Single-Use Signed URLs

Contributed by Kevin Bond in #64408

A signed URL stays valid until it expires, no matter how many times it's used. This is a problem for links like password resets, which should stop working once they do their job. Until now, you had to implement your own invalidation logic for these links (e.g. storing some token in the database).

In Symfony 8.2, the sign(), check(), checkRequest() and verify() methods of UriSigner accept a new $version argument. Its value is added to the signature (but not to the URL), so the URL is valid only while that value stays the same. Use a value that changes once the link is used, like the hash of the user password:

use Symfony\Component\HttpFoundation\UriSigner;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;

// when sending the password reset email
$url = $uriSigner->sign(
    $this->generateUrl('reset_password', ['id' => $user->getId()], UrlGeneratorInterface::ABSOLUTE_URL),
    new \DateInterval('PT30M'),
    $user->getPassword(),
);

// in the controller that handles the link
$uriSigner->verify($request, $user->getPassword());

Calling verify() doesn't invalidate the link. The link becomes invalid once the application saves the user's new password hash. Any subsequent call to verify() with that hash throws an UnverifiedSignedUriException.

The same idea works for other links: use the last login date for login links or the email verification date for email confirmation links.

Requiring an Expiration for Signed URLs

Contributed by Kevin Bond in #64455

Signed URLs without an expiration are valid forever, so a link that leaks in an old email or a log file can be used at any time. That's why Symfony 8.2 deprecates calling UriSigner::sign() without an expiration. In Symfony 9.0 the expiration will be required.

You can pass the expiration in each sign() call or define a default one via the new $defaultExpiration constructor argument (a \DateInterval or a number of seconds). If you use the uri_signer service of the framework, set the default expiration (in seconds) with the new uri_signer.expiration option:

# config/packages/framework.yaml
framework:
    uri_signer:
        expiration: 3600

// config/packages/framework.php
namespace Symfony\Component\DependencyInjection\Loader\Configurator;

return App::config([
    'framework' => [
        'uri_signer' => [
            'expiration' => 3600,
        ],
    ],
]);

Signed Parameters in Login Links

Contributed by Jan Klan in #64271

Login links contain the user identifier, the expiration date and a signature. If you added other query parameters to these links (e.g. the page to redirect to after login), anyone could change them because they weren't signed.

In Symfony 8.2, the createLoginLink() method accepts a new $parameters argument. These parameters are added to the link URL and covered by its signature:

$loginLinkDetails = $loginLinkHandler->createLoginLink($user, parameters: [
    'return_to' => '/account/settings',
]);

If someone changes or removes any of these parameters, the login link becomes invalid. When the link is used, Symfony stores the verified parameters in the _login_link_parameters request attribute:

$returnTo = $request->attributes->get('_login_link_parameters')['return_to'] ?? null;

EntityExists Constraint

Contributed by Evgen Yurchenko in #63483

When your application receives entity identifiers in DTOs (e.g. from an API request or a form), you usually have to repeat the same logic: look up the entity, check if it exists and throw an error otherwise. The new EntityExists constraint handles this check and reports a missing entity as a validation violation on the property:

use App\Entity\Product;
use App\Entity\User;
use Symfony\Bridge\Doctrine\Validator\Constraints\EntityExists;
use Symfony\Component\Validator\Constraints as Assert;

final class AssignOrderCommand
{
    #[Assert\NotBlank]
    #[EntityExists(entityClass: User::class)]
    public string $userId;

    // look up the value by some field other than the entity identifier
    #[EntityExists(entityClass: Product::class, identifierField: 'sku')]
    public ?string $productSku = null;
}

By default, the value is looked up by the entity identifier. You can also use the repositoryMethod option to call your own repository method; any truthy result (an entity, a count, true, etc.) means that the entity exists.

Like most constraints, null and empty strings are considered valid, so combine it with NotBlank when the value is required.

Cron Constraint

Contributed by Erfan Momeni in #64538

If your application lets users define schedules, a regular expression that only checks the format can miss invalid values such as 60 * * * * or */0 * * * *. The new Cron constraint validates cron expressions using a dedicated parser:

use Symfony\Component\Validator\Constraints as Assert;

class Report
{
    // accepts standard expressions (e.g. '0 6 * * 1-5') and aliases like '@daily'
    #[Assert\Cron]
    public string $schedule;

    // only accepts standard 5-field expressions
    #[Assert\Cron(mode: Assert\Cron::MODE_STANDARD)]
    public string $strictSchedule;

    // also accepts the hashed expressions of the Scheduler component (e.g. '# # * * *')
    #[Assert\Cron(mode: Assert\Cron::MODE_HASHED)]
    public string $scheduledTask;
}

The MODE_HASHED mode also accepts hashed cron expressions such as # # * * * and aliases like #daily, which the Scheduler component uses to spread recurring tasks over time. This constraint requires the dragonmantank/cron-expression package, which is the same one used by the Scheduler component for cron triggers.

Audio Constraint

Contributed by Valmont Pehaut-Pietri and Nicolas Grekas in #66143

Symfony 7.4 added a Video constraint to validate video files. Symfony 8.2 adds its audio counterpart, the Audio constraint, which validates audio files based on their actual characteristics (duration, bitrate, sample rate, number of channels, codec and container) and not only on their MIME type and size:

use Symfony\Component\HttpFoundation\File\File;
use Symfony\Component\Validator\Constraints as Assert;

class PodcastEpisode
{
    #[Assert\Audio(
        maxSize: '200M',
        // durations are in seconds, bitrates in bits per second and sample rates in Hz
        minDuration: 60,
        maxDuration: 3 * 3_600,
        minBitrate: 96_000,
        allowedSampleRates: [44_100, 48_000],
        maxChannels: 2,
        allowedCodecs: ['mp3', 'aac'],
        allowedContainers: ['mp3', 'mp4'],
    )]
    public ?File $audioFile = null;
}

The Audio constraint extends the File constraint, so all its options are available too. Its mimeTypes option defaults to audio/* and, unlike the Video constraint, it doesn't restrict codecs or containers unless you set the allowedCodecs and allowedContainers options. When you configure any of the audio-specific checks, it uses the Process component and the ffprobe binary from FFmpeg to inspect the file.

Compiled Event Dispatcher

In Symfony 8.2, the event_dispatcher service is a CompiledEventDispatcher. It receives an array of listener service IDs and methods, in the order they run, and a service locator to load them when needed. PHP's OPcache stores the array in shared memory, so each request doesn't need its own copy.

In a benchmark with 75 listeners across 31 events, creating the dispatcher took 0.48 µs, down from 33.7 µs. The listener closures previously used about 97 KB of memory; the compiled dispatcher doesn't need them.

Dispatching events is as fast as before. Listener services are still created only when they're about to run. If an event is never dispatched, or a listener stops its propagation, the remaining listeners aren't instantiated.

Your existing listener and subscriber registrations benefit from this automatically. The profiler and debug:event-dispatcher work as before.

Changing Listeners at Runtime Is Deprecated

Adding or removing a listener at runtime forces the compiled dispatcher to fall back to a regular EventDispatcher, losing the performance benefit. Symfony 8.2 therefore deprecates calling addListener(), addSubscriber(), removeListener() or removeSubscriber() on the shared event_dispatcher service. These calls also trigger deprecations in dev, where you can see them in the profiler.

Register your listeners as services instead. For temporary listeners, such as those needed while a console command runs, use the new ScopedEventDispatcher. It wraps the shared dispatcher and holds the extra listeners without adding them to the shared service. Only events dispatched through the wrapper reach those listeners:

use Symfony\Component\EventDispatcher\ScopedEventDispatcher;
use Symfony\Component\Messenger\EventListener\StopWorkerOnMessageLimitListener;
use Symfony\Component\Messenger\Worker;

$dispatcher = new ScopedEventDispatcher($this->eventDispatcher);
$dispatcher->addSubscriber(new StopWorkerOnMessageLimitListener(10));

$worker = new Worker($receivers, $bus, $dispatcher);
$worker->run();

The wrapper calls both sets of listeners in priority order. Symfony uses it in the messenger:consume and messenger:failed:retry commands.

Check your functional tests too. If a test adds a listener to the shared event_dispatcher to check that an event was dispatched, register that listener as a service in the test environment instead.

New Autowiring Type for the Event Dispatcher

Autowiring the shared dispatcher with Symfony\Component\EventDispatcher\EventDispatcherInterface is also deprecated, because that interface includes methods for changing listeners. If your service only dispatches events, switch to the contracts interface:

- use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+ use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;

class OrderPlacer
{
    public function __construct(
        private EventDispatcherInterface $dispatcher,
    ) {
    }

    // ...
}

To inspect registered listeners, for example in a debugging tool, autowire Symfony\Contracts\EventDispatcher\ListenerIntrospectionInterface. This new interface provides getListeners(), getListenerPriority() and hasListeners(). If you also need to dispatch events, combine both interfaces with an intersection type:

use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
use Symfony\Contracts\EventDispatcher\ListenerIntrospectionInterface;

public function __construct(
    private EventDispatcherInterface&ListenerIntrospectionInterface $dispatcher,
) {
}

Ordering Event Listeners

Suppose your listener sets the _locale request attribute. It needs to run before Symfony's LocaleListener reads that attribute to set the request's locale. You can now declare that directly on your listener:

// src/EventListener/RequestLocaleListener.php
namespace App\EventListener;

use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\EventListener\LocaleListener;

#[AsEventListener(before: LocaleListener::class.'::onKernelRequest')]
final class RequestLocaleListener
{
    public function __invoke(RequestEvent $event): void
    {
        // ...
    }
}

Both options accept a service ID or class name, or an array of them if you need to refer to several listeners. The ::onKernelRequest suffix selects a specific method. This matters here because LocaleListener has two methods that listen to kernel.request. Without the suffix, your listener would run before both of them.

Event subscribers registered as services can use these options too. Symfony 8.2 also lets you use named keys such as method and priority in getSubscribedEvents(), so you can write:

public static function getSubscribedEvents(): array
{
    return [
        KernelEvents::REQUEST => [
            'method' => 'onKernelRequest',
            'before' => LocaleListener::class.'::onKernelRequest',
        ],
    ];
}

A few things to keep in mind:

• Ordering is resolved when compiling the container, with no extra runtime work;
• Leave out the priority to let Symfony choose it. If you set one, constraints can only reorder listeners within that priority;
• References to listeners missing from the event are ignored (this way, you can support e.g. optional bundles);
• Conflicting priorities, circular constraints and invalid methods cause compilation errors.

Ordering Tagged Services

The same options are available when ordering tagged services. Suppose an import bundle provides CSV and XLSX handlers with the same priority, and you want to add your own TSV handler between them. You can express both requirements with AsTaggedItem or in the service's tag configuration:

// src/Handler/TsvHandler.php
namespace App\Handler;

use Acme\ImportBundle\Handler\CsvHandler;
use Acme\ImportBundle\Handler\XlsxHandler;
use Symfony\Component\DependencyInjection\Attribute\AsTaggedItem;

#[AsTaggedItem(after: CsvHandler::class, before: XlsxHandler::class)]
class TsvHandler
{
    // ...
}

# config/services.yaml
services:
    App\Handler\TsvHandler:
        tags:
            - name: 'app.handler'
              after: 'Acme\ImportBundle\Handler\CsvHandler'
              before: 'Acme\ImportBundle\Handler\XlsxHandler'

In the PHP example, the handler must already have the tag used by the import bundle, for example through autoconfiguration. AsTaggedItem configures its order; it doesn't add the tag itself.

Ordering Decorators

Service decorators had the same problem. When several decorators wrap a service, their priorities define which one is closer to the original service. To put yours in the right place, you had to check the priorities of the other decorators.

Symfony 8.2 adds two options for that: within lists the decorators that wrap yours, and around lists the decorators that yours wraps. Suppose you sign every outgoing HTTP request and want each retry to be signed again. Your decorator must be inside Symfony's RetryableHttpClient:

// src/HttpClient/SigningHttpClient.php
namespace App\HttpClient;

use Symfony\Component\DependencyInjection\Attribute\AsDecorator;
use Symfony\Component\HttpClient\RetryableHttpClient;
use Symfony\Contracts\HttpClient\HttpClientInterface;

#[AsDecorator('http_client', within: RetryableHttpClient::class)]
class SigningHttpClient implements HttpClientInterface
{
    // ...
}

# config/services.yaml
services:
    App\HttpClient\SigningHttpClient:
        decorates: http_client
        decoration_within: http_client.retryable

These options work the same way as before and after: they accept service IDs or class names (or a list of them), names that don't match any other decorator of the same service are ignored, and if you leave out the priority, Symfony chooses it for you. They also work with #[AsTagDecorator] when decorating all services with a given tag.

Ordering Doctrine Listeners and Messenger Handlers

Doctrine event listeners and Messenger handlers are ordered by priority too, and they get the same before and after options. The doctrine.event_listener tag uses them to order the listeners of an event on a connection:

# config/services.yaml
services:
    App\EventListener\SearchIndexer:
        tags:
            - name: 'doctrine.event_listener'
              event: 'postPersist'
              after: 'App\EventListener\AuditLogger'

Support for these options in the #[AsDoctrineListener] attribute is proposed in DoctrineBundle.

The #[AsMessageHandler] attribute and the messenger.message_handler tag use them to order the handlers of a message on a bus:

// src/MessageHandler/SendWelcomeEmailHandler.php
namespace App\MessageHandler;

use App\Message\UserRegistered;
use Symfony\Component\Messenger\Attribute\AsMessageHandler;

#[AsMessageHandler(after: AuditLogHandler::class)]
final class SendWelcomeEmailHandler
{
    public function __invoke(UserRegistered $message): void
    {
        // ...
    }
}

Constraints only apply between handlers of the same message class. Handlers of a parent class, of an interface, or registered for * can't be referenced.

Ordering Firewall Listeners

Bundles that add firewall listeners, for example to handle two-factor authentication, also had to pick priorities relative to Symfony's own listeners. The new #[FirewallListenerOrder] attribute lets them name those listeners instead:

use Symfony\Component\Security\Http\Attribute\FirewallListenerOrder;
use Symfony\Component\Security\Http\Firewall\AbstractListener;
use Symfony\Component\Security\Http\Firewall\AccessListener;
use Symfony\Component\Security\Http\Firewall\ContextListener;

#[FirewallListenerOrder(after: ContextListener::class, before: AccessListener::class)]
final class TwoFactorListener extends AbstractListener
{
    // ...
}

Firewall listeners always have a priority, so these constraints only reorder the listeners that share it. A constraint that would need a different priority makes compiling the container fail. This way, a bundle can't move Symfony's own security listeners by mistake.

Using Them as Safety Checks

You can also keep an explicit priority and add before or after as a check. Symfony now does this for its own listeners and argument value resolvers whose priority was chosen relative to another one. For example, the resolvers of Request, Session and #[CurrentUser] arguments declare that they run before Doctrine's EntityValueResolver. Their priorities didn't change, but if one of them is ever lowered below the Doctrine one, compiling the container fails instead of silently changing which resolver handles those arguments.

For more examples, see the docs on ordering event listeners, ordering tagged services and ordering decorators.

Targeted Cache-Control Headers

Contributed by Nicolas Grekas in #65282

You might want your CDN to cache a page for an hour, while keeping a much shorter cache lifetime in the browser. That's because you can purge the CDN cache when the content changes, but you can't purge the copies stored in your visitors' browsers. Targeted cache-control headers, defined in RFC 9213, let you give each cache its own rules.

For example, a CDN that supports CDN-Cache-Control uses it instead of Cache-Control. Browsers continue to use Cache-Control. In Symfony 8.2, call the new cacheControl() method on a Response with the target name (CDN, not CDN-Cache-Control):

// browsers consider the response stale immediately...
$response->setMaxAge(0)->setPrivate();

// ...but the CDN can cache it for one hour
$response->cacheControl('CDN')
    ->setMaxAge(3600)
    ->setStaleWhileRevalidate(60);

This code generates the following headers:

Cache-Control: max-age=0, private
CDN-Cache-Control: max-age=3600, stale-while-revalidate=60

You can use methods such as setPublic(), setPrivate() and setStaleIfError() on the returned object, or set() for other directives. Use setMaxAge() for the lifetime: there's no setSharedMaxAge() because the target already identifies the cache these rules apply to.

The Cache-Status Header

Contributed by Pascal CESCON in #65573

When you're debugging HTTP caching, you need to know whether a cache served the response or forwarded the request to your application. The Cache-Status header, defined in RFC 9211, gives caches a common way to report this.

To enable it in Symfony's HTTP cache, set the new cache_status option to the name you want to use for your cache:

# config/packages/framework.yaml
framework:
    http_cache:
        enabled: true
        cache_status: 'Symfony'

// config/packages/framework.php
namespace Symfony\Component\DependencyInjection\Loader\Configurator;

return App::config([
    'framework' => [
        'http_cache' => [
            'enabled' => true,
            'cache_status' => 'Symfony',
        ],
    ],
]);

With this configuration, responses include a Cache-Status header such as:

Cache-Status: Symfony; hit; ttl=58
Cache-Status: Symfony; fwd=miss; stored
Cache-Status: Symfony; fwd=stale; fwd-status=304; stored

The first example is a cache hit with 58 seconds of freshness left. The second is a cache miss: Symfony fetched the response from your application and stored it. In the third, the cached response was stale, but the application returned 304 Not Modified, so Symfony could reuse it. A negative ttl means the cache served a stale response.

If another cache has already added a Cache-Status header, Symfony appends its own entry, so you can follow the response through the caches.

You can enable this header in production, unlike the X-Symfony-Cache debug header. It's disabled by default (cache_status: null), since it exposes details about your cache that you may not want to share publicly.

Symfony development highlights

This week, 364 pull requests were merged (191 in code, 63 in docs, 101 in UX and 9 in AI) and 92 issues were closed (33 in code, 47 in docs, 8 in UX and 4 in AI). Excluding merges, 67 authors made additions and deletions. See details for code, docs, UX and AI.

6.4 changelog:

• 7a9b164: [Serializer] fix the cache key of MetadataAwareNameConverter when the context can't be serialized
• a7fe780: [FrameworkBundle] disable HTTP/2 push on the default HTTP client
• 410b9c3: [HttpKernel] fix the log level of exceptions mapped to an HTTP status code
• 7e59fe0: [Serializer] don't include the debug trace id in the attributes cache key
• 243d173: [DoctrineBridge] never claim an object as a collection key type
• 2b7cf91: [WebProfilerBundle] escape the workflow diagram source and listener map in the profiler
• cfbee39: [DoctrineBridge] don't map the uuid and ulid type names to uid classes in DoctrineExtractor
• 983d5a5: [Cache] escape glob characters when clearing Redis namespaces
• 35f513e: [DependencyInjection] export the service id when sharing a circular wither service
• f8e2d14: [FrameworkBundle] fix the description of an empty webhook routing secret
• 60cf683: [DependencyInjection, Routing] escape identifiers in generated PHP
• ce086d4: [DependencyInjection] track env placeholders reused after a previous extension dropped them
• b530685: [String] update wcswidth data with Unicode 18
• 3172f3f: [String] fix the width of emoji sequences and conjoining Hangul jamo
• be608ca: [Messenger] fix decoding ErrorDetailsStamp with Serializer::create()
• af9e4e4: [HttpClient] cap the timeout passed to curl_multi_select()
• 6ad469d: [Messenger] fix decoding ErrorDetailsStamp with the XML format
• 6aa5b27: [Messenger] don't send handler results to transports
• db66f78: [Messenger] turn any error thrown while decoding into a MessageDecodingFailedException
• c588108: [Messenger] fix decoding in XML an ErrorDetailsStamp that has no FlattenException
• fe8998a: [Messenger] fix decoding in XML a ValidationStamp that has one group or none
• fff4db5: [Messenger] fix recognizing a repeated error when its code does not keep its type in XML
• 82fab8a: [Messenger] fix decoding a ValidationStamp that holds a GroupSequence
• 983971e: [HttpFoundation] fix HeaderUtils::split() when a separator is a whitespace character
• c2aee89: [String] fix width() of skin tones on keycap and text-default bases, and of format characters
• 7a5c6a7: [Messenger] fix moving a message between transports that use different serialization formats
• e465d45: [String] fix width() of OSC sequences terminated by BEL
• 16c8fdb: [String] fix width() of escape sequences with an intermediate or a digit final byte
• 2a5c8f7: [Yaml] fix round-tripping literal blocks that start with spaces-only lines
• 32d3f8e: [PhpUnitBridge] remove silencing of __sleep/wakeup() deprecations
• 4800ae8: [Messenger] reject decoded messages that carry non-sendable stamps and validate the stamps of unserialized envelopes
• f4d6d8b: [Messenger] recommend not decoding non-sendable stamps in SerializerInterface::decode()
• 47ec709: [HttpFoundation] keep the session ID when the session handler fails to read
• e763561: [Yaml] fix dumping tagged multi-line literal blocks
• 513e96d: [Messenger] fix losing delayed messages when retrying the message that dispatched them
• 3614876: [Messenger] fix the Doctrine transport masking commit failures
• beb4c9c: [Security] pass only stringable request attributes to the URL generator in HttpUtils
• 68051a6: [FrameworkBundle] don't list aliases of abstract services in debug:autowiring
• ec54b1e: [Yaml] quote .inf and .nan strings when dumping
• 132867d: [String] fix wordwrap() with $cut when the string ends with the break

7.4 changelog:

• 30802f4: [JsonStreamer] fix generic types replacement in array shapes
• ad7c073: [TypeInfo] fix accepts() of union and intersection types
• 03654e1: [TypeInfo] fix quoted strings resolution with phpstan/phpdoc-parser 1.x
• 489d20d: [Serializer, Validator] fix compile-time discovery of attributes on non-public members
• bb5fdd6: [HtmlSanitizer] fix sanitizeFor() with table-related, image and plaintext contexts
• f25ca4f: [HtmlSanitizer] don't render comments as elements when the default action is Allow
• 21e5e2a: [TypeInfo] fix printing array shape keys that contain quotes or backslashes
• c462177: [JsonStreamer] fix replacing templates by mixed in union types
• c2e593d: [ObjectMapper] construct nested lazy-ghost targets when the mapper is decorated
• 94e5b55: [TypeInfo] fix Type::union() with mixed as the only non-null type
• 0c4996e: [PropertyInfo] fix quoted strings resolution in PhpStanExtractor with phpstan/phpdoc-parser 1.x
• 6321df0: [TypeInfo] fix infinite recursion on recursive type aliases
• fb7d2b3: [Security] give each role its own node in the Mermaid dump
• 3571209: [JsonStreamer] fix generated readers and writers for names holding quotes
• a3f66cc: [Cache] bind namespaces in PDO-based cache invalidation
• 7dcbcde: [Security] bind discovered OIDC keys to issuers
• 43dce2d: [JsonStreamer] escape types in generated PHP comments
• 41e11de: [Messenger] prevent PhpSerializer::getMessageType() from autoloading classes
• ee2ab09: [Mailer, Sweego] send the Reply-To address through the dedicated API field
• 9ef2936: use full setting name in deprecation message for consistency
• d6f029e: [Messenger] fix workers stopping on messages that fail signature verification
• 722eb74: [Mailer, Sweego] accept fractional seconds in webhook timestamps
• 8d7dadc: [Lock] fix denormalizing in XML a Key that has no expiring time or no state
• 78b2cea: [Messenger] fix skipping a message that has no original transport in messenger:failed:retry
• d8cb531: [FrameworkBundle, Messenger, Scheduler] require a signature for RedispatchMessage and ServiceCallMessage
• 6d25294: [Mailer, MicrosoftGraph] only forward headers that Graph can accept
• 990636b: [HttpClient] fix using HTTP/3 with CurlHttpClient
• ffc1b79: [JsonPath] fix index and slice selectors dropping null array elements
• 8881c9c: [JsonPath] fix anchoring and slash escaping in match() and search()
• 6b8537d: [Scheduler] fix processOnlyLastMissedRun() skipping every missed run after a restart

8.1 changelog:

• c505a39: [DependencyInjection, FrameworkBundle] fix describing services that have env closure arguments
• 6dc4600: [TypeInfo] fix object shape keys resolution in StringTypeResolver
• 963994d: [TypeInfo] fix printing object shape keys that contain quotes or backslashes
• abce89e: [JsonStreamer] fix generic types replacement in object shapes
• 739581a: [FrameworkBundle] require symfony/dependency-injection ^8.1.8
• 82c3ec2: [Tui] repaint the viewport without clearing the screen when overflowing content shrinks
• 335148d: [Tui] paint lines already in the scrollback in place when overflowing content grows back
• 55d26ca: [JsonStreamer] export the type as a literal in the generated encoding error message
• 2e56795: [Tui] fix slicing counting a combining mark as a column
• 0c3f6ee: [Messenger] keep the signature of signed messages that fail to decode
• ccfe5b6: [Messenger] don't retry messages rejected for their signature
• a6d9000: [Tui] measure an emoji ZWJ, modifier or tag sequence as two columns
• 6fd896e: [Messenger] fix acking messages that InMemoryTransport fails to decode
• 42952ca: [Messenger] fix endless retries of messages with an empty body or an undecodable stamp header
• 0eef6c7: [Messenger] fix duplicated stamps when a message that failed to decode is decoded on replay
• bba9ddb: [Messenger] fix losing the payload of a message without a type header when it is retried
• 00d18e6: [Messenger] fix ack/reject of Redis messages listed by the failed messages commands
• 1cf261c: [Messenger] route a message that PhpSerializer fails to decode to its own bus
• d060748: [Tui] fix wrapLineIntoChunks() returning a chunk wider than the width after wrapping at a space
• fc6822c: [Tui] give no width to format characters and lone combining marks
• 3217edf: [Messenger] add the default stamps of a message to its replayed decoding failure
• 1db8c7c: [Tui] fix parse() and matches() of modified function keys
• 6cebc11: [Tui] match a modified escape that parse() names

8.2 changelog:

• 296470b: [PropertyInfo] create the inflector and the type resolver of ReflectionExtractor on first use
• 91cdb3d: [TypeInfo] parse the class docblock once when creating a type context
• 7d66574: [Cache] clone the calls of CacheDataCollector once per profile
• 8c4eb68: [AssetMapper] load each cached asset once per request and from a single file
• 720a5ef: [TwigBundle] skip templates already warmed up under another name
• 343fa46: [HttpKernel] compute the cURL command of RequestDataCollector in lateCollect()
• 245ca50: [AssetMapper, FrameworkBundle, WebProfilerBundle] build neither the profiler nor Twig when the dev server serves an asset
• 8d581ad: [FrameworkBundle] build the configuration trees once for reference.php and schema.json
• b73db07: [PropertyInfo] parse the constructor docblock once per class
• 8823b6f: [Serializer] reduce the per-attribute overhead of normalizing objects
• f606ec9: [Serializer] speed up name conversion when normalizing objects
• 1248d08: [PropertyInfo, Serializer, Validator] warm up property info for the classes mapped by the serializer and the validator
• 590ba12: [HtmlSanitizer] skip parsing plain text
• 9b9212a: [Serializer] aggregate nested calls in SerializerDataCollector as they happen
• 0ffd5b3: [HttpKernel] log client errors at the warning level instead of error
• d827566: [HttpKernel] log exceptions without flattening them
• 69cf483: [Validator] reuse the IntlDateFormatter of ConstraintValidator::formatValue()
• 93a532a: [PropertyAccess] reduce the overhead of reading properties
• 7020f70: [Serializer] look up constructor parameters before property info when denormalizing
• c43fb8c: [Serializer] don't read class files when resolving the types of constructor parameters
• ae2f63b: [HttpKernel] collect the static data of ConfigDataCollector in lateCollect()
• c0bc6eb: [SecurityBundle] move the static work of SecurityDataCollector to lateCollect()
• f5e38b5: conflict with outdated Symfony UX packages when requiring symfony/symfony
• 659cd62: [TwigBundle] warm up only reachable form themes
• 0447e59: [FrameworkBundle, HttpKernel] skip resolving the runtime mode on web requests
• d3b022a: [DependencyInjection] skip encoding plain ASCII values in XmlDumper
• d49cb69: [Serializer] don't create a property accessor per denormalized object
• 6686941: [TypeInfo, Serializer, JsonStreamer] add Type::map()
• 1eba7ce: [KeyManagement] record the key ARN returned by AWS KMS in ciphertexts
• 9c6ba22: [Translation] extract messages from match expressions, interpolated strings, variables and method return values
• f212f28: [HttpClient] allow repeating fields in the query and body options
• df1286f: [Validator] make Constraint objects invokable
• 3b94fb1: [SecurityBundle] fix the role hierarchy diagram in the profiler
• 0a71f5f: [Messenger] allow using a named serializer for messenger.transport.symfony_serializer
• 775c1c2: [FrameworkBundle] allow using a named serializer for #[MapRequestPayload], #[MapQueryString] & #[Serialize]
• a4916cb: [Mailer, Scaleway] bind webhook requests to the configured topic ARN
• a1bff76: [String] skip the per-character width measurement for printable ASCII
• 7eaf80c: [KeyManagement] reject empty column values in the DBAL type
• 4732193: [Messenger] fix redispatching a message that failed to decode
• 977b90b: [Messenger] retry a claim that could not be retrieved with its original reference
• a6d7e84: [Security] let voters tell which denials a re-authentication can cure
• 616a19c: [Security, SecurityBundle] let the discovery endpoints of the oidc token handler be pinned to their issuer
• fec3f91: [Messenger] fix unverified decoding failures putting their stamps on signed messages
• e661238: [Messenger] fix endless retries of a claim that cannot be retrieved
• d1659d2: [Security] start a re-authentication for a check made by an allow_if expression or an #[IsGranted] closure
• 494d536: [Mime] keep the explicit encoding of parts in FormDataPart
• feb08ca: [Messenger] route a claim that cannot be retrieved to the bus of its message
• 3bf30ac: [Messenger] reject an unverified decoding failure that runs on another bus than its signed message
• 7cc98e4: [TwigBundle] skip checking known template directories on each request
• 7384daa: [Security] make FormLoginAuthenticator a re-authentication entry point
• 7614f74: [Messenger, Scheduler] replace RedispatchMessageHandler by a non-sendable RedispatchStamp
• fa61c64: [Messenger] let a flow carry its context in stamps: propagation, handler arguments and identity
• f9cce70: [Messenger] keep an application-defined message id generator when symfony/uid is missing
• 13a9950: [Messenger] merge the identity and propagation middlewares into FlowContextMiddleware and track delayed messages
• 9917e11: [Messenger, Scheduler] add a sign option to transports to sign every message
• 95b3e61: [Messenger] make SyncTransport trust the messages dispatched in this process
• 515f227: [Messenger] stop forwarding a redispatched message again once it was sent
• d547b96: [Messenger] refuse to call handlers that require a signature for untrusted envelopes
• 0520527: [FrameworkBundle, RateLimiter] register RateLimitAttributeListener in FrameworkBundle
• 37457db: [Tui] add the super, hyper and meta modifiers to key ids
• e130143: [Messenger] fix sending stamps and trust to parallel workers
• 1b33dca: [Messenger] fix delaying acks until after the idle sleep with --concurrency
• e469e86: [Tui] reject a key id naming an unknown key when creating Keybindings
• b024412: [HttpClient] use HTTP/2 with prior knowledge when http_version is 2.0
• d56d793: [Messenger] add ChainStamp to dispatch messages one after another
• 8318c76: [Messenger] add DispatchOnFailureStamp to dispatch a message when another one fails
• 77b7797: [KeyManagement] bind a stored data key to its reference and scope
• be05acb: [Tui] add Tui::getWidgetRect()
• e9a0f11: [Form] add the sort_choices option to ChoiceType
• 24809fd: [FrameworkBundle, HttpFoundation, Messenger, Security, SecurityBundle] allow rotating the secrets that sign URIs, remember-me cookies, login links and messages
• ed4c60b: [FrameworkBundle] improve the hints shown by debug:autowiring
• de96277: [JsonStreamer, Mailer, Notifier, SecurityBundle, Webhook] deprecate autowiring aliases named after implementations
• 5a5cd5b: [DependencyInjection] move PriorityTaggedServiceUtil to its own file so that it can be autoloaded
• cb263b0: [Config, DependencyInjection] add NodeDefinition::inlineEnvVars() to inline env vars while the container is compiled
• cb53c82: [DependencyInjection] add within and around constraints to order decorators
• 08829a1: [Config] fix enum nodes and validation rules that inline env vars

Symfony UX development highlights

3.x changelog:

• 683b467: [Image] add the UX Image package and its Cloudflare and KeyCDN bridges
• 865e532: [Toolkit] ship kit preview assets and add a preview app
• 19c7ad8: [Toolkit] add visual tests for recipes
• e7e7f1b: [Toolkit, Shadcn] fix the popover not focusing its content on a busy browser
• 27da043: [Toolkit] shard the browser tests and keep the server logs out of the CI output
• 402afd1: [Toolkit, Flowbite] fix the modal having no accessible name
• dd302b3: [Toolkit, Flowbite] fix inactive tabs being unreadable in dark mode
• cdc2878: [Toolkit, Shadcn] fix the arrow keys getting stuck before a disabled accordion item
• 01b3ed4: [Toolkit, Shadcn] fix alert dialogs opening on page load
• db56b43: [Toolkit, Shadcn] fix a closed drawer staying reachable with the keyboard
• 8d2b82f: [Toolkit, Shadcn] fix the combobox list not lining up with its trigger
• 3ebdfa0: [Toolkit, Shadcn] fix the radio indicator of the dropdown menu being a ring instead of a dot
• 183536e: [Toolkit, Shadcn] fix dropdown submenus wrapping their labels
• 99e0def: [Toolkit, Shadcn] fix the date picker focusing "Previous month" instead of a day
• 3e74e95: [Toolkit, Shadcn] fix the radio indicator of the menubar being a ring instead of a dot
• b2d63a8: [Toolkit, Shadcn] fix menubar submenus wrapping long labels
• fb844e7: [Toolkit, Shadcn] fix the dialog trigger's aria-expanded getting out of sync
• 4fd09a2: [Toolkit, Shadcn] fix Tab skipping the panels of the navigation menu
• e5896b1: [Toolkit, Shadcn] fix the resizable handle missing its separator state
• 9525e93: [Toolkit, Shadcn] fix a closed sheet staying reachable with the keyboard
• a2e0e03: [Toolkit, Shadcn] fix a disabled slider still reacting to the keyboard
• 893bd57: [Toolkit, Shadcn] fix the slider losing the focus after a click on its track
• c3f8aa5: [Toolkit, Shadcn] fix the close button and the action of a toast ignoring mouse clicks
• b505c4c: [Toolkit, Shadcn] fix the bookmark icon not filling in the toggle examples
• cf264f6: [Toolkit, Shadcn] fix the tooltip of the disabled button example never opening
• 07052f9: [Toolkit] fix ux:install not overwriting a file newer than the recipe
• 9becbdd: [Image] add presets
• 4cfdb08: [Icons] warm local icons on cache:warmup
• 7d06bf1: [TwigComponent] copy plain text in one go when pre-lexing templates
• cfae61f: [Toolkit, Shadcn] align combobox with the upstream Shadcn UI component
• 0297127: [Toolkit, Shadcn] align input-group with the upstream Shadcn InputGroup
• 41789ce: [Toolkit, Shadcn] fix data-slot being shadowed when forwarded to a child component
• 1ece7c6: [Toolkit, Shadcn] align select with the upstream Shadcn Select
• f23c899: [Toolkit] show a diff when ux:install asks to overwrite a file
• e396086: [Toolkit, Shadcn] keep the tooltip inside the viewport and fit it to its text
• ee36b37: [Toolkit, Shadcn] fix resizable handle moving twice as far once moved in the DOM
• 0e54cdf: [Toolkit, Shadcn] fix sonner losing its toasts once moved in the DOM
• 06803d9: [Toolkit, Shadcn] fix dialog no longer being modal once moved in the DOM
• c57118a: [Toolkit, Flowbite] fix modal no longer being modal once moved in the DOM
• 30ae785: [Toolkit, Shadcn] fix navigation-menu never opening again once moved in the DOM
• 8ae6aef: [Toolkit, Shadcn] fix alert-dialog no longer being modal once moved in the DOM
• 9be2122: [Toolkit, Shadcn] fix questionnaire freeform answer losing its name once moved in the DOM
• 49ab9cc: [LiveComponent] fix AssertDispatchedEvent::withPayloadSubset() crashing on non-scalar payload values
• b8d4038: [Pagination] fix Cursor pagination with DATETIMETZ_MUTABLE columns
• 5ef8a78: [Turbo] support the Mercure protocol 1.0 in turbo_stream_from()
• c19924f: [Turbo] only trigger the TurboStreamListenRenderer deprecation when the service is used
• dcbeef0: [LiveComponent] add the render:started hook to the ComponentHooks type
• 40eaad0: [LiveComponent] fix child components lost inside a data-skip-morph element
• 9613d13: [LiveComponent] finish the loading state when a request fails

Newest issues and pull requests

• [HttpKernel][Lock] Add #[Lock] attribute to reject or delay concurrent requests
• [Messenger][MongoDb] Listen to multiple queues in a single request
• [Messenger] Add InteropSerializer to exchange messages with another application
• [Validator] Piped Validation
• [Messenger] Add the messages and unwrap_exceptions options of buses

Symfony Jobs

These are some of the most recent Symfony job offers:

• Symfony Developer at Steward
  Part-time / Temporary - $8,700 – $13,000 / month
  Full remote
  View details
• Symfony Developer at ATH
  Contract / Freelance - €25 – €50 / hour
  Full remote
  View details

You can publish a Symfony job offer for free on symfony.com.

SymfonyCasts Updates

SymfonyCasts is the official way to learn Symfony. Select a track for a guided path through 100+ video tutorial courses about Symfony, PHP and JavaScript.

This week, SymfonyCasts published the following updates:

• (Video) Symfony Security: Going Further: Creating a Super Admin Voter
• (Video) Symfony Security: Going Further: Sudo Mode: Requiring Full Authentication

They talked about us

• Symfony AI in Practice: Building a Writing Assistant for Dyslexic Adults
• Playwright-PHP Changes the Game for Symfony Testing
• Symfony 8.2 — Single-Use Signed URLs, Without Extra Storage
• Symfony 7.4 to 8.1, measured twice a month apart: two of the scary parts were fixed in patch releases
• HTTP QUERY in Symfony: when your GET doesn’t fit on a postcard
• Translatable Enums in Symfony: Problems, Solutions, and When to Use Them
• Setting Up MCP with Symfony and Connecting It to Gemini Spark
• How I Built an AI Agent in PHP
• Domain Driven Design in Symfony
• I couldn't touch the database, so I built search next to it
• How to no longer suffer project migration
• Doctrine Lifecycle Listeners Are a Dangerous Place for GDPR Erasure
• Introducing EasyAdmin Pro
• ObjectMapper in Symfony 8: trasformare DTO senza boilerplate
• Multi-step forms in Symfony 8: form complessi senza dolore
• Как мы перестраивали e‑commerce‑платформу в production: от legacy‑системы к Next.js и Symfony

Upcoming Symfony Events

• Symfony/PHP Meetup Mannheim by SensioLabs: Mannheim, Germany (October 22, 2026)
• Meetup #1 - Symfony Québec: Montréal, Canada (October 28, 2026)

Call to Action

• Follow Symfony on X, on Mastodon, on Bluesky and on Threads and share this article.
• Subscribe to the Symfony blog RSS and never miss a Symfony story again.

Faster APIs

APIs that serialize and deserialize lots of objects see some of the biggest gains. When normalizing objects, the Serializer computes each attribute's context once, avoids copying the normalized array for each attribute and fetches the discriminator mapping once per object instead of once per attribute. On an API application that returns lists of 150 to 900 objects with serialization groups and a name converter, list routes are 14% to 24% faster (PR #66383).

Reading a property with PropertyAccess now takes 40% fewer PHP instructions, so those list routes run another 6% to 8% fewer instructions (PR #66397). The snake_case name converter also memoizes its results instead of running a regular expression for every attribute of every object, which makes list routes 2% to 5% faster (PR #66384).

Denormalizing (e.g. when using #[MapRequestPayload]) also got faster:

• The property accessor is only created for classes that use #[SerializedPath], instead of once per denormalized object (PR #66398);
• Constructor parameters are checked before calling PropertyInfo, which avoids some lookups when denormalizing readonly DTOs. POST requests run 4% to 6% fewer PHP instructions (PR #66399);
• Class files are no longer read on each request to resolve the types of constructor parameters (PR #66400);
• The property info of the classes mapped by the Serializer and the Validator is now warmed up into a single cache file instead of being computed and stored one entry at a time. POST requests are 4% to 5% faster in production (PR #66386).

PropertyInfo and TypeInfo were also optimized. Constructor docblocks are now parsed once per class instead of once per property. Since property info isn't cached in debug mode, this makes dev POST requests 24% to 38% faster (10 to 14 ms each) (PR #66382). Class docblocks are also parsed once per type context instead of five or six times (PR #66401).

Other improvements:

• The Validator reuses the IntlDateFormatter used to format dates in constraint violation messages instead of creating a new one each time (PR #66396);
• The ReflectionExtractor creates its inflector and type resolver only when needed, so a request that serializes one object loads 10 fewer classes (PR #66402);
• Exceptions are logged without turning them into FlattenException objects first. Logging a 422 response now takes 70 µs instead of 125 µs (PR #66392).

Finally, client errors (4xx HTTP responses) are now logged at the warning level instead of error (PR #66391). This better reflects a client mistake and also saves work: with the default Monolog recipe (fingers_crossed with action_level: error), 400, 403 and 422 responses no longer flush the request's log buffer. A 422 response from #[MapRequestPayload] is now 3% to 4% faster.

Faster Production Requests

The gains extend beyond APIs:

• The PhpFilesAdapter of the Cache component no longer tries to include files that don't exist. A failed include costs about 10 µs, while checking for the file takes 1 µs. On the Symfony Demo with a read-only cache directory and without APCu, this saves 830 µs per request (PR #66347);
• ChainAdapter::get() returns hits of its first adapter directly, without creating two closures each time (PR #66346);
• The runtime mode is no longer resolved on web requests, where it's not needed. This removes 8 of the 18 environment variable lookups of a production request in the Symfony Demo (PR #66367);
• The HtmlSanitizer no longer parses inputs that don't contain < or &. Sanitizing a short plain text string (very common when using the sanitize_html option in form fields) is now 5 times cheaper and no longer allocates 1.1 MB of memory on each call (PR #66389).

Faster Development Environment

You spend much of your day in the development environment, so it deserves some attention too. The profiler's Config, Security, Request and Cache data collectors now defer their static work (versions, bundles, role hierarchy, cURL commands, etc.) until profiles are saved. With PHP-FPM, that happens after the response is sent, saving up to 0.6 ms per collector per page (PR #66365, PR #66371, PR #66372, PR #66364).

The Serializer data collector also aggregates nested calls as they happen, instead of storing them all until the end. This saves 5 MB of memory on a dev request that serializes 1,000 orders (PR #66390).

If you use AssetMapper:

• Serving an asset with the dev server no longer builds the profiler and Twig. On the Symfony Demo, each asset is served in 6.3 ms instead of 7.0 ms (PR #66373);
• Each cached asset is loaded once per request and from a single file, instead of reading and unserializing two files each time it's needed. Rendering the importmap of the Symfony Demo in dev now takes 2.4 ms instead of 4.7 ms (PR #66369).

Faster Cache Warmup and Container Builds

Faster builds help on every deploy, when you run cache:clear and cache:warmup, and in dev, whenever a config change rebuilds the container:

• XLIFF translation files are first validated against a much smaller schema that compiles 10 times faster (the full schema is still used when needed). On the Symfony Demo, a cold cache:warmup goes from 1.77 s to 1.57 s and a dev request after editing a translation file goes from 82 ms to 67 ms (PR #66375);
• The Twig cache warmer only compiles the form themes that your app can use, instead of all the 13 themes included in Symfony. On the Symfony Demo, that's 10 fewer themes and a cold cache warmup that takes 2.11 s instead of 2.27 s (PR #66381). Templates listed twice under different names are also compiled only once (PR #66370);
• Dumping the container for debug only clones the service definitions that hold env vars (22 out of 1,344 in the Symfony Demo), instead of all of them. This step goes from 49 ms to 14 ms (PR #66343);
• The XmlDumper skips encoding plain ASCII values, which was almost 30% of the dump time (PR #66379);
• The configuration trees used to generate the reference.php and schema.json files are now built once instead of twice (PR #66378).

Other Performance Improvements

Symfony 8.2 also finish the response before the profiler saves its data, making dev pages end 11 to 13 ms sooner with PHP-FPM (PR #66330). Editing a translation file no longer rebuilds the container either, cutting the next request from about 790 ms to 85 ms (PR #66332).

This work also improved other projects: Twig traverses nodes faster (Twig PR #4976) and TwigComponent pre-lexes templates faster (Symfony UX PR #3934). It even reached PHP itself and Lexbor, the HTML5 parser behind PHP's Dom\HTMLDocument:

• new ArrayIterator() and new ArrayObject(), which Twig nodes, Symfony bags and Doctrine collections create in their getIterator() methods, now run about 180 fewer instructions per call (PHP PR #23946);
• Lexbor no longer allocates 8 times the memory it needs for some of its internal arrays, saving about 10 KB per parse (Lexbor PR #428).

Some other proposals are still under review:

• htmlspecialchars() returns its input when there's nothing to encode, which is the most common case in templates. On the Symfony Demo, which calls it 711 times per request, it becomes about 3.5 times cheaper (PHP PR #23957). Checking for UTF-8 first when resolving the charset makes it another 40% cheaper on short strings (PHP PR #23961);
• ArrayObject and ArrayIterator share the given arrays (copy-on-write) instead of copying them, so a foreach over these collections no longer duplicates their items (PHP PR #23945). Creating an iterator while others are alive (e.g. in a recursive walk of Twig nodes) is also faster (PHP PR #23947);
• Lexbor preallocates less memory, so parsing a small document needs about 200 KB instead of 1 MB (Lexbor PR #427).

Why Care About Sub-Millisecond Improvements?

Some of the changes mentioned above save 70 microseconds per request (that's 2,000 times faster than an average human blink). Why care about those? Because in a mature project like Symfony, you can't find one magic change that makes everything twice as fast. That's why we keep making it faster one small improvement at a time.

Upgrade to Symfony 8.2 when it's released in November to get all of this without changing a line of your application. If profiling your own application reveals something slow in Symfony, please tell us. We care about every microsecond.