This week, Symfony continued unveiling new Symfony 8.2 features, including new Messenger options and better performance, role hierarchy improvements, JSON Schema for configuration, and new Mailer features. In addition, Symfony UX 3.5 was released with a new Pagination package and many other improvements, and Twig 4.0 introduced runtime block composition. Finally, we published a new case study about Yuka and announced more talks for the upcoming SymfonyCon Warsaw 2026.

Symfony development highlights

This week, 167 pull requests were merged (135 in code and 32 in docs) and 62 issues were closed (26 in code and 36 in docs). Excluding merges, 47 authors made additions and deletions. See details for code and docs.

6.4 changelog:

  • 5c9a38a: [Messenger] fix InMemoryTransport delay when it spans a DST transition
  • db74510: [Workflow] escape the hash in Mermaid labels
  • b5bff47: [FrameworkBundle] fix DotenvVault corrupting a value that contains a back-reference
  • fa9a95f: [Messenger] fix sub-second delays being lost by the Doctrine transport
  • 185070c: [ErrorHandler] remove the backtrace from the array kept by FatalError
  • 2fac413: [HttpClient] don't set CURLOPT_WRITEFUNCTION from within the write callback
  • 5c84169: [DependencyInjection] fix moving tags to the outermost decorator when a decorator is decorated
  • c668950: [Messenger] avoid priority 0 when retrying AMQP messages
  • 86b9e70: [Uid] fix comparing a Uuid with a Ulid
  • d5a6ba8: [Serializer] fix denormalizing the discriminator type property when a name converter renames it
  • 0e5cab2: [HttpFoundation] make session handlers non-serializable
  • 423a67d: [Messenger] fix a doctrine/dbal 4.5 deprecation in DoctrinePostgreSqlFilterIntegrationTest
  • 564db2e: [HttpClient] don't reject highly compressed responses
  • cdb6936: [HttpClient] fix NativeHttpClient::stream() skipping responses not opened yet
  • 6cad787: [SecurityBundle] dispatch the events of firewalls sharing a context on their own dispatcher
  • ffc05a1: [Doctrine] resolve DBAL types through the connection instead of the static registry
  • 926ca5d: [WebProfilerBundle] fix long URLs overflowing the AJAX requests table in the toolbar
  • ec2e9ae: [WebProfilerBundle] truncate long non-GET URLs in the AJAX requests table
  • f8b6e6f: [Form] stop using the deprecated any() matcher in ValidatorExtensionTrait
  • 74adc1a: [Finder] avoid quadratic backtracking when globs contain consecutive stars
  • 1f9f467: [HttpKernel] fix reading the listeners of the default dispatcher from an unserialized EventDataCollector
  • 95dd9c0: [Finder] treat a .git file as the repository root in ignoreVCSIgnored()
  • 9bd069f: [DoctrineBridge] fix DoctrineExtractor for uid types and collections indexed by custom types
  • fcfe176: [Serializer] fix quadratic time when collecting denormalization errors
  • 7560c58: [Yaml] fix several parsing edge cases
  • 3775511: [Yaml] fix !!str and !!float tags on block scalars
  • 8b2693a: [Yaml] fix tabs in block scalars and comments after empty ones
  • 6261351: [Scheduler] fix stateful schedules skipping every run when the checkpoint cannot be saved

7.4 changelog:

  • 92b0b08: [Security] keep the real role names in the labels of the Mermaid dump
  • 69419f0: [SecurityBundle] make the remember-me config tree independent from the session config
  • 9322503: [Validator] fix Range PHPDoc to accept \DateTimeInterface min/max
  • 2b39fff: [Uid] fix UuidV7 ordering when the clock goes backwards
  • a194d22: [WebProfilerBundle] mark EventSource requests as finished when closed
  • 29a4281: [WebProfilerBundle] fix EventSource::close() on requests already finished or cleared
  • fe67450: [AssetMapper] fix CSS and JSON loaders breaking under es-module-shims
  • 92172c1: [Validator] prevent ffprobe option injection from video filenames
  • e3a4eed: [TypeInfo] fix class names resolution in the global namespace
  • 0fc3679: [HttpKernel] don't send headers again in HttpKernel::terminateWithException()
  • 983846b: [TypeInfo] fix resolving class keyword constants without type context
  • 536ea2d: [TypeInfo] fix resolving unknown class constants
  • eaedf88: [TypeInfo] fix array shape keys resolution in StringTypeResolver

8.1 changelog:

  • 9aa60b0: [Uid] fix Ulid::isValid() accepting base-58 strings above 2^128
  • 7737789: [HttpClient] align GuzzleHttpHandler with Guzzle when on_headers throws

8.2 changelog:

  • bb804ad: [Security] record the OIDC acr claim and name the attribute that started a re-authentication
  • 9031d63: [KeyManagement] let the AWS factory take the application's HTTP client
  • 838edaa: [FrameworkBundle] fix deprecated class aliases missing from the class map
  • d4ed974: [Security] read an OIDC authorization response the provider posted (form_post)
  • 6e7551e: [Config, FrameworkBundle, Lock, SecurityBundle] make the config trees independent from runtime state
  • 4c03d4d: [PhpUnitBridge] add DebugClassLoader issue trigger resolver
  • dd9b2dc: [KeyManagement] add CompositeKms, a client wrapping under several providers
  • 8015b6f: [HttpClient, WebProfilerBundle] show the duration and the transferred sizes of each request in the profiler
  • fe413d9: [Validator] allow Valid in Sequentially
  • 86b6948: [DependencyInjection, EventDispatcher] order tagged services and listeners with before/after constraints
  • 6a7cf3d: declare the ordering dependencies of listeners with before/after
  • 08d4f4c: [KeyManagement] let store.max_age express "never rotate" with null
  • 4ab2eff: [Form] add the entry_name option to CollectionType and PolymorphicCollectionType
  • af69f61: [Uid] stop relying on the uuid extension, and speed up conversions
  • 2b520d1: [DependencyInjection] accept non-array extension values in the AppReference shape
  • 92afce6: [Config] reject env placeholders of unknown type on array nodes
  • 849c3cb: [Uid] fix detecting forks after the clock went backwards
  • 4f75d5b: [HttpClient] expose HTTP trailers as the trailers response info
  • 991d8b0: [KeyManagement] fix a doctrine/dbal 4.5 deprecation in DataKeyStoreTest
  • 7a74946: [Serializer] deprecate denormalizing a property using its raw name when a name converter is configured
  • 1a0f879: [HttpClient] add support for the on_trailers request option to GuzzleHttpHandler
  • ecca80e: [KeyManagement] memoize Flysystem keys with optional reset
  • 11dc19d: [KeyManagement] refresh rejected KMS tokens after 401 responses
  • 69e66e3: [DependencyInjection] ignore env vars of overridden values forwarded by extension aliases
  • f7c2ce0: [HtmlSanitizer] speed up allowSafeElements() and allowStaticElements()
  • caf9f7a: [Routing] speed up URL generation by skipping steps that do nothing
  • 51ffe80: [Config] avoid creating an exception on each config cache freshness check
  • b5493f7: [AssetMapper] skip mapper lookups for the public paths rendered by the import map
  • de34bd7: [DependencyInjection] write the container directory with one rename instead of one per file
  • aa9f9cd: [HttpKernel] compress profiles with gzip level 1
  • 540085e: [Intl] look for the plain data file before the compressed one
  • 727cf2b: [Cache] check filesystem pool directories through the realpath cache
  • 12b3110: [HttpFoundation] speed up parsing Cache-Control headers
  • 53eb51a: [EventDispatcher, HttpKernel] build the stubs of listeners only when the events panel is displayed
  • 5285d65: [HttpKernel, VarDumper] skip source excerpts in the traces of collected deprecations
  • ffd3985: [DependencyInjection] preload EnvNotFoundException
  • 98bf1e8: [Config] speed up GlobResource freshness checks using directory mtimes
  • 2b376c4: [KeyManagement] validate Azure Key Vault key IDs
  • 69c1ef4: [Validator] prevent ffprobe option injection from filenames
  • e53e3c0: [Validator] reduce memory usage in WordCountValidator
  • 085b935: [Translation] register each translations directory once
  • 227985c: [SecurityBundle] make the expression language and the handlers of authenticators lazy
  • e375ae7: [Config] detect changes made in the same second as a cache was built
  • 5d81d2e: [Cache] skip APCu in system caches when OPcache is enabled and their directory is writable
  • 91a2445: [FrameworkBundle] register the secrets env var loader only when a vault directory exists
  • 172e4ad: [AssetMapper] keep the decoded compiled metadata in the system cache
  • d5aeac6: [DependencyInjection] replace env placeholders in one pass in ContainerBuilder::resolveEnvPlaceholders()
  • 575cc5f: [SecurityBundle] skip registering the web-token algorithms when the library is not installed
  • 7ad5e3d: [DependencyInjection] skip redundant filesystem checks when looking for vendor paths
  • c149e61: [HttpKernel] finish the response before saving profiles
  • 5b23e4e: [Yaml] add support for parsing a block scalar as the root node
  • ef79b50: [Cache] skip including missing files in PhpFilesAdapter
  • 9eb97f2: [Cache] return hits of the first adapter directly from ChainAdapter::get()
  • 515b83e: [Cache] return hits from get() before creating the compute closure
  • 7733a5d: [FrameworkBundle] clone only the definitions that hold env vars when dumping the container for debug
  • fcc0c33: [Cache, Contracts] share the early-expiration check of CacheTrait with ContractsTrait
  • 33eed31: [Yaml] handle tags on block scalars as on other values
  • 6ea4859: [Cache, Contracts, Scheduler] report failed saves through the $metadata argument of CacheInterface::get()
  • 6229830: [AssetMapper] conflict with outdated Symfony UX packages

Newest issues and pull requests

Symfony Jobs

These are some of the most recent Symfony job offers:

  • Symfony Developer at Steward
    Part-time / Temporary - $8,700 – $13,000 / month
    Full remote
    View details
  • Symfony Developer at ATH
    Contract / Freelance - €25 – €50 / hour
    Full remote
    View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

They talked about us

Upcoming Symfony Events

Call to Action

Published in #A week of symfony