Symfony 8.0.16 was released on July 29, 2026. It is the last release of the 8.0 branch.

Symfony's release policy gives standard versions eight months of support, with bug fixes and security fixes ending at the same time. Symfony 8.0.0 was published on November 27, 2025, so the branch closes at the end of July 2026, right on schedule. From now on, no further bug fix or security release will be published for 8.0, and the branch is frozen.

Every version that ends its life deserves a look back, and this one has a lot to show.

The release where Symfony met modern PHP once again

Symfony 8.0 shipped the same day as Symfony 7.4 LTS, with the same feature set. That is how Symfony majors work: the last minor of a series and the first of the next one are functionally identical, and the major only removes the code deprecated along the way. For 8.0, that meant deleting 13,202 lines of deprecated code and raising the minimum PHP version to 8.4.

Behind those two numbers sat two years of work, more than 7,300 commits and more than 650 new features, contributed by over 615 people.

The PHP 8.4 requirement is what made 8.0 special. It was not a routine version bump: it let Symfony delete its own implementations of things the engine now does natively.

  • Native lazy objects replaced LazyGhostTrait and LazyProxyTrait, so lazy services and Doctrine proxies now rely on the engine instead of generated code.
  • DomCrawler and HtmlSanitizer moved to PHP's native HTML5 parser, which is both faster and closer to what browsers actually do.
  • __sleep()/__wakeup() gave way to __serialize()/__unserialize() across the components.

A framework that gets smaller while gaining features is a rare thing, and 8.0 is the clearest example of it in Symfony's history.

One way to configure an application

Symfony 8.0 removed the XML configuration format and the fluent PHP config format. What remains is YAML and a new PHP format based on array shapes, designed so that your IDE and your static analyzer understand it.

The array shapes are generated from the actual configuration definitions, so autocompletion and type checking come for free. A config/reference.php file is generated automatically to document everything available, and YAML config files get a JSON schema for validation and autocompletion.

Three formats became two, and the two that remain are better tooled than any of the three were.

Commands you write, not scaffold

Invokable commands became the natural way to write console commands. 8.0 added #[Input] to bind a whole DTO, #[Interact] and #[Ask] for interactive prompts, support for BackedEnum arguments, usages declared through #[AsCommand], the Cursor helper, and support for invokable commands in CommandTester.

The boilerplate that used to open every command class is simply gone.

Four components out of the lab

JsonStreamer, JsonPath and ObjectMapper dropped their experimental status in 8.0 and joined TypeInfo as fully supported components covered by the backward compatibility promise. High performance JSON encoding and decoding, JSONPath queries, object to object mapping and PHP type introspection are now part of the stable surface of the framework.

And a long list of smaller things

  • Multi-step forms through FormFlow, with per-step validation and conditional branching.
  • Security voters that explain themselves, with the access_decision() and access_decision_for_user() Twig functions, plus #[IsGranted] restricted by HTTP method and stateless CSRF protection based on Sec-Fetch-Site.
  • An RFC 9111 compliant CachingHttpClient, so client-side HTTP caching finally follows the spec.
  • HTTP QUERY method support, and request body parsing for PUT, DELETE, PATCH and QUERY.
  • Signed messages in Messenger, so queued messages cannot be tampered with before consumption.
  • Weighted workflow transitions, to model processes that need quantities and not just states.
  • UUID v7 by default, with microsecond precision and a MockUuidFactory for deterministic tests.
  • Automatic FrankenPHP worker mode detection, and a configurable APP_SHARE_DIR for data shared across servers.
  • Readable exception traces in the terminal, instead of HTML dumped into your console.

The full story is in the New in Symfony 8.0/7.4 series and the 8.0.0 beta announcement.

Eight months of maintenance, in numbers

Between 8.0.1 on December 7, 2025 and 8.0.16 on July 29, 2026, the branch received 16 patch releases carrying 646 changes: 592 bug fixes, 29 CVEs and 21 data updates. 270 people authored those commits, touching 62 components. The busiest ones were DependencyInjection, FrameworkBundle, Serializer, Messenger, Cache, Console, Validator and HttpClient.

That is the part of a release nobody advertises, and it is the part that makes the framework trustworthy. Every one of those 592 bug reports had someone who took the time to write it up, and someone who took the time to fix it.

What to do now

If you are still on 8.0, you are running unmaintained code as of today. Two supported paths:

  • Upgrade to Symfony 8.1 (released May 29, 2026, maintained until January 2027). The backward compatibility promise applies, so the upgrade should require no change in your code. This is the path to follow if you track the standard release cadence, with 8.2 due in November 2026.
  • Move to Symfony 7.4 LTS (bug fixes until November 2028, security fixes until November 2029). It carries the same features as 8.0, plus the deprecated code layers that 8.0 removed. This is the option for teams that need a long support window rather than the latest features.

The upgrade guide and SymfonyInsight upgrade reports will tell you what needs attention. To avoid being caught out next time, subscribe to the roadmap notifications, which announce new releases and end of maintenance dates ahead of time.

Thank you

Thanks to the 615+ contributors who built Symfony 8.0, and to the 270 who kept it healthy for eight months after its release. Thanks as well to everyone who reported a bug, reviewed a pull request, triaged an issue, translated a message, or updated the documentation.

Symfony 8.0 was backed by Sulu, the CMS for Symfony developers, and by PhpStorm, the JetBrains IDE built for PHP. The Symfony 7.4 LTS release published the same day was backed by SensioLabs, JoliCode, redirection.io and Private Packagist. Support like theirs is what allows this release process, and the eight months of maintenance that follow every version, to exist at all.

See you on 8.1.

Published in #Community #Releases