Symfony 7.4.18 has just been released.

Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.

Tip

Want to be notified whenever a new Symfony release is published? Or when a version is not maintained anymore? Or only when a security issue is fixed? Consider subscribing to the Symfony Roadmap Notifications.

Changelog Since Symfony 7.4.17

  • bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
  • bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)
  • bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
  • bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
  • bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
  • bug #65731 [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
  • bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
  • bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
  • bug #65744 [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
  • bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
  • bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
  • bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
  • bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
  • bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
  • bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
  • bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
  • bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
  • bug #65730 [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
  • bug #65743 [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
  • bug #65729 [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
  • bug #65728 [Routing] Fix matching the "0" URL (@cs278)
  • bug #65727 [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
  • bug #65745 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
  • bug #65726 [Filesystem] preserve source mode when copying files (@nicolas-grekas)
  • bug #65741 [HttpFoundation] Reject invalid paths (@nicolas-grekas)
  • bug #65725 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
  • minor #65724 Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
  • bug #65721 [Lock] Never take the reserved "__write__" member as a Redis lock token (@nicolas-grekas)
  • bug #65718 [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
  • bug #65706 [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
  • bug #65704 [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
  • bug #65693 [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
  • bug #65692 [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
  • bug #65691 [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
  • bug #65690 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
  • bug #65689 [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
  • bug #65686 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
  • bug #65688 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
  • bug #65687 [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
  • bug #65709 [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
  • bug #65710 [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
  • bug #65716 [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
  • bug #65708 [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
  • bug #65712 [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
  • bug #65675 [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
  • bug #65670 [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
  • bug #65700 [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
  • bug #65701 [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
  • bug #65702 [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
  • bug #65677 [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
  • minor #65705 [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
  • bug #65684 [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
  • bug #65685 [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
  • bug #65699 [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
  • bug #65683 [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
  • bug #65682 [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
  • bug #65681 [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
  • bug #65655 [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
  • bug #65664 [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
  • bug #65679 [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
  • bug #65678 [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
  • bug #65676 [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
  • bug #65674 [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
  • bug #65666 [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
  • minor #65695 [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
  • minor #65671 [Form][Validator] Review Dutch (nl) translations (@andrewo0)
  • minor #65680 [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
  • bug #65662 [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
  • bug #65660 [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
  • minor #65653 [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
  • bug #65647 [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
  • minor #65646 Review translations for Estonian (et) (@erkia)
  • bug #65651 [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
  • minor #65645 [Validator] Review Bulgarian (bg) translations (@alkinbg)
  • bug #65644 [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
  • bug #65637 [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
  • minor #65593 [Validator] Improve Serbian translation messages (@kaznovac)
  • minor #65629 [Validator] #65566 Review Turkish (tr) translations (@mmustafaAydogan)
  • minor #65634 [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
  • bug #65630 [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
  • bug #65636 [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
  • bug #65621 [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
  • bug #65619 [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
  • minor #65615 [Validator] Review translations for Russian (ru) (@bifidokk)
  • bug #65607 [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
  • bug #65599 [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
  • bug #65601 [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
  • bug #65598 [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
  • minor #65594 [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
  • minor #65587 [Validator] Review Urdu translations (@UmairRathore)
  • bug #65597 [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
  • bug #65596 [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
  • bug #65589 [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
  • data #64370 Release v5.4.53
Published in #Releases