Symfony v8.1.6, v7.4.18 and v6.4.45 released!

NewsBot · 30 August 2026 23:21

Symfony v8.1.6, v7.4.18 and v6.4.45 has been released.

Changelog (Comparing v8.1.5...v8.1.6 · symfony/symfony · GitHub)

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)

bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)

bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)

bug #65748 [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)

bug #65749 [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)

bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)

bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)

bug #65731 [HttpClient] Don’t send the original Host header on cross-authority redirects (@nicolas-grekas)

bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)

bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)

bug #65744 [Mime] Reject an unquoted “@” in the local part of an email address (@nicolas-grekas)

bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)

bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)

bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)

bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)

bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)

bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)

bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize()…

Link: Release v8.1.6 · symfony/symfony · GitHub

Changelog (Comparing v7.4.17...v7.4.18 · symfony/symfony · GitHub)

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)

bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)

bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)

bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)

bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)

bug #65731 [HttpClient] Don’t send the original Host header on cross-authority redirects (@nicolas-grekas)

bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)

bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)

bug #65744 [Mime] Reject an unquoted “@” in the local part of an email address (@nicolas-grekas)

bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)

bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)

bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)

bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)

bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)

bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)

bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)

bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)

bug #65730 [HttpKernel] Fix Typ…

Link: Release v7.4.18 · symfony/symfony · GitHub

Changelog (Comparing v6.4.44...v6.4.45 · symfony/symfony · GitHub)

bug #65754 [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)

bug #65751 [HttpClient] Reject decompression bombs (@nicolas-grekas)

bug #65753 [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)

bug #65740 [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)

bug #65747 [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)

bug #65731 [HttpClient] Don’t send the original Host header on cross-authority redirects (@nicolas-grekas)

bug #65742 [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)

bug #65746 [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)

bug #65744 [Mime] Reject an unquoted “@” in the local part of an email address (@nicolas-grekas)

bug #65739 [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)

bug #65738 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)

bug #65735 [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)

bug #65734 [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)

bug #65733 [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)

bug #65732 [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)

bug #65737 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)

bug #65736 [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)

bug #65730 [HttpKernel] Fix Typ…

Link: Release v6.4.45 · symfony/symfony · GitHub