@@ -7,6 +7,118 @@ in 7.3 minor versions.
77To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
88To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v7.3.0...v7.3.1
99
10+ * 7.3.7 (2025-11-12)
11+
12+ * security #cve-2025 -64500 [ HttpFoundation] Fix parsing pathinfo with no leading slash (nicolas-grekas)
13+ * bug #62333 Postal mailer transport message ID retrieval (lalcebo)
14+
15+ * 7.3.6 (2025-11-06)
16+
17+ * bug #62324 [ HttpFoundation] Fix parsing hosts and schemes in URLs (nicolas-grekas)
18+ * bug #62171 [ Messenger] Fix commands writing to ` STDERR ` instead of ` STDOUT ` (wazum)
19+ * bug #62315 Keep body size limit for AMP redirects (villermen)
20+ * bug #62237 [ Form] Fix EnumType choice_label logic for grouped choices (yoeunes)
21+ * bug #62283 [ Filesystem] Unify logic for isAbsolute() in Path (yoeunes)
22+ * bug #62091 [ BrowserKit] The BrowserKit history with parameter separator without slash. (biozshock)
23+ * bug #62297 [ Twig] Ensure WrappedTemplatedEmail::getReturnPath() returns a string (yoeunes)
24+ * bug #62294 [ Console] Add missing VERBOSITY_SILENT case in CommandDataCollector (yoeunes)
25+ * bug #62290 [ Routing] Fix matching the "0" URL (cs278)
26+ * bug #62285 [ HttpClient] Reject 3xx pushed responses (nicolas-grekas)
27+ * bug #62267 [ Config] Use the empty string instead of null as an array offset (santysisi)
28+ * bug #62246 [ HttpFoundation] Allow Request::setFormat() to override predefined formats (longwave)
29+ * bug #62242 [ MonologBridge] Accept HttpExceptionInterface in HttpCodeActivationStrategy (GromNaN)
30+ * bug #62222 [ Cache] fix ext-redis 6.2.0 compatibility (xabbuh)
31+ * bug #62197 [ Validator] Fix call to undefined getParser() in YamlValidator (yoeunes)
32+ * bug #62201 [ HtmlSanitizer] Remove ` srcdoc ` from allowed attributes (Spomky)
33+
34+ * 7.3.5 (2025-10-28)
35+
36+ * bug #62153 [ HttpFoundation] Fix issue where ServerEvent with "0" data is not sent (santysisi)
37+ * bug #62145 [ Mailer] Fix parsing message ids in SMTP responses (hacfi)
38+ * bug #62096 [ Cache] fix compatibility with Relay 0.12.1 (xabbuh)
39+ * bug #62078 [ FrameworkBundle] Fix secrets: encrypt-from-local (nicolas-grekas)
40+ * bug #62028 [ Validator] Update regular expression in URL validator (mjaschen)
41+ * bug #62087 [ Cache] fix compatibility with Relay 0.12.1 (xabbuh)
42+ * bug #62083 [ TypeInfo] Fix resolving use statements with line breaks (ostrolucky)
43+ * bug #62054 [ AssetMapper] Fix parsing ` @import ` that don't use url() (nicolas-grekas)
44+ * bug #62058 [ Console] Ensure ` SHELL_VERBOSITY ` is always restored properly (ttskch)
45+ * bug #62037 Fix generating logout link with stateless csrf (pierredup)
46+ * bug #62041 [ DebugBundle] Wire ` DumpDataCollector ` 's ` webMode ` argument (HypeMC)
47+ * bug #62038 [ Translation] [ Loco ] filter should be empty when filtering on all domains (atomiix)
48+ * bug #62003 [ Serializer] Fix unexpected type in denormalization errors when float|int union type used in constructor with non numeric string in form-data request (d-mitrofanov-v)
49+ * bug #61990 [ Cache] [ RedisTagAwareAdapter ] Add Predis2 Replication Interface check (BrianMwit)
50+ * bug #61939 [ FrameworkBundle] fix using lock from service id when previous locks used env vars (AydinHassan)
51+ * bug #61970 [ Cache] fix compatibility with RelayCluster 0.11 and 0.12 (xabbuh)
52+ * bug #61964 [ PropertyInfo] [ TypeInfo ] Fix resolving constructor type with templates (HypeMC)
53+ * bug #61960 [ WebProfilerBundle] ”finish” errored requests (MatTheCat)
54+ * bug #61954 [ TypeInfo] Fix type alias with template resolving (mtarld)
55+ * bug #61924 [ Mailer] Revert " Fix memory leak with ` mailer.message_logger_listener ` " (kochen)
56+ * bug #61943 [ TypeInfo] ArrayShape can resolve key type as callable instead of string (Dean151)
57+ * bug #61947 [ Cache] fix Relay Cluster 0.12 compatibility (xabbuh)
58+ * bug #61945 [ Cache] fix compatibility with Relay 0.12 (xabbuh)
59+ * bug #61928 [ Form] keep labels from configured choices (xabbuh)
60+ * bug #61889 [ Serializer] Fix discriminator class mapping with allow_extra_attributes=false (chris54721)
61+ * bug #61861 [ Console] Ensure terminal is usable after termination signal (johnstevenson)
62+ * bug #61912 [ FrameworkBundle] Fix support of dumping workflow when workflow is decorated by TraceableWorkflow (lyrixx)
63+ * bug #61876 [ Mailer] [ MailJet ] Fix forbidden headers case-sensitive comparison (benjamintoussaint)
64+ * bug #61874 [ Scheduler] Don’t get next run date from ` null ` (MatTheCat)
65+ * bug #61875 [ Form] do not cast too big floats to int (xabbuh)
66+ * bug #61869 [ JsonPath] do not pass more than one byte to ord() (xabbuh)
67+ * bug #61856 [ Console] do not pass the empty string to ord() (xabbuh)
68+ * bug #61855 [ DoctrineBridge] [ Yaml ] don't cast strings exceeding the min/max int ranges (xabbuh)
69+ * bug #61844 do not coerce NAN to other types (xabbuh)
70+
71+ * 7.3.4 (2025-09-27)
72+
73+ * bug #61830 [ Security] Fix preload warning in ` AuthorizationChecker ` (MatTheCat)
74+ * bug #61825 [ DoctrineBridge] Make ` EntityUserProvider ` s pass attributes to their loader (MatTheCat)
75+ * bug #61818 [ Notifier] Rename LOX24RequestParser to Lox24RequestParser (nicolas-grekas)
76+ * bug #61808 [ Config] Fix incorrect serialized data mangling (aboks)
77+ * bug #61793 [ AssetMapper] Prevent duplicate entries in module preloads (xDeSwa)
78+ * bug #61785 [ ObjectMapper] Preserve non-promoted constructor parameters (rvanlaak)
79+ * bug #60515 [ Mailer] Fix memory leak with ` mailer.message_logger_listener ` (andrew-demb)
80+ * bug #61757 [ FrameworkBundle] Perform-no-deep-merging on workflow transitions' from/to configs (nicolas-grekas)
81+ * bug #61766 Fix ord()-related PHP 8.5 deprecations (nicolas-grekas)
82+ * bug #61368 [ HttpKernel] Refine Vary header check to skip special handling of 'Accept-Language' when it's the only entry and '_ vary_by_language' is ` true ` in ` CacheAttributeListener ` (santysisi)
83+ * bug #61752 [ PropertyInfo] Fix getting type from constructor of parent class in ` PhpStanExtractor ` (wuchen90)
84+ * bug #61746 [ Serializer] Fix unknown type in denormalization errors when union type used in constructor (d-mitrofanov-v)
85+ * bug #61724 [ Console] Fix handling of ` \E ` in Bash completion (HypeMC)
86+ * bug #61518 [ HttpKernel] Handle an array vary header in the http cache store for write (philpichet)
87+ * bug #61736 [ PhpUnitBridge] do not try to modify the result of a PhptTestCase (xabbuh)
88+ * bug #61728 [ TypeInfo] Fix issue with merging union type with a nullable union type (matijn-made)
89+ * bug #61731 [ PhpUnitBridge] Fix gathering deprecation in phpt (nicolas-grekas)
90+ * bug #61729 [ PhpUnitBridge] Silence deprecation of __ sleep/wakeup() (nicolas-grekas)
91+ * bug #61727 Replace __ sleep/wakeup() by __ (un)serialize() for throwing and internal usages (nicolas-grekas)
92+ * bug #61714 [ SecurityBundle] Fix semantic configuration for singulars/plurals in XML (nicolas-grekas)
93+ * bug #61132 [ JsonPath] Make the component RFC compliant (alexandre-daubois)
94+ * bug #60055 [ MonologBridge] Make ` ConsoleHandler ` not handle messages at SILENT verbosity (okhoshi)
95+ * bug #61701 [ SecurityBundle] Add missing ` fixXmlConfig() ` call for ` issuer ` (OskarStark)
96+ * bug #61693 [ Console] Don’t append a new line to test inputs ending with an EOT (MatTheCat)
97+ * bug #61596 [ FrameworkBundle] Normalize workflow places separately (KevinVanSonsbeek)
98+ * bug #61690 [ Console] Don’t automatically append EOT to multiline test inputs (MatTheCat)
99+ * bug #61667 [ Config] Fix ` GlobResource ` pattern with trailing slash (HypeMC)
100+ * bug #61658 [ Messenger] map legacy options to the "sentinel" key when parsing DSNs (xabbuh)
101+ * bug #61659 [ Security] Fix ` HttpUtils::createRequest() ` when the base request is forwarded (MatTheCat)
102+ * bug #61653 [ Routing] Don't rebuild cache when controller action body changes (HypeMC)
103+ * bug #61645 Replace backtick operator, deprecated in PHP 8.5, with shell_exec() (iluuu1994)
104+ * bug #61617 [ Validator] fall back to legacy options handling if configured named arguments do not match (xabbuh)
105+ * bug #61097 [ Serializer] Fix normalizing objects with accessors having the same name as a property (RafaelKr)
106+ * bug #61615 [ DependencyInjection] Fix optimizing ClassExistenceResource (nicolas-grekas)
107+ * bug #61614 [ SecurityBundle] Prevent accessing the tracked token storage when collecting data (MatTheCat)
108+ * bug #61607 [ Config] Fix ` ReflectionClassResource ` hash validation (HypeMC)
109+ * bug #61605 [ Cache] Fix internal representation of non-static values (nicolas-grekas)
110+ * bug #61599 [ Cache] Make ` TagAwareAdapter ` registrable as a service (a.dmitryuk)
111+ * bug #61595 [ Security] Pass attributes to nested ` ChainUserProvider ` s (valtzu)
112+ * bug #61580 [ JsonStreamer] Fix encoding iterable lists (mtarld)
113+ * bug #61232 [ Messenger] Firebird Database - incompatibility with expected lowercase columns (DSsatwareAG)
114+ * bug #61583 [ DoctrineBridge] Fix exception catch when deleting temporary table in the sameDatabaseChecker (GromNaN)
115+ * bug #61585 [ HttpFoundation] [ SQLSRV ] Change column type from ` TEXT ` to ` STRING ` (Matt-PMCT)
116+ * bug #61571 [ Serializer] Fix dealing with asymmetric visilibity for properties (santysisi)
117+ * bug #60766 [ DependencyInjection] Respect original service class when a proxy is defined (lyrixx)
118+ * bug #61561 [ JsonStreamer] Fix decoding iterable lists (mtarld)
119+ * bug #61573 [ Inflector] [ String ] Fix edge cases (OskarStark)
120+ * bug #61548 [ Security] Fix attribute-based chained user providers (valtzu)
121+
10122* 7.3.3 (2025-08-29)
11123
12124 * bug #61543 [ TypeInfo] Prevent interfaces extending BackedEnum to be treated as BackedEnums (ettoredn)
0 commit comments