CHANGELOG for 8.1.x

This changelog references the relevant changes (bug and security fixes) done in 8.1 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1

• 8.1.5 (2026-08-22)

• bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (nicolas-grekas)

• bug #65524 [Security] Match check paths given as a route alias (nicolas-grekas)

• bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (nicolas-grekas)

• bug #65514 [Messenger] Tell apart handler services that share the same class (nicolas-grekas)

• bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (nicolas-grekas)

• bug #65584 [Form] Map violations to child forms named after the snake cased property (nicolas-grekas)

• bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (nicolas-grekas)

• bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (llupa)

• bug #65455 [Console] Do not resolve core utility parameters as command input (lazerg)

• bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (nicolas-grekas)

• bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (nicolas-grekas)

• bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (nicolas-grekas)

• bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (nicolas-grekas)

• bug #65532 [DependencyInjection] Keep % escaping when resolving values against a resolved parameter bag (nicolas-grekas)

• bug #65530 [Form] Apply the configured rounding mode when no scale is set (nicolas-grekas)

• bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (nicolas-grekas)

• bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (nicolas-grekas)

• bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (nicolas-grekas)

• bug #65519 [DomCrawler] Detect the charset from meta tags only (nicolas-grekas)

• bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (nicolas-grekas)

• bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (nicolas-grekas)

• bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (nicolas-grekas)

• bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (nicolas-grekas)

• bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (nicolas-grekas)

• bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (nicolas-grekas)

• bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (nicolas-grekas)

• bug #65508 [Intl] Follow the ICU parent locale when falling back (nicolas-grekas)

• bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (nicolas-grekas)

• bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (nicolas-grekas)

• bug #65502 [Security] Refresh the impersonator while impersonating (nicolas-grekas)

• bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (nicolas-grekas)

• bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (nicolas-grekas)

• bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (nicolas-grekas)

• bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (nicolas-grekas)

• bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (nicolas-grekas)

• bug #65498 [Process] Do not wait for output when the input iterator has more data (nicolas-grekas)

• bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (nicolas-grekas)

• bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (nicolas-grekas)

• bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (nicolas-grekas)

• bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (nicolas-grekas)

• bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (nicolas-grekas)

• bug #65487 [Messenger] Fail when messenger:consume is given no receiver (nicolas-grekas)

• bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (nicolas-grekas)

• bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (nicolas-grekas)

• bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (nicolas-grekas)

• bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (nicolas-grekas)

• bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (nicolas-grekas)

• bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (nicolas-grekas)

• bug #65479 [Form] Fix generating the CSRF token when the form attributes are replaced (nicolas-grekas)

• bug #65474 [DependencyInjection] Fix compiling nested service locators (nicolas-grekas)

• bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (nicolas-grekas)

• bug #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (nicolas-grekas)

• bug #65528 [Security] Track session usage when a lazy firewall reads the token (nicolas-grekas)

• bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (nicolas-grekas)

• bug #65523 [PropertyInfo] Use the same mutator method for types and write info (nicolas-grekas)

• bug #65520 [BrowserKit] Return the most specific cookie when several ones match (nicolas-grekas)

• bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (nicolas-grekas)

• bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (nicolas-grekas)

• bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (nicolas-grekas)

• bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (nicolas-grekas)

• bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (lazerg)

• bug #65500 [Console] Keep backslashes preceding < and > when escaping text (nicolas-grekas)

• bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (nicolas-grekas)

• bug #65477 [Finder] Do not report dangling symlinks as both files and directories (nicolas-grekas)

• bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (nicolas-grekas)

• bug #65471 [Console] Fix clearing more lines than a section holds (nicolas-grekas)

• bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (nicolas-grekas)

• bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (nicolas-grekas)

• bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (nicolas-grekas)

• bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (lazerg)

• bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (nicolas-grekas)

• bug #65535 [Tui] Stop delivering the rest of an over-cap paste as key events (nicolas-grekas, fabpot)

• bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (nicolas-grekas)

• bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (wazum)

• bug #65475 [ErrorHandler] Don't autoload when resolving "@return" class constants (nicolas-grekas)

• bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (nicolas-grekas)

• bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (nicolas-grekas)

• bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (nicolas-grekas)

• bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (lazerg)

• bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (nicolas-grekas)

• bug #65441 [DependencyInjection] Skip abstract classes and interfaces in findTaggedResourceIds() (nicolas-grekas)

• bug #65416 [Tui] Batch of bug fixes (sadiqk2, nicolas-grekas)

• bug #65291 [Serializer] Enforce the element type of scalar collections (nicolas-grekas)

• bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (nicolas-grekas)

• bug #65429 [Cache] Fix numeric string keys being cast to integers (nicolas-grekas)

• bug #65425 [Yaml] Fix parsing an alias followed by a comment (eyupcanakman)

• bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (nicolas-grekas)

• bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (Nitram1123)

• bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (nicolas-grekas)

• bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (nicolas-grekas)

• bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (eyupcanakman)

• bug #65388 [Notifier][Mercure] Add support for Mercure 0.8 (lazerg)

• bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (nicolas-grekas)

• bug #65391 [DomCrawler] Read the whole content of a textarea (nicolas-grekas)

• bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (nicolas-grekas)

• bug #65385 [ObjectMapper] Allow #[Map] on abstract classes (nicolas-grekas)

• bug #65379 [DoctrineBridge] Fix explicit MapEntity mapping being overwritten by a route mapping (nicolas-grekas)

• bug #65365 [Yaml] Restore the default dump output for sequences of mappings (eissasoubhi)

• bug #65366 [ObjectMapper] Only honor an explicitly inbound target #[Map] for the same-name copy (soyuka)

• bug #65376 [Validator] Allow a literal # in the fragment part of Url (lazerg)

• bug #65371 [Translation] Read CSV translations without SplFileObject (nicolas-grekas)

• bug #65372 [HttpFoundation] Declare create_sid() on session handlers (nicolas-grekas)

• bug #65367 Fix PHP 8.6 deprecations (nicolas-grekas)

• bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (tomsommer)

• bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (ousamabenyounes)

• bug #65347 [Tui] Ignore arbitrary hex lengths Color cannot use (sadiqk2)

• bug #65354 [Serializer] Throw on XML data without a root node (nicolas-grekas)

• bug #65344 [Tui] Keep horizontal layout inside the available columns (sadiqk2)

• bug #65341 [Tui] Enforce the paste cap when the end marker is split across reads (sadiqk2)

• bug #65330 [Tui] Stop a column slice at a wide character instead of taking later columns (sadiqk2)

• bug #65331 [Tui] Match ctrl+alt+<letter> in its CSI u encoding too (sadiqk2)

• bug #65321 [Console] Resolve UIDs whatever their format (MatTheCat)

• bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (nicolas-grekas)

• bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (nicolas-grekas)

• bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (nicolas-grekas)

• bug #65309 [VarExporter] Split Exporter::export() so it stops crashing the PHP 8.5 JIT compiler (petrdobr)

• bug #65305 [Messenger] Handle synchronous batch nack (eissasoubhi)

• bug #65303 [FrameworkBundle] Do not leak the response body from assertResponseRedirects() when not verbose (nicolas-grekas)

• bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (eissasoubhi)

• bug #65294 [ObjectMapper] Fix reusing an already mapped object for a different target (ousamabenyounes)

• bug #62352 [Serializer] Convert the elements of scalar collections (nicolas-grekas)

• bug #65288 [Cache] Fix stampede protection not being disabled on CLI (nicolas-grekas)

• bug #65280 [FrameworkBundle] Wire the webhook request parser with the configured header names (nicolas-grekas)

• bug #65274 [Mailer][Notifier] Avoid retaining messages without the profiler (eissasoubhi)

• bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (nicolas-grekas)

• bug #65276 [Tui] Clamp borders that do not fit their container (nicolas-grekas)

• bug #65271 [DependencyInjection] Fix circular references through expressions (eissasoubhi)

• bug #65273 [Notifier][Sevenio] Fix successful sends being reported as failures (lazerg)

• bug #65266 [Tui] Track descendant positions of cached horizontal layout children (fabpot)

• bug #65275 [PropertyInfo] Ignore methods that only look like accessors (nicolas-grekas)

• bug #65268 [Tui] Reuse cached subtrees during vertical layout (fabpot)

• bug #65263 [Console] Keep falsy answers when collecting an array with #[Ask] (sadiqk2)

• bug #65264 [Mime] Do not drop the last line of a resource-backed message (sadiqk2)

• bug #65265 [Uid] Compare times by value in MockUuidFactory (sadiqk2)

• bug #65262 [AssetMapper] Include front controller in dev asset URLs (eissasoubhi)

• bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (bhavin-nakrani)

• bug #65255 [Tui] Fix column width accounting (sadiqk2)

• bug #65254 [Tui] Fix stdin framing and key id decoding (sadiqk2)

• bug #65258 [Console] Restore the catchExceptions state after running a command message (KevinMartinsDev)

• bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (nicolas-grekas)

• bug #65250 [DependencyInjection] Fix class-level tag attributes being overridden by interface-level ones (nicolas-grekas)

• bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (javiereguiluz)

• bug #65240 [WebProfilerBundle] move macros to the template root (xabbuh)

• bug #65242 [Console] Fix parsing #[Target] attribute on arguments of invokable commands (HypeMC)

• bug #65245 [Tui] Treat a zero terminal size as unknown (Bosun18)

• bug #65244 [Tui] Fix stop() scrolling the top of the frame off the screen (Bosun18)

• bug #65239 [Console] Fix terminator handling in the image protocols (nicolas-grekas)

• bug #65196 [Console] Fix decoding chunked Kitty graphics payloads (sadiqk2)

• bug #65197 [Console] Fix writing one-shot iterables to a CombinedOutput (sadiqk2)

• 8.1.4 (2026-08-07)

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (cs278)

• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (sadiqk2)

• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (sadiqk2)

• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (sadiqk2)

• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (sadiqk2)

• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (javiereguiluz)

• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (nicolas-grekas)

• bug #65174 [Tui] Keep ANSI codes ordered when slicing across a color change (smnandre)

• bug #65177 [HttpClient] Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 (peter17)

• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (munzzyy)

• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (ousamabenyounes)

• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (ousamabenyounes)

• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (javiereguiluz)

• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (xabbuh)

• bug #65150 [Tui] Render raw HTML in MarkdownWidget instead of dropping it (lazerg)

• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (lazerg)

• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (ousamabenyounes)

• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (lazerg)

• bug #65149 [DependencyInjection] Resolve factories on "service_container" against the concrete container class (lazerg)

• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (Zombaya)

• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (javiereguiluz)

• bug #65122 [Messenger] Re-send original payload when retrying undecodable messages (SystematicCZ)

• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (eliot488995568)

• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (javiereguiluz)

• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (nicolas-grekas)

• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (nicolas-grekas)

• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (nicolas-grekas)

• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (nicolas-grekas)

• bug #65105 [Uid] Fix the weak-secret guard in Uuid47Transformer for secrets longer than 16 bytes (semx)

• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (RobLogtenberg-Pay)

• bug #65085 [Messenger] Stop the PostgreSQL transport from blocking the worker loop (bzajacc)

• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (wayne530)

• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (nicolas-grekas)

• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (nicolas-grekas)

• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (ousamabenyounes)

• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (nicolas-grekas)

• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (alexisLefebvre)

• bug #65065 [Console] Fix column widths when a row spans columns (wazum)

• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (MarcinOrlowski)

• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (nicolas-grekas)

• bug #64696 [Config] Generate unsealed array shapes for any normalizers (ousamabenyounes)

• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (nicolas-grekas)

• bug #65058 [PropertyAccess] Fix caching of null read info (javiereguiluz)

• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (javiereguiluz)

• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (nicolas-grekas)

• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (nicolas-grekas)

• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (nicolas-grekas)

• 8.1.3 (2026-07-29)

• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (GrahamCampbell)

• 8.1.2 (2026-07-29)

• bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (alexandre-daubois)

• bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (nicolas-grekas)

• bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (nicolas-grekas)

• bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (nicolas-grekas)

• bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (nicolas-grekas)

• bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (nicolas-grekas)

• bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (nicolas-grekas)

• bug #65020 [HttpFoundation] Fix newline handling in server event fields (nicolas-grekas)

• bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (nicolas-grekas)

• bug #65011 [Cache] Add support for relay 0.40 (nicolas-grekas)

• bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (nicolas-grekas)

• bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (nicolas-grekas)

• bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (nicolas-grekas)

• bug #64999 [DependencyInjection] Restore reading "container.behavior_describing_tags" in DecoratorServicePass (nicolas-grekas)

• bug #65008 [HttpKernel] Fix the escaping of the generated curl command (nicolas-grekas)

• bug #65009 [HttpClient] Fix the escaping of the generated curl command (nicolas-grekas)

• bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (nicolas-grekas)

• bug #64995 [Serializer] Prefer serialized name over raw property key (ousamabenyounes)

• bug #64992 [String] Consistently return null for out-of-range offsets (javiereguiluz)

• bug #64986 [HttpKernel] Fix the curl command when a cookie holds an array (maximilian-walter)

• bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (saifulferoz)

• bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (takashiraki)

• bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (Baylox)

• bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (nicolas-grekas)

• bug #64978 [Messenger] Reject a serialized type name that is another message's class name (nicolas-grekas)

• bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (jprivet-dev)

• bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (misaert)

• bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (bendavies)

• bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (voodooism, nicolas-grekas)

• bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (lyrixx)

• bug #64903 [Console] Reduce buffer reallocations in FileInputHelper paste detection (jorgsowa)

• bug #64661 [FrameworkBundle] Register the argument resolver in ConsoleCommandAssertionsTrait::runCommand (fracsi)

• bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (nicolas-grekas)

• bug #64972 [AssetMapper] Reset the mapped asset factory between requests (pokki-deploy)

• bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (pokki-deploy)

• bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (pokki-deploy)

• bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (rjmackay)

• bug #64863 [FrameworkBundle] Keep transport decorators when mock_response_factory is set (alexndlm)

• bug #64864 [HttpKernel] Keep converting scalars of a form payload that carries an uploaded file (Amoifr)

• bug #64825 [PhpUnitBridge] fix finding given config file name (YumeNikki101)

• bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (Amoifr)

• bug #64781 [ObjectMapper] Keep the class-level transform/if of the target's #[Map] in the reverse class-map factory (Orkin)

• bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (Amoifr)

• bug #64868 [Messenger] Avoid redispatching messages from completed batches (Gaitholabi)

• bug #64835 [WebProfilerBundle] Fix crash when injecting the toolbar in a BinaryFileResponse (Fuck4ik)

• bug #64659 [Console] Strip terminal control characters from displayed file names (iliaal)

• bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (iliaal)

• bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (Amoifr)

• bug #64670 [Config] Accept env placeholders for scalar alternatives in generated array-shapes (yvh)

• bug #64938 [Messenger] Do not reject unknown types when no message requires signing (pokki-deploy)

• bug #64935 [PropertyInfo] Ignore mutators with several required parameters (pokki-deploy)

• bug #64937 [Validator] Allow Traverse to be inherited (MatTheCat)

• bug #64654 [Validator] Merge target's own constraints when using #[ExtendsValidationFor] (pokki-deploy)

• bug #64708 [DependencyInjection] Fix lazy + factory service with a leading-backslash class on PHP 8.4 (Amoifr)

• bug #64751 [FrameworkBundle] Make WebTestCase enable web mode by default (MatTheCat)

• bug #64770 [ObjectMapper] Fix explicit #[Map(target:)] being overwritten by a same-name source property (danielpilot)

• bug #64801 [Validator] Allow null groups in ConstraintValidatorTestCase (sjh9714)

• bug #64828 [DependencyInjection] Add supported literal option not_found for imports.[*].ignore_errors in services.schema and AppReference (kaznovac)

• bug #64831 [FrameworkBundle] Fix valkey cache adapters ignoring default_valkey_provider (lazerg)

• bug #64848 [ObjectMapper] Fix per-property #[Map(source:)] being ignored when the target property name also exists on the source (Amoifr)

• bug #64934 [HttpClient] Do not stream empty PSR-18 request bodies (pokki-deploy)

• bug #64931 [TwigBridge] prevent implicit string casts for translatable message objects (xabbuh)

• bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (Amoifr)

• bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (pkranjcecx)

• bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (pokki-deploy)

• bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (Amoifr)

• bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (jnahmias)

• bug #64727 [Routing] Detect circular references in object route parameters (Amoifr)

• bug #64932 Do not expose the BundleAdapter class in the kernel.bundles parameter (mpdude)

• bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (eyupcanakman)

• bug #64843 [Console] Fix table borders around colspan cells and header-less tables (wazum)

• bug #64930 Handle PHP 8.6 removing function arguments in error messages (MatTheCat)

• bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (semx)

• bug #64822 [Config] Escape "*/" in generated array-shape comments (lazerg)

• bug #64857 [Config] Escape comment-closing sequence in generated config builders (sadiqk2)

• bug #64886 [Console] Fix two ValueError crashes on multibyte / multi-column widths (sadiqk2)

• bug #64887 [Cache] Initialize PhpArrayAdapter before classifying keys in deleteItems() (sadiqk2)

• bug #64897 [Messenger][AmazonSqs] Fix fatal on shutdown when the in-flight receive cannot be resumed (vadimgodev)

• bug #64904 [ErrorHandler] Fix fatal error without args triggering an error when calling getTraceFromString (timacdonald)

• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)

• bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)

• bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strings (eyupcanakman)

• bug #64668 [DependencyInjection] Fix env var reported as never used for a removed autowired service (eyupcanakman)

• bug #64915 [Yaml] Fix parsing and dumping of NaN (semx)

• bug #64918 [String] Fix AsciiSlugger::getLocale() TypeError with no locale set (eyupcanakman)

• bug #64920 [Validator] add missing inherited options to Video constraint (xabbuh)

• bug #64891 [TwigBridge] ensure that a label with value "0" is rendered (xabbuh)

• bug #64889 [HttpClient] Replace the native "dechunk" stream filter with a pure PHP implementation (nicolas-grekas)

• bug #64898 [Cache] Remove obsolete return instruction from classes constructors (cedric-anne)

• bug #64895 [Dotenv] Allow multiple underscores at start (Sajito)

• bug #64884 Fix/webprofiler mailer macros 6.4 (HecFranco)

• bug #64877 [Validator] Reject misplaced "X" character in ISBN-10 validation (semx)

• bug #64856 [Console] Fall back to "stty sane" when restoring the captured terminal state fails (lyrixx)

• bug #64649 [Serializer] Fix support check for nested array items (nicolas-grekas)

• bug #64827 jitter shouldn't make scheduler miss runs (mrossard)

• bug #64840 [Tui] Repaint the full screen on resize so multiplexer reattaches are not blank (fabpot)

• bug #64849 [Console] Fix SymfonyStyle questions when using output sections (javiereguiluz)

• bug #64797 [Notifier] add handling for the Prelude bridge to UnsupportedSchemeException (xabbuh)

• bug #64815 [Cache] Remove always-true method_exists() check in FilesystemCommonTrait::__destruct() (munzzyy)

• bug #64794 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (MatTheCat)

• bug #64778 [Console] Fix #[MapDateTime] arguments resolved as strings by BuiltinTypeValueResolver (serhiilabs)

• bug #64791 [Tui] Fix wrapping lines that end with whitespace followed by ANSI codes exceeding the width (fabpot)

• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (thePanz)

• bug #64789 [HttpFoundation] Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (thePanz)

• bug #64739 [PropertyInfo] Prevent PhpDocTypeHelper to wrongly assume keys type (MatTheCat)

• bug #64752 [Yaml] Fix parsing of integers with a leading plus sign (eyupcanakman)

• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (tomm1996, alexander-schranz)

• bug #64734 [Filesystem] Trim trailing whitespace from the tempnam() prefix (Amoifr)

• bug #64732 [String] Fix splice() on multibyte strings (eyupcanakman)

• 8.1.1 (2026-06-27)

• bug #64718 [Serializer] Fix GetSetMethodNormalizer denormalization of constructor only objects (mtarld)

• data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (salvador-castro)

• data #64698 [Validator] reviewed Polish translation unit 146 (thunderer)

• data #64711 [Validator] Ukrainian translation update (VladyslavChernyshov)

• data #64675 [Validator] Add translated messages for the Cron constraint (fabpot)

• bug #64120 [Serializer] honor csv_headers context when no_headers is true (ousamabenyounes)

• bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (nicolas-grekas)

• bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (eyupcanakman)

• bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (Amoifr)

• bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (eyupcanakman)

• bug #49137 [Validator] Avoid TypeError and improve DX when null groups (alamirault)

• bug #64640 Messenger commands don't yet make use of listable Redis capabilities (dpi)

• bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (adrianrudnik)

• bug #64637 [Messenger] Fix #[AsMessage] on abstract classes (MatTheCat)

• bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (pokki-deploy)

• bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (Amoifr)

• bug #64589 [ObjectMapper] Fix self-referencing property mapping (GaryPEGEOT)

• bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (soyuka)

• bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (KevinMartinsDev, nicolas-grekas)

• data #64602 [Form][Validator] Review Hungarian translations (antalaron)

• data #64626 [Form][Validator] Ukrainian translation review and update (VladyslavChernyshov)

• bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (nicolas-grekas)

• bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (nicolas-grekas)

• bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (Amoifr)

• bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (nicolas-grekas)

• bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (nacorp)

• data #64597 Review Indonesian (id) translations (sawirricardo)

• bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (Amoifr)

• data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (Jerdon07)

• bug #64595 [Cache][VarExporter] Add argument $allowNamedClosure to DeepClone to fit ext-deepclone v0.8 (nicolas-grekas)

• bug #64588 Migrate table definitions to DBAL's TableEditor API (nicolas-grekas)

• bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (kbond)

• bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (Pelagoss)

• bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (nicolas-grekas)

• bug #64466 [ObjectMapper] Fix reverse class map throwing on unreadable source (yoye)

• data #64578 [Form][Validator] Review Bulgarian (bg) translations (moynzzz)

• bug #64572 [DependencyInjection] Fix decorating an event listener no longer replacing it (nicolas-grekas)

• data #64564 Remove review state from Serbian translations (Trysha-rbrn)

• data #64565 Remove review state from Russian translations #64512 (centaur-vova)

• bug #64566 Harden __toString trampolines via __unserialize() (nicolas-grekas)

• bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (nicolas-grekas)

• bug #64557 [Translation] Create Crowdin files before uploading translations (MatTheCat)

• bug #64555 [FrameworkBundle] Fix custom config directory being ignored when registering bundles (nicolas-grekas)

• bug #64560 [FrameworkBundle] Avoid resolving all env vars when building the router request context (nicolas-grekas)

• bug #64558 [Security] Make RoleHierarchy::getReachableRoleNames() return a list again (nicolas-grekas)

• data #64550 [Validator] reviewed Polish translation units 143-145 (thunderer)

• data #64551 [Form] reviewed Polish translation unit 129 (thunderer)

• bug #64552 [Cache][FrameworkBundle] Fix warming up caches that hold a closure (nicolas-grekas)

• bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (nicolas-grekas)

• bug #64362 [Tui] Fix vertical align (sblondeau)

• data #64544 [Validator] Review French (fr) translations for XML constraints (lacatoire)

• bug #64474 [HttpKernel] Allow leading zeros in int request attributes (ousamabenyounes)

• bug #64523 [DependencyInjection] Keep behavior-describing tags 'proxy' and 'container.service_subscriber.locator' on decorated services (ousamabenyounes)

• bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (ousamabenyounes, pokki-deploy)

• bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (ousamabenyounes)

• bug #64536 [Form] Don't re-add deleted collection entries on submit (eyupcanakman)

• data #64542 [Form][Validator] Update Spanish translations (ThiagoMirandaLiotto)

• data #64543 [Form][Validator] Review Croatian translations (HypeMC)

• bug #64534 [Tui] Avoid splitting Unicode ellipsis when truncating (rahul chavan)

• data #64526 [Form][Validator] Review and correct Arabic translation (ayyoub-afwallah)

• bug #64527 [Tui] Truncate InputWidget prompt when wider than available columns (ousamabenyounes)

• bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (ousamabenyounes)

• bug #64475 [AssetMapper] Render an empty import map as a JSON object (ousamabenyounes)

• bug #64458 [Webhook] Fix Content-Type key in createRequest method (MarijnDoeve)

• bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (derflocki)

• bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (MatTheCat)

• bug #64424 [Form] Translate TranslatableInterface label in violation messages (Amoifr)

• bug #64359 [Validator] Support SVG dimensions with units (Will-thom)

• bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (XananasX7)

• data #64451 [Form] Add missing translation for invalid UUID (jmsche)

• data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (Trysha-rbrn)

• bug #64441 [FrameworkBundle] Fix dumping the debug container on cache:clear/cache:warmup (nicolas-grekas)

• bug #64443 [DomCrawler] Remove final keyword on ChoiceFormField::addChoice() (syl20b)

• data #64446 [Validator] Add translated messages for the XML constraint (nicolas-grekas)

• bug #64449 [HttpKernel] Fix #[MapRequestPayload] being handled before #[IsGranted] (nicolas-grekas)

• bug #64375 [Notifier] Send message to MS-Teams via Workflow (gassan)

• bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (ibrambe)

• bug #64426 [HttpKernel] Fix TypeError in ResponseEvent when argument resolution throws (nicolas-grekas)

• bug #64420 [FrameworkBundle] Fix "allow_no_handlers" being ignored on message buses (damien-bp)

• bug #64394 Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)

• 8.1.0 (2026-05-29)

• feature #64398 Shopware is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64397 Mailtrap is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (nicolas-grekas)

• bug #64376 [Translation] Fix XLIFF 2 catalog metadata (MatTheCat)

• bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (nicolas-grekas)

• bug #64388 [Yaml] Fix parsing inline anchored values (nicolas-grekas)

• bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)

• bug #64389 Migrate configureSchema() to DBAL's editor API (nicolas-grekas)

• bug #64102 Remove usage of Kernel::VERSION (fabpot)

• 8.1.0-RC1 (2026-05-27)

• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (nicolas-grekas)

• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>, , and the URL inside <meta http-equiv="refresh"> content (nicolas-grekas)

• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)

• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)

• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)

• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)

• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)

• bug #64356 [Tui] Throw when ext-zip is not installed and one tries to load a zipped figlet (nicolas-grekas)

• bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)

• bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)

• bug #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (MatTheCat)

• feature #64334 [Form] Add handle_missing_data option to opt into MissingDataHandler for absent forms (hlecorche)

• bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (nicolas-grekas)

• bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (nicolas-grekas)

• bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (signor-pedro)

• bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)

• bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)

• bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)

• bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)

• bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)

• bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)

• bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)

• bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)

• bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)

• bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)

• bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)

• bug #64208 [AssetMapper] Rewrite relative paths in export ... from statements (ousamabenyounes)

• bug #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (nicolas-grekas)

• feature #64312 [FrameworkBundle][Validator] Add framework.validation.property_metadata_existence_check config (nicolas-grekas)

• bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (MatTheCat)

• bug #64260 [HttpClient] Various fixes and hardenings (Lctrs)

• bug #64234 [Tui] Fix unattached widget element styles (masskrdjn)

• bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (nicolas-grekas)

• bug #64223 [Tui] Fix invisible border with null color in BorderPattern's inverse strategies (sblondeau)

• 8.1.0-BETA3 (2026-05-20)

• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)

• security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (nicolas-grekas)

• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)

• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)

• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)

• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)

• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)

• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (alexandre-daubois)

• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (alexandre-daubois)

• bug #64301 [TwigBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64300 [TwigBridge] Fix daisyUI form layout and AppVariable locale filtering (nicolas-grekas)

• bug #64296 [Serializer] Improve normalizer error reporting and deprecations (nicolas-grekas)

• bug #64297 [Tui] Various fixes and hardenings (nicolas-grekas)

• bug #64299 [TypeInfo] Harden ObjectShapeType (nicolas-grekas)

• bug #64294 [RateLimiter] Harden calendar-aligned fixed window mode (nicolas-grekas)

• bug #64291 [MonologBridge] Harden MailerHandler subject truncation (nicolas-grekas)

• bug #64290 [Security] Various fixes and hardenings (nicolas-grekas)

• bug #64287 [Translation] Various fixes and hardenings (nicolas-grekas)

• bug #64286 [WebProfilerBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64283 [Lock] Various fixes and hardenings (nicolas-grekas)

• bug #64285 [WebLink] Add missing Link::AS_* constants for rel=preload / rel=modulepreload (nicolas-grekas)

• feature #64284 [PasswordHasher] Support stdin input and refine warning in security:hash-password (nicolas-grekas)

• bug #64273 [HttpKernel] Various fixes and hardenings (nicolas-grekas)

• bug #64276 [Runtime] Various fixes and hardenings (nicolas-grekas)

• bug #64280 [Workflow] Various fixes and hardenings (nicolas-grekas)

• bug #64275 [Routing] Fix missing HostTrait in ContentLoaderTrait (nicolas-grekas)

• bug #64274 [SecurityBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64272 [Mailer] Preserve the sent message object as is when sending it (nicolas-grekas)

• bug #64243 [HttpClient] Various fixes and hardenings (nicolas-grekas)

• bug #64269 [HttpFoundation] Various fixes and hardenings (nicolas-grekas)

• bug #64268 [FrameworkBundle] Various fixes and hardenings (nicolas-grekas)

• bug #64263 [ExpressionLanguage] Various fixes and hardenings (nicolas-grekas)

• bug #64262 [EventDispatcher] Various fixes and hardenings (nicolas-grekas)

• bug #64256 [DomCrawler] Various fixes and hardenings (nicolas-grekas)

• bug #64254 [DependencyInjection] Various fixes and hardenings (nicolas-grekas)

• bug #64252 [AssetMapper] Various fixes and hardenings (nicolas-grekas)

• bug #64251 [ObjectMapper] Various fixes and hardenings (nicolas-grekas)

• bug #64250 [CssSelector] Various fixes and hardenings (nicolas-grekas)

• bug #64249 [Form] Various fixes and hardenings (nicolas-grekas)

• bug #64248 [Mailer] Various fixes and hardenings (nicolas-grekas)

• bug #64239 [Validator] Various fixes and hardenings (nicolas-grekas)

• bug #64237 [Messenger] Various fixes and hardenings (nicolas-grekas)

• bug #64242 [TwigBridge] Require Twig to 3.25 for EscaperRuntime service definition (GromNaN)

• bug #64258 [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-selects (nicolas-grekas)

• bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (nicolas-grekas)

• bug #64207 [MonologBridge] Fix interactive_only not preventing propagation (philbates35)

• bug #64241 [JsonStreamer] Various fixes and hardenings (nicolas-grekas)

• bug #64255 [DoctrineBridge] Various fixes and hardenings (nicolas-grekas)

• bug #64246 [Console] Various fixes and hardenings (nicolas-grekas)

• bug #64244 [Semaphore] Various fixes and hardenings (nicolas-grekas)

• bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)

• bug #64215 [Runtime] Fix TypeError when resolving untyped arguments (nicolas-grekas)

• security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)

• security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)

• security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)

• security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling validateOnParse (alexandre-daubois)

• security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)

• security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)

• security #cve-2026-45065 [Routing] Fix regex alternation anchoring in UrlGenerator requirement validation (alexandre-daubois)

• security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)

• security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)

• security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)

• security #cve-2026-45755 [Mailer][Mailtrap] Reject webhooks with missing or invalid HMAC signature (alexandre-daubois)

• security #cve-2026-45756 [JsonPath] Cap regex backtracking in match()/search() to prevent ReDoS (alexandre-daubois)

• security #cve-2026-45074 [Security] Require configuring trusted hosts when using CAS authentication (nicolas-grekas)

• security #cve-2026-45075 [Security][HttpKernel] Fix HEAD requests bypassing methods filter in IsGranted, IsCsrfTokenValid and IsSignatureValid attributes (nicolas-grekas)

• bug #64213 [Security] Fix impersonation being deauthenticated on every request (nicolas-grekas)

• 8.1.0-BETA2 (2026-05-13)

• bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)

• bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)

• bug #64197 [Messenger] Ensure SigningSerializer won't decode before verifying the signature (nicolas-grekas)

• bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)

• bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)

• bug #64191 [Inflector][String] Fixed singularize traces > trace (ruudk)

• bug #64192 [Mailer] Use hash_equals() to compare webhook signatures for AhaSend (alexandre-daubois)

• bug #64193 [Notifier] Use hash_equals() to compare webhook signatures for Vonage (alexandre-daubois)

• bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)

• bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)

• feature #61936 [Messenger] Allow to respect retry strategy with RecoverableMessageHandlingException (VincentLanglet)

• bug #64182 [Console] Fix signal handler scoping (jpollard3)

• bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)

• bug #64058 [Process] Ignore array env values before proc_open (dionisvl)

• bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)

• bug #64176 [Console] Make ConsoleSectionOutput::overwrite() atomic to fix sections + ProgressIndicator clear (Amoifr)

• feature #63770 [HttpClient] Add custom DNS resolution using a decorator (peter17)

• bug #64158 [Form] Fix array_flip() warning in expanded+multiple ChoiceType on partial submit (SAY-5)

• feature #64156 [Validator] Add findByCodes() to ConstraintViolationListInterface (michaelthieulin)

• feature #64160 [HttpClient] Add $allowList argument to NoPrivateNetworkHttpClient (Amoifr)

• feature #64163 [HttpClient] Log stale-if-error fallback in CachingHttpClient (ousamabenyounes)

• bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)

• bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)

• bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)

• bug #64172 [WebProfilerBundle] Don’t try to access RawMessage::$headers (MatTheCat)

• bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)

• feature #60298 [Messenger][Amqp] delayed quorum queues (Miquel Fontana, miquel-angel)

• bug #64167 [Console] Add missing symfony/polyfill-php85 dependency (Amoifr)

• 8.1.0-BETA1 (2026-05-06)

• feature #63751 [DependencyInjection][HttpKernel] Add support for resetting non-shared services (Pechynho)

• feature #63689 [Routing] Allow collection prefixes to disable trailing slash on root (vvaswani)

• feature #62127 [RateLimiter] Add calendar-aligned mode to FixedWindowLimiter (Crovitche-1623)

• feature #64118 [Security] Revert "Add per-username login rate-limit to prevent brute-force attacks" (wouterj)

• feature #64094 [Messenger] Deprecate StopWorkerOnTimeLimitListener in favor of time_limit worker option (Toflar)

• feature #64104 [Security] Add per-username login rate-limit to prevent brute-force attacks (ayyoub-afwallah)

• feature #63862 [Console] Use ECH sequence for block padding (Amoifr)

• feature #64087 [HttpKernel][VarDumper][WebProfilerBundle] Forward CSP nonce to dump() instead of disabling CSP (Amoifr)

• feature #64079 [ErrorHandler] Trigger @method deprecation notices for abstract classes (lacatoire)

• feature #46654 [Serializer] Add COLLECT_EXTRA_ATTRIBUTES_ERRORS and full deserialization path (NorthBlue333)

• feature #62112 [Console] Add support for OSC 9;4 escape sequence for progress reporting (canvural)

• feature #52173 [Serializer] Add AbstractObjectNormalizer::ENABLE_TYPE_CONVERSION for scalar type transformation (Jeroeny)

• feature #60008 [HttpFoundation] Add SessionHasFlashMessage test constraint (Pierstoval)

• feature #63810 [VarDumper] Dump class-strings as class stubs with source location and static properties (lyrixx)

• feature #63929 [TwigBundle] Add twig.safe_class resource tag to register safe classes for the escaper (GromNaN)

• feature #62801 [Notifier][Prelude] Add bridge (zairigimad)

• feature #63727 [Form] Use translation_domain for expanded ChoiceType placeholder (eyupcanakman)

• feature #63762 [VarDumper] Add CSP nonce support to HtmlDumper (Amoifr)

• feature #63809 [Workflow] Add support for dumping listeners in Graphviz diagrams (lyrixx)

• feature #63879 [JsonStreamer] Add DateTimeZone value object support (mtarld)

• feature #63905 [FrameworkBundle] Add --sort option to debug:router command (Michael Thieulin)

• feature #63907 [RateLimiter] Add #[RateLimit] attribute to rate limit controllers declaratively (ayyoub-afwallah)

• feature #63925 [MonologBridge] Add $subjectMaxLength option to MailerHandler (Amoifr)

• feature #63945 [Validator] Make constraint validators reentrant instead of being stateful (stof)

• feature #64055 [Runtime] Add FRANKENPHP_RESET_KERNEL to reset the kernel between requests (nicolas-grekas)

• feature #63988 [DependencyInjection] Support autowiring env vars as closures or Stringable when using #[Autowire(env: 'FOO')] (nicolas-grekas)

• feature #64070 [Messenger] Release deduplication lock on definitive failure (ousamabenyounes)

• feature #63778 [Tui] Add the component (fabpot)

• feature #64049 [VarExporter] Deprecate Hydrator and Instantiator classes (nicolas-grekas)

• feature #64009 Improve phpdoc types (stof)

• feature #63910 [DependencyInjection] Allow inline Definition as factory and configurator (GromNaN)

• feature #63943 [WebProfilerBundle] Improve toolbar accessibility for screen reader (Nitram1123)

• feature #63912 [JsonStreamer] Improve error message when unable to encode (GaryPEGEOT)

• feature #63695 [VarExporter] Make DeepCloner::__serialize() return a pure array and add toArray()/fromArray() (nicolas-grekas)

• feature #63880 [DependencyInjection] Add #[RequiredBundle], ServicesBundle and ConsoleBundle (nicolas-grekas)

• feature #63877 [DependencyInjection] Add AddBehaviorDescribingTagsPass (nicolas-grekas)

• feature #63875 [EventDispatcher] Add hot-path and no-preload support to AddEventAliasesPass (nicolas-grekas)

• feature #63710 [DependencyInjection] Add Kernel and Bundle infrastructure for HTTP-less DI-powered apps (nicolas-grekas)

• feature #63771 [Security] Add enforce_key_usage_verification option to OIDC discovery (ruudk)

• feature #60334 [Twig] Add daisyUI form layout (Oviglo)

• feature #63742 [JsonStreamer] Add DateInterval value object support (mtarld)

• feature #63745 [FrameworkBundle][HttpKernel] Deprecate Bundle::registerCommands() (derrabus)

• feature #63735 [JsonStreamer] Support date time timezone (mtarld)

• feature #63714 [Console] Add validation constraints support to #[MapInput] (chalasr)

• feature #63709 [Console] Add optional PSR container parameter to Application (nicolas-grekas)

• feature #57598 [Console] Expose the original input arguments and options and to unparse options (theofidry)

• feature #52134 [HttpKernel] Add option to map empty data with MapQueryString and MapRequestPayload (Jeroeny)

• feature #41574 [Messenger] Add AmqpPriorityStamp for per-message priority on AMQP transport (Valentin Nazarov)

• feature #63661 [Runtime] Add FrankenPhpWorkerResponseRunner for simple response return (guillaume-sainthillier)

• feature #63666 [Messenger] Allow configuring the service reset interval in the messenger:consume command via the --no-reset option (nicolas-grekas)

• feature #63665 [Messenger] Add MessageExecutionStrategyInterface and refactor Worker to use it (nicolas-grekas)

• feature #63662 [Messenger] Add a --fetch-size option to the messenger:consume command to control how many messages are fetched per iteration (nicolas-grekas)

• feature #63663 [Contracts] Add ContainerAwareInterface (nicolas-grekas)

• feature #63631 [Form] Add labels option to DateType to customize year/month/day sub-field labels (guillaumeVDP)

• feature #62823 [JsonPath] Add custom function support (alexandre-daubois)

• feature #63590 [DependencyInjection] Add support for using service stacks as decorators (nicolas-grekas)

• feature #63595 [ObjectMapper] Add IsNotNull built-in condition (Nayte91)

• feature #63612 [VarExporter] Add DeepCloner for COW-friendly deep cloning (nicolas-grekas)

• feature #51379 [HttpKernel] Adding new #[MapRequestHeader] attribute and resolver (StevenRenaux)

• feature #63585 [Security] Deprecate erase_credentials config, container parameter and AuthenticatorManager constructor argument (guillaumeVDP)

• feature #62029 [Mailer][SES] Allow configuring port and tls options (adars)

• feature #63615 [Uid] Pass invalid UID value to InvalidArgumentException for better debug (rela589n)

• feature #63339 [JsonStreamer] Handle value objects (mtarld)

• feature #63383 [ObjectMapper] Allow class FQDN arrays as TargetClass and SourceClass param (rrajkomar)

• feature #63520 [FrameworkBundle] Allow configuring Webhook's header names and signing algo (lacatoire)

• feature #63593 [Uid] Add Uuid47Transformer support for UUIDv7/v4 conversion (nicolas-grekas)

• feature #63528 [TypeInfo] Resolve tentative return types (valtzu)

• feature #63546 [Console] Add outline-style block methods to SymfonyStyle (guillaumeVDP)

• feature #63581 [FrameworkBundle][Messenger] Deprecate "senders" nesting level in routing config (W0rma)

• feature #63441 [HttpClient] Default CachingHttpClient's $maxTtl to 86400s to prevent eternal cache items (Lctrs, nicolas-grekas)

• feature #63541 [HttpFoundation] Deprecate setting public properties of Request and Response objects directly (nicolas-grekas)

• feature #63552 [Runtime] Add SymfonyRuntime::resolveType() for customizing how types are resolved in extending runtimes (Kingdutch)

• feature #63481 [ErrorHandler] Allow namespace remapping in DebugClassLoader to relax the "same vendor" constraint (mpdude)

• feature #63524 [Translation][Crowdin] Replace deprecated Upload Translations method with Import Translations (bhdnb)

• feature #63505 [FrameworkBundle] Deprecate terminate_on_cache_hit http_cache option (Mynyx)

• feature #63538 [Console] Sort suggested commands alphabetically (javiereguiluz)

• feature #63537 [Console] Replace executeCommand() by runCommand() when testing commands (javiereguiluz)

• feature #45553 [Translation] Extract locale fallback computation into a dedicated class (mpdude)

• feature #63433 [HttpClient] Add GuzzleHttpHandler that allows using Symfony HttpClient as a Guzzle handler (nicolas-grekas)

• feature #63465 [Translation] Add support for XLIFF PGS (Plural, Gender, and Select Module) (alexandre-daubois)

• feature #62888 [Messenger] Route decode failures through failure handling (nicolas-grekas)

• feature #63453 [Console][WebProfilerBundle] Trace argument value resolvers (chalasr)

• feature #52055 [Console] Deprecate combining incompatible mode flags in InputArgument and InputOption (jnoordsij)

• feature #52058 [Console] Allow setting a boolean default value on InputOption::VALUE_NEGATABLE options (jnoordsij)

• feature #45081 [Form] Add support for submitting forms with unchecked checkboxes in request handlers (filiplikavcan)

• feature #63443 [Console] Add customization to SymfonyStyle progressBar (guillaumeVDP)

• feature #63451 [PropertyInfo] Add support for property hook settable types (alexandre-daubois)

• feature #63455 [Translation] Add support for XLIFF versions 2.1 and 2.2 (alexandre-daubois)

• feature #63427 [WebLink] : Adding consts for as attributes (ThomasLandauer)

• feature #63426 [DependencyInjection] Deprecate named autowiring alias that don't use #[Target] (nicolas-grekas)

• feature #63429 [FrameworkBundle] Add MicroKernelTrait::$allowedEnvs to enforce allowed values for APP_ENV (vincentpabst)

• feature #61494 [Console] Allow to test the different streams at the same time with a new result-based testing API for CommandTester (theofidry)

• feature #63371 [Form] Add uid_format option to EntityType (lacatoire)

• feature #61462 [Messenger] Add ListableReceiverInterface support to RedisReceiver (mudassaralichouhan)

• feature #49388 [CssSelector] Add :has() support (franckranaivo)

• feature #63242 [FrameworkBundle] Add decoration stack to debug:container command (ayyoub-afwallah)

• feature #63373 [HttpFoundation] Add BinaryFileResponse::shouldDeleteFileAfterSend() (lacatoire)

• feature #49518 Create #[Serialize] Attribute to serialize Controller Result (Koc)

• feature #63355 [Validator] Add ValidatorBuilder::enablePropertyMetadataExistenceCheck() (lacatoire)

• feature #63335 [TwigBridge] Add form_flow_* helper functions (ker0x)

• feature #63356 [FrameworkBundle] Configure custom marshaller per cache pool (mvanduijker)

• feature #63359 [Console] Allow passing Validator constraints to QuestionHelper and #[Ask] (chalasr)

• feature #54817 [HttpKernel] Support variadic with #[MapRequestPayload] (DjordyKoert)

• feature #63360 [Validator] Add clock-awareness to comparison and range validators (lacatoire)

• feature #63346 [Messenger][AMQP] Allow disabling default queue binding via queues option (xammmue)

• feature #52265 [HttpClient] Configure MockClient if mock_response_factory has been set on a scoped client (tarjei)

• feature #63293 [Console] Add image support to QuestionHelper and #[Ask] (chalasr)

• feature #47969 [Filesystem] rename Filesystem::mirror() option copy_on_windows to follow_symlinks (maxbeckers)

• feature #58871 [Form] BirthdayType has automatic attr when widget is single_text (nicolas-grekas)

• feature #59202 [Semaphore] Add a semaphore store based on locks (alexander-schranz)

• feature #47666 [Messenger] Move PostgreSQL LISTEN/NOTIFY blocking to worker idle event listener (d-ph)

• feature #62638 [DependencyInjection] Add tag decoration support (mtarld)

• feature #62320 [WebProfiler] add cURL copy/paste to request tab (darkweak)

• feature #63214 [Form] Allow ViolationMapperInterface injection for ValidatorExtension and FormTypeValidatorExtension (ktherage)

• feature #63304 [Contracts][DependencyInjection] Support hooked properties in ServiceMethodsSubscriberTrait (derrabus)

• feature #63277 [Messenger] Add idle timeout option to BatchHandlerTrait (HypeMC)

• feature #61458 [HttpKernel] Validate typed request attribute values before calling controllers (mudassaralichouhan)

• feature #63274 [HttpKernel] Add ControllerEvent::evaluate() et al. to help with evaluating expressions or closures in controller attributes (nicolas-grekas)

• feature #63032 [HttpKernel] Dispatch events named after controller attributes (nicolas-grekas)

• feature #63263 [FrameworkBundle][Lock] Scope semaphore and flock stores by project dir by default (nicolas-grekas)

• feature #61457 [FrameworkBundle] Deprecate container parameters router.request_context.scheme and .host (stollr)

• feature #63092 [HttpKernel] Expose controller metadata throughout the request lifecycle (nicolas-grekas)

• feature #58273 Allow usage of expressions for defining validation groups in #[MapRequestPayload] (Brajk19)

• feature #63201 [Security] Add this to #[IsGranted] subject expression vars when available (valtzu)

• feature #63181 [DependencyInjection] Add target parameter to #[AsAlias] attribute (ayyoub-afwallah)

• feature #53559 [DomCrawler] Allow to add choices to single select (norkunas)

• feature #53998 [Security] Add retrieval of parent role names (PierreCapel)

• feature #62875 [Messenger] Add regex support for transport name matching in messenger:consume command (santysisi)

• feature #58732 [Finder] Allow finder to set the UNIX_PATH flag when recursing directories (Shane McKinley)

• feature #62754 [ExpressionLanguage] Add support for null-safe syntax for array access (cancan101)

• feature #57365 [Validator] Add Xml constraint (sfmok)

• feature #58966 [Serializer] Trigger deprecation when could not parse date with default format (alexndlm)

• feature #57769 [Notifier] [Telegram] Add support for local API server (ahmedghanem00)

• feature #57653 [FrameworkBundle] Allow default action in HtmlSanitizer configuration (Neirda24)

• feature #54866 [Messenger] Added the ability to force RedisCluster (adideas)

• feature #63130 [Console] Add TesterTrait::assertCommandFailed and TesterTrait::assertCommandIsInvalid helpers (darovic)

• feature #63095 [FrameworkBundle] Add shortcut to run console command in tests (Koc)

• feature #63097 [Security] Decouple SameOriginCsrfTokenManager from event listening (jprivet-dev)

• feature #62599 [FrameworkBundle][JsonStreamer] Add default options (mtarld)

• feature #63061 [Messenger] Add support for custom type in Serializer Transport (lyrixx)

• feature #62885 [TypeInfo] Allow resolving object shapes (bnf)

• feature #63183 [Console] Allow object as default for input options and arguments (chalasr)

• feature #63157 [Security] Add support for enums in SignatureHasher::computeSignatureHash() (nicolas-grekas)

• feature #63024 [ObjectMapper] Add targetClass on MapCollection transform (soyuka)

• feature #63111 [DependencyInjection] Add argument exclude to ContainerConfigurator::import() (tilaven)

• feature #63135 [Scheduler] Add option to order recurring messages by next run date in debug command (yoye)

• feature #62434 [HttpKernel] deprecate the Extension class (xabbuh)

• feature #63059 [Semaphore] Add SemaphoreKeyNormalizer (clegginabox)

• feature #62909 [FrameworkBundle] Enable mocking non-shared services in tests (HypeMC)

• feature #62751 [HttpClient] Add support of the persistent cURL handles (Koc)

• feature #63121 [Translation][FramworkBundle] Allow using env vars in the list of enabled locales (nicolas-grekas)

• feature #62566 [FrameworkBundle] Add AbstractController::createFormFlowBuilder (silasjoisten)

• feature #62917 [Console] Add ArgumentResolver (chalasr)

• feature #63090 [HttpKernel] Return attributes as a flat list when using Controller[Arguments]Event::getAttributes(*) (nicolas-grekas)

• feature #63039 [PhpUnitBridge] add logic for checking for dist.xml, xml.dist and xml phpunit config (gennadigennadigennadi)

• feature #62941 [HttpKernel] Allow the Cache attribute to be applied conditionally (HypeMC)

• feature #62511 [ObjectMapper] merge nested properties when targeting the same class (soyuka)

• feature #62835 [DependencyInjection] Allow environment variables with . in them (Max Baldanza)

• feature #62957 [ObjectMapper] Throw exception for invalid transform callable (calm329, Asenar)

• feature #62522 [FrameworkBundle][ObjectMapper] Add automatic class-map array based on map attributes (Orkin)

• feature #63023 [Uid] Add argument $format to Ulid::isValid() (mms-uret)

• feature #62854 [HttpClient] Add support for the max_connect_duration option (alexandre-daubois)

• feature #62940 [HttpKernel] Allow using closures with the Cache attribute (HypeMC)

• feature #62925 [HttpKernel] Deserialize UploadedFile for #[MapRequestPayload] (Grafikart)

• feature #62911 [Console] Add #[AskChoice] attribute for interactive choice questions (yceruto)

• feature #62939 [HttpKernel] Improve Cache attribute expression vars (HypeMC)

• feature #62850 [HttpKernel] Decouple controller attributes from source code and add ResponseEvent::getControllerAttributes() (nicolas-grekas)

• feature #62567 [Console] Add support for method-based commands (yceruto)

• feature #62538 [HttpKernel] Add support for SOURCE_DATE_EPOCH environment variable (Charles-Édouard Coste)

• feature #62824 [DependencyInjection][SecurityBundle] Leverage #[AsTaggedItem] for voters (ayyoub-afwallah)

• feature #62339 [DependencyInjection] Deprecate default index/priority methods when defining tagged locators/iterators (nicolas-grekas)

• feature #62792 [DoctrineBridge] Deprecate RegisterMappingsPass::$aliasMap (GromNaN)

• feature #62800 [HttpKernel] Add support for bundles as compiler passes (yceruto)

• feature #62578 [Form] Add reset button in NavigatorFlowType (Nayte91)

• feature #62572 [Messenger] Use clock in DelayStamp and RedeliveryStamp instead of native time classes and methods (bluemmb)

• feature #62483 [DependencyInjection] Deprecate invalid options when using from_callable (yoeunes)

• feature #60372 [Mailer][SendGrid] add support for scheduling delivery via send_at API parameter (Mickael GOETZ, MrMitch)

• feature #62322 [Security] add missing Clear-Site-Data directives (xabbuh)

• feature #62390 [Mailer] Add support of ipPoolId for infobip mailer transport (jbdelhommeau)