Symfony v8.1.0-BETA3, v8.0.12 and v7.4.12 released!

[NewsBot]

Symfony v8.1.0-BETA3, v8.0.12 and v7.4.12 has been released.

Changelog (Comparing v8.1.0-BETA2...v8.1.0-BETA3 · symfony/symfony · GitHub)

• data #64307 Release v8.1.0-BETA3
• data #64303 Release v6.4.40
• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER[‘QUERY_STRING’] (@nicolas-grekas)
• security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (@nicolas-grekas)
• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (@nicolas-grekas)
• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (@alexandre-daubois)
• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (@nicolas-grekas)
• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)
• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (@alexandre-daubois)
• bug #64301 [TwigBundle] Various fixes and hardenings (@nicolas-grekas)
• bug #64300 [TwigBridge] Fix daisyUI form layout and AppVariable locale filtering (@nicolas-grekas)
• bug #64296 [Serializer] Improve normalizer error reporting and deprecations (@nicolas-grekas)
• bug #64297 [Tui] Various fixes and hardenings (@nicolas-grekas)
• bug #64299 [TypeInfo] Harden ObjectShapeType (@nicolas-grekas)
• bug #64294 [RateLimiter] Harden calendar-aligned fixed window mode (@nicolas-grekas)
• bug #64291 [MonologBridge] Harden MailerHandler subject truncation (@nicolas-grekas)
• bug #64290 [Security] Various fixes and hardenings (@nicolas-grekas)
• bug #64287 [Translation] Various fixes and hardenings (@nicolas-grek…

Link: Release v8.1.0-BETA3 · symfony/symfony · GitHub

Changelog (Comparing v8.0.11...v8.0.12 · symfony/symfony · GitHub)

• data #64306 Release v8.0.12
• data #64303 Release v6.4.40
• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER[‘QUERY_STRING’] (@nicolas-grekas)
• security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (@nicolas-grekas)
• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (@nicolas-grekas)
• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (@alexandre-daubois)
• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (@nicolas-grekas)
• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)
• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (@alexandre-daubois)
• bug #64258 [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-selects (@nicolas-grekas)
• bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (@nicolas-grekas)
• bug #64207 [MonologBridge] Fix interactive_only not preventing propagation (@philbates35)
• bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (@nicolas-grekas)
• security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (@nicolas-grekas)
• security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (@nicolas-grekas)
• security #cve-2026-45133 [Yaml] Bound recursion depth in th…

Link: Release v8.0.12 · symfony/symfony · GitHub

Changelog (Comparing v7.4.11...v7.4.12 · symfony/symfony · GitHub)

• data #64305 Release v7.4.12
• data #64303 Release v6.4.40
• security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER[‘QUERY_STRING’] (@nicolas-grekas)
• security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (@nicolas-grekas)
• security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (@nicolas-grekas)
• security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (@nicolas-grekas)
• security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (@alexandre-daubois)
• security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (@nicolas-grekas)
• security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (@nicolas-grekas)
• security #cve-2026-45066 [HtmlSanitizer] Fix allowLinkHosts/allowMediaHosts bypass via URL parser differentials and <area> misclassification (@alexandre-daubois)
• security #cve-2026-45069 [Security] Add missing claims in OidcTokenHandler (@alexandre-daubois)
• bug #64258 [DomCrawler] Fix ChoiceFormField::addChoice() clobbering values on multi-selects (@nicolas-grekas)
• bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (@nicolas-grekas)
• security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (@nicolas-grekas)
• security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (@nicolas-grekas)
• security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (@nicolas-grekas)
• security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling validateOnParse (@alexandre-daubois)
• security #cve-2026-45068 [Mailer] Add end-of-options separator before r…

Link: Release v7.4.12 · symfony/symfony · GitHub