Symfony Files

Changelog (https://github.com/symfony/symfony/compare/v8.1.5...v8.1.6)

• bug [#65754] [PhpUnitBridge] Fix ClockMock::hrtime() when the clock is not mocked and when the nanoseconds have leading zeros (@nicolas-grekas)
• bug [#65751] [HttpClient] Reject decompression bombs (@nicolas-grekas)
• bug [#65753] [HttpFoundation] Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug [#65748] [PropertyInfo] Read only the doc block of a promoted property in getTypeFromConstructor() (@nicolas-grekas)
• bug [#65749] [Serializer] Enforce the element type of nested scalar collections (@nicolas-grekas)
• bug [#65740] [HttpClient] Reject https:// proxies that curl would connect to in cleartext (@nicolas-grekas)
• bug [#65747] [RateLimiter] Cap the burst size and the duration computed from it (@cs278, @nicolas-grekas)
• bug [#65731] [HttpClient] Don't send the original Host header on cross-authority redirects (@nicolas-grekas)
• bug [#65742] [HttpClient] Reject 3xx pushed responses (@nicolas-grekas)
• bug [#65746] [Messenger] Drop trace args from FlattenException normalization (@ousamabenyounes, @nicolas-grekas)
• bug [#65744] [Mime] Reject an unquoted "@" in the local part of an email address (@nicolas-grekas)
• bug [#65739] [Process] Ignore invalid env var names and non-scalar env values (@nicolas-grekas, @dionisvl)
• bug [#65738] [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug [#65735] [Security] Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug [#65734] [Security] Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug [#65733] [Security] Remove the legacy nested unserialize() call from token and exception classes (@nicolas-grekas)
• bug [#65732] [SecurityBundle] Restrict redirections to the current host when sessions are disabled (@nicolas-grekas)
• bug [#65737] [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (@XananasX7)
• bug [#65736] [HttpKernel] Ignore the session id that PHP kept from a previous request (@nicolas-grekas)
• bug [#65730] [HttpKernel] Fix TypeError in UriSigner when the hash parameter is not a string (@nicolas-grekas)
• bug [#65743] [HttpFoundation] Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug [#65729] [HttpFoundation] Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug [#65728] [Routing] Fix matching the "0" URL (@cs278)
• bug [#65727] [Yaml] Fix a TypeError when "!!binary" is given an unparsable value (@nicolas-grekas)
• bug [#65745] [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug [#65726] [Filesystem] preserve source mode when copying files (@nicolas-grekas)
• bug [#65741] [HttpFoundation] Reject invalid paths (@nicolas-grekas)
• bug [#65725] [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• minor [#65724] Declare the polyfills needed by the code on PHP 7.2 (@nicolas-grekas)
• bug [#65721] [Lock] Never take the reserved "write" member as a Redis lock token (@nicolas-grekas)
• bug [#65718] [VarDumper] Escape UTF-8 encoded C1 control characters (@nicolas-grekas)
• bug [#65706] [Mailer][Mailchimp] Sign the webhook URL as sent and reject a non-string mandrill_events parameter (@nicolas-grekas)
• bug [#65704] [HttpClient] Drop credentials when a redirect changes the scheme (@nicolas-grekas)
• bug [#65693] [Messenger] Restrict what "X-Message-Stamp-*" headers can put in an envelope (@nicolas-grekas)
• bug [#65692] [Console][MonologBridge][VarDumper] Escape context strings written to the terminal (@nicolas-grekas)
• bug [#65691] [VarDumper] Escape context strings in HtmlDescriptor (@nicolas-grekas)
• bug [#65690] [ExpressionLanguage] Bound the nesting level of parsed expressions (@nicolas-grekas)
• bug [#65689] [SecurityBundle] Use a lock for login throttling by default (@nicolas-grekas)
• bug [#65686] [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (@nicolas-grekas)
• bug [#65688] [Yaml] Bound recursion depth in the inline lexer (@nicolas-grekas)
• bug [#65687] [HttpKernel] Validate the profiler token before using it as a file name (@nicolas-grekas)
• bug [#65709] [Mailer][Mailgun] Reject non-string signature fields instead of throwing a TypeError (@nicolas-grekas)
• bug [#65710] [Notifier][Twilio] Sign the query string as sent instead of the normalized one (@nicolas-grekas)
• bug [#65716] [Notifier][Lox24] Match JSON webhook requests only (@nicolas-grekas)
• bug [#65708] [Mailer][Resend] Reject a versioned signature entry without a value instead of raising a warning (@nicolas-grekas)
• bug [#65712] [Notifier][Lox24] Read the webhook payload from the JSON body (@nicolas-grekas)
• bug [#65675] [Mailer][Notifier] Reject webhook requests with a stale timestamp (@nicolas-grekas)
• bug [#65670] [Serializer] Fix deep_object_to_populate for collections of objects (@lazerg)
• bug [#65700] [Mailer][Notifier] Reject Mailgun, SendGrid and Vonage webhook requests with a stale timestamp (@nicolas-grekas)
• bug [#65701] [DoctrineBridge] Restore the tolerance for outdated remember-me tokens after concurrent requests (@nicolas-grekas)
• bug [#65702] [HtmlSanitizer] Compare schemes and hosts case-insensitively (@nicolas-grekas)
• bug [#65677] [Security] Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• minor [#65705] [Translation] Fix Persian (fa) translations for Form and Validator components (@amirreza-khaleghverdi)
• bug [#65684] [Cache][HttpFoundation] Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug [#65685] [Security] Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug [#65699] [Mailer] Reject Mailomat webhook requests with a stale timestamp (@nicolas-grekas)
• bug [#65683] [HttpFoundation] Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug [#65682] [HttpFoundation] Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
• bug [#65681] [HttpKernel] Strip cache-internal headers from backend responses in HttpCache (@nicolas-grekas)
• bug [#65655] [Security] Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• bug [#65664] [HtmlSanitizer] Keep rejecting denied URL characters when percent-decoding yields malformed UTF-8 (@nicolas-grekas)
• bug [#65679] [Messenger] Cover the headers that describe the message with the SigningSerializer signature (@nicolas-grekas)
• bug [#65678] [SecurityBundle] Make the remember-me cookie follow the session cookie defaults (@nicolas-grekas)
• bug [#65676] [Lock] Delete a DynamoDb lock only when the caller holds it (@nicolas-grekas)
• bug [#65674] [Mailer] Use the configured secret to authenticate Postmark webhooks (@nicolas-grekas)
• bug [#65666] [VarDumper] Account for PHP 8.6 deprecating SplFileObject::getCsvControl() (@nicolas-grekas)
• bug [#65697] [VarExporter] Fix fatal error when loading code exported by versions < 8.1 (@nicolas-grekas)
• minor [#65695] [Validator] Review and finalize Indonesian (id) translation messages (@VernSG)
• minor [#65671] [Form][Validator] Review Dutch (nl) translations (@andrewo0)
• minor [#65680] [Lock] Declare symfony/http-client in the DynamoDb bridge (@nicolas-grekas)
• minor [#65665] [Validator] fix comment for Url requireTld argument (@dmitryuk)
• bug [#65662] [HtmlSanitizer] Accept percent-encoded line breaks and tabs in the query of hostless URLs (@webdevsamran)
• bug [#65660] [Cache] Respect max_execution_time in LockRegistry's wait loop (@uncaught)
• minor [#65657] [Security] Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)
• bug [#65656] [Tui] Fix Tailwind font-weight and font-family utilities being treated as FIGlet fonts (@sadiqk2)
• minor [#65653] [Validator] Remove needs-review-translation state from Spanish translations (@reiarseni)
• bug [#65647] [Serializer] Fix max depth counting for subclasses that inherit MaxDepth metadata (@oliinykdm)
• minor [#65646] Review translations for Estonian (et) (@erkia)
• bug [#65651] [Yaml] Quote strings that look like octal numbers when dumping (@lazerg)
• minor [#65645] [Validator] Review Bulgarian (bg) translations (@alkinbg)
• bug [#65644] [Notifier] Fix escaping of MarkdownV2 markup in TelegramTransport (@nicolas-grekas)
• bug [#65640] [Serializer] Let DISABLE_TYPE_ENFORCEMENT keep strings that cannot be converted (@nicolas-grekas)
• bug [#65637] [Console][FrameworkBundle] Fix profiling a command stopped at ConsoleEvents::COMMAND (@Spomky)
• minor [#65593] [Validator] Improve Serbian translation messages (@kaznovac)
• minor [#65629] [Validator] [#65566] Review Turkish (tr) translations (@mmustafaAydogan)
• minor [#65634] [Validator] reviewed Polish translation units 147 and 148 (@thunderer)
• bug [#65632] [HttpClient] Fix GuzzleHttpHandler consuming responses out of band (@peter17)
• bug [#65630] [HttpKernel] Fix regression when a locale aware service is never initialized (@lazerg)
• bug [#65636] [Cache] Fix authenticating to the master when using Redis Sentinel (@nicolas-grekas)
• bug [#65621] [PropertyInfo] Do not prefer a static named constructor as the property mutator (@nicolas-grekas)
• bug [#65619] [PropertyInfo] Do not prefer a static named constructor as the property accessor (@lazerg)
• bug [#65613] [Console] Fix service arguments not resolved when a command is invoked by alias or abbreviation (@lazerg)
• minor [#65615] [Validator] Review translations for Russian (ru) (@bifidokk)
• bug [#65607] [HttpKernel] Capture flushed content in HttpKernelBrowser (@vencakrecl)
• bug [#65599] [CssSelector] Fix quadratic token probing in Reader::findPattern() (@iliaal)
• bug [#65601] [VarExporter] Fix export of string parameter defaults containing escaped quotes (@iliaal)
• bug [#65598] [Filesystem] Fix makeRelative() stripping leading dots when the base path is a root (@iliaal)
• minor [#65594] [Validator] Improve Serbian (Cyrillic) translation messages (@kaznovac, @nicolas-grekas)
• minor [#65587] [Validator] Review Urdu translations (@UmairRathore)
• bug [#65597] [Filesystem] Keep tempnam() files private when a suffix is given (@iliaal)
• bug [#65596] [CssSelector] Cap the nesting depth of :is() and :where() (@iliaal)
• bug [#65589] [Mailer] Handle MailerSend webhooks version 2 (@ovgray)
• data [#64370] Release v5.4.53