This week, Symfony maintenance versions 6.4.46, 7.4.19, and 8.1.7 were released. Meanwhile, we kicked off the "New in Symfony 8.2" blog series and SymfonyCasts published a new Symfony Security: The Basics course. Finally, we announced the last days to get regular tickets for SymfonyCon Warsaw 2026.

Symfony development highlights

This week, 141 pull requests were merged (103 in code and 38 in docs) and 59 issues were closed (27 in code and 32 in docs). Excluding merges, 41 authors made additions and deletions. See details for code and docs.

6.4 changelog:

  • d7ff22d: [Form] describe the options of a type extension registered on a type extension
  • c59e1fa: [TwigBridge] compose form theme blocks with Twig's BlockChain when available
  • 41a8d9d: [HttpFoundation] remove the ambiguity that makes HeaderUtils::split() backtrack
  • 6f81740: [Security] explain why a remember-me login counts as interactive
  • 537fc0a: [HttpFoundation] fix port stripping on IPv4-mapped IPv6 forwarded addresses
  • 63fe071: [Serializer] make MetadataAwareNameConverter caches per instance
  • 8593e50: [HttpClient] add missing non-routable ranges to NoPrivateNetworkHttpClient
  • a9246b5: [Security] fix the type declared for the event dispatcher
  • 5f59304: [Security] document that user checkers run on every authentication
  • ad13f2e: [Yaml] fix the line offset handed to nested block parsers
  • cd198fd: [Notifier] fix the event dispatcher type of the FakeChat transports
  • a3a4fc8: [FrameworkBundle] cache the serializer metadata in debug mode when it comes from mapping files
  • 8dd02c1: [Console] fix quadratic formatting of non-ASCII content
  • b25e0d7: [Lock] document that only the owning key can release a lock
  • 2eb4033: [ErrorHandler] stop recursing when the logger keeps throwing
  • c810597: [ErrorHandler] use the fatal error backtrace provided by PHP 8.5

7.4 changelog:

  • abfeda3: [Messenger] make PhpSerializer::getMessageType() agree with unserialize()
  • 2195be8: [Messenger] fix keepalive on the Amazon SQS transport
  • 58c855d: [Messenger] do not drop the Beanstalkd keepalive raised during a command
  • 084e34f: [Messenger] keep the worker running when a keepalive fails
  • 3b3fff2: [Messenger] hold the signals until the SQS request is actually sent
  • 59121cd: [Validator] fix the Video constraint ignoring its codec and container options

8.2 changelog:

  • e9d4b77: [KeyManagement] add a new component for Key Management Systems
  • 2a4c1c3: [Form, PropertyInfo] reduce the cost of the "empty_data" guess and of getWriteInfo()
  • c293120: [FrameworkBundle] add a "configure_container" option to WebTestCase::createClient()
  • 24a3fb6: [Messenger] extract the failed-message logic out of the console commands
  • 013a20b: [FrameworkBundle, Messenger] add MessengerAssertionsTrait to test in-memory transports
  • c7b200e: [Security, SecurityBundle] add IS_AUTHENTICATED_RECENTLY to require a fresh authentication
  • 322f9e1: [FrameworkBundle, SecurityBundle] remove inert "extended-type" tag attributes
  • c4b9e82: [Security] stamp auth_time from the OIDC ID token claim
  • 490dc46: [Form] extract the "empty_data" guesser and guess through a simple property_path
  • 2f2c543: [Translation] extract messages from ternary and null-coalescing expressions
  • 3187ea7: [Security] decide IS_AUTHENTICATED_RECENTLY through the trust resolver
  • cb848dc: [Security, SecurityBundle] add a re-authentication entry point
  • bdd9eb6: [Security, SecurityBundle] allow tailoring the OIDC authorization request per request
  • fadcfb0: [Security] let OidcLoginAuthenticator start a re-authentication
  • 11e7cbc: [Form] add BoundsType to render a lower and an upper bound
  • b9205a2: [Messenger] add retry and failure transport support to the sync transport
  • afd026f: formalize dependency to doctrine/persistence
  • ffa9927: [EventDispatcher] add CompiledEventDispatcher
  • e2a604c: [Security] add CheckRefreshedUserEvent to extend the user-change checks
  • 345240c: [Security] record which authentication methods were proven, and when
  • 5c6f287: [Security] add IS_AUTHENTICATED_VERY_RECENTLY, decided by the trust resolver
  • c8d6e97: [Security] add AuthenticationMethodBadge, for an authenticator to state which methods it verified
  • 46d835c: [Scheduler, Security] stop mutating the event dispatcher at runtime
  • a270754: [EventDispatcher] wrap listeners at call time in the traceable dispatcher
  • e3ae404: [EventDispatcher, Messenger] deprecate mutating the event dispatcher of the container at runtime
  • 82322d9: [DependencyInjection] deprecate the EventDispatcherInterface autowiring alias
  • 4f3b5c4: [Contracts, EventDispatcher] add ListenerIntrospectionInterface
  • c33231f: [Security] require "sub" in the OIDC ID token and shorten the nonce
  • 6096638: [Security] run a user checker when the user is refreshed from the session
  • dc74eb3: [FrameworkBundle, Messenger, Scheduler] add framework.scheduler.use_messenger_routing
  • 6ad354e: [Serializer, Validator] skip mapping files for the classes they do not map
  • 11aca3b: [DependencyInjection] dump the compiler log in all environments
  • 7e53a7c: [Mailer] support tenant configuration via the DSN and the X-SES-TENANT header
  • 82ae0e2: [ObjectMapper] infer nested target class from destination property type
  • 2a56495: [HttpFoundation] expose parameter keys as strings
  • 83895d3: [HttpFoundation] expose header and attribute keys as strings
  • b927689: [AssetMapper] add an "asset_mapper.metadata_dir" option
  • 9ead931: [Mailer] keep display names on PufferPost payload addresses
  • 81acb02: [Validator] add the Audio constraint for validating audio files
  • 7367c92: [ObjectMapper] add property metadata factories
  • 6df7f70: [Tui] wrap select list labels and descriptions in aligned columns

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Symfony Developer at Steward
    Part-time / Temporary - $8,700 – $13,000 / month
    Full remote
    View details
  • Symfony Developer at ATH
    Contract / Freelance - €25 – €50 / hour
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Call to Action

Published in #A week of symfony