CHANGELOG for 7.4.x
===================

This changelog references the relevant changes (bug and security fixes) done
in 7.4 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v7.4.0...v7.4.1

* 7.4.17 (2026-08-22)

 * bug #65541 [Serializer] Fix denormalizing mime messages typed as RawMessage (nicolas-grekas)
 * bug #65524 [Security] Match check paths given as a route alias (nicolas-grekas)
 * bug #65521 [WebProfilerBundle] Fix the mailer panel crashing when an attached file was deleted (nicolas-grekas)
 * bug #65514 [Messenger] Tell apart handler services that share the same class (nicolas-grekas)
 * bug #65506 [Validator] Fix auto-mapping strategies being ignored on inherited properties (nicolas-grekas)
 * bug #65584 [Form] Map violations to child forms named after the snake cased property (nicolas-grekas)
 * bug #65582 [CssSelector] Fix :disabled and :enabled inside nested fieldsets (nicolas-grekas)
 * bug #65579 [TypeInfo] Fix resolving constants defined on interfaces (llupa)
 * bug #65540 [HttpKernel] Fix caching responses that cannot provide their content (nicolas-grekas)
 * bug #65538 [Form] Fix rendering and parsing dates before the Gregorian cutover (nicolas-grekas)
 * bug #65534 [ErrorHandler] Fix leaking an exception handler when not replacing the error handler (nicolas-grekas)
 * bug #65533 [Scheduler] Reject canceled scheduled messages so async transports do not redeliver them (nicolas-grekas)
 * bug #65532 [DependencyInjection] Keep % escaping when resolving values against a resolved parameter bag (nicolas-grekas)
 * bug #65530 [Form] Apply the configured rounding mode when no scale is set (nicolas-grekas)
 * bug #65526 [HttpKernel] Restore the locale that was in use before a sub-request (nicolas-grekas)
 * bug #65525 [FrameworkBundle] Fix lint:container skipping services matched by tagged iterators (nicolas-grekas)
 * bug #65522 [Form] Do not inherit translation parameters for translatable labels and help messages (nicolas-grekas)
 * bug #65519 [DomCrawler] Detect the charset from meta tags only (nicolas-grekas)
 * bug #65517 [FrameworkBundle] Fix dispatching console events after cache:clear (nicolas-grekas)
 * bug #65516 [HttpKernel] Forward the request headers to inline rendered fragments (nicolas-grekas)
 * bug #65513 [Messenger] Ignore the option-less handler tag added by autoconfiguration (nicolas-grekas)
 * bug #65512 [HttpKernel] Ignore the session id that PHP kept from a previous request (nicolas-grekas)
 * bug #65511 [Serializer] Fix SerializedName being ignored on denormalization when the attribute has groups (nicolas-grekas)
 * bug #65510 [PhpUnitBridge] Fix finding the project root when vendor/ is a symlink (nicolas-grekas)
 * bug #65509 [Mime] Reject an unquoted "@" in the local part of an email address (nicolas-grekas)
 * bug #65508 [Intl] Follow the ICU parent locale when falling back (nicolas-grekas)
 * bug #65507 [BrowserKit] Fix decoding raw cookie values that contain a plus sign (nicolas-grekas)
 * bug #65504 [Messenger] Stop applying serialization groups and attribute filters to stamps (nicolas-grekas)
 * bug #65502 [Security] Refresh the impersonator while impersonating (nicolas-grekas)
 * bug #65501 [PropertyInfo] Fix the priority of the accessor named after the property (nicolas-grekas)
 * bug #65499 [Serializer] Fix XmlEncoder dropping the extra attributes of item elements on decode (nicolas-grekas)
 * bug #65491 [Serializer] Allow the attributes of nested discriminator maps when denormalizing (nicolas-grekas)
 * bug #65580 [Notifier] Fix SendFailedMessageToNotifierListener rejecting any notifier but the concrete one (nicolas-grekas)
 * bug #65476 [DoctrineBridge][EventDispatcher] Fix losing listeners when a lazy listener adds listeners (nicolas-grekas)
 * bug #65498 [Process] Do not wait for output when the input iterator has more data (nicolas-grekas)
 * bug #65495 [TwigBridge] Fix the broken error box around Bootstrap 4 date and time widgets (nicolas-grekas)
 * bug #65494 [Translation] Stop leaking a temporary schema copy per validated XLIFF file inside a phar (nicolas-grekas)
 * bug #65493 [Serializer] Fix XmlEncoder skipping normalizers for nested Traversable values (nicolas-grekas)
 * bug #65489 [Scheduler] Fix refreshing the checkpoint lock with a negative TTL (nicolas-grekas)
 * bug #65488 [MonologBridge] Fix NotifierHandler calling a method that NotifierInterface does not declare (nicolas-grekas)
 * bug #65487 [Messenger] Fail when messenger:consume is given no receiver (nicolas-grekas)
 * bug #65486 [Messenger] Remove the worker listeners when messenger:consume ends (nicolas-grekas)
 * bug #65485 [Mailer] Remove metadata headers from the emails sent by the SES HTTP transports (nicolas-grekas)
 * bug #65484 [HttpClient] Fix CachingHttpClient when trusted hosts are configured (nicolas-grekas)
 * bug #65483 [FrameworkBundle] Show the effective priority of tagged services in debug:container (nicolas-grekas)
 * bug #65482 [FrameworkBundle] Fix ignored --raw option of debug:router (nicolas-grekas)
 * bug #65481 [FrameworkBundle] Fix debug:config and config:dump-reference when a bundle registers services in its build method (nicolas-grekas)
 * bug #65479 [Form] Fix generating the CSRF token when the form attributes are replaced (nicolas-grekas)
 * bug #65474 [DependencyInjection] Fix compiling nested service locators (nicolas-grekas)
 * bug #65473 [DependencyInjection] Fix sorting tagged services when autoconfiguration duplicates a tag (nicolas-grekas)
 * bug #65578 [Form] Apply the guessed "pattern" and "maxlength" attributes to the types rendered as text inputs (nicolas-grekas)
 * bug #65528 [Security] Track session usage when a lazy firewall reads the token (nicolas-grekas)
 * bug #65527 [Mailer] Fix emails reported twice when they are queued and sent in the same process (nicolas-grekas)
 * bug #65523 [PropertyInfo] Use the same mutator method for types and write info (nicolas-grekas)
 * bug #65520 [BrowserKit] Return the most specific cookie when several ones match (nicolas-grekas)
 * bug #65505 [Form] Apply the guessed "pattern" and "maxlength" attributes to text inputs only (nicolas-grekas)
 * bug #65496 [HttpKernel] Send the response content before terminating the kernel in the test client (nicolas-grekas)
 * bug #65492 [Serializer] Allow array indexes in the property paths of attributes when denormalizing (nicolas-grekas)
 * bug #65529 [Finder] Fix gitignore matching of negated patterns and excluded directories (nicolas-grekas)
 * bug #65546 [Scheduler] Fix infinite loop in MessageGenerator when a trigger does not move the run date forward (lazerg)
 * bug #65500 [Console] Keep backslashes preceding < and > when escaping text (nicolas-grekas)
 * bug #65542 [DependencyInjection] Detect circular references through a shared factory builder (nicolas-grekas)
 * bug #65477 [Finder] Do not report dangling symlinks as both files and directories (nicolas-grekas)
 * bug #65472 [HttpKernel] Write pending dumps to the output before dd() exits (nicolas-grekas)
 * bug #65471 [Console] Fix clearing more lines than a section holds (nicolas-grekas)
 * bug #65470 [Yaml] Fix parsing tagged block scalars inside sequences (nicolas-grekas)
 * bug #65537 [Filesystem] Fix mirror() deleting files from the origin directory (nicolas-grekas)
 * bug #65518 [Translation] Fix pushing numeric translation keys to Lokalise (nicolas-grekas)
 * bug #65547 [VarDumper] Fix division by zero when dumping a DatePeriod whose interval does not move forward (lazerg)
 * bug #65544 [Mailer] Fix the SMTP scheme check in the transport factory test case (nicolas-grekas)
 * bug #65503 [VarDumper] Fix losing colors when dumping to php://output on the CLI (nicolas-grekas)
 * bug #65469 [Scheduler] Fix infinite loop in PeriodicalTrigger when the interval cannot move the run date forward (wazum)
 * bug #65475 [ErrorHandler] Don't autoload when resolving "`@return`" class constants (nicolas-grekas)
 * bug #65478 [Form] Replace the {{ max }} placeholder in the post_max_size error message (nicolas-grekas)
 * bug #65480 [Form] Fix the money pattern for locales that do not use ASCII digits (nicolas-grekas)
 * bug #65465 [TwigBridge] Pass a valid XML version to DOMDocument in the form layout test case (nicolas-grekas)
 * bug #65448 [HttpKernel] Fix concurrent cache warmups corrupting the deprecations log (lazerg)
 * bug #65444 [Config] Fix dumping keyless prototyped arrays of arrays in XmlReferenceDumper (nicolas-grekas)
 * bug #65441 [DependencyInjection] Skip abstract classes and interfaces in findTaggedResourceIds() (nicolas-grekas)
 * bug #65430 [Cache] Validate every key before deleting any in ArrayAdapter::deleteItems() (nicolas-grekas)
 * bug #65429 [Cache] Fix numeric string keys being cast to integers (nicolas-grekas)
 * bug #65425 [Yaml] Fix parsing an alias followed by a comment (eyupcanakman)
 * bug #65421 [Cache] Fix Predis ignoring the "auth" parameter set in the DSN or in the options (nicolas-grekas)
 * bug #65423 [WebProfilerBundle] Fix wrongly disabled tabs and toggles that cannot be focused (Nitram1123)
 * bug #65422 [Security] Reject malformed login link parameters instead of throwing a TypeError (nicolas-grekas)
 * bug #65419 [Console] Consume the whole escape sequence when reading autocomplete input (nicolas-grekas)
 * bug #65395 [Yaml] Do not treat an uppercase 0X prefix as hexadecimal (eyupcanakman)
 * bug #65388 [Notifier][Mercure] Add support for Mercure 0.8 (lazerg)
 * bug #65392 [DomCrawler] Fix FormField::getLabel() when the field id contains a quote (nicolas-grekas)
 * bug #65391 [DomCrawler] Read the whole content of a textarea (nicolas-grekas)
 * bug #65382 [DomCrawler] Fix matches(), closest() and children() for selectors with a combinator or a positional pseudo-class (nicolas-grekas)
 * bug #65366 [ObjectMapper] Only honor an explicitly inbound target #[Map] for the same-name copy (soyuka)
 * bug #65376 [Validator] Allow a literal # in the fragment part of Url (lazerg)
 * bug #65371 [Translation] Read CSV translations without SplFileObject (nicolas-grekas)
 * bug #65372 [HttpFoundation] Declare create_sid() on session handlers (nicolas-grekas)
 * bug #65367  Fix PHP 8.6 deprecations (nicolas-grekas)
 * bug #65363 [MonologBridge] Release command data in ConsoleCommandProcessor when the command terminates (tomsommer)
 * bug #65352 [Mailer] Reconnect after a timeout to avoid SMTP response desync (ousamabenyounes)
 * bug #65354 [Serializer] Throw on XML data without a root node (nicolas-grekas)
 * bug #65315 [Translation] Do not extract messages from classes merely named TranslatableMessage (nicolas-grekas)
 * bug #65314 [HttpClient] Fix abandoned wrapped response throwing on destruct (nicolas-grekas)
 * bug #65311 [HttpClient] Fix mis-armed consumption guard in AsyncResponse::stream() (nicolas-grekas)
 * bug #65305 [Messenger] Handle synchronous batch nack (eissasoubhi)
 * bug #65303 [FrameworkBundle] Do not leak the response body from `assertResponseRedirects()` when not verbose (nicolas-grekas)
 * bug #65296 [DoctrineBridge] Fix removing lazy listeners by object (eissasoubhi)
 * bug #65288 [Cache] Fix stampede protection not being disabled on CLI (nicolas-grekas)
 * bug #65274 [Mailer][Notifier] Avoid retaining messages without the profiler (eissasoubhi)
 * bug #65278 [FrameworkBundle] Reset the notification logger listener between messages (nicolas-grekas)
 * bug #65271 [DependencyInjection] Fix circular references through expressions (eissasoubhi)
 * bug #65273 [Notifier][Sevenio] Fix successful sends being reported as failures (lazerg)
 * bug #65275 [PropertyInfo] Ignore methods that only look like accessors (nicolas-grekas)
 * bug #65263 [Console] Keep falsy answers when collecting an array with #[Ask] (sadiqk2)
 * bug #65264 [Mime] Do not drop the last line of a resource-backed message (sadiqk2)
 * bug #65265 [Uid] Compare times by value in MockUuidFactory (sadiqk2)
 * bug #65262 [AssetMapper] Include front controller in dev asset URLs (eissasoubhi)
 * bug #65260 [Messenger][AmazonSqs] Support queue URLs from the aws-cn and aws-eusc partitions (bhavin-nakrani)
 * bug #65258 [Console] Restore the catchExceptions state after running a command message (KevinMartinsDev)
 * bug #65252 [HttpFoundation] Combine trusted host patterns into a single regexp (nicolas-grekas)
 * bug #65250 [DependencyInjection] Fix class-level tag attributes being overridden by interface-level ones (nicolas-grekas)
 * bug #65249 [DependencyInjection][HttpKernel] Fix undefined variable when locking the container build fails early (javiereguiluz)

* 7.4.16 (2026-08-07)

 * bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (cs278)
 * bug #65183 [Intl] Honor the expiry date of currencies that have no start date (sadiqk2)
 * bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (sadiqk2)
 * bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (sadiqk2)
 * bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (sadiqk2)
 * bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (javiereguiluz)
 * bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (nicolas-grekas)
 * bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (munzzyy)
 * bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (ousamabenyounes)
 * bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (ousamabenyounes)
 * bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (javiereguiluz)
 * bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (xabbuh)
 * bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (lazerg)
 * bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (ousamabenyounes)
 * bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (lazerg)
 * bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (Zombaya)
 * bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (javiereguiluz)
 * bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (eliot488995568)
 * bug #65120 [DependencyInjection] Fix `#[Autoconfigure]` being processed twice for PSR-4-discovered abstract types (javiereguiluz)
 * bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (nicolas-grekas)
 * bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (nicolas-grekas)
 * bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (nicolas-grekas)
 * bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (nicolas-grekas)
 * bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (RobLogtenberg-Pay)
 * bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (wayne530)
 * bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (nicolas-grekas)
 * bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (nicolas-grekas)
 * bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (ousamabenyounes)
 * bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (nicolas-grekas)
 * bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (alexisLefebvre)
 * bug #65065 [Console] Fix column widths when a row spans columns (wazum)
 * bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (MarcinOrlowski)
 * bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (nicolas-grekas)
 * bug #64696 [Config] Generate unsealed array shapes for any normalizers (ousamabenyounes)
 * bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (nicolas-grekas)
 * bug #65058 [PropertyAccess] Fix caching of null read info (javiereguiluz)
 * bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (javiereguiluz)
 * bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (nicolas-grekas)
 * bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (nicolas-grekas)
 * bug #65052 [PropertyInfo] Revert "bug #64990  Do not trigger legacy Type deprecat… (nicolas-grekas)
 * bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (GrahamCampbell)

* 7.4.15 (2026-07-29)

 * bug #65029 [JsonPath] Add limits for filter expression length and depth in JsonCrawler (alexandre-daubois)
 * bug #65028 [HttpClient] Fail when an https proxy is configured but libcurl cannot use it (nicolas-grekas)
 * bug #65026 [JsonStreamer] Drop the unbounded process-global key cache in Splitter (nicolas-grekas)
 * bug #65025 [Serializer] Check the denormalized class is a Mime part in MimeMessageNormalizer (nicolas-grekas)
 * bug #65024 [SecurityBundle] Always constrain redirect targets to the current host, even without sessions (nicolas-grekas)
 * bug #65023 [HttpFoundation] Validate the characters allowed in a cookie path and domain (nicolas-grekas)
 * bug #65022 [HttpFoundation] Don't crash on a non-string signature in UriSigner (nicolas-grekas)
 * bug #65020 [HttpFoundation] Fix newline handling in server event fields (nicolas-grekas)
 * bug #65019 [HttpClient] Strip Proxy-Authorization on cross-authority redirects (nicolas-grekas)
 * bug #65011 [Cache] Add support for relay 0.40 (nicolas-grekas)
 * bug #65005 [JsonPath] Reject non-singular queries in filter comparisons (nicolas-grekas)
 * bug #65002 [JsonPath] Fix evaluating filter expressions wrapped in several parentheses (nicolas-grekas)
 * bug #65001 [HttpFoundation] Fix retry field being dropped across server event streams (nicolas-grekas)
 * bug #65009 [HttpClient] Fix the escaping of the generated curl command (nicolas-grekas)
 * bug #65004 [HttpClient] Don't send the original Host header on cross-authority redirects (nicolas-grekas)
 * bug #64995 [Serializer] Prefer serialized name over raw property key (ousamabenyounes)
 * bug #64992 [String] Consistently return null for out-of-range offsets (javiereguiluz)
 * bug #64990 [PropertyInfo] Do not trigger legacy Type deprecation on getType() (saifulferoz)
 * bug #64983 [ObjectMapper] Fix nested map() reconstructing an existing target (takashiraki)
 * bug #64985 [Mailer] Fix fatal TypeError when sending a RawMessage via an API transport (Baylox)
 * bug #64975 [SecurityBundle] Let the LDAP and non-LDAP variants of an authenticator share a firewall (nicolas-grekas)
 * bug #64662 [Console] Decorate stdout and stderr independently when a formatter is injected (jprivet-dev)
 * bug #64697 [Serializer] Keep the collection value type for iterable constructor parameters (misaert)
 * bug #64917 [Messenger] Do not wrap the Doctrine transport keepalive in a transaction (bendavies)
 * bug #64820 [Mailer][Messenger] Wrap AsyncAws exceptions into TransportException in the AmazonSqs and SES transports (voodooism, nicolas-grekas)
 * bug #64768 [Bridge][Monolog] Do not reset in ConsoleCommandProcessor (lyrixx)
 * bug #64971 [Dotenv] Don't parse external env var values when resolving .env references (nicolas-grekas)
 * bug #64972 [AssetMapper] Reset the mapped asset factory between requests (pokki-deploy)
 * bug #64966 [AssetMapper] Avoid re-expanding bare importmap entries (pokki-deploy)
 * bug #64965 [Serializer] Do not read subclass discriminator attributes from base objects (pokki-deploy)
 * bug #64957 [Cache] Fix "Class Relay\Relay not found" for RedisCluster/RedisArray with tcp_keepalive (rjmackay)
 * bug #64862 [ObjectMapper] Resolve a nested reverse-mapped property by the type of its destination (Amoifr)
 * bug #64724 [Serializer] Keep FILTER_BOOL working when ENABLE_TYPE_CONVERSION is enabled (Amoifr)
 * bug #64710 [Mailer] Reject control characters in SmtpTransport::setLocalDomain() (iliaal)
 * bug #64945 [HttpFoundation] Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (Amoifr)
 * bug #64670 [Config] Accept env placeholders for scalar alternatives in generated array-shapes (yvh)
 * bug #64938 [Messenger] Do not reject unknown types when no message requires signing (pokki-deploy)
 * bug #64935 [PropertyInfo] Ignore mutators with several required parameters (pokki-deploy)
 * bug #64937 [Validator] Allow `Traverse` to be inherited (MatTheCat)
 * bug #64654 [Validator] Merge target's own constraints when using #[ExtendsValidationFor] (pokki-deploy)
 * bug #64708 [DependencyInjection] Fix lazy + factory service with a leading-backslash class on PHP 8.4 (Amoifr)
 * bug #64751 [FrameworkBundle] Make `WebTestCase` enable web mode by default (MatTheCat)
 * bug #64770 [ObjectMapper] Fix explicit #[Map(target:)] being overwritten by a same-name source property (danielpilot)
 * bug #64801 [Validator] Allow null groups in ConstraintValidatorTestCase (sjh9714)
 * bug #64828 [DependencyInjection] Add supported literal option `not_found` for `imports.[*].ignore_errors` in `services.schema` and `AppReference` (kaznovac)
 * bug #64831 [FrameworkBundle] Fix valkey cache adapters ignoring `default_valkey_provider` (lazerg)
 * bug #64848 [ObjectMapper] Fix per-property #[Map(source:)] being ignored when the target property name also exists on the source (Amoifr)
 * bug #64934 [HttpClient] Do not stream empty PSR-18 request bodies (pokki-deploy)
 * bug #64931 [TwigBridge] prevent implicit string casts for translatable message objects (xabbuh)
 * bug #64905 [PropertyInfo] Fix union with mixed handling in PhpStanTypeHelper (Amoifr)
 * bug #64928 [Messenger] Strip trace from nested exceptions in ErrorDetailsStamp (pkranjcecx)
 * bug #64933 [Messenger] Fix ack/reject failing when the Redis stream entry is already deleted (pokki-deploy)
 * bug #64707 [AssetMapper] Fix crash when a remote package depends on a locally-mapped importmap entry (Amoifr)
 * bug #64655 [EventDispatcher] Fix regression in TraceableEventDispatcher invocation counting (jnahmias)
 * bug #64727 [Routing] Detect circular references in object route parameters (Amoifr)
 * bug #64741 [Mime] Fix dropped whitespace between multiple encoded words (eyupcanakman)
 * bug #64843 [Console] Fix table borders around colspan cells and header-less tables (wazum)
 * bug #64930  Handle PHP 8.6 removing function arguments in error messages (MatTheCat)
 * bug #64847 [DoctrineBridge] Filter non-.php files in ProxyCacheWarmer::warmUp() to avoid CacheWarmerAggregate exception (semx)
 * bug #64822 [Config] Escape "*/" in generated array-shape comments (lazerg)
 * bug #64857 [Config] Escape comment-closing sequence in generated config builders (sadiqk2)
 * bug #64886 [Console] Fix two ValueError crashes on multibyte / multi-column widths (sadiqk2)
 * bug #64887 [Cache] Initialize PhpArrayAdapter before classifying keys in deleteItems() (sadiqk2)
 * bug #64897 [Messenger][AmazonSqs] Fix fatal on shutdown when the in-flight receive cannot be resumed (vadimgodev)
 * bug #64904 [ErrorHandler] Fix fatal error without args triggering an error when calling `getTraceFromString` (timacdonald)
 * bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)
 * bug #64914 [EventDispatcher] Clear wrappedListeners in TraceableEventDispatcher::reset() (guillaumedelre)
 * bug #64672 [Yaml] Fix line folding after trailing backslashes in quoted strings (eyupcanakman)
 * bug #64668 [DependencyInjection] Fix env var reported as never used for a removed autowired service (eyupcanakman)
 * bug #64915 [Yaml] Fix parsing and dumping of NaN (semx)
 * bug #64918 [String] Fix AsciiSlugger::getLocale() TypeError with no locale set (eyupcanakman)
 * bug #64920 [Validator] add missing inherited options to Video constraint (xabbuh)
 * bug #64891 [TwigBridge] ensure that a label with value "0" is rendered (xabbuh)
 * bug #64889 [HttpClient] Replace the native "dechunk" stream filter with a pure PHP implementation (nicolas-grekas)
 * bug #64898 [Cache] Remove obsolete `return` instruction from classes constructors (cedric-anne)
 * bug #64895 [Dotenv] Allow multiple underscores at start (Sajito)
 * bug #64884  Fix/webprofiler mailer macros 6.4 (HecFranco)
 * bug #64877 [Validator] Reject misplaced "X" character in ISBN-10 validation (semx)
 * bug #64856 [Console] Fall back to "stty sane" when restoring the captured terminal state fails (lyrixx)
 * bug #64649 [Serializer] Fix support check for nested array items (nicolas-grekas)
 * bug #64827  jitter shouldn't make scheduler miss runs (mrossard)
 * bug #64849 [Console] Fix SymfonyStyle questions when using output sections (javiereguiluz)
 * bug #64815 [Cache] Remove always-true method_exists() check in FilesystemCommonTrait::__destruct() (munzzyy)
 * bug #64794 [PropertyInfo] Prevent `PhpDocTypeHelper` to wrongly assume keys type (MatTheCat)
 * bug #64783  Add additional IP ranges for RFC2544 and RFC5180 (thePanz)
 * bug #64789 [HttpFoundation] Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (thePanz)
 * bug #64739 [PropertyInfo] Prevent `PhpDocTypeHelper` to wrongly assume keys type (MatTheCat)
 * bug #64752 [Yaml] Fix parsing of integers with a leading plus sign (eyupcanakman)
 * bug #64701  Fix Absolute URL generation by ignore tel: mailto: and other app links (tomm1996, alexander-schranz)
 * bug #64734 [Filesystem] Trim trailing whitespace from the tempnam() prefix (Amoifr)
 * bug #64732 [String] Fix splice() on multibyte strings (eyupcanakman)

* 7.4.14 (2026-06-27)

 * bug #64718 [Serializer] Fix `GetSetMethodNormalizer` denormalization of constructor only objects (mtarld)
 * data #64692 [Validator] Remove needs-review-translation state from Spanish cron e… (salvador-castro)
 * data #64698 [Validator] reviewed Polish translation unit 146 (thunderer)
 * data #64711 [Validator] Ukrainian translation update (VladyslavChernyshov)
 * data #64675 [Validator] Add translated messages for the Cron constraint (fabpot)
 * bug #64120 [Serializer] honor `csv_headers` context when `no_headers` is true (ousamabenyounes)
 * bug #64648 [Cache] Ensure RelayProxy compatibility with Relay extension 0.30.0 (nicolas-grekas)
 * bug #64225 [Serializer] Fix #[Ignore] on a getter ignoring a same-name property (eyupcanakman)
 * bug #64645 [Cache] Ensure RelayClusterProxy compatibility with Relay extension 0.30.0 (Amoifr)
 * bug #64236 [Finder] Fix recursion into stream wrapper subdirectories on Windows (eyupcanakman)
 * bug #49137 [Validator] Avoid TypeError and improve DX when null groups (alamirault)
 * bug #64635 [AssetMapper] Fix stale dev asset cache in long-running runtimes (adrianrudnik)
 * bug #64576 [Serializer] Fix denormalization of already-instantiated nested objects (pokki-deploy)
 * bug #63791 [ObjectMapper] Fix mapping of private properties from parent classes (Amoifr)
 * bug #64404 [SecurityBundle] Fix state leak in LogoutUrlGenerator in async environments (KevinMartinsDev, nicolas-grekas)
 * data #64602 [Form][Validator] Review Hungarian translations (antalaron)
 * data #64626 [Form][Validator] Ukrainian translation review and update (VladyslavChernyshov)
 * bug #64617 [Cache][DoctrineBridge][HttpFoundation][Lock][Messenger] Restore compat with DBAL 4.5 (nicolas-grekas)
 * bug #63800 [FrameworkBundle] Detect env placeholders in resolved route parameter values (Amoifr)
 * bug #64596 [EventSourceHttpClient] Prevent re-yielding of the first chunk after reconnect (nacorp)
 * data #64597  Review Indonesian (id) translations (sawirricardo)
 * bug #64605 [Mailer] Register MicrosoftGraphTransportFactory in Transport::FACTORY_CLASSES (Amoifr)
 * data #64607 [Translation] Verify Tagalog (tl) validator strings and remove needs-… (Jerdon07)
 * bug #64588  Migrate table definitions to DBAL's `TableEditor` API (nicolas-grekas)
 * bug #64577 [ObjectMapper] Make existing-object mapping behavior consistent (kbond)
 * bug #64583 [Mailer][Bridge][MicrosoftGraphApi] Set recipients from $envelope instead of the $email headers (Pelagoss)
 * bug #64584 [ObjectMapper] Fix fatal errors on unreadable source properties (nicolas-grekas)
 * data #64578 [Form][Validator] Review Bulgarian (bg) translations (moynzzz)
 * data #64564  Remove review state from Serbian translations (Trysha-rbrn)
 * data #64565  Remove review state from Russian translations #64512 (centaur-vova)
 * bug #64566  Harden __toString trampolines via __unserialize() (nicolas-grekas)
 * bug #64561 [VarExporter] Fix exporting objects that cannot be instantiated empty (nicolas-grekas)
 * bug #64557 [Translation] Create Crowdin files before uploading translations (MatTheCat)
 * data #64550 [Validator] reviewed Polish translation units 143-145 (thunderer)
 * data #64551 [Form] reviewed Polish translation unit 129 (thunderer)
 * bug #64549 [TwigBridge] Reject __toString trampolines in TemplatedEmail::__unserialize() (nicolas-grekas)
 * data #64544 [Validator] Review French (fr) translations for XML constraints (lacatoire)
 * bug #64532 [HttpKernel] Restore null-on-invalid for nullable #[Autowire(service:)] controller args (ousamabenyounes, pokki-deploy)
 * bug #64533 [Console] Render formatter tags in ChoiceQuestion default value (ousamabenyounes)
 * data #64542 [Form][Validator] Update Spanish translations (ThiagoMirandaLiotto)
 * data #64543 [Form][Validator] Review Croatian translations (HypeMC)
 * data #64526 [Form][Validator] Review and correct Arabic translation (ayyoub-afwallah)
 * bug #64477 [Serializer] Keep collection value type for iterable constructor parameters (ousamabenyounes)
 * bug #64475 [AssetMapper] Render an empty import map as a JSON object (ousamabenyounes)
 * bug #64458 [Webhook] Fix Content-Type key in createRequest method (MarijnDoeve)
 * bug #64468 [HttpFoundation] Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (derflocki)
 * bug #64452 [Translation] Copy domains metadata when moving messages to intl ones (MatTheCat)
 * bug #64424 [Form] Translate TranslatableInterface label in violation messages (Amoifr)
 * bug #64359 [Validator] Support SVG dimensions with units (Will-thom)
 * bug #64419 [HttpKernel][Security] Add allowed_classes => false to unserialize() in CacheWarmerAggregate, LoggerDataCollector, and HttpCache Store (XananasX7)
 * data #64451 [Form] Add missing translation for invalid UUID (jmsche)
 * data #64440 [Validator] fix sr-Latn validation messages and video constraint translations (Trysha-rbrn)
 * data #64446 [Validator] Add translated messages for the XML constraint (nicolas-grekas)
 * bug #64375 [Notifier] Send message to MS-Teams via Workflow (gassan)
 * bug #64429 [Mailer] Fix inline images in MandrillApiTransport by using the Content-ID as image name (ibrambe)
 * bug #64394  Fix XMLHttpRequest URL handling in toolbar JS (Mudassar Ali)
 * bug #64376 [Translation] Fix XLIFF 2 catalog metadata (MatTheCat)
 * bug #64386 [Dotenv] Don't truncate external env vars containing $ when referenced via ${...} indirection (nicolas-grekas)
 * bug #64388 [Yaml] Fix parsing inline anchored values (nicolas-grekas)
 * bug #64358 [ObjectMapper] Fix TargetClass generic type in ConditionCallableInterface (Mudassar Ali)
 * bug #64389  Migrate `configureSchema()` to DBAL's editor API (nicolas-grekas)
 * bug #64102  Remove usage of `Kernel::VERSION` (fabpot)

* 7.4.13 (2026-05-27)

 * security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (nicolas-grekas)
 * security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on <object>, <applet>, <iframe>, <img>, and the URL inside <meta http-equiv="refresh"> content (nicolas-grekas)
 * security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (nicolas-grekas)
 * security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (nicolas-grekas)
 * security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (nicolas-grekas)
 * security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (nicolas-grekas)
 * security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (nicolas-grekas)
 * bug #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (nicolas-grekas)
 * bug #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)
 * bug #64348 [FrameworkBundle] Allow to pass `doctrine_open_transaction_logger`’s entity manager name positionally (MatTheCat)
 * bug #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (nicolas-grekas)
 * bug #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (nicolas-grekas)
 * bug #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (signor-pedro)
 * bug #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (ousamabenyounes)
 * bug #64338 [SecurityBundle] Fix Security::login() across firewalls (ousamabenyounes)
 * bug #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (nicolas-grekas)
 * bug #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (nicolas-grekas)
 * bug #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (nicolas-grekas)
 * bug #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (nicolas-grekas)
 * bug #64337 [Security] Initialize lazy users before serializing them (MatTheCat)
 * bug #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (nicolas-grekas)
 * bug #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (nicolas-grekas)
 * bug #64316 [Yaml] Allow trailing newlines after the end-of-document marker (nicolas-grekas)
 * bug #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (MatTheCat)
 * bug #64208 [AssetMapper] Rewrite relative paths in `export ... from` statements (ousamabenyounes)
 * bug #64311 [DependencyInjection] Fix `service()` as invokable factory in array-based PHP config (nicolas-grekas)
 * bug #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both `WARNING` and `warning` (MatTheCat)
 * bug #64260 [HttpClient] Various fixes and hardenings (Lctrs)
 * bug #64309 [FrameworkBundle] Sign transports for unrouted messages too (nicolas-grekas)

* 7.4.12 (2026-05-20)

 * security #cve-2026-46626 [Runtime] Fix CVE-2024-50340 patch bypass by gating argv on $_SERVER['QUERY_STRING'] (nicolas-grekas)
 * security #cve-2026-45754 [Notifier][Lox24] Reject webhooks with missing or invalid token (nicolas-grekas)
 * security #cve-2026-47212 [Notifier][Twilio] Reject webhooks with missing or invalid HMAC signature (nicolas-grekas)
 * security #cve-2026-45753 [HtmlSanitizer] Sanitize URLs in action, formaction, poster and cite attributes (nicolas-grekas)
 * security #cve-2026-45754 [Mailer][Mailjet] Reject webhooks with missing or invalid Basic credentials (alexandre-daubois)
 * security #cve-2026-45072 [TwigBridge] Fix XSS issue in CodeExtension::fileExcerpt() (nicolas-grekas)
 * security #cve-2026-45064 [HtmlSanitizer] Reject BiDi override characters and percent-encode spaces in URLs (nicolas-grekas)
 * security #cve-2026-45066 [HtmlSanitizer] Fix `allowLinkHosts`/`allowMediaHosts` bypass via URL parser differentials and `<area>` misclassification (alexandre-daubois)
 * security #cve-2026-45069 [Security] Add missing claims in `OidcTokenHandler` (alexandre-daubois)
 * bug #64258 [DomCrawler] Fix `ChoiceFormField::addChoice()` clobbering values on multi-selects (nicolas-grekas)
 * bug #64214 [HttpKernel] Preserve named-attribute override on Request/Session value resolvers (nicolas-grekas)
 * security #cve-2026-45305 [Yaml] Harden the Parser::cleanup() regexes against catastrophic backtracking (nicolas-grekas)
 * security #cve-2026-45304 [Yaml] Bound collection-alias resolution in the parser (nicolas-grekas)
 * security #cve-2026-45133 [Yaml] Bound recursion depth in the parser (nicolas-grekas)
 * security #cve-2026-45071 [DomCrawler] Fix XXE in addXmlContent() by not enabling `validateOnParse` (alexandre-daubois)
 * security #cve-2026-45068 [Mailer] Add end-of-options separator before recipients in SendmailTransport; reject addresses starting with a dash (alexandre-daubois)
 * security #cve-2026-45063 [Security] Anchor emailAddress regex to RDN boundary in X509Authenticator (alexandre-daubois)
 * security #cve-2026-45065 [Routing] Fix regex alternation anchoring in `UrlGenerator` requirement validation (alexandre-daubois)
 * security #cve-2026-45067 [Mime] Reject email addresses containing line breaks in Address (alexandre-daubois)
 * security #cve-2026-45073 [Cache] Validate the prefix given to AbstractAdapter::clear() (nicolas-grekas)
 * security #cve-2026-45077 [MonologBridge] Bind server:log to localhost by default (nicolas-grekas)
 * security #cve-2026-45755 [Mailer][Mailtrap] Reject webhooks with missing or invalid HMAC signature (alexandre-daubois)
 * security #cve-2026-45756 [JsonPath] Cap regex backtracking in `match()`/`search()` to prevent ReDoS (alexandre-daubois)
 * security #cve-2026-45074 [Security] Require configuring trusted hosts when using CAS authentication (nicolas-grekas)
 * security #cve-2026-45075 [Security][HttpKernel] Fix HEAD requests bypassing methods filter in `IsGranted`, `IsCsrfTokenValid` and `IsSignatureValid` attributes (nicolas-grekas)
 * bug #64261 [Messenger] Fix PhpSerializer::getMessageType() when getting payload with Serializable instances (nicolas-grekas)
 * bug #64207 [MonologBridge] Fix `interactive_only` not preventing propagation (philbates35)
 * bug #64213 [Security] Fix impersonation being deauthenticated on every request (nicolas-grekas)

* 7.4.11 (2026-05-13)

 * bug #64198 [SecurityBundle] Allow defining security provider factories without config (hockdudu)
 * bug #64189 [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver (ousamabenyounes)
 * bug #64197 [Messenger] Ensure SigningSerializer won't decode before verifying the signature (nicolas-grekas)
 * bug #64195 [Security] Remove the legacy nested unserialize() call from token and exception classes (nicolas-grekas)
 * bug #64196 [Yaml] Reject non-stringables when using "!!binary" (nicolas-grekas)
 * bug #64191 [Inflector][String] Fixed singularize `traces` > `trace` (ruudk)
 * bug #64192 [Mailer] Use `hash_equals()` to compare webhook signatures for AhaSend (alexandre-daubois)
 * bug #64193 [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage (alexandre-daubois)
 * bug #64180 [Messenger][Amqp] Fix support for RabbitMQ v4 by adding delayed quorum queues (Jean85)
 * bug #64187 [AssetMapper] Warn on missing bare CSS and JSON imports (ousamabenyounes)
 * bug #64182 [Console] Fix signal handler scoping (jpollard3)
 * bug #64181 [Security] Preserve webserver base URL in HttpUtils::createRequest() (ousamabenyounes)
 * bug #64058 [Process] Ignore array env values before proc_open (dionisvl)
 * bug #64179 [Filesystem] preserve source mode when copying files (nicolas-grekas)
 * bug #64176 [Console] Make `ConsoleSectionOutput::overwrite()` atomic to fix sections + ProgressIndicator clear (Amoifr)
 * bug #64174 [Scheduler] Use stored checkpoint as base date for debug:scheduler (ousamabenyounes)
 * bug #64153 [Messenger] Drop trace args from FlattenException normalization (ousamabenyounes)
 * bug #64150 [HttpKernel] Use backend-handled request for terminate listeners in HttpCache (Toflar)
 * bug #64172 [WebProfilerBundle] Don’t try to access `RawMessage::$headers` (MatTheCat)
 * bug #64148 [Dotenv] Don't truncate OS env vars containing $ when $_ENV is unpopulated (HMAZonderland)

* 7.4.10 (2026-05-06)

 * bug #63761 [Scheduler] Fix checkpoint state expiring when cache has default TTL (Amoifr)
 * bug #64141 [DependencyInjection] Fix lazy-autowiring an already-lazy service (nicolas-grekas)
 * bug #64138 [Translation] Fix `TranslationPushCommand::getDomainsFromTranslatorBag` (MatTheCat)
 * bug #63744 [Validator] Fix Compound constraint with nested Composite and validation groups (Amoifr)
 * bug #63757 [Messenger][AmazonSqs] Do not override queue-level DelaySeconds when no DelayStamp is set (psantus)
 * bug #64122 [Cache] Ensure compatibility with Relay extension 0.22.0 (nicolas-grekas)
 * bug #64119 [Yaml] fix flow collection drops `&anchor` and `!!str &anchor` items (ousamabenyounes)
 * bug #64016 [Mailer][AzureMailer] Fix inline attachments (kohlerdominik)
 * bug #64086 [Messenger] Move `--time-limit` handling to Worker for proper capping with `--sleep` (Toflar)
 * bug #64103 [AssetMapper] Stop baking CSP nonce into the importmap polyfill body (ousamabenyounes)
 * bug #64106 [Config] Normalize `backed-enum` in array shapes (MatTheCat)
 * bug #64100 [Translation] URL-encode tmp path in XliffUtils::shouldEnableEntityLoader (ousamabenyounes)
 * bug #64095 [RateLimiter] Carry over reserved tokens past fixed window resets (ousamabenyounes)
 * bug #64111 [Serializer] Fix low deps (nicolas-grekas)
 * bug #64099 [Ldap] Cast `default_socket_timeout` to `int` (ousamabenyounes)

* 7.4.9 (2026-05-01)

 * bug #64090 [DependencyInjection] Reject circular references through a factory builder's setup (nicolas-grekas)
 * bug #64088 [Uid] Fix compat with ext-ds v2 (nicolas-grekas)
 * bug #64083 [Messenger] Alias the AMQP "user" connection option to "login" (lacatoire)
 * bug #64084 [Messenger] Do not sleep after worker is stopped during idle cycle (Toflar)
 * bug #63653  Fix default boolean values `SweegoTransportFactory` (qdequippe)
 * bug #64043 [Form] Preserve collection children added by PRE_SET_DATA listeners (dargor980)
 * bug #64042 [Config] Fix array-shape generator dropping alternative types on nested PrototypedArrayNode (Amoifr)
 * bug #64025 [DoctrineBridge] Catch any driver exception in the same-database check (lacatoire)
 * bug #64023 [FrameworkBundle] Fix mailer package check for bridges whose composer name does not match the service id (lacatoire)
 * bug #63992 [Messenger] Keep deduplication lock when handler throws (ousamabenyounes)
 * bug #63993 [Mailer][Postmark] Handle alternate error payload shapes for Payload Too Large (ousamabenyounes)
 * bug #64067 [Serializer] Move type-mismatch and uninitialized-property handling into concrete normalizers (ousamabenyounes)
 * bug #64065 [Notifier][Ntfy] Fix Basic auth header by keeping base64 padding (ousamabenyounes)
 * bug #64045 [Config] Allow env placeholders in NumericNode min/max checks (ousamabenyounes)
 * bug #64047 [Mime] Preserve inline part filename instead of overwriting it with the Content-ID (ousamabenyounes)
 * bug #64044 [FrameworkBundle] Apply tagged MIME type guessers in File::getMimeType() (ousamabenyounes)
 * bug #64030 [MonologBridge] Guard against re-entrant calls in AbstractTokenProcessor (ousamabenyounes)
 * bug #64060 [Cache] Normalize default_lifetime for pools wrapped by ChainAdapter (ostrolucky)
 * bug #63996 [RateLimiter] Keep token bucket alive while reservation debt is unpaid (ousamabenyounes)
 * bug #63975 [Lock] Avoid aborting outer PostgreSQL transaction on lock contention (lacatoire)
 * bug #64046 [HttpClient] Don't share CURL_LOCK_DATA_CONNECT to honor max_host_connections (ousamabenyounes)
 * bug #64036 [Validator] fix mapping properties using property hooks (mrossard)
 * bug #64024 [AssetMapper] Allow spaces in version constraints (MatTheCat)
 * bug #64020 [Dotenv] Strip NUL byte placeholder from values passed to `putenv()` (alexandre-daubois)
 * bug #63991 [FrameworkBundle] Strip --no-fill marker from every translation domain (ousamabenyounes)
 * bug #63982 [Messenger] Respect SentToFailureTransportStamp when failure transports are configured (ousamabenyounes)
 * bug #63990 [Messenger] Do not apply --max to --stats unless explicitly set (ousamabenyounes)
 * bug #63979 [Serializer] Capture constructor TypeError when collecting denormalization errors (lacatoire)
 * bug #64006 [DependencyInjection] Fix hidden dependency on symfony/config in PhpDumper (GromNaN)
 * bug #63983 [Security] Throw BadCredentialsException on empty JSON login username/password (ousamabenyounes)
 * bug #63981 [Routing] Honor the Request's method in UrlMatcher::matchRequest() (ousamabenyounes)
 * bug #63980 [DependencyInjection] Log every build parameter removed during compilation (ousamabenyounes)
 * bug #63974 [Serializer] Make `BackedEnumNormalizer` unconditionally return `null` on invalid value if `allow_invalid_values` is set (MatTheCat)
 * bug #63964 [Cache] Ensure internal state is cleared in TagAwareAdapter::reset() … (KevinMartinsDev)
 * bug #63955 [Dotenv] Fix variable corruption when loading env more than once (nicolas-grekas)
 * bug #63959 [VarExporter] Don't warn for __sleep()-listed uninitialized declared properties (nicolas-grekas)
 * bug #63918 [TypeInfo] Fix collectUses() to support grouped use imports (Amoifr)
 * bug #63952 [Scheduler] Respect `console.command` DI tag `command` attribute (nicolas-grekas)
 * bug #63951 [DependencyInjection] Fix autowiring nullable intersection types (HypeMC)
 * bug #63948 [Scheduler] Support command aliases (ambroisemaupate)
 * bug #63923 [CssSelector] Fix :is() and :where() combining conditions with parent selector (lacatoire)
 * bug #63938 [Workflow] Fix HTML escaping in `GraphvizDumper` labels (alexandre-daubois)
 * bug #63930 [WebProfilerBundle] Fix toolbar toggle button accessibility (Nitram1123)
 * bug #63889 [ObjectMapper] Auto-inject ObjectMapper into ObjectMapperAwareInterface transforms (Amoifr)
 * bug #63915 [Mailer] Fix handling of webhook.test verification event from MailerSend webhook (mwansinck)
 * bug #63909 [Filesystem] Fix Path methods replacing backslashes on UNIX (Amoifr)
 * bug #63922 [DependencyInjection] Fix excludeSelf not applied when using AutowireLocator (GromNaN)
 * bug #63894 [Dotenv] Fix self-referencing variable resolution with suffix/prefix (Amoifr)
 * bug #63883 [Serializer] Fix getAllowedAttributes() when groups contain wildcard '*' (takashiraki)
 * bug #63876 [DependencyInjection] Fix instanceof autoconfiguration for anonymous classes (jlabedo)
 * bug #63860 [Cache] Fix Psr16Cache::getMultiple() returning wrapper values when using TTL (nicolas-grekas)
 * bug #63859 [Console] Fix shell completion when SHELL_VERBOSITY=-1 (nicolas-grekas)
 * bug #63847 [EventDispatcher] Fix TraceableEventDispatcher when reset during dispatch (aschempp)
 * data #63849  Remove needs-review flag for Afrikaans (af) (payene)

* 7.4.8 (2026-03-31)

 * bug #63812 [DependencyInjection] Fix tagged_iterator/tagged_locator in array PHP config (javiereguiluz)
 * bug #63823 [DependencyInjection] Fix rejecting inline services in parameters section (nicolas-grekas)
 * bug #63817 [Serializer] Fix denormalization of nested array with key types (mtarld)
 * bug #63782 [Serializer] Fix mixed-typed constructor parameters overriding getter-inferred type (pcescon)
 * bug #63818 [Cache] Ensure compatibility with Relay extension 0.21.0 (lyrixx)
 * bug #63806 [Ldap] Make the Adapter resettable (kira0269, nicolas-grekas)
 * bug #63720 [MonologBridge] Fix `ConsoleHandler` losing output after nested command terminates (mp3000mp)
 * bug #63723 [EventDispatcher] Fix memory leak in TraceableEventDispatcher for long-running processes (wazum)
 * bug #63749 [Console] Fix performance regression in OutputFormatter for ASCII content (pcescon)
 * bug #63683 [TwigBridge] Fix image method to use DataPart content ID (pavelwitassek)
 * bug #63787 [Serializer] Fix can*() prefix support in GetSetMethodNormalizer (sn3mdev)
 * bug #63747 [Cache] Fix `Psr16Cache::getMultiple()` returning `ValueWrapper` with `TagAwareAdapter` (pcescon)
 * bug #63766 [Dotenv] Fix preloading warning by replacing anonymous exception class (pcescon)
 * bug #63777 [FrameworkBundle] Fix setting `router.request_context.base_url` when option `default_uri` is defined (nicolas-grekas)
 * bug #63692 [HttpClient][EventSourceHttpClient] Fix broken streams when first event is delayed (LachlanArthur)
 * bug #63726 [HttpClient] Unset push response content when the push handler is released (sakozoko)
 * bug #63736 [Cache] Fix undefined array key when tag save fails in AbstractTagAwareAdapter (pcescon)
 * bug #63724 [HttpKernel] Fix allowing invalid `#[Autowire]` references in controller arguments (valtzu)
 * bug #63722 [SecurityBundle] Fix profiler showing ERROR instead of DENIED  (audain-dg)
 * bug #63691 [Messenger] Use SignalRegistry::isSupported() in ConsumeMessagesCommand (shyim)
 * bug #63648 [VarDumper] Wrong dumper output for Accept: aplication/json requests (rfcdt)
 * bug #63674 [Dotenv] Fix self-referencing variables with defaults and env key resolution during deferred expansion (nicolas-grekas)
 * bug #63676 [HttpKernel] Reset router locale to default when finishing main request (guillaumeVDP)
 * bug #63679 [WebProfilerBundle] Only decrement pendingRequests when it's more than zero (andyexeter)
 * bug #63655 [Cache] Fix ChainAdapter ignoring item expiry when propagating to earlier adapters (guillaumeVDP)
 * bug #63656 [Form] Fix typed property initialization in ValidatorExtension (SeverinGloeckle)
 * bug #63643 [Messenger] Fix duplicate pending messages in Redis transport with batch handlers (wazum)
 * bug #63639 [ErrorHandler] "`@method`" deprecation notices are missing when interface inheritance is used (mpdude)
 * bug #63627 [Serializer] Fix `self` type reference on promoted constructor parameter (andersonamuller, nicolas-grekas)
 * bug #63635 [VarExporter] Skip rewriting initialized readonly properties during hydration (nicolas-grekas)
 * bug #63629  Fix deprecation notices for "`@method`" annotations and classes with `__call()` (mpdude)
 * bug #63624 [JsonStreamer] Fix lazy instantiation for internal PHP classes (Maxcastel)
 * bug #63620 [Dotenv] Fix escaped dollar signs lost during deferred variable resolution (nicolas-grekas)
 * bug #63611 [Process] Throw InvalidArgumentException when env block exceeds Windows limit (Nadim AL ABDOU)
 * bug #63616 [HttpKernel] Set propertyPath on MapUploadedFile validation violations (eyupcanakman)

* 7.4.7 (2026-03-06)

 * bug #63604 [Console] Fix `ApplicationTester` ignoring `interactive` and `verbosity` options when `SHELL_VERBOSITY` is set (nicolas-grekas)
 * bug #63602 [Serializer] Fix denormalization of magic `__set` properties (nicolas-grekas)
 * bug #63603 [HttpFoundation] Fix session cookie_lifetime not applied in mock session storage (nicolas-grekas)
 * bug #63598 [UrlSanitizer] Add 'sms' to hostless schemes (hivokas)
 * bug #63599 [Validator] Fix required options check when extending a constraint with a simplified constructor (nicolas-grekas)
 * bug #63592 [Cache] Add timeout and slot eviction to LockRegistry stampede prevention (nicolas-grekas)
 * bug #63591 [Validator] Fix when constraint without expression language installed, when using closure expression (annadamm-check24)
 * bug #63589 [Form] Fix session data contamination by non-serializable objects in form flow (nicolas-grekas)
 * bug #63570 [Console] Fix OUTPUT_RAW corrupting binary content on Windows (guillaumeVDP)
 * bug #63584 [Mime] Use shell_exec() instead of passthru() in FileBinaryMimeTypeGuesser (nicolas-grekas)
 * bug #63583 [DoctrineBridge] Rename `_schema_subscriber_check` table to `schema_subscriber_check_` for Oracle compatibility (moneire)
 * bug #63573 [HttpClient] Fix CachingHttpClient compatibility with decorator clients on 304 responses (nicolas-grekas)
 * bug #63574 [FrameworkBundle] Fix stale container after reboot in KernelTestCase (nicolas-grekas)
 * bug #63572 [Form] Fix duplicate validation errors when ValidatorExtension is instantiated multiple times (nicolas-grekas)
 * bug #63568 [TwigBridge] Fix Bootstrap 4 horizontal layout broken by form errors moved outside label (nicolas-grekas)
 * bug #63555 [HttpKernel] Fix int-to-float coercion for JSON #[MapRequestPayload] with pre-parsed array data (eyupcanakman)
 * bug #63559 [Messenger] Flush batch handlers after inactivity timeout when worker is busy (nicolas-grekas)
 * bug #63563 [TypeInfo] Fix StringTypeResolver calling Type::enum() on interfaces extending BackedEnum (gnutix)
 * bug #63547 [Serializer] Fix nullable array constructor parameter overriding collection value type (nicolas-grekas)
 * bug #63523 [Mailer][Mailjet] Fix inline attachments with custom Content-ID (99Vicky)
 * bug #63550 [RateLimiter] Prevent negative token from causing integer underflow (jhogervorst)
 * bug #63542 [TypeInfo] Fix resolving class const type (gharlan)
 * bug #63510 [PropertyInfo][ReflectionExtractor] fix is/can/has type resolver on method without property (Guilain)
 * bug #63522 [Notifier] Fix `SweegoTransport` by allowing bool values (qdequippe)
 * bug #63526 [WebProfilerBundle] Fix Symfony web debug toolbar not being displayed (zoglo)
 * bug #63500 [PhpUnitBridge] Consider PSR-0/PSR-4 fallback dirs when building paths (mpdude)
 * bug #63508 [DependencyInjection] Handle `Stringable` for string-typed arguments in `CheckTypeDeclarationsPass` (yoeunes)
 * bug #63509 [JsonStreamer] Fix missing generator for shared types in self-referencing objects (mtarld)
 * bug #63533 [DebugBundle] gracefully handle the kernel.runtime_mode.web parameter missing (xabbuh)
 * bug #63534 [Validator] Regex bypass when match is false with too big input (vincent4vx)
 * bug #63496 [Dotenv] Defer variable and command expansion to account for overrides from subsequent .env files (nicolas-grekas)
 * bug #63506 [DependencyInjection] Fix `TypeError` when using a custom container base class with typed `$parameterBag` (nicolas-grekas)

* 7.4.6 (2026-02-26)

 * bug #63492 [RateLimiter] Fix retryAfter when consuming exactly all remaining tokens in FixedWindow and TokenBucket (ERuban)
 * bug #63491 [RateLimiter] Fix `retryAfter` when consuming exactly all remaining tokens in `SlidingWindow` (ERuban)
 * bug #52413 [RateLimiter] Fix reservations outside the second fixed window (SanderSander)
 * bug #57392 [Serializer][Validator] Fix propertyPath in ConstraintViolationListNormalizer with MetadataAwareNameConverter (antten)
 * bug #54236 [Config][Routing] Fix exclude option being ignored for non-glob and PSR-4 resources (NeilPeyssard)
 * bug #47424 [Filesystem] makePathRelative with existing files, remove ending / (Petar Marjanovic)
 * bug #52083 [Messenger][Amqp] Don't use retry routing key when sending to failure transport (Fabien Perroquin)
 * bug #63275 [Messenger] Fix re-sending failed messages to a different failure transport (bartholdbos)
 * bug #63478 [Config] Fix ArrayShapeGenerator required keys with deep merging (lacatoire)
 * bug #63476 [Validator] Correctly handle null `allowedVariables` in `ExpressionSyntaxValidator` (alexandre-daubois)
 * bug #63473 [DependencyInjection] Fix PriorityTaggedServiceTrait not discovering `#[AsTaggedItem]` on decorated services (lacatoire)
 * bug #63446 [ObjectMapper] fix nested mapping with class-level transform (Thibaut Cholley)
 * bug #63472 [TwigBridge] Fix Bootstrap 4 form errors rendered inside `<label>` (asispts)
 * bug #54324 [Form] Fix merging POST params and files when collection entries have mismatched indices (priyadi)
 * bug #52722 [Validator] Fix type error for non-array items when `Unique::fields` is set (aprat84)
 * bug #54703 [HttpKernel] Fix default locale ignored when Accept-Language has no enabled-locale match (karimmorel)
 * bug #62681 [FrameworkBundle] Make `ConfigDebugCommand` use its container to resolve env vars (MatTheCat)
 * bug #47432 [Console] Fix various completion edge cases (Seldaek)
 * bug #60662 [Routing] assign attribute aliases to localized route if applicable (alcohol)
 * bug #63463 [Validator] Fix required options not validated when constructor calls parent with null (lacatoire)
 * bug #63468 [Mailer][Mailchimp] Fix webhook rejection by switching to form-encoded request parsing (nicolas-grekas)
 * bug #63450 [Form] Fix missing resource tracking for type extensions in FormPass (ranpafin)
 * bug #63435 [Mailer] Fix handling postal transport apikey (MarcHagen)
 * bug #63462 [FrameworkBundle] Fix phpstan false-positive about config/reference.php (nicolas-grekas)
 * bug #63454 [Security] Fix lazy firewall triggering remember me authentication on POST requests to public routes (nicolas-grekas)
 * bug #63460 [Workflow] Implement missing `reset()` method in `TraceableWorkflow` (santysisi)
 * bug #63456 [Console] Fix validator exception masked by MissingInputException on empty input (nicolas-grekas)
 * bug #63444 [Console] Fix arguments set via `#[Ask]` wrongly considered null in profiler (chalasr)
 * bug #63439 [SecurityBundle] Update security-1.0.xsd with missing oauth2 element (welcoMattic)
 * bug #63428 [Serializer] Fix handling of constructor enum denormalization errors (vvaswani)
 * bug #63438 [Console] ProgressIndicator console helper display with multiple processes (guillaumeVDP)
 * bug #63436 [Console] Silence shell_exec warning in hasSttyAvailable (lacatoire)
 * bug #63448 [HttpFoundation] Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (nicolas-grekas)
 * bug #63437 [Cache] Wrap `DoctrineDbalAdapter::doSave()` in savepoint to prevent transaction poisoning (lacatoire)
 * bug #63416 [TypeInfo] TypeContextFactory::collectTemplates now also works with `@phpstan`-template and `@psalm`-template (TomasLudvik)
 * bug #63415 [Console] Fix profiling commands that use `#[Ask]` (chalasr)
 * bug #63401 [Serializer] Fix constructor parameter type override when property type extractor returns a different type (nicolas-grekas)
 * bug #63405 [Serializer] Fix passing context option to property-info (nicolas-grekas)
 * bug #63400 [CssSelector] Fix memory exhaustion by adding an LRU cache to CssSelectorConverter (arcangelini)
 * bug #63391 [Cache][Messenger] Align Redis sentinel auth handling across components (nicolas-grekas)
 * bug #62738 [TypeInfo] Fix template key-type for array (DjordyKoert)
 * bug #63386 [HttpKernel] Handle invalid backed-enum values gracefully in RequestPayloadValueResolver (nicolas-grekas)
 * bug #63384 [FrameworkBundle] fail gracefully when the semaphore config is used but the component is missing (xabbuh)
 * bug #63380 [Messenger] Use mutable datetime columns in Doctrine transport schema (nicolas-grekas)
 * bug #63379 [DependencyInjection] Prevent false unused-env errors for abstract definitions removed at compile time (nicolas-grekas)
 * bug #63375 [PropertyInfo] prioritize property type over is/has/can accessors (xabbuh)
 * bug #63372 [Dotenv] Use `SYMFONY_DOTENV_PATH` variable when dumping dotenv (Spea)
 * bug #63344 [PropertyInfo] Prioritize property type over is/has/can accessors (nicolas-grekas)
 * bug #63368 [Console] Fix ProgressBar `remaining` and `estimated` placeholder guards (yoeunes)
 * bug #63363 [HttpKernel] Fix variadic argument handling with #[MapUploadedFile] (nicolas-grekas)
 * bug #63353 [Validator] Fix comparison validator crash on extreme dates (lacatoire)
 * bug #63354 [Mailer] Fix invalid encoding of custom headers in SES API (lacatoire)
 * bug #63349 [Validator] Fix AbstractComparison deprecation triggered for array values (lacatoire)
 * bug #63351 [Console] Fix SymfonyStyle block output with \r\n line endings (lacatoire)
 * bug #63342 [PropertyInfo] fix union with mixed handling for the legacy PropertyInfo Type (xabbuh)
 * bug #59540 [PropertyInfo] Fix support for inline ``@var`` docblocks on promoted properties (wuchen90)
 * bug #63247 [ObjectMapper] Skip source mapping attempts when target class condition evaluates to false (rrajkomar)
 * bug #63333 [FrameworkBundle] Fix JsonStreamer forward compatibility (mtarld)
 * bug #63264 [Mailer][MicrosoftGraph] Also bypass Sender header within MicrosoftGraphApiTransport (deeky666)
 * bug #63330 [TypeInfo] Fix nested union null type detection in `TypeFactoryTrait::union()` (yoeunes)
 * bug #63319 [HttpFoundation] BinaryFileResponse: always return 206 if Range is valid (Jimbolino)
 * bug #63329 [TypeInfo] Fix `ArrayShapeType::getExtraValueType()` return value (yoeunes)
 * bug #63309 [Workflow] Fix swapped workflow/transition names in `WorkflowValidator` (yoeunes)
 * bug #63315 [WebProfilerBundle] Fix EventSource is missing static properties (Oleksii Kozhemiaka)
 * bug #63307 [DependencyInjection] Fix stale binding lookup in `ResolveBindingsPass` error message (yoeunes)
 * bug #63317 [Asset] Fix JsonManifestVersionStrategy exception on missing manifest in non-strict mode (claude)
 * bug #63324 [Cache] Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (ckrack)
 * bug #63324 [Cache] Fix DSN auth not passed to Redis/RedisCluster/Relay in RedisTrait (ckrack)
 * bug #57292 [Yaml] Fix parsing nested mappings in sequences (HypeMC)
 * bug #63294 [JsonStreamer] Fix DateTime handling in union types (mtarld)
 * bug #63305 [FrameworkBundle] Fix autoconfiguring controllers using legacy Route annotations as attributes (nicolas-grekas)
 * bug #63306 [Cache] Revert "Fix DSN auth not passed to clusters in RedisTrait" (nicolas-grekas)
 * bug #63272 [Messenger][Cache] Fix forwarding SSL settings to the redis sentinel (CientistaDaWeb)
 * bug #63288 [Messenger] Optimize serialized size of ErrorDetailsStamp (nicolas-grekas)
 * bug #63292 [Messenger] Fix AMQP heartbeat reconnection during in-flight message handling (wazum)
 * bug #63291 [JsonStreamer] Fix composite node provider arguments in stream mode (mtarld)
 * bug #63289 [PropertyInfo] Fix union with `mixed` handling (mtarld)
 * bug #63278 [Mailer] Fix Mailjet SMTP relay X-MJ-TemplateErrorReporting header format to MailjetApiTransport (mwijngaard)
 * bug #63282 [Messenger] Revert batch processing fix (HypeMC)
 * bug #63259 [FrameworkBundle] Fix BrowserKitAssertionsTrait compatibility with HttpBrowser (thiagomp)
 * bug #63281 [String] Treat emoji VS16 as wide in width calc (fabpot)
 * bug #63279 [Serializer] Normalize static methods when they have groups (digilist)
 * bug #62970 [WebProfilerBundle] Fix hot reload support (FrankenPHP) (dunglas)
 * bug #63271 [DoctrineBridge] Respect `schema_filter` in schema listeners (wazum)
 * bug #63235 [PropertyInfo] phpdocumentor/reflection-docblock 6 compatibility (mtarld)
 * bug #63262 [HttpFoundation] Reject invalid paths (nicolas-grekas)
 * bug #58460  Fix destructor throwing while timeout was handled (Seldaek, nicolas-grekas)
 * bug #63260 [HttpKernel] Fix handling empty MapUploadedFile arrays (nicolas-grekas)
 * bug #63255 [FrameworkBundle] Add missing `useAttributeAsKey` calls (MatTheCat)
 * bug #57561 [DependencyInjection] Fix ignore invalid_reference behavior param for the some services (Nguyen26052004)
 * bug #54304 [HttpFoundation] When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (ArmCyber)
 * bug #63101 [HttpKernel] Bypass mapping construction when `RedirectController::urlRedirectAction` is triggered (florianorineveu)
 * bug #63238 [Console] Fall back to 0 when getCode() does not provide an integer (makomweb)
 * bug #63239 [FrameworkBundle] Fix accessing the test container when using KernelTestCase in non-debug mode (nicolas-grekas)
 * bug #58433 [Messenger] Avoid skipping batch handlers on flush (Erwin Houtsma)
 * bug #63236 [FrameworkBundle] Fix clearing the HttpCache store in tests (nicolas-grekas)
 * bug #63234 [DependencyInjection][HttpKernel] Fix parsing Target attributes on properties and on controllers (nicolas-grekas)
 * bug #63231 [Translation] Fix for Crowdin Translation File Replaced with Partial Data When Pushing Default Locale Without --force (bhdnb)
 * bug #63226 [Messenger] Fix calling nack() when ack() fails (nicolas-grekas)
 * bug #63230 [Cache][HttpFoundation][Lock] fix engine declaration on mysql pdo table creations (tandev)
 * bug #63225 [Finder] Fix SortableIterator inadvertently and inconsistently deduplicating appended iterators (nicolas-grekas)

* 7.4.5 (2026-01-28)

 * bug #63213 [DependencyInjection] Fix lazy proxy type resolution for decorated services (nicolas-grekas)
 * bug #63212 [HttpClient] Fix dealing with truncated streams after headers arrived with CurlHttpClient (nicolas-grekas)
 * bug #63208 [PropertyInfo] Fix DocBlock resolution for inherited promoted properties (yoeunes)
 * bug #63170 [RateLimiter] Persist state when consuming negative tokens (jhogervorst)
 * bug #63137 [HttpFoundation] Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (samy-mahmoudi)
 * bug #63211 [HttpClient] Fix dealing with multiple levels of AsyncResponse decoration (nicolas-grekas)
 * bug #63202 [Messenger] Only send `UNLISTEN` query if we are actively listening (jwage)
 * security #cve-2026-24739 [Process] Fix escaping for MSYS on Windows (nicolas-grekas)
 * bug #63206 [PropertyInfo] Conflict with phpdocumentor/reflection-docblock >= 6 (all branches) (nicolas-grekas)
 * bug #63204 [PropertyInfo] Fix resolution of self/parent types in inherited DocBlocks (yoeunes)
 * bug #63141 [ObjectMapper] apply conditions to constructor arguments (soyuka)
 * bug #63195 [FrameworkBundle] Clean `http_cache` dir in `KernelTestCase::ensureKernelShutdown()` (nicolas-grekas)
 * bug #63164 [Process] Fix escaping for MSYS on Windows (nicolas-grekas)
 * bug #63192 [Finder] Fix appending empty iterators (nicolas-grekas)
 * bug #63193 [PropertyInfo] Conflict with phpdocumentor/reflection-docblock >= 6 (branch 6.4 only) (nicolas-grekas)
 * bug #63191  [Serializer] Apply `#[Ignore]` to the right metadata (VincentLanglet)

* 7.4.4 (2026-01-24)

 * bug #63160 [DependencyInjection] Fix alias chain inversion when deprecated alias points to decorated service (amateescu)
 * bug #63159 [JsonStreamer] Fix exponential resource class memory growth (mtarld)
 * bug #62852 [Cache] Fix DSN auth not passed to clusters in RedisTrait (wikando-ck)
 * bug #62959 [PropertyInfo] do not parse `scalar` as an object (xabbuh)
 * bug #63136 [Serializer] Fix is/has/can accessor naming to strip prefix unless colliding (nicolas-grekas)
 * bug #63144 [Form] Fix `OrderedHashMap` auto-increment logic with mixed keys (yoeunes)
 * bug #63154 [Form] don't skip custom view transformers while normalizing submitted newlines (xabbuh)
 * bug #63155 [HttpClient] Skip HTTP/3 when using a proxy (nicolas-grekas)
 * bug #63084 [PropertyInfo] fix exception with nullable value-of phpdoc (Максим Колокольников, maxmirazh33)
 * bug #63051 [DoctrineBridge] Fix custom type based on Uid on entity loader (IndraGunawan)
 * bug #63108 [ErrorHandler] fix parsing of complexe type (jderusse)
 * bug #63126 [PropertyInfo] Throw when phpdocumentor/reflection-docblock v6 is in use (branch 6.4 only) (nicolas-grekas)
 * bug #63113 [Form] Fix ICU 72+ whitespace handling in `DateTimeToLocalizedStringTransformer` (roukmoute)
 * bug #63052 [Serializer] Fix NameConverter not detecting wrong input format with `allow_extra_attributes=false` (xersion22)
 * bug #63064 [Translation] Fix handling of empty lines in CsvFileLoader (fnogatz)
 * bug #63056 [String] Fix UnicodeString::startsWith()/endsWith() on strings that start/end with a zero (nicolas-grekas)
 * bug #63043 [FrameworkBundle] Check for console package before register `CommandDataCollector` (gimler)
 * bug #63016 [FrameworkBundle] Ensure a fresh container is used after cache warmup in `KernelTestCase` (lyrixx)
 * bug #63053 [Config] add back missing enabled key in normalization step (xabbuh)
 * bug #62762 [Finder] Fix `Finder::append()` breaking generic typing contract (jack-worman)
 * bug #62973 [WebProfiler] fix the security profiler template (aurac)
 * bug #63002 [Config] Fix merging node that canBeDisable()/canBeEnabled() (nicolas-grekas)
 * bug #63027 [ObjectMapper] error when multiple targets and no condition (soyuka)
 * bug #63000 [JsonStreamer] Fix memory leak by caching stream readers/writers (mtarld)
 * bug #62997 [TypeInfo] Fix type resolution when called class is in other namespace (mtarld)
 * bug #62985 [FrameworkBundle] Skip extensions with empty configuration in `reference.php` (bendavies)
 * bug #62984 [Mailer][MicrosoftGraph] Also bypass `Return-Path` header within `MicrosoftGraphApiTransport` (zoglo)
 * bug #62862 [ObjectMapper] Fix mapping for missing source properties (Ali-HENDA)
 * bug #63003 [FrameworkBundle] Don't list ExpressionConfigurator if expression-language is not installed on reference config shape (nicolas-grekas)
 * bug #63004 [Process] Ignore invalid env var names (nicolas-grekas)
 * bug #63005 [FrameworkBundle] Revert destination file change for secrets:decrypt-to-local (nicolas-grekas)
 * bug #63012 [HttpFoundation] Fix double-prefixing of session keys when using redis/memcached (nicolas-grekas)
 * bug #63001 [Scheduler] Fix array to string conversion in `#[AsCronTask]` arguments (serhiilabs)
 * bug #62953 [Serializer] Fix removing nested values (gnoddep)
 * bug #62988 [Messenger] Fix DBALv4 support by replacing trigger by explicit pg_notify() (nicolas-grekas)
 * bug #62795 [FrameworkBundle] Fix mocking decorated services in tests (nicolas-grekas)
 * bug #62779 [Messenger] Fix `DeduplicateStamp` serialization (VincentLanglet)
 * bug #62838 [Serializer] Fix serialization of method with same name than property (VincentLanglet)
 * bug #62872 [Messenger] Fix processing batches (HypeMC)
 * bug #62848 [HttpKernel] Fix using HTTP Cache in worker mode (nicolas-grekas, stakovicz)
 * bug #62954 [HttpClient] Fix existing headers must be replaced in CachingHttpClient (Toflar)
 * bug #62920 [Config] Allow `ParamConfigurator` in `ParametersConfig` (jack-worman)
 * feature #62892 [BrowserKit] Allow wrapping response content to give proper context when fetching fragments (Jean-Beru)
 * bug #62884 [Form][TwigBridge] Prevent cached block prefixes from leaking across nested collections (nicolas-grekas)
 * bug #62886 [PropertyAccess][PropertyInfo][Serializer] Skip methods that look like getters but return void or never (jordikroon)
 * bug #62898 [HttpClient] update chunk items' expiration on revalidation (Lctrs)

* 7.4.3 (2025-12-31)

 * bug #62877 [Translation] Add ResetInterface and reset method to DataCollectorTranslator (tourze, adming-zz, nicolas-grekas)
 * bug #62873 [Cache] Fix namespace of chained pools when using another chain as template (nicolas-grekas)
 * bug #62858 [WebProfilerBundle] Fix using URL objects with `EventSource` (HypeMC)
 * bug #62818 [Config][FrameworkBundle] Allow using ParamConfigurator with every configurable value (jack-worman)
 * bug #62840 [Cache] Fix stampede protection when forcing item recomputation (nicolas-grekas)
 * bug #62845 [HttpClient] Fix ever growing `$maxHostConnections` (nicolas-grekas)
 * bug #62843 [DependencyInjection] Fix referencing build-time array parameters (nicolas-grekas)
 * bug #62841 [Form] Always normalize CRLF and CR to LF in `TextareaType` (alexandre-daubois)
 * bug #62490 [FrameworkBundle] Fix cache:pool:prune exit code on failure (yoeunes)
 * bug #62837 [DoctrineBridge] Fix checking for the session table when using PDO (nicolas-grekas)
 * bug #62807 [Messenger] Incorrect filtering of signed messages based on routing (Orkin)
 * bug #62813 [Console] Fix EofShortcut instruction when using a modern terminal on Windows (fperxas)
 * bug #62827 [Console] Fix choice autocomplete issue when string has spaces (ayyoub-afwallah)
 * bug #62826 [Security] Fix persisting valid origin for both safe and non-safe requests (llegaz)
 * bug #62797 [Serializer] Fix inconsistent field naming from accessors when using groups (nicolas-grekas)
 * bug #62741 [Finder] Fix converting unanchored glob patterns to regex (nicolas-grekas)
 * bug #62759 [Form] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62796 [Security] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62808 [Translation] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62775 [Process] Fix dealing with broken stdin pipes (nicolas-grekas)
 * bug #62791 [Routing] Fix simple parameter mappings in routes (nicolas-grekas)
 * bug #62793 [Cache] Fix calling the callback wrapper for `ChainAdapter` (nicolas-grekas)
 * bug #62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (nicolas-grekas)
 * bug #62803 [AssetMapper] Batch concurrent requests to prevent flooding jsdelivr (nicolas-grekas)
 * bug #62810 [TwigBundle] Align TemplateIterator handling of @! original bundle templates with TwigExtension (mbessolov)
 * bug #62812 [Messenger][AMQP] Fix negative delays with AMQP messenger transport (hockdudu)
 * bug #62805 [VarDumper] Fix dumper selection for Accept: */* requests (apoca)
 * bug #62794 [JsonPath] fix calling non-static method statically (keradus)
 * bug #62772 [PropertyInfo] Fix calling same-named method with required args instead of reading public property (makraz)
 * bug #62773 [Serializer] Do not skip nested `null` values when denormalizing (MatTheCat)
 * bug #62745 [Validator] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62755 [DependencyInjection] Fix `#[AutowireCallable]` sometimes incorrectly inlined (HypeMC)
 * bug #61963 [Doctrine][Messenger] Remove old MySQL special handling that causes deadlocks (psihius)
 * bug #62744 [TwigBridge] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62756 [Mailer] do not use PHPUnit mock objects without configured expectations (xabbuh)
 * bug #62740 [Serializer] Fix php 8.5 warning unexpected NAN value was coerced to … (aaa2000)
 * bug #62747 [Routing] Do not renumber query parameters with numeric key (tillhoerner)
 * bug #62758 [BrowserKit] Allow Cookie expiration to be an int (derrabus)
 * bug #62764 [Console] Escape `` in description of console commands (SiebeVE)
 * bug #62735 [JsonStreamer] Fix the generated PHP code when using array shape (sukei)
 * bug #62719 [Workflow] Fix empty string condition for place name (mboelsterli)
 * bug #62728 [HttpClient] mark response stale when age equals freshness lifetime (Lctrs)
 * bug #62396 [PropertyInfo] Fix inconsistency between isWritable and getWriteInfo (yoeunes)
 * bug #62699 [HttpClient] Fix `ScopingHttpClient` to always pass `base_uri` as `string` instead of parsed `array` (santysisi)
 * bug #62716 [Validator] fix handling named arguments in `Existence` constraint (xabbuh)
 * bug #62717 [PropertyInfo] fix ``@var`` tag support for `PhpStanExtractor` (qconer)
 * bug #62711 [PhpUnitBridge] Fix TestCase patching (villfa)
 * bug #62706 [HttpClient] Fix PHP deprecation when using `AmpHttpClient` (nicolas-grekas)
 * bug #62698 [HttpClient] Fix copy as curl for arrays with resources & unreachable host (HypeMC)
 * bug #62695 [TwigBridge] do not render button labels if they are explicitly disabled (xabbuh)
 * bug #62692 [FrameworkBundle] Enable console profiling only if the console is actually available (dbu)
 * bug #62691 [JsonPath] Update and fix the compliance test suite (alexandre-daubois)
 * bug #62686 [PropertyInfo] Fix PseudoType support in PhpDocTypeHelper (VincentLanglet)
 * bug #62710 [TwigBundle] Fix unintended BC break for the `exception_controller` twig setting (stof)
 * bug #62715 [DependencyInjection] Fix sharing services used only by tagged iterators (nicolas-grekas)
 * bug #62714 [DependencyInjection] Handle recursive factory reentry for shared services in `PhpDumper` (nicolas-grekas)

* 7.4.2 (2025-12-08)

 * bug #62682 [Serializer][Validator] Attribute metadata no longer requires `container.excluded` tags (HypeMC)
 * bug #62685 [DependencyInjection] Fix `PriorityTaggedServiceTrait` when tag attributes are not a list (GromNaN)

* 7.4.1 (2025-12-07)

 * bug #62663 [HttpFoundation] Improve logic in Request::createFromGlobals() (nicolas-grekas)
 * bug #62675 [DependencyInjection] Fix dealing with errored service definitions (nicolas-grekas)
 * bug #62671 [DomCrawler] Fixing dealing with invalid charset (ThomasLandauer)
 * bug #62488 [HttpKernel] Make `#[Cache]` respect all explicit cache directives set in controller (ayyoub-afwallah)
 * bug #62665 [DependencyInjection] Revert "bug #62541  Reset resolved state when setting a parameter" (nicolas-grekas)
 * bug #62388 [TypeInfo] Simple array should be array type (matijn-made)
 * bug #61962  [Console] Handle signals on text input (valx76)
 * bug #62661 [Runtime] Reuse the already created Request object when the app needs one as argument and returns a kernel (nicolas-grekas)
 * bug #62477 [DependencyInjection] Allow manual bindings on parameters with #[Target] (yoeunes)
 * bug #62495 [Security][Http] Fix OIDC discovery when multiple HttpClient instances are used (Ali-HENDA)
 * bug #62563 [Config] Fix array shape generation for backed enums (OskarStark)
 * bug #62621 [Form] Fix moneytype step (Belhassen)
 * bug #62622 [JsonStreamer] fix invalid json output for list of self (DjordyKoert)
 * bug #62627 [Console] Preserve `--help` option when a command is not found (santysisi)
 * bug #62656 [FrameworkBundle] Fix using `FailedMessages*Command` with `SigningSerializer` (HypeMC)
 * bug #62653 [Lock] Fix unserializing already serialized Key payloads (nicolas-grekas)
 * bug #62652 [HttpClient] CachingHttpClient must run after UriTemplate and Scoping (Lctrs)
 * bug #62651 [FrameworkBundle] Only register PhpConfigReferenceDumpPass in dev env with debug flag enabled (bobvandevijver)
 * bug #62619 [Messenger] Fix PHP 8.5 deprecation for pgsqlGetNotify() in PostgreSQL transport (Shine-neko)
 * bug #62544 [DependencyInjection] Ensure deprecation detection does not trigger a PHP error (bnf)
 * bug #62586 [DependencyInjection][FrameworkBundle] fix BC break when dumping container for build/lint commands (aschempp)
 * bug #62607 [Form] Clean up wrong method docblocks in data transformers (alexndlm)
 * bug #62612 [Yaml] Fix regression handling blank lines in unquoted scalars (yoeunes)
 * bug #62646 [DependencyInjection] Throw when using `$this` or its internal scope from PHP config files (nicolas-grekas)
 * bug #62645 [HttpClient] Fix sharing CurlClientState between clones of CurlHttpClient instances (nicolas-grekas)
 * bug #62647 [FrameworkBundle] Don't exclude classes with constraint/serialization attributes from being registered as services (nicolas-grekas)
 * bug #62614 [Cache] Fix NullAdapter must set taggable (a.dmitryuk)
 * bug #62562 [Console] don't discard existing aliases when constructing Command (henderkes)
 * bug #62535 [HttpKernel] Don't reset services between fragments redering when using in HttpCache (nicolas-grekas)
 * bug #62532 [FrameworkBundle] Dump bundles config reference first (MatTheCat)
 * bug #62541 [DependencyInjection] Reset resolved state when setting a parameter (yoeunes)
 * bug #62558 [DependencyInjection] Don't add empty `.container.known_envs` in XML loader (GromNaN)
 * bug #62602 [Cache] Fix the creation of a redis connection with only ext-relay (stof)
 * bug #62587 [PropertyInfo] treat mixed[] the same as array when getting types from docblocks (xabbuh)
 * bug #62524 [Notifier][Mercure] Add support for Mercure 0.7 (Kocal)
 * bug #62571 [Console] Fix profile invokable command (Jibbarth)
 * bug #62577 [PropertyInfo] treat `mixed[]` the same as `array` when getting types from docblocks (xabbuh)
 * bug #62498 [FrameworkBundle] fix merging of enabled locales (dmaicher)
 * bug #62551 [FrameworkBundle] register attribute loader arguments in a forward-compatible way (xabbuh)
 * bug #62465  [JsonPath] Fix throwing on quoted True/False/Null (TamasSzigeti)
 * bug #62482 [DependencyInjection] Fix loose validation in `#[Autowire]` attribute (yoeunes)
 * bug #62513 [FrameworkBundle] Add missing `useAttributeAsKey` calls (MatTheCat)
 * bug #62523 [DependencyInjection] Fix state corruption in `PhpFileLoader` during recursive imports (yoeunes)
 * bug #62543 [Cache] ensure compatibility with RelayCluster 0.20.0 (xabbuh)
 * bug #62536 [Cache] ensure compatibility with Relay extension 0.20.0 (xabbuh)
 * bug #62515  [FrameworkBundle] Allow backed enum to be used in initial_marking workflow configuration (DemonTPx)
 * bug #62506 [DependencyInjection] Fix `query_string` env processor for URLs without query string (yoeunes)
 * bug #62502 [HttpFoundation] Fix Expires response header for EventStream (4513)
 * bug #62503 [HttpClient] Fix releasing uploaded stream resources (nicolas-grekas)

* 7.4.0 (2025-11-27)

 * feature #62528  Thank you redirection.io and JoliCode for backing Symfony 7.4! (nicolas-grekas)
 * feature #62527  Thank you Private Packagist for backing Symfony 7.4! (nicolas-grekas)
 * feature #62526  Thank you SensioLabs for backing Symfony 7.4! (nicolas-grekas)
 * bug #62474 [Config] Fix nullable EnumNode with BackedEnum (yoeunes)
 * bug #62485 [DependencyInjection] Fix loop corruption in `CheckTypeDeclarationsPass` (yoeunes)
 * bug #62486 [DependencyInjection] Fix invalid PHP syntax for nullable `TypedReference` in `PhpDumper` (yoeunes)
 * bug #62487 [Security] Fix `UserBadge` validation bypass via identifier normalizer (yoeunes)
 * bug #62489 [FrameworkBundle] Fix TypeError when traversing scalar values in debug:config (yoeunes)
 * bug #62493 [Console] Fix exception message when abbreviation matches multiple hidden commands (yoeunes)
 * bug #62471 [String] Fix normalization in trimPrefix/trimSuffix (yoeunes)
 * bug #62476 [DependencyInjection] Fix wrong trait usage in ServiceLocatorArgument (yoeunes)
 * feature #62469 [Security] Keep SymfonyCasts as backers of the Security components v7.4 🤗 (nicolas-grekas)

* 7.4.0-RC3 (2025-11-21)

 * bug #62454 [ObjectMapper] mapping of nested classes with promoted read-only properties (soyuka)
 * bug #62456 [AssetMapper] Fix entrypoint status lost during update (yoeunes)
 * bug #62416 [Console] Fix completion for global options values (HypeMC)
 * bug #62455 [ObjectMapper] map to embedded object with property access (soyuka)
 * bug #62458 [Workflow] Fix `MethodMarkingStore` crash with inherited uninitialized properties (yoeunes)
 * bug #62459 [Routing] Fix case sensitivity for static host matching in compiled routes (yoeunes)
 * bug #62461 [Routing] Fix localized prefix updates breaking aliases (yoeunes)
 * bug #62460 [Routing] Fix addNamePrefix breaking aliases to external routes (yoeunes)
 * bug #62453 [FrameworkBundle] Make `APP_*_DIR` relative to the project directory (nicolas-grekas)
 * bug #62447 [Form] Mark FormFlow as finished if the last step is skipped (yceruto)
 * bug #62436 [FrameworkBundle] Dump all registered extensions’ configuration reference (MatTheCat)
 * bug #62449 [HttpKernel] Fix using MapRequestPayload on nullable arguments (nicolas-grekas)
 * bug #62415 [HttpClient] Don't reset unused clients in data collector (HypeMC)
 * bug #62417 [ObjectMapper] bypass lazy ghost with class transform (soyuka)
 * bug #62437 [DependencyInjection] Fix preloading `LazyClosure` (nicolas-grekas)
 * bug #62441 [WebProfilerBundle] fix displaying runner (94noni)

* 7.4.0-RC2 (2025-11-16)

 * bug #62411 [HttpKernel] Conflict with symfony/flex < 2.10 (nicolas-grekas)
 * bug #62409 [Yaml] Align unquoted multiline scalar parsing with spec for comments (yoeunes)
 * bug #62398 [Cache] Fix accepting named closures as early-expiration callbacks (nicolas-grekas)
 * bug #62406 [Notifier] do not use recipient phone numbers as sender e-mail addresses (xabbuh)
 * bug #62407 [FrameworkBundle] work around limitation in `JsonResponse` when the data is `null` (xabbuh)
 * bug #62402 [FrameworkBundle] Revert auto-import of #[Route] defined on controllers (nicolas-grekas)
 * bug #62400 [Form] Fix EnumType choice_label logic for grouped choices (yoeunes)
 * bug #62369 [Security] Set OIDC JWKS cache TTL from provider headers (Ali-HENDA)
 * bug #62393 [Dependencyinjection] Call default index method when index is not provided by tag (yoeunes)
 * bug #62372 [Cache] Recognize saveDeferred events as writes in `CacheDataCollector` (yitznewton)
 * bug #62389 [Routing] Align routing.schema.json with YamlFileLoader behavior (yoeunes)

* 7.4.0-RC1 (2025-11-13)

 * bug #62335 [Console] Fix signal handlers not being cleared after command termination (yoeunes)
 * bug #62348 [Translation][Lokalise] fix "Project too big for sync export" (santysisi)
 * bug #62304 [DependencyInjection] Fix lazy proxy creation for interfaces aliased to final classes (yoeunes)
 * bug #62036 [HttpKernel] Fix StreamedResponse with chunks support in HttpKernelBrowser (wuchen90)
 * bug #62063 [JsonStreamer] Rebuild cache on class update (mtarld)
 * bug #62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (yoeunes)
 * bug #62325 [Routing] Fix default value not taken if usigng name:entity.attribute (eltharin)
 * bug #62329 [DependencyInjection] Fix merging explicit tags and #[AsTaggeditem] (nicolas-grekas)
 * bug #62356 [HttpClient] Fix `Warning: curl_multi_select(): timeout must be positive` (Jeroeny)
 * bug #62334 [PropertyInfo] Fix `ReflectionExtractor` handling of underscore-only property names (yoeunes)
 * bug #58473 [Serializer] Fix `AbstractObjectNormalizer` to allow scalar values to be normalized (Hanmac, xabbuh)
 * bug #62093 [Security] Fix `HttpUtils::createRequest()` when the context’s base URL isn’t empty (MatTheCat)
 * bug #62007 [Serializer] fix inherited properties normalization (Link1515)
 * bug #62286 [Cache] compatibility with ext-redis 6.3 (xabbuh)
 * bug #62321 [Serializer] Fix BackedEnumNormalizer behavior with partial denormalization (yoeunes)
 * bug #62344 [OptionsResolver] Fix missing prototype key in nested error paths (yoeunes)
 * bug #62346 [Clock] Align MockClock::sleep() behavior with NativeClock for negative values (yoeunes)
 * bug #62347 [OptionsResolver] Ensure remove() also unsets deprecation status (yoeunes)
 * bug #62359 [Yaml] Fix parsing of unquoted multiline scalars with comments or blank lines (yoeunes)
 * bug #62350 [ExpressionLanguage] Compile numbers with var_export in Compiler::repr for thread-safety (yoeunes)
 * security #cve-2025-64500 [HttpFoundation] Fix parsing pathinfo with no leading slash (nicolas-grekas)
 * bug #62333  Postal mailer transport message ID retrieval (lalcebo)
 * feature #62326 [Cache][Messenger] re-allow ext-redis 6.1 (xabbuh)
 * bug #62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (nicolas-grekas)
 * bug #62171 [Messenger] Fix commands writing to `STDERR` instead of `STDOUT` (wazum)
 * bug #62315  Keep body size limit for AMP redirects (villermen)
 * bug #62214 [ObjectMapper] lazy loading (soyuka)
 * bug #62237 [Form] Fix EnumType choice_label logic for grouped choices (yoeunes)
 * bug #62283 [Filesystem] Unify logic for isAbsolute() in Path (yoeunes)
 * feature #62302 [Routing] Simplify importing routes defined on controller services (nicolas-grekas)
 * bug #62091 [BrowserKit] The BrowserKit history with parameter separator without slash. (biozshock)
 * bug #62297 [Twig] Ensure WrappedTemplatedEmail::getReturnPath() returns a string (yoeunes)
 * bug #62294 [Console] Add missing VERBOSITY_SILENT case in CommandDataCollector (yoeunes)
 * bug #62290 [Routing] Fix matching the "0" URL (cs278)
 * bug #62285 [HttpClient] Reject 3xx pushed responses (nicolas-grekas)

* 7.4.0-BETA2 (2025-11-02)

 * feature #62270 [Lock][DynamoDB] Allow symfony/lock 8.0 (DavidPrevot)
 * bug #62267 [Config] Use the empty string instead of null as an array offset (santysisi)
 * feature #62230 [Messenger] Support signing messages per handler (nicolas-grekas)
 * bug #62246 [HttpFoundation] Allow Request::setFormat() to override predefined formats (longwave)
 * feature #60153 [Serializer] Allow forcing timezone in `DateTimeNormalizer` during denormalization (frankdekker)
 * bug #62240 [DomCrawler] Handle malformed tags in HTML5 parser (longwave)
 * bug #62242 [MonologBridge] Accept HttpExceptionInterface in HttpCodeActivationStrategy (GromNaN)
 * bug #62222 [Cache] fix ext-redis 6.2.0 compatibility (xabbuh)
 * bug #62211 [Workflow] State contamination due to class-based setter cache (nicolas-grekas)
 * bug #62184 [EventDispatcher][FrameworkBundle] Rework union types on `#[AsEventListener]` (HypeMC)
 * bug #62199 [Workflow] State Contamination in Marking Stores due to Class-based Getter Cache (siganushka)
 * bug #62197 [Validator] Fix call to undefined getParser() in YamlValidator (yoeunes)
 * bug #62203 [Mailer] Fix contentId assignment for inline attachments (webflo)
 * bug #62201 [HtmlSanitizer] Remove `srcdoc` from allowed attributes (Spomky)
 * feature #62190 [Runtime] Expose `project_dir` as `APP_PROJECT_DIR` env var (nicolas-grekas)
 * bug #62191 [FrameworkBundle] Change HttpCache directory to use new getShareDir (alexander-schranz)
 * bug #62169 [HttpClient] Fix caching client decorating scoping client (pierredup)
 * bug #62185 [FrameworkBundle] Add missing `container.excluded` to `serializer.attribute_metadata` (HypeMC)
 * bug #62186 [DomCrawler] Fix converting HTML5 trees to DOM nodes (nicolas-grekas)
 * bug #62182 [VarDumper] Fix dumping CurlHttpClient instances (nicolas-grekas)
 * bug #62180 [DomCrawler] Properly ignore errors when using the native HTML5 parser (nicolas-grekas)
 * bug #62178 [FrameworkBundle] Expose share directory in AboutCommand (ro0NL)
 * bug #62167 [Lock][DynamoDB] Enable `http_client` injection and fix tests using AmpV5 client (GromNaN)

* 7.4.0-BETA1 (2025-10-27)

 * feature #62170 [HttpKernel] Add `KernelInterface::getShareDir()`, `APP_SHARE_DIR` and `kernel.share_dir` (nicolas-grekas)
 * feature #59974 [Runtime] Make project_dir configurable (wickedOne)
 * feature #60033 [ErrorHandler][FrameworkBundle] Add support for selecting the appropriate error renderer based on the `APP_RUNTIME_MODE` (yceruto)
 * feature #62027 [DebugBundle][HttpKernel] Collect dumps when console profiling is enabled (HypeMC)
 * feature #61843 [Messenger] Add `MessageSentToTransportsEvent` (HypeMC)
 * feature #61880 [JsonStreamer] Merge `PropertyMetadata` value transformers (mtarld)
 * feature #60212 [Form] Add `FormFlow` for multistep forms management (yceruto)
 * feature #62135 [Config] Deprecate config builder generators (nicolas-grekas)
 * feature #62129 [FrameworkBundle] Auto-generate `config/reference.php` to assist in writing and discovering app's configuration (nicolas-grekas)
 * feature #62069 [JsonStreamer] Add synthetic properties support (mtarld)
 * feature #62092 [Config][DependencyInjection] Deprecate the fluent PHP format for semantic configuration (nicolas-grekas)
 * feature #62090 [Config] Deprecate setting a default value to a node that is required (GromNaN)
 * feature #61984 [Messenger] Add retry delay on amazon sqs transport (deguif)
 * feature #62077 [Security] Add support for `Sec-Fetch-Site` to `SameOriginCsrfTokenManager` (nicolas-grekas)
 * feature #62073 [HttpClient] Add QUERY to the list of retriable HTTP methods (nicolas-grekas)
 * feature #62068 [Console] Add support for `Cursor` helper in invokable commands (yceruto)
 * feature #62059 [HttpClient] Add option `auto_upgrade_http_version` to control how the request HTTP version is handled in `HttplugClient` and `Psr18Client` (ajgarlag)
 * feature #62043 [Security] Allow multiple OIDC discovery endpoints (ruudk)
 * feature #62010 [Routing] Initialize `router.request_context`'s `_locale` parameter to `kernel.default_locale` (MatTheCat)
 * feature #62039 [Notifier] Add support for `confirm` option in Slack buttons API (Taras Hinyk)
 * feature #61949 [HttpFoundation] Deprecate HTTP method override for methods GET, HEAD, CONNECT and TRACE (nicolas-grekas)
 * feature #61979 [HttpFoundation] Add `Request::set/getAllowedHttpMethodOverride()` to list which HTTP methods can be overridden (nicolas-grekas)
 * feature #61490 [DependencyInjection][Routing] Define array-shapes to help writing PHP configs using yaml-like arrays (nicolas-grekas)
 * feature #61961 [HttpFoundation] Make `Request::createFromGlobals()` parse the body of PUT, DELETE, PATCH and QUERY requests (MatTheCat)
 * feature #61992 [DoctrineBridge] Deprecate `AbstractDoctrineExtension` (GromNaN)
 * feature #60660 [Security] Add security:oidc-token:generate command (Jean-Beru)
 * feature #61955 [Messenger] bump ext-redis to 6.2 and ext-relay to 0.12 minimum (xabbuh)
 * feature #61252 [FrameworkBundle] Add support for union types on `#[AsEventListener]` (Fan2Shrek)
 * feature #61748 [Console] Add support for interactive invokable commands with `#[Interact]` and `#[Ask]` attributes (yceruto)
 * feature #61952 [Cache] bump ext-relay to 0.12+ (xabbuh)
 * feature #61948 [HttpFoundation] Deprecate Request::get() in favor of using properties ->attributes, query or request directly (nicolas-grekas)
 * feature #61933 [Workflow] Move the dump command to the component (lyrixx)
 * feature #61919 [DependencyInjection] Deprecate `ExtensionInterface::getXsdValidationBasePath()` and `getNamespace()` (nicolas-grekas)
 * feature #60201 [Workflow] Add support for weighted transitions (lyrixx)
 * feature #60568 [DependencyInjection][Routing] Deprecate XML configuration format (MatTheCat)
 * feature #61837 [Form] Add new `active_at`, `not_active_at` and `legal_tender` options to `CurrencyType` (Crovitche-1623)
 * feature #61894 [DependencyInjection][Routing] Handle declaring services and routes using PHP arrays that follow the same shape as corresponding yaml files (nicolas-grekas)
 * feature #61860 [Config][DependencyInjection][Routing] Deprecate using `$this` or the internal scope of the loader from PHP config files (nicolas-grekas)
 * feature #61885 [DependencyInjection] Handle returning arrays and config-builders from config files (nicolas-grekas)
 * feature #59576 [HttpClient] Make `CachingHttpClient` compatible with RFC 9111 (Lctrs)
 * feature #61841 [Validator] deprecate passing an associative array to GroupSequence (xabbuh)
 * feature #61789 [Security] deprecate extending `RememberMeDetails` using legacy constructor signature (xabbuh)
 * feature #61807 [Uid] Add `MockUuidFactory` for deterministic UUID generation in tests (momito69)
 * feature #61838 [Notifier][LOX24] Add Lox24 webhook request parser support (alebedev80)
 * feature #61836 [MonologBridge] Deprecate `NotFoundActivationStrategy` (HypeMC)
 * feature #61791 [Validator] deprecate implicit constraint option names in YAML/XML mapping files (xabbuh)
 * feature #61778 [Notifier] Add support for building SmsEvent by dlr_code and RemoteEvent for other LOX24 webhook event types (alebedev80)
 * feature #61820 [HttpKernel][WebProfilerBundle] Display runner class in the profiler toolbar (MatTheCat)
 * feature #60902 [TwigBridgeRessources] add aria-invalid and aria-describedby on form inputs when validation failure exist (jeanfrancois-morin)
 * feature #59955 [MonologBridge] Add ability to react to console input being interactive or not (dkarlovi)
 * feature #61812 [Uid] Default to `UuidV7` when using `UuidFactory` (nicolas-grekas)
 * feature #60237 [DoctrineBridge] Add new `DayPointType` and `TimePointType` Doctrine type (wkania)
 * feature #60085 [Security] improve VoteObject adding extraData for give more possibilities to AccessDecicsionStrategy (eltharin)
 * feature #51273 [Config] Add `ArrayNodeDefinition::acceptAndWrap()` to list alternative types that should be accepted and wrapped in an array (nicolas-grekas)
 * feature #60561 [Validator] Add option to allow `ANY` protocol in `Assert\Url` constraint (alekLexis)
 * feature #61775 [Mailer][Mandrill] Add `subaccount` to the payload (andrehoong-pixieset)
 * feature #61777 [Notifier][Twilio] WhatsApp number validation (OvidiuGi)
 * feature #60023 [Lock] Add `LockKeyNormalizer` (valtzu)
 * feature #46257 [Messenger] Add AMQP exchange to exchange bindings (Samik081)
 * feature #60228 [Serializer] Support preserving array keys with `XmlEncoder` (Maximilian Ruta)
 * feature #61765 [TypeInfo] Add result cache to `TypeContextFactory` (landure)
 * feature #60114 [Workflow] Add support for `BackedEnum` in `MethodMarkingStore` (tucksaun)
 * feature #61758 [Mailer][Sendgrid] Add support for `global` region (sonnymilton)
 * feature #61743 [Security] deprecate the FQCN properties of `PersistentToken` and `RememberMeDetails` (xabbuh)
 * feature #60204 [FrameworkBundle] Add support for configuring workflow places with glob patterns matching consts/backed enums (lyrixx)
 * feature #60395 [HttpFoundation] Add `#[IsSignatureValid]` attribute (santysisi)
 * feature #61110 [FrameworkBundle] Prepare session in functionnal tests (cyve)
 * feature #61718 [Config] Add argument `$singular` to `NodeBuilder::arrayNode()` to decouple plurals/singulars from XML (nicolas-grekas)
 * feature #60138 [Lock] DynamoDB store (natepage)
 * feature #61092 [Console][QuestionHelper] add optional timeout for human interaction (janedbal)
 * feature #54366 [Messenger] Introduce `DefaultStampsProviderInterface ` (VincentLanglet)
 * feature #61694 [Security] Add `$tokenSource` argument to `#[IsCsrfTokenValid]` to support reading tokens from the query string or headers (webda2l)
 * feature #61563 [Serializer] Add `#[ExtendsSerializationFor]` to declare new serialization attributes for a class (nicolas-grekas)
 * feature #61545 [Validator] Add `#[ExtendsValidationFor]` to declare new constraints for a class (nicolas-grekas)
 * feature #61311 [WebProfilerBundle] Show `EventSource` requests in debug toolbar (valtzu)
 * feature #61654 [Security] Deprecate `PersistentToken::getClass()` and `RememberMeDetails::getUserFqcn()` in order to remove the user FQCN from the remember-me cookie in 8.0 (nicolas-grekas)
 * feature #58070 [VarDumper] Select HtmlDumper only if `Accept` header contains "html" (alexandre-daubois)
 * feature #61478 [Console] Add `#[Input]` attribute to support DTOs in invokable commands (yceruto)
 * feature #61034 [Security][SecurityBundle] Dump role hierarchy as mermaid chart (damienfern)
 * feature #61656 [DependencyInjection] Allow `Class::function(...)` and `global_function(...)` closures in PHP DSL for factories (GromNaN)
 * feature #61657 [VarExporter] Add support for exporting named closures (nicolas-grekas)
 * feature #61532 [Serializer] Allow using attributes to declare compile-time serialization metadata (nicolas-grekas)
 * feature #61528 [Validator] Allow using attributes to declare compile-time constraint metadata (nicolas-grekas)
 * feature #61379 [Security][TwigBridge] Add `access_decision()` and `access_decision_for_user()` (florentdestremau)
 * feature #59042 [Validator] Add `Video` constraint for validating video files (symfonyaml)
 * feature #61575 [DependencyInjection] Allow multiple `#[AsDecorator]` attributes (Jean-Beru)
 * feature #61592 [Runtime] Expose the runtime class in `$_SERVER['APP_RUNTIME']` (nicolas-grekas)
 * feature #61578 [DependencyInjection] Parse attributes found on abstract classes for resource definitions (nicolas-grekas)
 * feature #61564 [Serializer][Validator] Add JSON schema for validating and autocompleting YAML config files (nicolas-grekas)
 * feature #61536 [DependencyInjection] Allow adding resource tags using any config formats (nicolas-grekas)
 * feature #61297 [Form] Add form type guesser for `EnumType` (mttsch)
 * feature #61555 [Mailer][Sweego] Add support for new webhook events (welcoMattic)
 * feature #61431 [Intl] Add methods to filter currencies more precisely (Crovitche-1623)
 * feature #61542 [Security] Allow subclassing `#[IsGranted]` (nicolas-grekas)
 * feature #61497 [ObjectMapper] cache attributes in memory (soyuka)
 * feature #61522 [Runtime] Support runtime options as a string (VincentLanglet)
 * feature #59780 [FrameworkBundle] Only show relevant columns in `debug:router` call and adding colors (mamazu)
 * feature #61057 [Security] Improve performance of `RoleHierarchy::buildRoleMap` method (simonjamain-gp, simonjamain)
 * feature #60979 [Messenger] Add `--exclude-receivers` to `messenger:consume` command (jbdelhommeau)
 * feature #60442 [ObjectMapper] embed collection transformer (soyuka)
 * feature #61504  [SecurityHttp] Removes final keyword from IsGranted attribute (crtl)
 * feature #61500 [JsonPath][JsonStreamer][ObjectMapper] the components are no longer experimental (xabbuh)
 * feature #61492 [FrameworkBundle][Routing] Auto-register routes from attributes found on controller services (nicolas-grekas)
 * feature #61282 [DependencyInjection][Routing] Add JSON schema for validating and autocompleting YAML config files (nicolas-grekas)
 * feature #61078 [Console] Add getter for the original command "code" object (weitzman)
 * feature #61078 [Console] Add getter for the original command "code" object (weitzman)
 * feature #61480 [TypeInfo] Add extra type alias support (mtarld)
 * feature #61487 [Routing][Serializer] Deprecate annotation aliases and getters and setters in favor of public properties on attributes (nicolas-grekas)
 * feature #61475 [DomCrawler] Use the native HTML5 parser on PHP 8.4 (nicolas-grekas)
 * feature #60120 [Routing] Add possibility to create a request context with parameters directly (alexander-schranz)
 * feature #61455 [Mailer][Sendgrid] Add suppression groups support (KiloSierraCharlie)
 * feature #61267 [HttpFoundation] Add support for structured MIME suffix (Spomky)
 * feature #61358 [Routing] allow setting multiple envs in `#[Route]` attribute (santysisi)
 * feature #61359 [Security] Add `$methods` support to `#[IsGranted]` to restrict access by HTTP method (santysisi)
 * feature #60218 [Notifier][Discord] Add `DiscordBotTransport` (norkunas)
 * feature #61444 [Notifier][Telegram] Add TelegramOptions::messageThreadId() (MKC-MKC)
 * feature #61315 [Mailer] Add compatibility for Mailtrap's sandbox (KiloSierraCharlie)
 * feature #61173 [HttpFoundation][HttpKernel][WebProfilerBundle] Add support for the `QUERY` HTTP method (alexandre-daubois)
 * feature #61423 [Mime] Deprecate implementing `__sleep/wakeup()` on `AbstractPart` implementations (nicolas-grekas)
 * feature #61418 [Validator] Deprecate implementing `__sleep/wakeup()` on GenericMetadata implementations (nicolas-grekas)
 * feature #61417 [String] Deprecate implementing `__sleep/wakeup()` on string implementations (nicolas-grekas)
 * feature #61412 [HttpKernel] Deprecate `__sleep/wakeup()` on kernels and data collectors and make `Profile` final (nicolas-grekas)
 * feature #61413 [Serializer] Make `AttributeMetadata` and `ClassMetadata` final (nicolas-grekas)
 * feature #61366 [HtmlSanitizer] Use the native HTML5 parser when using PHP 8.4+ (nicolas-grekas)
 * feature #61290 [Mailer] Add MicrosoftGraph API Transport (bobvandevijver)
 * feature #60754 [Messenger] Allow SQS to handle its own retry/DLQ (maxbaldanza)
 * feature #61308 [Console] Adding more helpful error messages to the Questionhelper (mamazu)
 * feature #61270 [DependencyInjection] Deprecate registering a service without a class when its id is a non-existing FQCN (nicolas-grekas)
 * feature #61255 [Validator] deprecate passing choices as `$options` argument to `Choice` constraint (xabbuh)
 * feature #60355 [Serializer] Add `CDATA_WRAPPING_NAME_PATTERN` support to `XmlEncoder` (Maximilian Ruta)
 * feature #60955 [BrowserKit] Add PHPUnit constraints: `BrowserHistoryIsOnFirstPage` and `BrowserHistoryIsOnLastPage` (santysisi)
 * feature #60805 [Validator] Add `min` and `max` in both error messages of `LengthValidator` (VincentLanglet)
 * feature #61133 [AssetMapper] Add support for loading JSON using import statements (nicolas-grekas)
 * feature #61204 [Security] Support union type for `#[CurrentUser]` attribute (VincentLanglet)
 * feature #60730  [JsonStreamer] Add `include_null_properties` option (mtarld)
 * feature #61006 [JsonStreamer] Provide current object to value transformers  (mtarld)
 * feature #60935 [Translation] Add `StaticMessage` (VincentLanglet)
 * feature #61145 [ObjectMapper] Add `ObjectMapperAwareInterface` to set the owning object mapper instance (soyuka)
 * feature #61109 [Translation] Deprecate `TranslatableMessage::__toString` (VincentLanglet)
 * feature #61023 [Serializer] add `can` to the accessor prefixes recognized by the `AttributeLoader` (Mark Schmale)
 * feature #61127 [Cache] Add `TagAwareAdapterInterface` to `NullAdapter` (a.dmitryuk)
 * feature #61108 [DoctrineBridge][Validator] mark getRequiredOptions()/getDefaultOption() of UniqueEntity as deprecated (xabbuh)
 * feature #60801 [Validator] deprecate handling options in the base Constraint class (xabbuh)
 * feature #60110 [Mailer] [Transport] Allow exception logging for `RoundRobinTransport` mailer (jnoordsij)
 * feature #61024 [Intl] Optionally allow Kosovo as a component region (llupa)
 * feature #61046 [SecurityBundle] configuration for the storage service for the login throttling rate limiter (xabbuh)
 * feature #60999 [Messenger] Allow any `ServiceResetterInterface` implementation in `ResetServicesListener` (santysisi)
 * feature #60480 [VarDumper] Add support for adding more default casters to `AbstractCloner::addDefaultCasters()` (lyrixx)
 * feature #60895 [BrowserKit] Add `isFirstPage()` and `isLastPage()` methods to History (santysisi)
 * feature #60857 [FrameworkBundle] Add `ControllerHelper`; the helpers from `AbstractController` as a standalone service (nicolas-grekas)
 * feature #60898 [Uid] Add microsecond precision to UUIDv7 and optimize on x64 (nicolas-grekas)
 * feature #60910 [DependencyInjection] Add argument `$target` to `ContainerBuilder::registerAliasForArgument()` (nicolas-grekas)
 * feature #60597 [DependencyInjection][FrameworkBundle] Use php-serialize to dump the container for debug/lint commands (nicolas-grekas)
 * feature #60874 [FrameworkBundle] Allow using their name without added suffix when using #[Target] for custom services (Valmonzo)
 * feature #60614 [Security] Deprecate callable firewall listeners (MatTheCat)
 * feature #60876 [HttpFoundation] Deprecate using `Request::sendHeaders()` after headers have already been sent (nicolas-grekas)
 * feature #60823 [Console] Add support for Invokable Commands in `CommandTester` (ruudk)
 * feature #60503 [Runtime] Automatically use FrankenPHP runner when its worker mode is detected (alexandre-daubois)
 * feature #60788 [FrameworkBundle] Allow to un-verbose all the method in `BrowserKitAssertionsTrait` (VincentLanglet)
 * feature #60819 [DependencyInjection] Allow extending `#[AsAlias]` attribute (ruudk)
 * feature #60740 [Mailer] Add `assertEmailAddressNotContains` (santysisi)
 * feature #60767 [Console] Allow Usages to be specified via #[AsCommand] attribute (weitzman)
 * feature #60586 [Console] Support `BackedEnum` in invokable commands (GromNaN)
 * feature #60371 [SecurityBundle] register alias for argument for password hasher (lyrixx, chalasr)
 * feature #60394 [Console][FrameworkBundle] Simplify using invokable commands when the component is used standalone (HypeMC)
 * feature #60731 [JsonStreamer] Add PHPDoc to generated code (mtarld)
 * feature #60739 [Console] Allow setting aliases & hidden via command name passed to the constructor (HypeMC)
 * feature #60424 [PhpUnitBridge] Add `strtotime()` to `ClockMock` (jprivet-dev)
 * feature #60508 [Routing] Allow query-specific parameters in `UrlGenerator` using `_query` (BenMorel)
 * feature #60704 [HttpClient] Deprecate using amphp/http-client < 5 (nicolas-grekas)
 * feature #60253 [Scheduler] Throw error on duplicate schedule provider service registration on the schedule name (adrianrudnik)
 * feature #60315 [Form] Add `input=date_point` to `DateTimeType`, `DateType` and `TimeType` (wkania)
 * feature #60498 [HttpCache] Add a `waiting` trace when finding the cache locked (mpdude)
 * feature #60569 [HttpKernel] Do not superseed private cache-control when no-store is set (alexander-schranz)
 * feature #60209 [Notifier] Allow to set block_id/value for SlackActionsBlock and SlackButtonBlockElement (miloszowi)
 * feature #60544 [JsonStreamer] Remove `nikic/php-parser` dependency (mtarld)
 * feature #60420 [WebLink] Add class to parse Link headers from HTTP responses (GromNaN)

