticator against malformed provider data and mix-up attacks
  • 31c8cd9: [Security, SecurityBundle] let the oidc token handler answer for several audiences
  • 4409df4: [Console] register class-level #[AsCommand] groups and let the attribute list options
  • 99b258a: [DependencyInjection, HttpKernel] instantiate on demand the bundles that have nothing to do at boot time
  • 1bb575d: [Config, DependencyInjection, FrameworkBundle] allow a configuration node to alias the configuration of another extension
  • 84003c7: [FrameworkBundle, Workflow] add WorkflowBundle
  • a1f8660: [FrameworkBundle, JsonPath, Mime, ObjectMapper, Process] add bundles for the components that own no configuration key
  • 0a73ec6: [FrameworkBundle, RemoteEvent, Semaphore, WebLink] add bundles for the sections with no cross-section coupling
  • 5a79078: [FrameworkBundle, HtmlSanitizer] add HtmlSanitizerBundle
  • 102319b: [FrameworkBundle, PropertyAccess, TypeInfo, Uid] add bundles for the sections needing one inversion
  • b7b8f40: [FrameworkBundle, Lock] add LockBundle
  • e8f7c6e: [Cache, FrameworkBundle] add CacheBundle
  • edbf20d: [FrameworkBundle, Messenger] add MessengerBundle
  • 9542a92: [FrameworkBundle, Scheduler] add SchedulerBundle
  • d68be53: [FrameworkBundle, JsonStreamer] add JsonStreamerBundle
  • 305fbdc: [FrameworkBundle, PropertyInfo] add PropertyInfoBundle
  • 32f7b0f: [AssetMapper, FrameworkBundle] add AssetMapperBundle
  • 1cdc3be: [FrameworkBundle, RateLimiter] add RateLimiterBundle
  • 61c0d33: [FrameworkBundle, Webhook] add WebhookBundle
  • d4ae7d9: [FrameworkBundle, HttpClient] add HttpClientBundle
  • efc11f4: [FrameworkBundle, Mailer] add MailerBundle
  • 2492972: [FrameworkBundle, Notifier] add NotifierBundle
  • 8dae404: [Security] do not follow redirects on the OIDC token, UserInfo and JWKS endpoints
  • c79f7e7: [Asset, FrameworkBundle] add AssetBundle
  • 97b8c5d: [FrameworkBundle, Routing] add RouterBundle
  • 6023964: [FrameworkBundle, Serializer] add SerializerBundle
  • b4fdf11: [FrameworkBundle, Validator] add ValidationBundle
  • 4a4b29d: [DependencyInjection] name the package to install for a missing component extension
  • 89496d4: [Security] improve OIDC secure URL checks
  • 5edf994: [FrameworkBundle] fix the pass order so unwired services are removed before the passes that collect them
  • cf29b9b: [Cache, FrameworkBundle, Serializer, Validator] move the cache warmers into their own components
  • 90f7e56: [FrameworkBundle] move every configuration section to a bundle shipped by its own component
  • e95b475: [DependencyInjection] add the "container.remove_if_missing" tag
  • 0546760: [FrameworkBundle] move the passes and commands that act on another package to that package
  • 084d243: [Validator] add #[WithHttpStatus(422)] to ValidationFailedException
  • c1baf75: [Notifier] deprecate the LineNotify bridge
  • 777d898: [TypeInfo] collect templates in declaration order
  • 53a762a: [EventDispatcher] allow getSubscribedEvents() to name its keys
  • 464abd7: [DependencyInjection] pass top-level extension values that are not arrays to the extension
  • 3e88113: [Serializer] resolve generic template types during denormalization
  • ef3dd52: [Notifier] support per-message recipient in the LineBot bridge
  • c2e203a: [HttpKernel, Routing] perform scheme redirects before any other listener runs
  • 2d43fa6: [Console] autowire the lock factory named "console" in LockableTrait

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Symfony Developer at Steward
    Part-time / Temporary - $8,700 – $13,000 / month
    Full remote
    View details
  • Symfony Developer at ATH
    Contract / Freelance - €25 – €50 / hour
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts announced a new course:

They talked about us

Upcoming Symfony Events

Call to Action

Published in #A week of symfony