Symfony Files

Changelog (https://github.com/symfony/symfony/compare/v8.1.9...v8.1.10)

• minor [#67593] Release v8.1.10
• security #cve-2026-45070 [Mime] Reject parameter names containing non-token characters (@alexandre-daubois)
• minor [#67589] [Form] Refine Persian date interval and locale translations (@ephpicman)
• bug [#67587] [JsonStreamer] Reject scalar values of the wrong type instead of converting them (@nicolas-grekas)
• bug [#67581] [HttpKernel] Don't keep the stale container when rebuilding it fails (@lazerg)
• minor [#67582] [Messenger] Allow installing the Redis bridge with only ext-relay (@lazerg)
• bug [#67575] [Console] Fix raw token stripping when an option value matches the command (@ahbaqdadi)
• bug [#67576] [Console] Don't format escaped tags again when sections measure their lines (@nicolas-grekas)
• bug [#67574] [Cache] Fix items losing their tags when saved after a concurrent invalidation (@nicolas-grekas)
• minor [#67566] [Form] Improve Persian validator translations (@ephpicman)
• bug [#67560] [Security] Stop logging router errors when a check path does not match the request (@nicolas-grekas)
• bug [#67556] [Messenger] Reject non-integer fetch sizes (@ahbaqdadi)
• minor [#67546] [Form] Review Indonesian validator translations (@Yoruxyv)
• minor [#67551] [SecurityBundle] Stop asserting an empty body for the 401 of a rejected access token (@nicolas-grekas)
• minor [#67540] [Validator] Fix Arabic validation messages and six-form plurals (@malekkadri)
• bug [#67543] [Intl] Fix Timezones::getRawOffset() depending on the default timezone around DST transitions (@wfatih)
• bug [#67542] [Console] Fix style names with uppercase letters not being applied (@wfatih)
• bug [#67533] [Console] Fix Table header cells that span rows and escaped tags in TableCell (@nicolas-grekas)
• minor [#67531] [Form] Review Arabic translations (@MohannadElemary)
• bug [#67523] [Console] Fix the alignment of wrapped Table cells and newlines around style tags (@nicolas-grekas)
• bug [#67522] [Console] Fix styles that leak out of Table cells (@nicolas-grekas)
• minor [#67519] [Form] Review Swedish translations (@JakobHallin)
• bug [#67515] [JsonStreamer] Fix explicit null handling in the string reader and reject it on non-nullable types (@mtarld)
• minor [#67517] [Form][Validator] Review Latvian translations (@k0d3r1s)
• bug [#67516] [FrameworkBundle] Make secrets key generation and list updates safe to interrupt (@nicolas-grekas)
• bug [#67511] [FrameworkBundle] Make secrets key rotation safe to interrupt (@cestercian)
• bug [#67513] [HttpClient] Fix retry delays longer than the idle timeout (@nicolas-grekas)
• bug [#67512] [PropertyAccess] Fix writing SimpleXMLElement children and dynamic properties of #[AllowDynamicProperties] classes (@nicolas-grekas)
• minor [#67509] [Intl] Update the ICU data to 79.1 (@nicolas-grekas)
• bug [#67507] [Console] Fix Helper::removeDecoration() keeping escaped > and trailing backslashes (@nicolas-grekas)
• bug [#67508] [Routing] Don't ignore route conditions that are "0" (@nicolas-grekas)
• bug [#67504] [HttpFoundation] Ignore malformed and multiple ranges in BinaryFileResponse (@jack-worman)
• bug [#67503] [Scheduler] Fix skipping a run when the cache loses the checkpoint of a running worker (@nicolas-grekas)
• minor [#67498] [Form] Review pt_BR translations (@anderson-oliveira-git)
• minor [#67502] [Form] Remove needs-review-translation state from Spanish translations (@abp002)
• bug [#67501] [HttpFoundation] Don't reject suffix ranges longer than the file in BinaryFileResponse (@jack-worman)
• bug [#67494] [FrameworkBundle][Serializer] Fix autowired normalizers being shared between named serializers (@nicolas-grekas)
• minor [#67449] [Form][Security][Validator] Add Central Kurdish (ckb) translations (@RawanD201)
• bug [#67497] [Mime] Fix unserializing subclasses of TextPart, DataPart and SMimePart that implement __sleep() (@nicolas-grekas)
• bug [#67485] [Intl] Add the locales that have a three-letter language code (@nicolas-grekas)
• bug [#67496] [HttpFoundation] Match whole subtags in Request::getPreferredLanguage() (@nicolas-grekas)
• bug [#67493] [Mime] Reject non-string values when unserializing TextPart, SMimePart and Email (@nicolas-grekas)
• bug [#67495] [Form] Fix delete_empty with object collections (@nicolas-grekas)
• bug [#67472] [Mime] Fix unserializing DataPart payloads created by 6.4 and reject non-string values (@nicolas-grekas)
• bug [#67471] [Mime] Fix losing the content of multipart and custom parts when serializing them (@nicolas-grekas)
• bug [#67478] [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug [#67476] [Intl] Fix EmojiTransliterator on empty slices and on slices that split a surrogate pair (@nicolas-grekas)
• bug [#67467] [JsonStreamer] Ignore static properties when reading and writing objects (@nicolas-grekas)
• bug [#67466] [JsonStreamer] Stop ignoring properties set to the internal missing value marker (@nicolas-grekas)
• bug [#67461] [HttpKernel] Don't put the HTTP method in the default key of #[RateLimit] (@nicolas-grekas)
• bug [#67459] [Serializer] Escape formulas in the header row of CSV files (@nicolas-grekas)
• bug [#67456] [Messenger] Fix describing classes whose docblock only has a tag in debug:messenger (@nicolas-grekas)
• bug [#67450] [WebProfilerBundle] Check that the profiler is enabled before opening files (@nicolas-grekas)
• bug [#67444] [Mime] Escape quotes and backslashes in quoted parameter values (@wleeaf)
• minor [#67441] [Form][Security][Validator] Review Thai translations (@Warayuth014)
• minor [#67482] [Console][SecurityBundle] Fix two tests that fail on every 5.4 pull request (@nicolas-grekas)
• bug [#67296] [HttpFoundation] Handle filter failures in array values (@nicolas-grekas)
• bug [#67443] [DomCrawler] Drop the base fragment when resolving an empty URI (@wleeaf)
• bug [#67440] [DomCrawler] Resolve 0 as a relative URI (@nicolas-grekas)
• bug [#67438] [DomCrawler] Fix dot segment handling in UriResolver (@wleeaf)
• minor [#67437] [Form] Review Russian translations (@lazerg)
• bug [#67410] [Form] Reject week numbers lower than 1 in WeekToArrayTransformer (@wfatih)
• bug [#67412] [Cache] Fix Relay Cluster node selection when clearing pools (@nicolas-grekas)
• bug [#67415] [JsonStreamer] Fix numeric streamed names (@mtarld)
• bug [#67404] [TypeInfo] Resolve keywords case-insensitively in StringTypeResolver (@DerManoMann)
• minor [#67330] [Form] Change the validator translations to use neutral messages. (@Fan2Shrek)
• bug [#67401] [Lock] Fix database names parsed from MongoDB URIs (@nicolas-grekas)
• bug [#67396] [DomCrawler] Exclude script text from option values (@nicolas-grekas)
• bug [#67397] [DomCrawler] Fix select defaults and disabled options with duplicate values (@nicolas-grekas)
• bug [#67395] [DomCrawler] Do not submit fields inside a disabled fieldset (@randomsymbols)
• bug [#67394] [DomCrawler] Skip disabled options when choosing the default value of a select (@randomsymbols)
• bug [#67392] [DomCrawler] Do not submit reset inputs (@randomsymbols)
• bug [#67393] [DomCrawler] Strip and collapse whitespace in option text used as value (@randomsymbols)
• bug [#67386] [Console] Preserve temporary input files in forked processes (@nicolas-grekas)
• bug [#67385] [DomCrawler][HttpKernel][Process][Translation] Fix cleanup after forking (@nicolas-grekas)
• bug [#67376] [DependencyInjection] Preserve XML schema temporary files in forked processes (@mbeccati)
• minor [#67354] [Form][Security][Validator] Correct Arabic translations (@malekkadri)
• bug [#67345] [HttpFoundation] Fix cookie names and header parsing (@nicolas-grekas)
• bug [#67373] [Console] Fix shell completion when a global option conflicts with an option of _complete (@lyrixx)
• bug [#67361] [String] Fix hyphenated locales in AsciiSlugger (@malekkadri)
• minor [#67379] Add PHP 8.7 to CI (@nicolas-grekas)
• bug [#67381] [JsonStreamer] Fix string validation and non-seekable stream reads (@nicolas-grekas)
• bug [#67362] [Messenger] Release deduplication lock after failed dispatch (@dalerazimov)
• bug [#67380] [String] Fix slugger cache changing parent locale transliteration (@nicolas-grekas)
• minor [#67370] [JsonStreamer] Preserve JSON encoding error messages (@nicolas-grekas)
• bug [#67351] [JsonStreamer] Fix exponential data model on unions of already generated classes (@mtarld)
• bug [#67352] [Translation] Check XLIFF 2 target language when linting filenames (@malekkadri)
• bug [#67339] [JsonStreamer] Fix value transformers called on missing properties (@mtarld)
• bug [#67349] [JsonStreamer] Fix reading JSON lists as non-list arrays from streams (@mtarld)
• bug [#67337] [Routing] Remove the "deprecated" key from route definitions in routing.schema.json (@momito69)
• bug [#67320] [Translation] Support the official XLIFF 2.2 namespace (@malekkadri)
• bug [#67329] [Console] Fix StringInput dropping quotes inside a quoted option value (@mkantautas)
• bug [#67307] [Notifier] Fix Transport::fromDsn() when some bridges are installed (@javiereguiluz)
• bug [#67301] [VarExporter] Preserve named variadic arguments in lazy proxies (@nicolas-grekas)
• bug [#67300] [DependencyInjection] Fix lazy closures for static and never-returning methods (@nicolas-grekas)
• bug [#67288] [FrameworkBundle] Fix TestContainer::initialized() for private services (@nicolas-grekas)
• bug [#67286] [Tui] Fix widths of newer Unicode characters and emoji (@nicolas-grekas)
• bug [#67284] [String] Preserve text after emoji joiners in width calculations (@nicolas-grekas)
• bug [#60091] [FrameworkBundle][Serializer] Fix nested normalizers being shared between named serializers (@HypeMC)
• bug [#67268] [ObjectMapper] Remove @internal from Mapping (@nikophil)
• bug [#67269] [DependencyInjection] Fix process() running twice on extensions also registered as compiler passes (@HypeMC)
• bug [#67264] [Mailer] Throw a TransportException when proc_open() is not available (@Amoifr)
• minor [#67261] [Notifier][Brevo] Update the Brevo API documentation link (@lbonnet-gda)
• bug [#67249] [PropertyInfo] Fix resolution of self, static and parent with TypeInfo (@nicolas-grekas)
• bug [#67248] [MonologBridge] Fix NotifierHandler not raising levels below Error with Monolog 3 (@nicolas-grekas)
• bug [#67234] [PropertyInfo] Fix resolution of self, static and parent in collection types (@nicolas-grekas)
• bug [#67243] [Serializer] Fix denormalizing a scalar into a union with an object type (@nicolas-grekas)
• bug [#67245] [FrameworkBundle] Fix describing classes whose docblock only has a tag (@nicolas-grekas)
• bug [#67242] [Config] Quote the default values of arrays in the YAML reference (@nicolas-grekas)
• bug [#67241] [DependencyInjection] Fix autowiring intersection types with aliases of aliases (@nicolas-grekas)
• bug [#67240] [AssetMapper] Fix importmap:update and importmap:remove deleting vendor files when they fail (@nicolas-grekas)
• bug [#67239] [DependencyInjection] Fix env vars reported as never used when overriding an extension service (@nicolas-grekas)
• bug [#67238] [ErrorHandler] Fix DebugClassLoader suggesting template types as native return types (@nicolas-grekas)
• bug [#67236] [ErrorHandler] Log uncaught exceptions like PHP does when no logger is set (@nicolas-grekas)
• bug [#67235] [BrowserKit] Send a Content-Length header when uploading files (@nicolas-grekas)
• bug [#67232] [Serializer] Fix normalizing a file that DataUriNormalizer denormalized (@nicolas-grekas)
• bug [#67231] [Messenger] Fix the user_id, CC and expiration of republished or delayed AMQP messages (@nicolas-grekas)
• bug [#67230] [Messenger] Do not inherit AMQP expiration when sending to another transport (@dalerazimov)
• bug [#67227] [HtmlSanitizer] Don't cut a multibyte character when truncating the input to its maximum length (@nicolas-grekas)
• bug [#67226] [HtmlSanitizer] Ignore meta charset declarations in NativeParser (@lazerg)
• bug [#67223] [HttpClient] Fix NativeHttpClient sending paused requests up to one second late (@nicolas-grekas)
• minor [#67221] [DependencyInjection][VarDumper] Import the PHPUnit attributes that some tests use without a use statement (@nicolas-grekas)
• bug [#67208] [Console] Support sections in TestOutput (@norkunas)
• bug [#67204] [RateLimiter] Fix early retry and expiry times, and three consume() edge cases (@nicolas-grekas)
• bug [#67203] [RateLimiter] Fix SlidingWindow wait duration when refused by the hits of the current window (@florentdestremau)
• bug [#67200] [DomCrawler] Ignore documents without a root element in addNode() (@nicolas-grekas)
• bug [#67161] [Console] Fix invalid null device redirection on Windows (@laloona)
• bug [#67179] [FrameworkBundle][HttpKernel] Collect garbage cycles in the callers of Kernel::shutdown() (@nicolas-grekas)
• bug [#67174] [Runtime] Don't terminate the last request twice when a FrankenPHP worker stops (@nicolas-grekas)
• bug [#67158] [HttpKernel] Replace the error handler loggers installed by a previous container (@nicolas-grekas)
• bug [#67157] [Finder] Match symlinks against their own path in ignoreVCSIgnored() (@nicolas-grekas)
• bug [#67152] [Finder] Respect .git/info/exclude in ignoreVCSIgnored() (@ephpicman)
• bug [#67150] [Messenger] Never reuse the received AMQP routing key when sending to another transport (@dalerazimov)
• bug [#67145] [Security][SecurityBundle] Decide the checks of an expression for the token being voted on (@Neirda24)
• bug [#67148] [Security] Fix TraceableAccessDecisionManager reusing a finished access decision (@nicolas-grekas)
• bug [#67146] [Console] Fix locking a command again after acquiring its lock failed (@nicolas-grekas)
• bug [#67147] [Console] Lock an invokable command on the name of the command that runs it (@nicolas-grekas)
• bug [#67144] [Console] Stop a failed release from wedging the lock of a command (@HypeMC)
• bug [#67143] [Console] Lock an invokable command on its name alone, not on its aliases (@HypeMC)
• bug [#67142] [ObjectMapper] Fix losing the value mapped to a promoted property when a later #[Map] is skipped (@nicolas-grekas)
• bug [#67139] [Serializer] Fix denormalizing string-keyed collections and unions from XML (@nicolas-grekas)
• bug [#67134] [DependencyInjection] Keep lazy closures lazy when their service is part of a circular reference (@nicolas-grekas)
• bug [#67138] [Serializer] Fix denormalizing nested scalar collections from XML (@chr-hertel)
• bug [#67132] [Console] Fix markdown tables with colspan cells or several header rows (@nicolas-grekas)
• bug [#67128] [Console] Always write a valid header and delimiter row in markdown tables (@ybai08)
• bug [#67126] [HttpFoundation] Fix MigratingSessionHandler sending needless cookies to delete empty sessions (@nicolas-grekas)
• bug [#67055] [Serializer] Fix the first normalized object deciding whether property paths are normalized (@HypeMC)
• bug [#67113] [Finder] Fix followLinks() looping on circular symlinks (@nicolas-grekas)
• bug [#67068] [String] Fix trim(), trimStart() and trimEnd() with empty chars on unicode strings (@wfatih)
• bug [#67101] [Form] Invalidate cached resources when a block hierarchy changes (@drewmt)
• bug [#67092] [Console] Only rewrite the changed lines when appending a table row (@semx)
• bug [#67049] [ObjectMapper] Fix the reverse class map overriding source property transforms and dropping property paths (@lazerg)
• bug [#67123] [HttpFoundation] Destroy empty sessions in updateTimestamp() of the Redis, Memcached, MongoDb and Pdo session handlers (@PhilETaylor)
• bug [#67104] [BrowserKit] Fix HttpBrowser ignoring UploadedFile instances (@nicolas-grekas)
• bug [#67106] [Yaml] Fix dumping control characters and invalid UTF-8 in multi-line literal blocks (@nicolas-grekas)
• bug [#67125] [HttpFoundation] Don't marshall empty session data in MarshallingSessionHandler (@nicolas-grekas)
• bug [#67121] [Messenger] Fix messages retried through Amazon SQS collecting one TransportMessageIdStamp per delivery (@nicolas-grekas)
• bug [#67120] [HttpKernel] Fix transient failures in ResponseCacheStrategyTest (@nicolas-grekas)
• bug [#67119] [CssSelector] Fix more bugs in the translation to XPath (@nicolas-grekas)
• bug [#67117] [DependencyInjection] Fix #[AutowireServiceClosure] ignoring #[Target] (@nicolas-grekas)
• bug [#67116] [DoctrineBridge] Fix dispatching events after a lazy listener failed to initialize (@nicolas-grekas)
• bug [#67115] [Messenger][WebProfilerBundle] Fix tracing messages dispatched from internal functions (@nicolas-grekas)
• bug [#67114] [HttpKernel] Fix ExceptionEvent::isKernelTerminating() for exceptions thrown by terminate listeners (@nicolas-grekas)
• bug [#67112] [HttpClient] Fix AmpHttpClient reporting completed responses up to one second late (@nicolas-grekas)
• bug [#67111] [Console] Fix several bugs when sections count the rows of their lines (@nicolas-grekas)
• bug [#67109] [Finder] Fix negated bracket expressions in gitignore patterns (@nicolas-grekas)
• bug [#67102] [BrowserKit] Fix URI resolution for mixed-case schemes and base URIs without path (@nicolas-grekas)
• bug [#67110] [Form] Fix where collection_entry is inserted in the block prefixes of a collection prototype (@nicolas-grekas)
• bug [#67070] [Validator] Fix the Video constraint for rotated videos and thumbnails (@GromNaN)
• bug [#67097] [CssSelector] Fix :is() and :where() ignoring combinators and structural pseudo-classes (@nicolas-grekas)
• bug [#67098] [CssSelector] Fix :has() matching the element itself and ignoring structural pseudo-classes (@nicolas-grekas)
• bug [#67099] [Console] Fix clearing section lines that are wider than the terminal (@nicolas-grekas)
• bug [#67096] [CssSelector] Fix several bugs in the translation to XPath (@nicolas-grekas)
• bug [#67091] [String] Fix trim(), trimStart() and trimEnd() with ".." ranges on unicode strings (@nicolas-grekas)
• bug [#67079] [DependencyInjection] Fix the proxy tags of lazy arguments typed as a nullable intersection (@nicolas-grekas)
• bug [#67094] [Finder] Treat unclosed brackets and braces in glob patterns as literal characters (@nicolas-grekas)
• bug [#67093] [Routing] Fix HEAD-only routes with UrlMatcher and scheme redirections when both trailing slash variants exist (@nicolas-grekas)
• bug [#67088] [Console] Fix hyperlinks next to a literal < or > (@nicolas-grekas)
• bug [#67087] [RateLimiter] Apply updated configuration to stored fixed windows (@nicolas-grekas)
• bug [#67083] [HttpKernel] Make Kernel::terminate() go through http_cache like handle() does (@nicolas-grekas)
• bug [#67081] [WebProfilerBundle] Fix the toolbar hiding unhandled fetch() rejections and leaving 0 ms requests loading (@nicolas-grekas)
• bug [#67080] [Security] Fix use_referer redirecting to the check path (@nicolas-grekas)
• bug [#67039] [Console] Preserve ANSI sequences when wrapping output (@nicolas-grekas)
• bug [#67038] [Messenger] Acknowledge messages sent for retry (@nicolas-grekas)
• bug [#67036] [Cache] Detect ElastiCache Serverless eviction policy (@nicolas-grekas)
• bug [#67035] [DomCrawler] Remove temporary uploads at shutdown (@nicolas-grekas)
• bug [#67034] [Serializer] Apply ignored attributes to setter and adder aliases (@nicolas-grekas)
• bug [#67033] [PhpUnitBridge] Honor --stderr for listener output (@nicolas-grekas)
• bug [#67032] [Validator] Compare integer ranges without losing precision (@nicolas-grekas)
• bug [#67029] [DoctrineBridge] Collect queries executed during request termination (@nicolas-grekas)
• bug [#67027] [Cache] Fix overriding the adapter of a cache pool that has a provider (@nicolas-grekas)
• bug [#67026] [Finder] Only treat patterns that compile as regexps (@nicolas-grekas)
• bug [#67023] [Mailer] Accept Brevo marketing webhook payloads (@nicolas-grekas)
• bug [#67022] [RateLimiter] Apply updated configuration to stored token buckets (@nicolas-grekas)
• bug [#67021] [RateLimiter] Reject refill intervals below one second (@nicolas-grekas)
• bug [#67028] [WebProfilerBundle] Fix dumps on pages with a CSP (@nicolas-grekas)
• bug [#67084] [Messenger] Fix the in-memory transport decoding the whole queue on each get() (@javiereguiluz)
• bug [#67078] [DependencyInjection] Fix lazy nullable arguments whose service is missing (@nicolas-grekas)
• bug [#67076] [Validator] Fix Collection with groups failing on fields that have no groups (@nicolas-grekas)
• bug [#67075] [Finder] Fix wildcards and escapes inside glob bracket expressions (@nicolas-grekas)
• bug [#67074] [Finder] Fix backslash escapes in gitignore patterns (@nicolas-grekas)
• minor [#67072] [Messenger] Fix the Amazon SQS and Beanstalkd transports when pcntl_signal_dispatch() is disabled (@nicolas-grekas)
• bug [#67069] [OptionsResolver] Ensure remove() also unsets nested options (@wfatih)
• bug [#67067] [Validator] Fix Count::$divisibleBy being ignored in groups other than Default (@wfatih)
• bug [#67053] [DependencyInjection] Allow #[Lazy] with an interface on union types (@HypeMC)
• bug [#67052] [HttpClient] Fix CurlHttpClient leaking temp file streams (@bakugo)
• bug [#67085] [HttpClient] Fix CurlHttpClient leaking the curl handle of responses closed while performing (@nicolas-grekas)
• minor [#67056] [Doctrine][Messenger] Handle disabled pcntl_signal_dispatch when receiving messages (@aragon999)
• bug [#67066] [Finder] Fix escaped brackets in glob patterns (@wfatih)
• bug [#67059] [HttpFoundation] Don't announce a Content-Length on non-successful BinaryFileResponse (@lazerg)
• bug [#67060] [HttpFoundation] Register the session shutdown function only once in NativeSessionStorage (@lazerg)
• bug [#67063] [ObjectMapper] Fix the metadata of a property leaking into a class whose name continues the class name (@javiereguiluz)
• minor [#67061] Refine Portuguese translations in validators.pt.xlf (@lucascamp)
• minor [#67065] Resolve grammar and vocabulary issues in pt-PT (@1PedroSoares)
• bug [#67017] [DependencyInjection] Release the closures that reference the container when resetting it (@nicolas-grekas)
• bug [#67016] [WebProfilerBundle] Fix the form and translation panels with Twig 4 (@nicolas-grekas)
• bug [#67007] [Form] Fix debug:form for types calling addNormalizer(), setDeprecated(), setInfo() or getInfo() on inherited options (@andyexeter)
• bug [#67010] [Form] Fix debug:form listing an overridden option twice (@nicolas-grekas)
• bug [#67009] [DependencyInjection] Don't initialize lazy services when resetting the container (@nicolas-grekas)
• bug [#67002] [Messenger] Fix the Redis transport after a lost connection (@nicolas-grekas)
• bug [#67001] [Messenger] Fix the Amazon SQS connection losing buffered messages when a receive fails (@nicolas-grekas)
• bug [#67000] [Messenger] Fix the Amazon SQS connection rethrowing the same error after a failed receive (@nicolas-grekas)
• bug [#66998] [Notifier][Sevenio] Fix response code 101 being reported as a success (@nicolas-grekas)
• bug [#66986] [Serializer] Fix normalizing discriminated classes that have no properties (@nicolas-grekas)
• bug [#66994] [String] Fix slice(), splice() and chunk() with very large offsets or lengths (@nicolas-grekas)
• bug [#66997] [HttpKernel] Fix FileProfilerStorage not removing some expired profiles (@nicolas-grekas)
• bug [#66992] [HttpKernel] Don't list expired profiles in the profiler search (@javiereguiluz)
• bug [#66990] [TwigBridge] Fix form_label() with a literal label and non-literal variables (@nicolas-grekas)
• bug [#66989] [FrameworkBundle] Reset the whole request context, not only its parameters (@nicolas-grekas)
• bug [#66991] [Cache] Fix RedisTagAwareAdapter returning invalidated items from Relay's memory (@nicolas-grekas)
• bug [#66965] [PropertyAccess] Fix using custom PropertyPathInterface implementations on objects (@nicolas-grekas)
• bug [#66980] [Translation] Fix FileDumper::dump() when another process creates the target directory (@nicolas-grekas)
• bug [#66981] [Console] Fix two state bugs in OutputFormatterStyle (@nicolas-grekas)
• bug [#66973] [Messenger] Fix the Doctrine transport not retrying ack() and reject() on deadlocks (@nicolas-grekas)
• bug [#66974] [Messenger] Fix PostgreSqlConnection throwing from its destructor when the database is gone (@nicolas-grekas)
• bug [#66978] [Cache] Fix PhpArrayAdapter::warmUp() when another process creates the cache directory (@nicolas-grekas)
• bug [#66975] [Messenger] Fix the worker looping without sleeping just before its time limit (@nicolas-grekas)
• bug [#66971] [Console] Fix how sections count and redraw their lines (@nicolas-grekas)
• bug [#66969] [String] Fix UnicodeString::replace() and split() with ignorable characters like U+200B (@nicolas-grekas)
• bug [#66966] [VarDumper] Fix source excerpts of files with CRLF line endings (@nicolas-grekas)
• minor [#66967] [HttpKernel] Document registering after -10000 when the new controller has other parameters (@Florian-B)
• minor [#66959] Release v5.4.54
• security #cve-2026-109449 [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas, @lazerg)
• security #cve-2026-108082 [HttpFoundation] Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• security #cve-2026-109413 [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug [#66955] [Messenger] Fix the Beanstalkd transport using the "default" tube after a failed reconnect (@nicolas-grekas)
• bug [#66958] [Form] Fix rendering the parent block twice from a form theme block (@nicolas-grekas)
• bug [#66956] [Form] Clear the renderer state when rendering a block fails (@KevinMartinsDev)
• bug [#66954] [Yaml] Fix TypeErrors, a PHP warning and wrong results for !php/const keys and merge keys (@nicolas-grekas)
• bug [#66942] [Console] Escape pipes and newlines in markdown tables (@lazerg)
• bug [#66943] [Console] Fix nested applications exiting on signals handled by the outer application (@nicolas-grekas)
• bug [#66944] [FrameworkBundle] Fix request context parameters leaking between requests (@nicolas-grekas)
• bug [#66948] [Cache][HttpKernel] Fix missing #[Cache] headers on 304 responses (@nicolas-grekas)
• minor [#66946] [HttpKernel] Document how to keep controller attributes when replacing the controller (@nicolas-grekas)
• bug [#66940] [HttpClient] Ignore negative CURLOPT_MAXREDIRS values in GuzzleHttpHandler (@nicolas-grekas)
• bug [#66938] [HttpClient] Don't add the query option again to redirect targets in NoPrivateNetworkHttpClient (@nicolas-grekas)
• bug [#66935] [Messenger] Fix DispatchAfterCurrentBusMiddleware staying in a root dispatch after an \Error (@KevinMartinsDev)
• bug [#66922] [HttpKernel] Reset the default logger between requests (@KevinMartinsDev)
• bug [#66932] [PropertyAccess] Fix using custom PropertyPathInterface implementations (@HawkForge)
• minor [#66933] [Validator] Review Italian translations (@mrCabez)
• bug [#66914] [Messenger] Prevent losing delayed Redis messages on migration failure (@dalerazimov)
• minor [#66916] Release v7.4.21
• minor [#66915] Release v6.4.48

[SECURITY] Security release