This week, Symfony 5.4.28 and 6.3.4 maintenance versions were released. Meanwhile, the upcoming Symfony 6.4 version added a new AutowireLocator attribute, improved the security of the login throttling logs, and added a command to download missing AssetMapper packages. Lastly, we announced the last Call for Papers days and a hackathon for the SymfonyCon Brussels 2023 conference.

Symfony development highlights

This week, 32 pull requests were merged (30 in code and 2 in docs) and 24 issues were closed (24 in code and 0 in docs). Excluding merges, 18 authors made 1,047 additions and 330 deletions. See details for code and docs.

5.4 changelog:

  • f874dd2: [HttpFoundation] fix base URI detection on IIS with UrlRewriteModule
  • 6b34c00: [Security] fail for non-string password in FormLoginAuthenticator
  • 5ab06a1: [VarDumper] fix managing collapse state in CliDumper

6.3 changelog:

  • e4ada73: [Serializer] fix serialized name with groups during denormalization
  • bf4ea59: [Serializer] fix deserializing of nested snake_case attributes using CamelCaseToSnakeCaseNameConverter
  • 469f1cc: [Serializer] fix deserializing object collection properties
  • 02bd9da: [HtmlSanitizer] allow league/uri v7
  • 897a054: [AssetMapper] improve the error message when a downloaded file is missing
  • 0ef6b32: [Security] fix loading user from UserBadge
  • a3b0d89: [Security] prevent creating session in stateless firewalls
  • cd5af8b: [Mailer] fix attachment base64 content string in MailerSendApiTransport

6.4 changelog:

  • 3265ec2: [Clock] add $modifier argument to the now() helper
  • 060ee11, 7f49e8d: [FrameworkBundle] deprecate not setting both framework.session.save_path and framework.session.handler_id at the same time
  • c64214c: [DependencyInjection] add #[AutowireLocator] attribute
  • f354c1e: [FrameworkBundle, Validator] deprecate annotation occurrences
  • 8462874: [HttpKernel] fix checking for the runtime mode in DebugLoggerConfigurator
  • 394d52c: [Security] hide username and client IP in throttling logs
  • 991d81e: [Validator] un-deprecate passing an annotation reader to AnnotationLoader
  • 609ec6b: [Serializer] remove @SerializedPath annotation from test
  • c24906f: [AssetMapper] add command to download missing downloaded packages

7.0 changelog:

  • d906ee8: [Form] use never return type in form events
  • 056c66e: [FrameworkBundle, Validator] remove remaining deprecations
  • d510239: [FrameworkBundle] remove compat code

Newest issues and pull requests

They talked about us

Call to Action

Published in #A week of symfony