CHANGELOG for 8.1.x
===================

This changelog references the relevant changes (bug and security fixes) done
in 8.1 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v8.1.0...v8.1.1

* 8.1.3 (2026-07-29)

 * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (GrahamCampbell)

* 8.1.2 (2026-07-29)

 * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (alexandre-daubois)
 * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (nicolas-grekas)
 * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (nicolas-grekas)
 * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (nicolas-grekas)
 * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (nicolas-grekas)
 * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (nicolas-grekas)
 * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (nicolas-grekas)
 * bug #65020 [HttpFoundation] Fix newline handling in server event fields (nicolas-grekas)
 * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (nicolas-grekas)
 * bug #65011 [Cache] Add support for relay 0.40 (nicolas-grekas)
 * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (nicolas-grekas)
 * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (nicolas-grekas)
 * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (nicolas-grekas)
 * bug #64999 [DependencyInjection] Restore reading "container.behavior_describing_tags" in DecoratorServicePass (nicolas-grekas)
 * bug #65008 [HttpKernel] Fix the escaping of the generated curl command (nicolas-grekas)
 * bug #65009 [HttpClient] Fix the escaping of the generated curl command (nicolas-grekas)
 * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (nicolas-grekas)
 * bug #64995 [Serializer] Prefer serialized name over raw property key (ousamabenyounes)
 * bug #64992 [String] Consistently return null for out-of-range offsets (javiereguiluz)
 * bug #64986 [HttpKernel] Fix the curl command when a cookie holds an array (maximilian-walter)
 * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (saifulferoz)
 * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (takashiraki)
 * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (Baylox)
 * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (nicolas-grekas)
 * bug #64978 [Messenger] Reject a serialized type name that is another message's class name (nicolas-grekas)
 * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (jprivet-dev)
 * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (misaert)
 * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (bendavies)
 * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (voodooism, nicolas-grekas)
 * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (lyrixx)
 * bug #64903 [Console] Reduce buffer reallocations in FileInputHelper paste detection (jorgsowa)
 * bug #64661 [FrameworkBundle] Register the argument resolver in ConsoleCommandAssertionsTrait::runCommand (fracsi)
 * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (nicolas-grekas)
 * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (pokki-deploy)
 * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (pokki-deploy)
 * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (pokki-deploy)
 * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (rjmackay)
 * bug #64863 [FrameworkBundle] Keep transport decorators when mock_response_factory is set (alexndlm)
 * bug #64864 [HttpKernel] Keep converting scalars of a form payload that carries an uploaded file (Amoifr)
 * bug #64825 [PhpUnitBridge] fix finding given config file name (YumeNikki101)
 * bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (Amoifr)
 * bug #64781 [ObjectMapper] Keep the class-level transform/if of the target's #[Map] in the reverse class-map factory (Orkin)
 * bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (Amoifr)
 * bug #64868 [Messenger] Avoid redispatching messages from completed batches (Gaitholabi)
 * bug #64835 [WebProfilerBundle] Fix crash when injecting the toolbar in a BinaryFileResponse (Fuck4ik)
 * bug #64659 [Console] Strip terminal control characters from displayed file names (iliaal)
 * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (iliaal)
 * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (Amoifr)
 * bug #64670 [Config] Accept env placeholders for scalar alternatives in generated array-shapes (yvh)
 * bug #64938 [Messenger] Do not reject unknown types when no message requires signing (pokki-deploy)
 * bug #64935 [PropertyInfo] Ignore mutators with several required parameters (pokki-deploy)
 * bug #64937 [Validator] Allow `Traverse` to be inherited (MatTheCat)
 * bug #64654 [Validator] Merge target's own constraints when using #[ExtendsValidationFor] (pokki-deploy)
 * bug #64708 [DependencyInjection] Fix lazy + factory service with a leading-backslash class on PHP 8.4 (Amoifr)
 * bug #64751 [FrameworkBundle] Make `WebTestCase` enable web mode by default (MatTheCat)
 * bug #64770 [ObjectMapper] Fix explicit #[Map(target:)] being overwritten by a same-name source property (danielpilot)
 * bug #64801 [Validator] Allow null groups in ConstraintValidatorTestCase (sjh9714)
 * bug #64828 [DependencyInjection] Add supported literal option `not_found` for `imports.[*].ignore_errors` in `services.schema` and `AppReference` (kaznovac)
 * bug #64831 [FrameworkBundle] Fix valkey cache adapters ignoring `default_valkey_provider` (lazerg)
 * bug #64848 [ObjectMapper] Fix per-property #[Map(source:)] being ignored when the target property name also exists on the source (Amoifr)
 * bug #64934 [HttpClient] Do not stream empty PSR-18 request bodies (pokki-deploy)
 * bug #64931 [TwigBridge] prevent implicit string casts for translatable message objects (xabbuh)
 * bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (Amoifr)
 * bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (pkranjcecx)
 * bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (pokki-deploy)
 * bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (Amoifr)
 * bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (jnahmias)
 * bug #64727 [Routing] Detect circular references in object route parameters (Amoifr)
 * bug #64932  Do not expose the `BundleAdapter` class in the `kernel.bundles` parameter (mpdude)
 * bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (eyupcanakman)
 * bug #64843 [Console] Fix table borders around colspan cells and header-less tables (wazum)
 * bug #64930  Handle PHP 8.6 removing function arguments in error messages (MatTheCat)
 * bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (semx)
 * bug #64822 [Config] Escape "*/" in generated array-shape comments (lazerg)
 * bug #64857 [Config] Escape comment-closing sequence in generated config builders (sadiqk2)
 * bug #64886 [Console] Fix two ValueError crashes on multibyte / multi-column widths (sadiqk2)
 * bug #64887 [Cache] Initialize PhpArrayAdapter before classifying keys in deleteItems() (sadiqk2)
 * bug #64897 [Messenger][AmazonSqs] Fix fatal on shutdown when the in-flight receive cannot be resumed (vadimgodev)
 * bug #64904 [ErrorHandler] Fix fatal error without args triggering an error when calling `getTraceFromString` (timacdonald)
 * bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)
 * bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)
 * bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strings (eyupcanakman)
 * bug #64668 [DependencyInjection] Fix env var reported as never used for a removed autowired service (eyupcanakman)
 * bug #64915 [Yaml] Fix parsing and dumping of NaN (semx)
 * bug #64918 [String] Fix AsciiSlugger::getLocale() TypeError with no locale set (eyupcanakman)
 * bug #64920 [Validator] add missing inherited options to Video constraint (xabbuh)
 * bug #64891 [TwigBridge] ensure that a label with value "0" is rendered (xabbuh)
 * bug #64889 [HttpClient] Replace the native "dechunk" stream filter with a pure PHP implementation (nicolas-grekas)
 * bug #64898 [Cache] Remove obsolete `return` instruction from classes constructors (cedric-anne)
 * bug #64895 [Dotenv] Allow multiple underscores at start (Sajito)
 * bug #64884  Fix/webprofiler mailer macros 6.4 (HecFranco)
 * bug #64877 [Validator] Reject misplaced "X" character in ISBN-10 validation (semx)
 * bug #64856 [Console] Fall back to "stty sane" when restoring the captured terminal state fails (lyrixx)
 * bug #64649 [Serializer] Fix support check for nested array items (nicolas-grekas)
 * bug #64827  jitter shouldn't make scheduler miss runs (mrossard)
 * bug #64840 [Tui] Repaint the full screen on resize so multiplexer reattaches are not blank (fabpot)
 * bug #64849 [Console] Fix SymfonyStyle questions when using output sections (javiereguiluz)
 * bug #64797 [Notifier] add handling for the Prelude bridge to UnsupportedSchemeException (xabbuh)
 * bug #64815 [Cache] Remove always-true method_exists() check in FilesystemCommonTrait::__destruct() (munzzyy)
 * bug #64794 [PropertyInfo] Prevent `PhpDocTypeHelper` to wrongly assume keys type (MatTheCat)
 * bug #64778 [Console] Fix #[MapDateTime] arguments resolved as strings by BuiltinTypeValueResolver (serhiilabs)
 * bug #64791 [Tui] Fix wrapping lines that end with whitespace followed by ANSI codes exceeding the width (fabpot)
 * bug #64783  Add additional IP ranges for RFC2544 and RFC5180 (thePanz)
 * bug #64789 [HttpFoundation] Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (thePanz)
 * bug #64739 [PropertyInfo] Prevent `PhpDocTypeHelper` to wrongly assume keys type (MatTheCat)
 * bug #64752 [Yaml] Fix parsing of integers with a leading plus sign (eyupcanakman)
 * bug #64701  Fix Absolute URL generation by ignore tel: mailto: and other app links (tomm1996, alexander-schranz)
 * bug #64734 [Filesystem] Trim trailing whitespace from the tempnam() prefix (Amoifr)
 * bug #64732 [String] Fix splice() on multibyte strings (eyupcanakman)

* 8.1.1 (2026-06-27)

 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (mtarld)
 * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (salvador-castro)
 * data #64698 [Validator] reviewed Polish translation unit 146 (thunderer)
 * data #64711 [Validator] Ukrainian translation update (VladyslavChernyshov)
 * data #64675 [Validator] Add translated messages for the Cron constraint (fabpot)
 * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (ousamabenyounes)
 * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (nicolas-grekas)
 * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (eyupcanakman)
 * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (Amoifr)
 * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (eyupcanakman)
 * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (alamirault)
 * bug #64640  Messenger commands don't yet make use of listable Redis capabilities (dpi)
 * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (adrianrudnik)
 * bug #64637 [Messenger] Fix `#[AsMessage]` on abstract classes (MatTheCat)
 * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (pokki-deploy)
 * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (Amoifr)
 * bug #64589 [ObjectMapper] Fix self-referencing property mapping (GaryPEGEOT)
 * bug #64567 [ObjectMapper] Handle N targets per source in reverse class map (soyuka)
 * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (KevinMartinsDev, nicolas-grekas)
 * data #64602 [Form][Validator] Review Hungarian translations (antalaron)
 * data #64626 [Form][Validator] Ukrainian translation review and update (VladyslavChernyshov)
 * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (nicolas-grekas)
 * bug #64627 [Contracts] Add ContainerAwareInterface back, deprecated (nicolas-grekas)
 * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (Amoifr)
 * bug #64615 [Contracts] Rename ContainerAwareInterface to ContainerProviderInterface (nicolas-grekas)
 * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (nacorp)
 * data #64597  Review Indonesian (id) translations (sawirricardo)
 * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (Amoifr)
 * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (Jerdon07)
 * bug #64595 [Cache][VarExporter] Add argument $allowNamedClosure to DeepClone to fit ext-deepclone v0.8 (nicolas-grekas)
 * bug #64588  Migrate table definitions to DBAL's `TableEditor` API (nicolas-grekas)
 * bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (kbond)
 * bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (Pelagoss)
 * bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (nicolas-grekas)
 * bug #64466 [ObjectMapper] Fix reverse class map throwing on unreadable source (yoye)
 * data #64578 [Form][Validator] Review Bulgarian (bg) translations (moynzzz)
 * bug #64572 [DependencyInjection] Fix decorating an event listener no longer replacing it (nicolas-grekas)
 * data #64564  Remove review state from Serbian translations (Trysha-rbrn)
 * data #64565  Remove review state from Russian translations #64512 (centaur-vova)
 * bug #64566  Harden __toString trampolines via __unserialize() (nicolas-grekas)
 * bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (nicolas-grekas)
 * bug #64557 [Translation] Create Crowdin files before uploading translations (MatTheCat)
 * bug #64555 [FrameworkBundle] Fix custom config directory being ignored when registering bundles (nicolas-grekas)
 * bug #64560 [FrameworkBundle] Avoid resolving all env vars when building the router request context (nicolas-grekas)
 * bug #64558 [Security] Make RoleHierarchy::getReachableRoleNames() return a list again (nicolas-grekas)
 * data #64550 [Validator] reviewed Polish translation units 143-145 (thunderer)
 * data #64551 [Form] reviewed Polish translation unit 129 (thunderer)
 * bug #64552 [Cache][FrameworkBundle] Fix warming up caches that hold a closure (nicolas-grekas)
 * bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (nicolas-grekas)
 * bug #64362 [Tui] Fix vertical align (sblondeau)
 * data #64544 [Validator] Review French (fr) translations for XML constraints (lacatoire)
 * bug #64474 [HttpKernel] Allow leading zeros in int request attributes (ousamabenyounes)
 * bug #64523 [DependencyInjection] Keep behavior-describing tags 'proxy' and 'container.service_subscriber.locator' on decorated services (ousamabenyounes)
 * bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (ousamabenyounes, pokki-deploy)
 * bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (ousamabenyounes)
 * bug #64536 [Form] Don't re-add deleted collection entries on submit (eyupcanakman)
 * data #64542 [Form][Validator] Update Spanish translations (ThiagoMirandaLiotto)
 * data #64543 [Form][Validator] Review Croatian translations (HypeMC)
 * bug #64534 [Tui] Avoid splitting Unicode ellipsis when truncating (rahul chavan)
 * data #64526 [Form][Validator] Review and correct Arabic translation (ayyoub-afwallah)
 * bug #64527 [Tui] Truncate InputWidget prompt when wider than available columns (ousamabenyounes)
 * bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (ousamabenyounes)
 * bug #64475 [AssetMapper] Render an empty import map as a JSON object (ousamabenyounes)
 * bug #64458 [Webhook] Fix Content-Type key in createRequest method (MarijnDoeve)
 * bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (derflocki)
 * bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (MatTheCat)
 * bug #64424 [Form] Translate TranslatableInterface label in violation messages (Amoifr)
 * bug #64359 [Validator] Support SVG dimensions with units (Will-thom)
 * bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (XananasX7)
 * data #64451 [Form] Add missing translation for invalid UUID (jmsche)
 * data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (Trysha-rbrn)
 * bug #64441 [FrameworkBundle] Fix dumping the debug container on `cache:clear`/`cache:warmup` (nicolas-grekas)
 * bug #64443 [DomCrawler] Remove final keyword on `ChoiceFormField::addChoice()` (syl20b)
 * data #64446 [Validator] Add translated messages for the XML constraint (nicolas-grekas)
 * bug #64449 [HttpKernel] Fix #[MapRequestPayload] being handled before #[IsGranted] (nicolas-grekas)
 * bug #64375 [Notifier] Send message to MS-Teams via Workflow (gassan)
 * bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (ibrambe)
 * bug #64426 [HttpKernel] Fix TypeError in ResponseEvent when argument resolution throws (nicolas-grekas)
 * bug #64420 [FrameworkBundle] Fix "allow_no_handlers" being ignored on message buses (damien-bp)
 * bug #64394  Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)

* 8.1.0 (2026-05-29)

 * feature #64398 Shopware is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64397 Mailtrap is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64396 Les-Tilleuls.coop is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * feature #64395 TYPO3 is backing Symfony 8.1, thanks to them! (nicolas-grekas)
 * bug #64376 [Translation] Fix XLIFF 2 catalog metadata (MatTheCat)
 * bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (nicolas-grekas)
 * bug #64388 [Yaml] Fix parsing inline anchored values (nicolas-grekas)
 * bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
 * bug #64389 Migrate `configureSchema()` to DBAL's editor API (nicolas-grekas)
 * bug #64102 Remove usage of `Kernel::VERSION` (fabpot)

* 8.1.0-RC1 (2026-05-27)

 * security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (nicolas-grekas)
 * security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>, <img>, and the URL inside <meta http-equiv="refresh"> content (nicolas-grekas)
 * security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)
 * security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)
 * security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)
 * security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)
 * security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)
 * bug #64356 [Tui] Throw when ext-zip is not installed and one tries to load a zipped figlet (nicolas-grekas)
 * bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)
 * bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)
 * bug #64348 [FrameworkBundle] Allow to pass `doctrine_open_transaction_logger`’s entity manager name positionally (MatTheCat)
 * feature #64334 [Form] Add `handle_missing_data` option to opt into MissingDataHandler for absent forms (hlecorche)
 * bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (nicolas-grekas)
 * bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (nicolas-grekas)
 * bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (signor-pedro)
 * bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)
 * bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)
 * bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)
 * bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)
 * bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)
 * bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)
 * bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)
 * bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)
 * bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)
 * bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)
 * bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)
 * bug #64208 [AssetMapper] Rewrite relative paths in `export ... from` statements (ousamabenyounes)
 * bug #64311 [DependencyInjection] Fix `service()` as invokable factory in array-based PHP config (nicolas-grekas)
 * feature #64312 [FrameworkBundle][Validator] Add `framework.validation.property_metadata_existence_check` config (nicolas-grekas)
 * bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both `WARNING` and `warning` (MatTheCat)
 * bug #64260 [HttpClient] Various fixes and hardenings (Lctrs)
 * bug #64234 [Tui] Fix unattached widget element styles (masskrdjn)
 * bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (nicolas-grekas)
 * bug #64223 [Tui] Fix invisible border with null color in BorderPattern's inverse strategies (sblondeau)

* 8.1.0-BETA3 (2026-05-20)

 * security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)
 * security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (nicolas-grekas)
 * security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)
 * security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)
 * security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)
 * security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)
 * security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)
 * security #cve-2026-45066 [HtmlSanitizer] Fix `allowLinkHosts`/`allowMediaHosts` bypass via URL parser differentials and `<area>` misclassification (alexandre-daubois)
 * security #cve-2026-45069 [Security] Add missing claims in `OidcTokenHandler` (alexandre-daubois)
 * bug #64301 [TwigBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64300 [TwigBridge] Fix daisyUI form layout and AppVariable locale filtering (nicolas-grekas)
 * bug #64296 [Serializer] Improve normalizer error reporting and deprecations (nicolas-grekas)
 * bug #64297 [Tui] Various fixes and hardenings (nicolas-grekas)
 * bug #64299 [TypeInfo] Harden ObjectShapeType (nicolas-grekas)
 * bug #64294 [RateLimiter] Harden calendar-aligned fixed window mode (nicolas-grekas)
 * bug #64291 [MonologBridge] Harden MailerHandler subject truncation (nicolas-grekas)
 * bug #64290 [Security] Various fixes and hardenings (nicolas-grekas)
 * bug #64287 [Translation] Various fixes and hardenings (nicolas-grekas)
 * bug #64286 [WebProfilerBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64283 [Lock] Various fixes and hardenings (nicolas-grekas)
 * bug #64285 [WebLink] Add missing `Link::AS_*` constants for `rel=preload` / `rel=modulepreload` (nicolas-grekas)
 * feature #64284 [PasswordHasher] Support stdin input and refine warning in security:hash-password (nicolas-grekas)
 * bug #64273 [HttpKernel] Various fixes and hardenings (nicolas-grekas)
 * bug #64276 [Runtime] Various fixes and hardenings (nicolas-grekas)
 * bug #64280 [Workflow] Various fixes and hardenings (nicolas-grekas)
 * bug #64275 [Routing] Fix missing HostTrait in ContentLoaderTrait (nicolas-grekas)
 * bug #64274 [SecurityBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64272 [Mailer] Preserve the sent message object as is when sending it (nicolas-grekas)
 * bug #64243 [HttpClient] Various fixes and hardenings (nicolas-grekas)
 * bug #64269 [HttpFoundation] Various fixes and hardenings (nicolas-grekas)
 * bug #64268 [FrameworkBundle] Various fixes and hardenings (nicolas-grekas)
 * bug #64263 [ExpressionLanguage] Various fixes and hardenings (nicolas-grekas)
 * bug #64262 [EventDispatcher] Various fixes and hardenings (nicolas-grekas)
 * bug #64256 [DomCrawler] Various fixes and hardenings (nicolas-grekas)
 * bug #64254 [DependencyInjection] Various fixes and hardenings (nicolas-grekas)
 * bug #64252 [AssetMapper] Various fixes and hardenings (nicolas-grekas)
 * bug #64251 [ObjectMapper] Various fixes and hardenings (nicolas-grekas)
 * bug #64250 [CssSelector] Various fixes and hardenings (nicolas-grekas)
 * bug #64249 [Form] Various fixes and hardenings (nicolas-grekas)
 * bug #64248 [Mailer] Various fixes and hardenings (nicolas-grekas)
 * bug #64239 [Validator] Various fixes and hardenings (nicolas-grekas)
 * bug #64237 [Messenger] Various fixes and hardenings (nicolas-grekas)
 * bug #64242 [TwigBridge] Require Twig to 3.25 for `EscaperRuntime` service definition (GromNaN)
 * bug #64258 [DomCrawler] Fix `ChoiceFormField::addChoice()` clobbering values on multi-selects (nicolas-grekas)
 * bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (nicolas-grekas)
 * bug #64207 [MonologBridge] Fix `interactive_only` not preventing propagation (philbates35)
 * bug #64241 [JsonStreamer] Various fixes and hardenings (nicolas-grekas)
 * bug #64255 [DoctrineBridge] Various fixes and hardenings (nicolas-grekas)
 * bug #64246 [Console] Various fixes and hardenings (nicolas-grekas)
 * bug #64244 [Semaphore] Various fixes and hardenings (nicolas-grekas)
 * bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)
 * bug #64215 [Runtime] Fix TypeError when resolving untyped arguments (nicolas-grekas)
 * security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)
 * security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)
 * security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)
 * security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse` (alexandre-daubois)
 * security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)
 * security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)
 * security #cve-2026-45065 [Routing] Fix regex alternation anchoring in `UrlGenerator` requirement validation (alexandre-daubois)
 * security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)
 * security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)
 * security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)
 * security #cve-2026-45755 [Mailer][Mailtrap] Reject webhooks with missing or invalid HMAC signature (alexandre-daubois)
 * security #cve-2026-45756 [JsonPath] Cap regex backtracking in `match()`/`search()` to prevent ReDoS (alexandre-daubois)
 * security #cve-2026-45074 [Security] Require configuring trusted hosts when using CAS authentication (nicolas-grekas)
 * security #cve-2026-45075 [Security][HttpKernel] Fix HEAD requests bypassing methods filter in `IsGranted`, `IsCsrfTokenValid` and `IsSignatureValid` attributes (nicolas-grekas)
 * bug #64213 [Security] Fix impersonation being deauthenticated on every request (nicolas-grekas)

* 8.1.0-BETA2 (2026-05-13)

 * bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)
 * bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)
 * bug #64197 [Messenger] Ensure SigningSerializer won't decode before verifying the signature (nicolas-grekas)
 * bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)
 * bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)
 * bug #64191 [Inflector][String] Fixed singularize `traces` > `trace` (ruudk)
 * bug #64192 [Mailer] Use `hash_equals()` to compare webhook signatures for AhaSend (alexandre-daubois)
 * bug #64193 [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage (alexandre-daubois)
 * bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)
 * bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)
 * feature #61936 [Messenger] Allow to respect retry strategy with `RecoverableMessageHandlingException` (VincentLanglet)
 * bug #64182 [Console] Fix signal handler scoping (jpollard3)
 * bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)
 * bug #64058 [Process] Ignore array env values before proc_open (dionisvl)
 * bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)
 * bug #64176 [Console] Make `ConsoleSectionOutput::overwrite()` atomic to fix sections + ProgressIndicator clear (Amoifr)
 * feature #63770 [HttpClient] Add custom DNS resolution using a decorator (peter17)
 * bug #64158 [Form] Fix array_flip() warning in expanded+multiple ChoiceType on partial submit (SAY-5)
 * feature #64156 [Validator] Add findByCodes() to ConstraintViolationListInterface (michaelthieulin)
 * feature #64160 [HttpClient] Add $allowList argument to NoPrivateNetworkHttpClient (Amoifr)
 * feature #64163 [HttpClient] Log stale-if-error fallback in CachingHttpClient (ousamabenyounes)
 * bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)
 * bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)
 * bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)
 * bug #64172 [WebProfilerBundle] Don’t try to access `RawMessage::$headers` (MatTheCat)
 * bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)
 * feature #60298 [Messenger][Amqp] delayed quorum queues (Miquel Fontana, miquel-angel)
 * bug #64167 [Console] Add missing `symfony/polyfill-php85` dependency (Amoifr)

* 8.1.0-BETA1 (2026-05-06)

 * feature #63751 [DependencyInjection][HttpKernel] Add support for resetting non-shared services (Pechynho)
 * feature #63689 [Routing] Allow collection prefixes to disable trailing slash on root (vvaswani)
 * feature #62127 [RateLimiter] Add calendar-aligned mode to FixedWindowLimiter (Crovitche-1623)
 * feature #64118 [Security] Revert "Add per-username login rate-limit to prevent brute-force attacks" (wouterj)
 * feature #64094 [Messenger] Deprecate `StopWorkerOnTimeLimitListener` in favor of time_limit worker option (Toflar)
 * feature #64104 [Security] Add per-username login rate-limit to prevent brute-force attacks (ayyoub-afwallah)
 * feature #63862 [Console] Use ECH sequence for block padding (Amoifr)
 * feature #64087 [HttpKernel][VarDumper][WebProfilerBundle] Forward CSP nonce to dump() instead of disabling CSP (Amoifr)
 * feature #64079 [ErrorHandler] Trigger `@method` deprecation notices for abstract classes (lacatoire)
 * feature #46654 [Serializer] Add `COLLECT_EXTRA_ATTRIBUTES_ERRORS` and full deserialization path (NorthBlue333)
 * feature #62112 [Console] Add support for OSC 9;4 escape sequence for progress reporting (canvural)
 * feature #52173 [Serializer] Add `AbstractObjectNormalizer::ENABLE_TYPE_CONVERSION` for scalar type transformation (Jeroeny)
 * feature #60008 [HttpFoundation] Add SessionHasFlashMessage test constraint (Pierstoval)
 * feature #63810 [VarDumper] Dump class-strings as class stubs with source location and static properties (lyrixx)
 * feature #63929 [TwigBundle] Add `twig.safe_class` resource tag to register safe classes for the escaper (GromNaN)
 * feature #62801 [Notifier][Prelude] Add bridge  (zairigimad)
 * feature #63727 [Form] Use `translation_domain` for expanded `ChoiceType` placeholder (eyupcanakman)
 * feature #63762 [VarDumper] Add CSP nonce support to HtmlDumper (Amoifr)
 * feature #63809 [Workflow] Add support for dumping listeners in Graphviz diagrams (lyrixx)
 * feature #63879 [JsonStreamer] Add `DateTimeZone` value object support (mtarld)
 * feature #63905 [FrameworkBundle] Add --sort option to debug:router command (Michael Thieulin)
 * feature #63907 [RateLimiter] Add `#[RateLimit]` attribute to rate limit controllers declaratively (ayyoub-afwallah)
 * feature #63925 [MonologBridge] Add `$subjectMaxLength` option to MailerHandler (Amoifr)
 * feature #63945 [Validator] Make constraint validators reentrant instead of being stateful (stof)
 * feature #64055 [Runtime] Add FRANKENPHP_RESET_KERNEL to reset the kernel between requests (nicolas-grekas)
 * feature #63988 [DependencyInjection] Support autowiring env vars as closures or `Stringable` when using `#[Autowire(env: 'FOO')]` (nicolas-grekas)
 * feature #64070 [Messenger] Release deduplication lock on definitive failure (ousamabenyounes)
 * feature #63778 [Tui] Add the component (fabpot)
 * feature #64049 [VarExporter] Deprecate Hydrator and Instantiator classes (nicolas-grekas)
 * feature #64009  Improve phpdoc types (stof)
 * feature #63910 [DependencyInjection] Allow inline Definition as factory and configurator (GromNaN)
 * feature #63943 [WebProfilerBundle] Improve toolbar accessibility for screen reader (Nitram1123)
 * feature #63912 [JsonStreamer] Improve error message when unable to encode (GaryPEGEOT)
 * feature #63695 [VarExporter] Make `DeepCloner::__serialize()` return a pure array and add `toArray()`/`fromArray()` (nicolas-grekas)
 * feature #63880 [DependencyInjection] Add #[RequiredBundle], ServicesBundle and ConsoleBundle (nicolas-grekas)
 * feature #63877 [DependencyInjection] Add AddBehaviorDescribingTagsPass (nicolas-grekas)
 * feature #63875 [EventDispatcher] Add hot-path and no-preload support to AddEventAliasesPass (nicolas-grekas)
 * feature #63710 [DependencyInjection] Add Kernel and Bundle infrastructure for HTTP-less DI-powered apps (nicolas-grekas)
 * feature #63771 [Security] Add `enforce_key_usage_verification` option to OIDC discovery (ruudk)
 * feature #60334 [Twig] Add daisyUI form layout (Oviglo)
 * feature #63742 [JsonStreamer] Add `DateInterval` value object support (mtarld)
 * feature #63745 [FrameworkBundle][HttpKernel] Deprecate `Bundle::registerCommands()` (derrabus)
 * feature #63735 [JsonStreamer] Support date time timezone (mtarld)
 * feature #63714 [Console] Add validation constraints support to `#[MapInput]` (chalasr)
 * feature #63709 [Console] Add optional PSR container parameter to `Application` (nicolas-grekas)
 * feature #57598 [Console] Expose the original input arguments and options and to unparse options (theofidry)
 * feature #52134 [HttpKernel] Add option to map empty data with `MapQueryString` and `MapRequestPayload` (Jeroeny)
 * feature #41574 [Messenger] Add AmqpPriorityStamp for per-message priority on AMQP transport (Valentin Nazarov)
 * feature #63661 [Runtime] Add FrankenPhpWorkerResponseRunner for simple response return (guillaume-sainthillier)
 * feature #63666 [Messenger] Allow configuring the service reset interval in the `messenger:consume` command via the `--no-reset` option (nicolas-grekas)
 * feature #63665 [Messenger] Add `MessageExecutionStrategyInterface` and refactor `Worker` to use it (nicolas-grekas)
 * feature #63662 [Messenger] Add a `--fetch-size` option to the `messenger:consume` command to control how many messages are fetched per iteration (nicolas-grekas)
 * feature #63663 [Contracts] Add `ContainerAwareInterface` (nicolas-grekas)
 * feature #63631 [Form] Add `labels` option to DateType to customize year/month/day sub-field labels (guillaumeVDP)
 * feature #62823 [JsonPath] Add custom function support (alexandre-daubois)
 * feature #63590 [DependencyInjection] Add support for using service stacks as decorators (nicolas-grekas)
 * feature #63595 [ObjectMapper] Add `IsNotNull` built-in condition (Nayte91)
 * feature #63612 [VarExporter] Add `DeepCloner` for COW-friendly deep cloning (nicolas-grekas)
 * feature #51379 [HttpKernel] Adding new `#[MapRequestHeader]` attribute and resolver (StevenRenaux)
 * feature #63585 [Security] Deprecate erase_credentials config, container parameter and AuthenticatorManager constructor argument (guillaumeVDP)
 * feature #62029 [Mailer][SES] Allow configuring port and tls options (adars)
 * feature #63615 [Uid] Pass invalid UID value to `InvalidArgumentException` for better debug (rela589n)
 * feature #63339 [JsonStreamer] Handle value objects (mtarld)
 * feature #63383 [ObjectMapper] Allow class FQDN arrays as TargetClass and SourceClass param (rrajkomar)
 * feature #63520 [FrameworkBundle] Allow configuring Webhook's header names and signing algo (lacatoire)
 * feature #63593 [Uid] Add Uuid47Transformer support for UUIDv7/v4 conversion (nicolas-grekas)
 * feature #63528 [TypeInfo] Resolve tentative return types (valtzu)
 * feature #63546 [Console] Add outline-style block methods to SymfonyStyle (guillaumeVDP)
 * feature #63581 [FrameworkBundle][Messenger] Deprecate "senders" nesting level in routing config (W0rma)
 * feature #63441 [HttpClient] Default CachingHttpClient's $maxTtl to 86400s to prevent eternal cache items (Lctrs, nicolas-grekas)
 * feature #63541 [HttpFoundation] Deprecate setting public properties of `Request` and `Response` objects directly (nicolas-grekas)
 * feature #63552 [Runtime] Add `SymfonyRuntime::resolveType()` for customizing how types are resolved in extending runtimes (Kingdutch)
 * feature #63481 [ErrorHandler] Allow namespace remapping in DebugClassLoader to relax the "same vendor" constraint (mpdude)
 * feature #63524 [Translation][Crowdin] Replace deprecated Upload Translations method with Import Translations (bhdnb)
 * feature #63505 [FrameworkBundle] Deprecate `terminate_on_cache_hit` http_cache option (Mynyx)
 * feature #63538 [Console] Sort suggested commands alphabetically (javiereguiluz)
 * feature #63537 [Console] Replace executeCommand() by runCommand() when testing commands (javiereguiluz)
 * feature #45553 [Translation] Extract locale fallback computation into a dedicated class (mpdude)
 * feature #63433 [HttpClient] Add `GuzzleHttpHandler` that allows using Symfony HttpClient as a Guzzle handler (nicolas-grekas)
 * feature #63465 [Translation] Add support for XLIFF PGS (Plural, Gender, and Select Module) (alexandre-daubois)
 * feature #62888 [Messenger] Route decode failures through failure handling (nicolas-grekas)
 * feature #63453 [Console][WebProfilerBundle] Trace argument value resolvers (chalasr)
 * feature #52055 [Console] Deprecate combining incompatible mode flags in `InputArgument` and `InputOption` (jnoordsij)
 * feature #52058 [Console] Allow setting a boolean default value on `InputOption::VALUE_NEGATABLE` options (jnoordsij)
 * feature #45081 [Form] Add support for submitting forms with unchecked checkboxes in request handlers (filiplikavcan)
 * feature #63443 [Console] Add customization to SymfonyStyle progressBar (guillaumeVDP)
 * feature #63451 [PropertyInfo] Add support for property hook settable types (alexandre-daubois)
 * feature #63455 [Translation] Add support for XLIFF versions 2.1 and 2.2 (alexandre-daubois)
 * feature #63427 [WebLink] : Adding `const`s for `as` attributes (ThomasLandauer)
 * feature #63426 [DependencyInjection] Deprecate named autowiring alias that don't use `#[Target]` (nicolas-grekas)
 * feature #63429 [FrameworkBundle] Add `MicroKernelTrait::$allowedEnvs` to enforce allowed values for `APP_ENV` (vincentpabst)
 * feature #61494 [Console] Allow to test the different streams at the same time with a new result-based testing API for `CommandTester` (theofidry)
 * feature #63371 [Form] Add uid_format option to EntityType (lacatoire)
 * feature #61462 [Messenger] Add `ListableReceiverInterface` support to `RedisReceiver` (mudassaralichouhan)
 * feature #49388 [CssSelector] Add `:has()` support (franckranaivo)
 * feature #63242 [FrameworkBundle] Add decoration stack to `debug:container` command (ayyoub-afwallah)
 * feature #63373 [HttpFoundation] Add `BinaryFileResponse::shouldDeleteFileAfterSend()` (lacatoire)
 * feature #49518  Create `#[Serialize]` Attribute to serialize Controller Result (Koc)
 * feature #63355 [Validator] Add ValidatorBuilder::enablePropertyMetadataExistenceCheck() (lacatoire)
 * feature #63335 [TwigBridge] Add form_flow_* helper functions (ker0x)
 * feature #63356 [FrameworkBundle] Configure custom marshaller per cache pool (mvanduijker)
 * feature #63359 [Console] Allow passing Validator constraints to `QuestionHelper` and `#[Ask]` (chalasr)
 * feature #54817 [HttpKernel] Support variadic with `#[MapRequestPayload]` (DjordyKoert)
 * feature #63360 [Validator] Add clock-awareness to comparison and range validators (lacatoire)
 * feature #63346 [Messenger][AMQP] Allow disabling default queue binding via queues option (xammmue)
 * feature #52265 [HttpClient] Configure `MockClient` if mock_response_factory has been set on a scoped client (tarjei)
 * feature #63293 [Console] Add image support to `QuestionHelper` and `#[Ask]` (chalasr)
 * feature #47969 [Filesystem] rename `Filesystem::mirror()` option `copy_on_windows` to `follow_symlinks` (maxbeckers)
 * feature #58871 [Form] `BirthdayType` has automatic `attr` when `widget` is `single_text` (nicolas-grekas)
 * feature #59202 [Semaphore] Add a semaphore store based on locks (alexander-schranz)
 * feature #47666 [Messenger] Move PostgreSQL LISTEN/NOTIFY blocking to worker idle event listener (d-ph)
 * feature #62638 [DependencyInjection] Add tag decoration support (mtarld)
 * feature #62320 [WebProfiler] add cURL copy/paste to request tab (darkweak)
 * feature #63214 [Form] Allow `ViolationMapperInterface` injection for `ValidatorExtension` and `FormTypeValidatorExtension` (ktherage)
 * feature #63304 [Contracts][DependencyInjection] Support hooked properties in ServiceMethodsSubscriberTrait (derrabus)
 * feature #63277 [Messenger] Add idle timeout option to `BatchHandlerTrait` (HypeMC)
 * feature #61458 [HttpKernel] Validate typed request attribute values before calling controllers (mudassaralichouhan)
 * feature #63274 [HttpKernel] Add `ControllerEvent::evaluate()` et al. to help with evaluating expressions or closures in controller attributes (nicolas-grekas)
 * feature #63032 [HttpKernel] Dispatch events named after controller attributes (nicolas-grekas)
 * feature #63263 [FrameworkBundle][Lock] Scope semaphore and flock stores by project dir by default (nicolas-grekas)
 * feature #61457 [FrameworkBundle] Deprecate container parameters router.request_context.scheme and .host (stollr)
 * feature #63092 [HttpKernel] Expose controller metadata throughout the request lifecycle (nicolas-grekas)
 * feature #58273  Allow usage of expressions for defining validation groups in `#[MapRequestPayload]` (Brajk19)
 * feature #63201 [Security] Add `this` to `#[IsGranted]` subject expression vars when available (valtzu)
 * feature #63181 [DependencyInjection] Add `target` parameter to `#[AsAlias]` attribute (ayyoub-afwallah)
 * feature #53559 [DomCrawler] Allow to add choices to single select (norkunas)
 * feature #53998 [Security] Add retrieval of parent role names (PierreCapel)
 * feature #62875 [Messenger] Add regex support for transport name matching in `messenger:consume` command (santysisi)
 * feature #58732 [Finder] Allow finder to set the `UNIX_PATH` flag when recursing directories (Shane McKinley)
 * feature #62754 [ExpressionLanguage] Add support for null-safe syntax for array access (cancan101)
 * feature #57365 [Validator] Add `Xml` constraint (sfmok)
 * feature #58966 [Serializer] Trigger deprecation when could not parse date with default format (alexndlm)
 * feature #57769 [Notifier] [Telegram] Add support for local API server (ahmedghanem00)
 * feature #57653 [FrameworkBundle] Allow default action in HtmlSanitizer configuration (Neirda24)
 * feature #54866 [Messenger] Added the ability to force `RedisCluster` (adideas)
 * feature #63130 [Console] Add TesterTrait::assertCommandFailed and TesterTrait::assertCommandIsInvalid helpers (darovic)
 * feature #63095 [FrameworkBundle] Add shortcut to run console command in tests (Koc)
 * feature #63097 [Security] Decouple `SameOriginCsrfTokenManager` from event listening (jprivet-dev)
 * feature #62599 [FrameworkBundle][JsonStreamer] Add default options (mtarld)
 * feature #63061 [Messenger] Add support for custom `type` in `Serializer` Transport (lyrixx)
 * feature #62885 [TypeInfo] Allow resolving object shapes (bnf)
 * feature #63183 [Console] Allow object as default for input options and arguments (chalasr)
 * feature #63157 [Security] Add support for enums in `SignatureHasher::computeSignatureHash()` (nicolas-grekas)
 * feature #63024 [ObjectMapper] Add `targetClass` on `MapCollection` transform (soyuka)
 * feature #63111 [DependencyInjection] Add argument `exclude` to `ContainerConfigurator::import()` (tilaven)
 * feature #63135 [Scheduler] Add option to order recurring messages by next run date in debug command (yoye)
 * feature #62434 [HttpKernel] deprecate the `Extension` class (xabbuh)
 * feature #63059 [Semaphore] Add `SemaphoreKeyNormalizer` (clegginabox)
 * feature #62909 [FrameworkBundle] Enable mocking non-shared services in tests (HypeMC)
 * feature #62751 [HttpClient] Add support of the persistent cURL handles (Koc)
 * feature #63121 [Translation][FramworkBundle] Allow using env vars in the list of enabled locales (nicolas-grekas)
 * feature #62566 [FrameworkBundle] Add `AbstractController::createFormFlowBuilder` (silasjoisten)
 * feature #62917 [Console] Add ArgumentResolver (chalasr)
 * feature #63090 [HttpKernel] Return attributes as a flat list when using `Controller[Arguments]Event::getAttributes(*)` (nicolas-grekas)
 * feature #63039 [PhpUnitBridge] add logic for checking for dist.xml, xml.dist and xml phpunit config (gennadigennadigennadi)
 * feature #62941 [HttpKernel] Allow the `Cache` attribute to be applied conditionally (HypeMC)
 * feature #62511 [ObjectMapper] merge nested properties when targeting the same class (soyuka)
 * feature #62835 [DependencyInjection] Allow environment variables with `.` in them (Max Baldanza)
 * feature #62957 [ObjectMapper] Throw exception for invalid transform callable (calm329, Asenar)
 * feature #62522 [FrameworkBundle][ObjectMapper] Add automatic class-map array based on map attributes (Orkin)
 * feature #63023 [Uid] Add argument `$format` to `Ulid::isValid()` (mms-uret)
 * feature #62854 [HttpClient] Add support for the `max_connect_duration` option (alexandre-daubois)
 * feature #62940 [HttpKernel] Allow using closures with the `Cache` attribute (HypeMC)
 * feature #62925 [HttpKernel] Deserialize `UploadedFile` for `#[MapRequestPayload]` (Grafikart)
 * feature #62911 [Console] Add `#[AskChoice]` attribute for interactive choice questions (yceruto)
 * feature #62939 [HttpKernel] Improve `Cache` attribute expression vars (HypeMC)
 * feature #62850 [HttpKernel] Decouple controller attributes from source code and add `ResponseEvent::getControllerAttributes()` (nicolas-grekas)
 * feature #62567 [Console] Add support for method-based commands (yceruto)
 * feature #62538 [HttpKernel] Add support for `SOURCE_DATE_EPOCH` environment variable (Charles-Édouard Coste)
 * feature #62824 [DependencyInjection][SecurityBundle] Leverage `#[AsTaggedItem]` for voters (ayyoub-afwallah)
 * feature #62339 [DependencyInjection] Deprecate default index/priority methods when defining tagged locators/iterators (nicolas-grekas)
 * feature #62792 [DoctrineBridge] Deprecate `RegisterMappingsPass::$aliasMap` (GromNaN)
 * feature #62800 [HttpKernel] Add support for bundles as compiler passes (yceruto)
 * feature #62578 [Form] Add reset button in `NavigatorFlowType` (Nayte91)
 * feature #62572 [Messenger] Use clock in `DelayStamp` and `RedeliveryStamp` instead of native time classes and methods (bluemmb)
 * feature #62483 [DependencyInjection] Deprecate invalid options when using `from_callable` (yoeunes)
 * feature #60372 [Mailer][SendGrid] add support for scheduling delivery via `send_at` API parameter (Mickael GOETZ, MrMitch)
 * feature #62322 [Security] add missing `Clear-Site-Data` directives (xabbuh)
 * feature #62390 [Mailer] Add support of ipPoolId for infobip mailer transport (jbdelhommeau)

