Changelog (since v5.0.3...v5.0.4)

• bug #35530 [HttpClient] Fix regex bearer (@noniagriconomie)
• bug #35532 [Validator] fix access to uninitialized property when getting value (@greedyivan)
• bug #35486 [Translator] Default value for 'sort' option in translation:update should be 'asc' (@versgui)
• bug #35305 [HttpKernel] Fix stale-if-error behavior, add tests (@mpdude)
• bug #34808 [PhpUnitBridge] Properly handle phpunit arguments for configuration file (@biozshock)
• bug #35517 [Intl] Provide more locale translations (@ro0NL)
• bug #35518 [Mailer] Fix STARTTLS support for Postmark and Mandrill (@fabpot)
• bug #35480 [Messenger] Check for all serialization exceptions during message dec… (@patrick Berenschot)
• bug #35502 [Messenger] Fix bug when using single route with XML config (@Nyholm)
• bug #35438 [SecurityBundle] fix ldap_bind service arguments (@Ioni14)
• bug #35429 [DI] CheckTypeDeclarationsPass now checks if value is type of parameter type (@pfazzi)
• bug #35464 [ErrorHandler] Add debug argument to decide whether debug page is shown or not (@yceruto)
• bug #35423 Fixes a runtime error when accessing the cache panel (@DamienHarper)
• bug #35428 [Cache] fix checking for igbinary availability (@nicolas-grekas)
• bug #35424 [HttpKernel] Check if lock can be released (@sjadema)

[PR] #35541

Changelog (since v5.0.2...v5.0.3)

• bug #35364 [Yaml] Throw on unquoted exclamation mark (@fancyweb)
• bug #35065 [Security] Use supportsClass in addition to UnsupportedUserException (@linaori)
• bug #35351 Revert #34797 "Fixed translations file dumper behavior" and fix #34713 (@yceruto)
• bug #35356 [Filesystem] chown and chgrp should also accept int as owner and group (@Slamdunk)
• bug #35335 [Security] Fix RememberMe with null password (@jderusse)
• bug #35339 [String] add missing encoding when calling mb_ord() (@nicolas-grekas)
• bug #35355 [DI] Fix EnvVar not loaded when Loader requires an env var (@jderusse)
• bug #35343 [Security] Fix RememberMe with null password (@jderusse)
• bug #34223 [DI] Suggest typed argument when binding fails with untyped argument (@gudfar)
• bug #35323 [FrameworkBundle] Set booted flag to false when test kernel is unset (@thiagocordeiro)
• bug #35324 [HttpClient] Fix strict parsing of response status codes (@Armando-Walmeric)
• bug #35318 [Yaml] fix PHP const mapping keys using the inline notation (@xabbuh)
• bug #35306 [FrameworkBundle] Make sure one can use fragments.hinclude_default_template (@Nyholm)
• bug #35304 [HttpKernel] Fix that no-cache MUST revalidate with the origin (@mpdude)
• bug #35299 Avoid stale-if-error in FrameworkBundle's HttpCache if kernel.debug = true (@mpdude)
• bug #35240 [SecurityBundle] Fix collecting traceable listeners info on lazy firewalls (@chalasr)
• bug #35151 [DI] deferred exceptions in ResolveParameterPlaceHoldersPass (@Islam93)
• bug #35290 [Filesystem][FilesystemCommonTrait] Use a dedicated directory when there are no namespace (@fancyweb)
• bug #35099 [FrameworkBundle] Do not throw exception on value generate key (@jderusse)
• bug #35278 [EventDispatcher] expand listener in place (@xabbuh)
• bug #35269 [HttpKernel][FileLocator] Fix deprecation message (@fancyweb)
• bug #35254 [PHPUnit-Bridge] Fail-fast in simple-phpunit if one of the passthru() commands fails (@mpdude)
• bug #35261 [Routing] Fix using a custom matcher & generator dumper class (@fancyweb)
• bug #34643 [Dotenv] Fixed infinite loop with missing quote followed by quoted value (@naitsirch)
• bug #35239 [Security\Http] Prevent canceled remember-me cookie from being accepted (@chalasr)
• bug #35267 [Debug] fix ClassNotFoundFatalErrorHandler (@nicolas-grekas)
• bug #35252 [Serializer] Fix cache in MetadataAwareNameConverter (@bastnic)
• bug #35200 [TwigBridge] do not render preferred choices as selected (@xabbuh)
• bug #35243 [HttpKernel] release lock explicitly (@nicolas-grekas)
• bug #35193 [TwigBridge] button_widget now has its title attr translated even if its label = null or false (@stephen-lewis)
• bug #35219 [PhpUnitBridge] When using phpenv + phpenv-composer plugin, composer executable is wrapped into a bash script (@oleg-andreyev)
• bug #35150 [Messenger] Added check if json_encode succeeded (@toooni)
• bug #35137 [Messenger] Added check if json_encode succeeded (@toooni)
• bug #35170 [FrameworkBundle][TranslationUpdateCommand] Do not output positive feedback on stderr (@fancyweb)
• bug #35245 [HttpClient] fix exception in case of PSR17 discovery failure (@nicolas-grekas)
• bug #35244 [Cache] fix processing chain adapter based cache pool (@xabbuh)
• bug #35247 [FrameworkBundle][ContainerLintCommand] Only skip .errored. services (@fancyweb)
• bug #35225 [DependencyInjection] Handle ServiceClosureArgument for callable in container linting (@shieldo)
• bug #35223 [HttpClient] Don't read from the network faster than the CPU can deal with (@nicolas-grekas)
• bug #35214 [DI] DecoratorServicePass should keep container.service_locator on the decorated definition (@malarzm)
• bug #35209 [HttpClient] fix support for non-blocking resource streams (@nicolas-grekas)
• bug #35210 [HttpClient] NativeHttpClient should not send >1.1 protocol version (@nicolas-grekas)
• bug #35162 [Mailer] Make sure you can pass custom headers to Mailgun (@Nyholm)
• bug #33672 [Mailer] Remove line breaks in email attachment content (@stuart Fyfe)
• bug #35101 [Routing] Fix i18n routing when the url contains the locale (@fancyweb)
• bug #35124 [TwigBridge][Form] Added missing help messages in form themes (@cmen)
• bug #35195 [HttpClient] fix casting responses to PHP streams (@nicolas-grekas)
• bug #35168 [HttpClient] fix capturing SSL certificates with NativeHttpClient (@nicolas-grekas)
• bug #35134 [PropertyInfo] Fix BC issue in phpDoc Reflection library (@jaapio)
• bug #35184 [Mailer] Payload sent to Sendgrid doesn't include names (@versgui)
• bug #35173 [Mailer][MailchimpBridge] Fix missing attachments when sending via Mandrill API (@vilius-g)
• bug #35172 [Mailer][MailchimpBridge] Fix incorrect sender address when sender has name (@vilius-g)
• bug #35125 [Translator] fix performance issue in MessageCatalogue and catalogue operations (@ArtemBrovko)
• bug #35120 [HttpClient] fix scheduling pending NativeResponse (@nicolas-grekas)
• bug #35117 [Cache] do not overwrite variable value (@xabbuh)
• bug #35113 [VarDumper] Fix "Undefined index: argv" when using CliContextProvider (@xepozz)
• bug #34673 Migrate server:log command away from WebServerBundle (@jderusse)
• bug #35103 [Translation] Use locale_parse for computing fallback locales (@alanpoulain)
• bug #35060 [Security] Fix missing defaults for auto-migrating encoders (@chalasr)
• bug #35067 [DependencyInjection][CheckTypeDeclarationsPass] Handle \Closure for callable (@fancyweb)
• bug #35094 [Console] Fix filtering out identical alternatives when there is a command loader (@fancyweb)

[PR] #35414

Changelog (since v5.0.1...v5.0.2)

• bug #35051 [DependencyInjection] Fix binding tagged services to containers (@nicolas-grekas)
• bug #35039 [DI] skip looking for config class when the extension class is anonymous (@nicolas-grekas)
• bug #35049 [ProxyManager] fix generating proxies for root-namespaced classes (@nicolas-grekas)
• bug #35022 [Dotenv] FIX missing getenv (@mccullagh)
• bug #35023 [HttpKernel] ignore failures generated by opcache.restrict_api (@nicolas-grekas)
• bug #35024 [HttpFoundation] fix pdo session handler for sqlsrv (@azjezz)
• bug #35025 [HttpClient][Psr18Client] Remove Psr18ExceptionTrait (@fancyweb)
• bug #35028 [TwigBridge] Fix invalid typehint for subject in is_granted Twig function (@emodric)
• bug #35015 [Config] fix perf of glob discovery when GLOB_BRACE is not available (@nicolas-grekas)
• bug #35014 [HttpClient] make pushed responses retry-able (@nicolas-grekas)
• bug #35010 [VarDumper] ignore failing __debugInfo() (@nicolas-grekas)
• bug #34998 [DI] fix auto-binding service providers to their service subscribers (@nicolas-grekas)
• bug #34954 [Mailer] Fixed undefined index when sending via Mandrill API (@wulff)
• bug #33670 [DI] Service locators can't be decorated (@malarzm)
• bug #35000 [Console][SymfonyQuestionHelper] Handle multibytes question choices keys and custom prompt (@fancyweb)
• bug #35005 [HttpClient] force HTTP/1.1 when NTLM auth is used (@nicolas-grekas)
• bug #34707 [Validation][FrameworkBundle] Allow EnableAutoMapping to work without auto-mapping namespaces (@ogizanagi)
• bug #34996 Fix displaying anonymous classes on PHP 7.4 (@nicolas-grekas)
• bug #29839 [Validator] fix comparisons with null values at property paths (@xabbuh)
• bug #34900 [DoctrineBridge] Fixed submitting invalid ids when using queries with limit (@HeahDude)
• bug #34791 [Serializer] Skip uninitialized (PHP 7.4) properties in PropertyNormalizer and ObjectNormalizer (@vudaltsov)
• bug #34956 [Messenger][AMQP] Use delivery_mode=2 by default (@lyrixx)
• bug #34915 [FrameworkBundle] Fix invalid Windows path normalization in TemplateNameParser (@mvorisek)
• bug #34981 stop using deprecated Doctrine persistence classes (@xabbuh)
• bug #34904 [Validator][ConstraintValidator] Safe fail on invalid timezones (@fancyweb)
• bug #34935 [FrameworkBundle][DependencyInjection] Skip removed ids in the lint container command and its associated pass (@fancyweb)
• bug #34957 [Security] Revert "AbstractAuthenticationListener.php error instead info" (@larzuk91)
• bug #34922 [FrameworkBundle][Secrets] Hook configured local dotenv file (@fancyweb)
• bug #34967 [HttpFoundation] fix redis multi host dsn not recognized (@jan Christoph Beyer)
• bug #34963 [Lock] fix constructor argument type declaration (@xabbuh)
• bug #34955 Require doctrine/persistence ^1.3 (@nicolas-grekas)
• bug #34923 [DI] Fix support for immutable setters in CallTrait (@Lctrs)
• bug #34878 [TwigBundle] fix broken FilesystemLoader::exists() with Twig 3 (@dpesch)
• bug #34921 [HttpFoundation] Removed "Content-Type" from the preferred format guessing mechanism (@yceruto)
• bug #34886 [HttpKernel] fix triggering deprecation in file locator (@xabbuh)
• bug #34918 [Translation] fix memoryleak in PhpFileLoader (@nicolas-grekas)
• bug #34920 [Routing] fix memoryleak when loading compiled routes (@nicolas-grekas)
• bug #34787 [Cache] Propagate expiry when syncing items in ChainAdapter (@trvrnrth)
• bug #34694 [Validator] Fix auto-mapping constraints should not be validated (@ogizanagi)
• bug #34848 [Process] change the syntax of portable command lines (@nicolas-grekas)
• bug #34862 [FrameworkBundle][ContainerLintCommand] Reinitialize bundles when the container is reprepared (@fancyweb)
• bug #34896 [Cache] fix memory leak when using PhpFilesAdapter (@nicolas-grekas)
• bug #34438 [HttpFoundation] Use Cache-Control: must-revalidate only if explicit lifetime has been given (@mpdude)
• bug #34449 [Yaml] Implement multiline string as scalar block for tagged values (@natepage)
• bug #34601 [MonologBridge] Fix debug processor datetime type (@mRoca)
• bug #34842 [ExpressionLanguage] Process division by zero (@tigr1991)
• bug #34902 [PropertyAccess] forward caught exception (@xabbuh)
• bug #34903 Fixing bad order of operations with null coalescing operator (@weaverryan)
• bug #34888 [TwigBundle] add tags before processing them (@xabbuh)
• bug #34760 [Mailer] Fix SMTP Authentication when using STARTTLS (@DjLeChuck)
• bug #34762 [Config] never try loading failed classes twice with ClassExistenceResource (@nicolas-grekas)
• bug #34783 [DependencyInjection] Handle env var placeholders in CheckTypeDeclarationsPass (@fancyweb)
• bug #34839 [Cache] fix memory leak when using PhpArrayAdapter (@nicolas-grekas)
• bug #34801 [String] implement __sleep()/__wakeup() on strings (@nicolas-grekas)
• bug #34782 [String] inline Latin-ASCII rules (@nicolas-grekas)
• bug #34812 [Yaml] fix parsing negative octal numbers (@xabbuh)
• bug #34854 [Messenger] gracefully handle missing event dispatchers (@xabbuh)
• bug #34802 [Security] Check UserInterface::getPassword is not null before calling needsRehash (@dbrekelmans)
• bug #34788 [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass (@fancyweb)
• bug #34859 [SecurityBundle] Fix TokenStorage::reset not called in stateless firewall (@jderusse)
• bug #34827 [HttpFoundation] get currently session.gc_maxlifetime if ttl doesnt exists (@rafaeltovar)
• bug #34755 [FrameworkBundle] resolve service locators in debug:* commands (@nicolas-grekas)
• bug #34832 [Validator] Allow underscore character "_" in URL username and password (@romainneutron)
• bug #34765 [DoctrineBridge] Removed QueryBuilder type hint in getLoader() (@HeahDude)
• bug #34811 [TwigBridge] Update bootstrap_4_layout.html.twig missing switch-custom label (@sabruss)
• bug #34820 [FrameworkBundle][SodiumVault] Create secrets directory only when it is used (@fancyweb)
• bug #34776 [DI] fix resolving bindings for named TypedReference (@nicolas-grekas)
• bug #34794 [DependencyInjection] Resolve expressions in CheckTypeDeclarationsPass (@fancyweb)
• bug #34795 [Routing][ObjectLoader] Remove forgotten deprecation after merge (@fancyweb)
• bug #34797 [Translation] Fix FileDumper behavior (@yceruto)
• bug #34738 [SecurityBundle] Passwords are not encoded when algorithm set to "true" (@nieuwenhuisen)
• bug #34759 [SecurityBundle] Fix switch_user provider configuration handling (@fancyweb)
• bug #34779 [Security] do not validate passwords when the hash is null (@xabbuh)
• bug #34786 [SecurityBundle] Use config variable in AnonymousFactory (@martijnboers)
• bug #34784 [FrameworkBundle] Set the parameter bag as resolved in ContainerLintCommand (@fancyweb)
• bug #34763 [Security/Core] Fix checking for SHA256/SHA512 passwords (@david Brooks)
• bug #34757 [DI] Fix making the container path-independent when the app is in /app (@nicolas-grekas)

[PR] #35055

Changelog (since v5.0.0...v5.0.1)

• bug #34732 [DependencyInjection][Xml] Fix the attribute 'tag' is not allowed in 'bind' tag (@tienvx)
• bug #34729 [DI] auto-register singly implemented interfaces by default (@nicolas-grekas)
• bug #34728 [DI] fix overriding existing services with aliases for singly-implemented interfaces (@nicolas-grekas)
• bug #34649 more robust initialization from request (@dbu)
• bug #34715 [TwigBundle] remove service when base class is missing (@xabbuh)
• bug #34600 [DoctrineBridge] do not depend on the QueryBuilder from the ORM (@xabbuh)
• bug #34627 [Security/Http] call auth listeners/guards eagerly when they "support" the request (@nicolas-grekas)
• bug #34671 [Security] Fix clearing remember-me cookie after deauthentication (@chalasr)
• bug #34711 Fix the translation commands when a template contains a syntax error (@fabpot)
• bug #34032 [Mime] Fixing multidimensional array structure with FormDataPart (@jvahldick)
• bug #34697 [MonologBridge] Fix compatibility of ServerLogHandler with Monolog 2 (@jderusse)
• bug #34560 [Config][ReflectionClassResource] Handle parameters with undefined constant as their default values (@fancyweb)
• bug #34695 [Config] don't break on virtual stack frames in ClassExistenceResource (@nicolas-grekas)
• bug #34716 [DependencyInjection] fix dumping number-like string parameters (@xabbuh)
• bug #34558 [Console] Fix autocomplete multibyte input support (@fancyweb)
• bug #34130 [Console] Fix commands description with numeric namespaces (@fancyweb)
• bug #34562 [DI] Skip unknown method calls for factories in check types pass (@fancyweb)
• bug #34677 [EventDispatcher] Better error reporting when arguments to dispatch() are swapped (@rimas-kudelis)
• bug #33573 [TwigBridge] Add row_attr to all form themes (@fancyweb)
• bug #34019 [Serializer] CsvEncoder::NO_HEADERS_KEY ignored when used in constructor (@Dario Savella)
• bug #34083 [Form] Keep preferred_choices order for choice groups (@vilius-g)
• bug #34091 [Debug] work around failing chdir() on Darwin (@mary2501)
• bug #34305 [PhpUnitBridge] Read configuration CLI directive (@ro0NL)
• bug #34490 [Serializer] Fix MetadataAwareNameConverter usage with string group (@antograssiot)
• bug #34632 [Console] Fix trying to access array offset on value of type int (@Tavafi)
• bug #34669 [HttpClient] turn exception into log when the request has no content-type (@nicolas-grekas)
• bug #34662 [HttpKernel] Support typehint to deprecated FlattenException in controller (@andrew-demb)
• bug #34619 Restores preview mode support for Html and Serializer error renderers (@yceruto)
• bug #34636 [VarDumper] notice on potential undefined index (@sylvainmetayer)
• bug #34668 [Cache] Make sure we get the correct number of values from redis::mget() (@thePanz)
• bug #34621 [Routing] Continue supporting single colon in object route loaders (@fancyweb)
• bug #34554 [HttpClient] Fix early cleanup of pushed HTTP/2 responses (@lyrixx)
• bug #34607 [HttpKernel] Ability to define multiple kernel.reset tags (@rmikalkenas)
• bug #34599 [Mailer][Mailchimp Bridge] Throwing undefined index _id when setting message id (@monteiro)
• bug #34569 [Workflow] Apply the same logic of precedence between the apply() and the buildTransitionBlockerList() method (@lyrixx)
• bug #34580 [HttpKernel] Don't cache "not-fresh" state (@nicolas-grekas)
• bug #34577 [FrameworkBundle][Cache] Don't deep-merge cache pools configuration (@alxndrbauer)
• bug #34515 [DependencyInjection] definitions are valid objects (@xabbuh)
• bug #34536 [SecurityBundle] Don't require a user provider for the anonymous listener (@chalasr)
• bug #34533 [Monolog Bridge] Fixed accessing static property as non static. (@Sander-Toonen)
• bug #34502 [FrameworkBundle][ContainerLint] Keep "removing" compiler passes (@fancyweb)
• bug #34552 [Dotenv] don't fail when referenced env var does not exist (@xabbuh)
• bug #34546 [Serializer] Add DateTimeZoneNormalizer into Dependency Injection (@jewome62)
• bug #34547 [Messenger] Error when specified default bus is not among the configured (@vudaltsov)
• bug #34513 [Validator] remove return type declaration from __sleep() (@xabbuh)
• bug #34551 [Security] SwitchUser is broken when the User Provider always returns a valid user (@tucksaun)
• bug #34570 [FrameworkBundle][Notifier] Fixing notifier email definition without mailer (@chr-hertel)
• bug #34385 Avoid empty "If-Modified-Since" header in validation request (@mpdude)
• bug #34458 [Validator] ConstraintValidatorTestCase: add missing return value to mocked validate method calls (@ogizanagi)
• bug #34516 [HttpKernel] drop return type declaration (@xabbuh)
• bug #34474 [Messenger] Ignore stamps in in-memory transport (@tienvx)

[PR] #34743

Changelog (since v5.0.0-RC1...v5.0.0)

• bug #34464 [Form] group constraints when calling the validator (@nicolas-grekas)
• bug #34451 [DependencyInjection] Fix dumping multiple deprecated aliases (@shyim)
• bug #34448 [Form] allow button names to start with uppercase letter (@xabbuh)
• bug #34434 [Routing] Fix ContainerLoader and ObjectLoaderTest (@fancyweb)
• bug #34428 [Security] Fix best encoder not wired using migrate_from (@chalasr)

[PR] #34472

Changelog (since v5.0.0-BETA2...v5.0.0-RC1)

• bug #34419 [Cache] Disable igbinary on PHP >= 7.4 (@nicolas-grekas)
• bug #34347 [Messenger] Perform no deep merging of bus middleware (@vudaltsov)
• bug #34366 [HttpFoundation] Allow redirecting to URLs that contain a semicolon (@JayBizzle)
• feature #34405 [HttpFoundation] Added possibility to configure expiration time in redis session handler (@mantulo)
• bug #34397 [FrameworkBundle] Remove project dir from Translator cache vary scanned directories (@fancyweb)
• bug #34384 [DoctrineBridge] Improve queries parameters display in Profiler (@fancyweb)
• bug #34408 [Cache] catch exceptions when using PDO directly (@xabbuh)
• bug #34411 [HttpKernel] Flatten "exception" controller argument if not typed (@chalasr)
• bug #34410 [HttpFoundation] Fix MySQL column type definition. (@jbroutier)
• bug #34403 [Cache] Redis Tag Aware warn on wrong eviction policy (@andrerom)
• bug #34400 [HttpKernel] collect bundle classes, not paths (@nicolas-grekas)
• bug #34398 [Config] fix id-generation for GlobResource (@nicolas-grekas)
• bug #34404 [HttpClient] fix HttpClientDataCollector (@nicolas-grekas)
• bug #34396 [Finder] Allow ssh2 stream wrapper for sftp (@damienalexandre)
• bug #34383 [DI] Use reproducible entropy to generate env placeholders (@nicolas-grekas)
• bug #34389 [WebProfilerBundle] add FrameworkBundle requirement (@xabbuh)
• bug #34381 [WebProfilerBundle] Require symfony/twig-bundle (@fancyweb)
• bug #34358 [Security] always check the token on non-lazy firewalls (@nicolas-grekas, @lyrixx)
• bug #34390 [FrameworkBundle] fix wiring of httplug client (@nicolas-grekas)
• bug #34369 [FrameworkBundle] Disallow WebProfilerBundle < 4.4 (@derrabus)
• bug #34370 [DI] fix detecting singly implemented interfaces (@nicolas-grekas)

[PR] #34425

Changelog (since v4.3.6...v4.3.7)

• bug #34294 [Workflow] Fix error when we use ValueObject for the marking property (@FabienSalles)
• bug #34297 [DI] fix locators with numeric keys (@nicolas-grekas)
• bug #34282 [DI] Dont cache classes with missing parents (@nicolas-grekas)
• bug #34287 [HttpClient] Fix a crash when calling CurlHttpClient::__destruct() (@dunglas)
• bug #34129 [FrameworkBundle][Translation] Invalidate cached catalogues when the scanned directories change (@fancyweb)
• bug #34246 [Serializer] Use context to compute MetadataAwareNameConverter cache (@antograssiot)
• bug #34251 [HttpClient] expose only gzip when doing transparent compression (@nicolas-grekas)
• bug #34244 [Inflector] add support for 'species' (@jeffreymoelands)
• bug #34085 [Console] Detect dimensions using mode CON if vt100 is supported (@rtek)
• bug #34199 [HttpClient] Retry safe requests using HTTP/1.1 when HTTP/2 fails (@nicolas-grekas)
• bug #34192 [Routing] Fix URL generator instantiation (@X-Coder264, @HypeMC)
• bug #34134 [Messenger] fix retry of messages losing the routing key and properties (@Tobion)
• bug #34181 [Stopwatch] Fixed bug in getDuration when counting multiple ongoing periods (@TimoBakx)
• bug #34165 [PropertyInfo] Fixed type extraction for nullable collections of non-nullable elements (@happyproff)
• bug #34179 [Stopwatch] Fixed a bug in StopwatchEvent::getStartTime (@TimoBakx)
• bug #34203 [FrameworkBundle] [HttpKernel] fixed correct EOL and EOM month (@erics86)
• bug #34035 [Serializer] Fix property name usage for denormalization (@antograssiot)

[PR] #34323

Changelog (since v4.3.4...v4.3.5)

• bug #33742 [Crawler] document $default as string|null (@nicolas-grekas)
• bug #32308 [Messenger] DoctrineTransport: ensure auto setup is only done once (@bendavies)
• bug #33871 [HttpClient] bugfix exploding values of headers (@michaljusiega)
• bug #33834 [Validator] Fix ValidValidator group cascading usage (@fancyweb)
• bug #33863 [Routing] gracefully handle docref_root ini setting (@nicolas-grekas)
• bug #33846 [Cache] give 100ms before starting the expiration countdown (@nicolas-grekas)
• bug #33853 [HttpClient] fix "no_proxy" option ignored in NativeHttpClient (@Harry-Dunne)
• bug #33841 [VarDumper] fix dumping uninitialized SplFileInfo (@nicolas-grekas)
• bug #33842 [Cache] fix logger usage in CacheTrait::doGet() (@nicolas-grekas)
• bug #33835 [Workflow] Fixed BC break on WorkflowInterface (@lyrixx)
• bug #33799 [Security]: Don't let falsy usernames slip through impersonation (@j4nr6n)
• bug #33814 [HttpFoundation] Check if data passed to SessionBagProxy::initialize is an array (@mynameisbogdan)
• bug #33744 [DI] Add CSV env var processor tests / support PHP 7.4 (@ro0NL)
• bug #33805 [FrameworkBundle] Fix wrong returned status code in ConfigDebugCommand (@jschaedl)
• bug #33781 [AnnotationCacheWarmer] add RedirectController to annotation cache (@jenschude)
• bug #33777 Fix the :only-of-type pseudo class selector (@jakzal)
• bug #32051 [Serializer] Add CsvEncoder tests for PHP 7.4 (@ro0NL)
• feature #33776 Copy phpunit.xsd to a predictable path (@julienfalque)
• bug #33759 [Security/Http] fix parsing X509 emailAddress (@nicolas-grekas)
• bug #33733 [Serializer] fix denormalization of string-arrays with only one element (@mkrauser)
• bug #33754 [Cache] fix known tag versions ttl check (@SwenVanZanten)
• bug #33646 [HttpFoundation] allow additinal characters in not raw cookies (@marie)
• bug #33748 [Console] Do not include hidden commands in suggested alternatives (@m-vo)
• bug #33625 [DependencyInjection] Fix wrong exception when service is synthetic (@k0d3r1s)
• bug #32979 [Messenger] return empty envelopes when RetryableException occurs (@surikman)
• bug #32522 [Validator] Accept underscores in the URL validator, as the URL will load (@battye)
• bug #32437 Fix toolbar load when GET params are present in "_wdt" route (@Molkobain)
• bug #32925 [Translation] Collect original locale in case of fallback translation (@digilist)
• bug #33691 [HttpClient] fix race condition when reading response with informational status (@nicolas-grekas)
• bug #33727 [HttpClient] workaround bad Content-Length sent by old libcurl (@nicolas-grekas)
• bug #31198 [FrameworkBundle] Fix framework bundle lock configuration not working as expected (@HypeMC)
• bug #33719 [Cache] dont override native Memcached options (@nicolas-grekas)
• bug #33703 [Cache] fail gracefully when locking is not supported (@nicolas-grekas)
• bug #33713 Fix exceptions (PDOException) error code type (@Fruty)
• bug #32335 [Form] Names for buttons should start with lowercase (@mcfedr)
• bug #33706 [Mailer][Messenger] ensure legacy event dispatcher compatibility (@xabbuh)
• bug #33688 Add missing row_attr option to FormType (@mcsky)
• bug #33693 [Security] use LegacyEventDispatcherProxy (@dmaicher)
• bug #33675 [PhpUnit] Fix usleep mock return value (@fabpot)
• bug #33652 [Cache] skip igbinary on PHP 7.4.0 (@nicolas-grekas)
• bug #33643 [HttpClient] fix throwing HTTP exceptions when the 1st chunk is emitted (@nicolas-grekas)
• bug #33618 fix tests depending on other components' tests (@xabbuh)
• bug #33626 [PropertyInfo] ensure compatibility with type resolver 0.5 (@xabbuh)
• bug #33620 [Twig] Fix Twig config extra keys (@fabpot)
• bug #33600 [Messenger] Fix exception message of failed message is dropped on retry (@tienvx)
• bug #33601 [HttpClient] Add default value for Accept header (@numerogeek)
• bug #33340 [Finder] Adjust regex to correctly match comments in gitignore contents (@Jeroeny)
• bug #33588 [PropertyInfo] ensure compatibility with type resolver 0.5 (@xabbuh)
• bug #33575 [WebProfilerBundle] Fix time panel legend buttons (@fancyweb)
• bug #33571 [Inflector] add support 'see' to 'ee' for singularize 'fees' to 'fee' (@maxhelias)
• bug #32763 [Console] Get dimensions from stty on windows if possible (@rtek)
• bug #33570 Fixed cache pools affecting each other due to an overwritten seed variable (@roed)
• bug #33517 [Yaml] properly catch legacy tag syntax usages (@xabbuh)
• bug #33546 [DependencyInjection] Accept existing interfaces as valid named args (@fancyweb)
• bug #33547 [HttpClient] Re-enable Server Push support (@dunglas)
• bug #33521 Fixed incompatibility between ServiceSubscriberTrait and classes with protected $container property (@a-menshchikov)
• bug #33518 [Yaml] don't dump a scalar tag value on its own line (@xabbuh)
• bug #33505 [HttpClient] fallbackto CURLMOPT_MAXCONNECTS when CURLMOPT_MAX_HOST_CONNECTIONS is not available (@nicolas-grekas)
• bug #32818 [HttpKernel] Fix getFileLinkFormat() to avoid returning the wrong URL in Profiler (@Arman-Hosseini)
• bug #33487 [HttpKernel] Fix Apache mod_expires Session Cache-Control issue (@pbowyer)
• bug #33469 [FrameworkBundle] Fixed suggested package for missing server:dump command (@lyrixx)
• bug #31964 [Router] routing cache crash when using generator_class (@dFayet)
• bug #33481 [Messenger] fix empty amqp body returned as false (@Tobion)
• bug #33387 [Mailer] maintain sender/recipient name in SMTP envelopes (@xabbuh)
• bug #33449 Fix gmail relay (@beno!t POLASZEK)
• bug #33391 [HttpClient] fix support for 103 Early Hints and other informational status codes (@nicolas-grekas)
• bug #33444 [HttpClient] improve handling of HTTP/2 PUSH, disable it by default (@nicolas-grekas)
• bug #33435 [Validator] Only handle numeric values in DivisibleBy (@fancyweb)
• bug #33437 Fix #33427 (@sylfabre)
• bug #33439 [Validator] Sync string to date behavior and throw a better exception (@fancyweb)
• bug #33436 [DI] fix support for "!tagged_locator foo" (@nicolas-grekas)
• bug #32903 [PHPUnit Bridge] Avoid registering listener twice (@alexpott)
• bug #33432 [Mailer] Fix Mailgun support when a response is not JSON as expected (@fabpot)
• bug #33402 [Finder] Prevent unintentional file locks in Windows (@jspringe)
• bug #33376 [Mailer] Remove the default dispatcher in AbstractTransport (@fabpot)
• bug #33357 [FrameworkBundle] Fix about command not showing .env vars (@brentybh)
• bug #33396 Fix #33395 PHP 5.3 compatibility (@kylekatarnls)
• bug #33363 [Routing] fix static route reordering when a previous dynamic route conflicts (@nicolas-grekas)
• bug #33385 [Console] allow Command::getName() to return null (@nicolas-grekas)
• bug #33353 Return null as Expire header if it was set to null (@danrot)
• bug #33382 [ProxyManager] remove ProxiedMethodReturnExpression polyfill (@nicolas-grekas)
• bug #33377 [Yaml] fix dumping not inlined scalar tag values (@xabbuh)

[PR] #33891

Changelog (since v4.3.3...v4.3.4)

• bug #33335 [DependencyInjection] Fixed the getServiceIds implementation to always return aliases (@pdommelen)
• bug #33298 [Messenger] Stop worker when it should stop (@tienvx)
• bug #33292 [VarExporter] fix support for PHP 7.4 (@nicolas-grekas)
• bug #33282 [HttpKernel] Do not extend the new SF 4.3 ControllerEvent so we can make it final (@Tobion)
• bug #33278 [FrameworkBundle] Fix BrowserKit assertions to make them compatible with Panther (@dunglas)
• bug #33216 [Mime] Trim and remove line breaks from NamedAddress name arg (@maldoinc)
• bug #33124 [Config] Add handling for ignored keys in ArrayNode::mergeValues. (@alexandre Parent)
• bug #33244 [Router] Fix TraceableUrlMatcher behaviour with trailing slash (@xavier Leune)
• bug #33232 Fix handling for session parameters (@vkhramtsov)
• bug #32497 [Messenger] DispatchAfterCurrentBusMiddleware does not cancel messages from delayed handlers (@Nyholm, @BastienClement)
• bug #33127 [Messenger] make delay exchange and queues durable like the normal ones by default (@Tobion)
• bug #33210 [Mailer] Don't duplicate addresses in Sendgrid Transport (@pierredup)
• bug #33172 [Console] fixed a PHP notice when there is no function in the stack trace of an Exception (@fabpot)
• bug #33157 Fix getMaxFilesize() returning zero (@ausi)
• bug #33139 [Intl] Cleanup unused language aliases entry (@ro0NL)
• bug #33126 [SecurityBundle] display the correct class name on the deprecated notice (@maxhelias)
• bug #33093 [EventDispatcher] wrong Request class (@maxhelias)
• bug #33092 [DependencyInjection] Improve an exception message (@fabpot)
• bug #32541 [HttpKernel] trim the leading backslash in the controller init (@Simperfit, @fabpot)
• bug #32455 [HttpFoundation] Clear invalid session cookie (@Toflar)
• bug #33066 [Serializer] Fix negative DateInterval (@jderusse)
• bug #33045 Make HttpClientTestCase compatible with PHPUnit8 (@jderusse)
• bug #33033 [Lock] consistently throw NotSupportException (@xabbuh)
• bug #33022 [HttpClient] Remove CURLOPT_CONNECTTIMEOUT_MS curl opt (@lyrixx)
• bug #32516 [FrameworkBundle][Config] Ignore exceptions thrown during reflection classes autoload (@fancyweb)
• bug #33010 [TwigBridge] pass translation parameters to the trans filter (@xabbuh)
• bug #32981 Fix tests/code for php 7.4 (@jderusse)
• bug #32986 [Mime] fixed wrong mimetype (@rjwebdev)
• bug #32992 [ProxyManagerBridge] Polyfill for unmaintained version (@jderusse)
• bug #32989 [HttpClient] Declare $active first to prevent weird issue (@Kocal)
• bug #32999 Added correct plural for box -> boxes (@cinamo)
• bug #32933 [PhpUnitBridge] fixed PHPUnit 8.3 compatibility: method handleError was renamed to __invoke (@karser)
• bug #32947 [Intl] Support DateTimeInterface in IntlDateFormatter::format (@pierredup)
• bug #32919 [Intl] Order alpha2 to alpha3 mapping + phpdoc fixes (@ro0NL)
• bug #32792 [Messenger] Fix incompatibility with FrameworkBundle <4.3.1 (@chalasr)
• bug #32836 [Messenger] Removed named parameters and replaced with ? placeholders for sqlsrv compatibility (@david Legatt)
• bug #32838 [FrameworkBundle] Detect indirect env vars in routing (@ro0NL)
• bug #32918 [Intl] Order alpha2 to alpha3 mapping (@ro0NL)
• bug #32902 [PhpUnitBridge] Allow sutFqcnResolver to return array (@VincentLanglet)
• bug #32814 Create mailBody with only attachments part present (@srsbiz)
• bug #32682 [HttpFoundation] Revert getClientIp @return docblock (@ossinkine)
• bug #32910 [Yaml] PHP-8: Uncaught TypeError: abs() expects parameter 1 to be int or float, string given (@aleksandr Dankovtsev)
• bug #32870 #32853 Check if $this->parameters is array. (@ABGEO07)
• bug #32899 [Mailer] fix wrong error message when connection closes unexpectedly (@fabpot)
• bug #32895 [Mailer] Fix error not being thrown properly (@fabpot)
• bug #32868 [PhpUnitBridge] Allow symfony/phpunit-bridge > 4.2 to be installed with phpunit 4.8 (@jderusse)
• bug #32823 [HttpClient] Preserve the case of headers when sending them (@nicolas-grekas)
• bug #32767 [Yaml] fix comment in multi line value (@soufianZantar)
• bug #32790 [HttpFoundation] Fix getMaxFilesize (@bennyborn)
• bug #32796 [Cache] fix warning on PHP 7.4 (@jpauli)
• bug #32806 [Console] fix warning on PHP 7.4 (@rez1dent3)
• bug #32809 Don't add object-value of static properties in the signature of container metadata-cache (@arjenm)
• bug #32708 Recompile container when translations directory changes (@pierredup)
• bug #32722 [DependencyInjection] Fix bindings and tagged_locator (@deguif)
• bug #32802 Make sure trace_level is always defined (@dbu)
• bug #30096 [DI] Fix dumping Doctrine-like service graphs (bis) (@weaverryan, @nicolas-grekas)
• bug #32799 [HttpKernel] do not stopwatch sections when profiler is disabled (@Tobion)
• bug #32631 [Messenger] expire delay queue and fix auto_setup logic (@Tobion)
• bug #32641 [Messenger] Retrieve table default options from the SchemaManager (@vincenttouzet)

[PR] #33345

Changelog (since v4.3.2...v4.3.3)

• bug #32726 [Messenger] Fix redis last error not cleared between calls (@chalasr)
• bug #32760 [HttpKernel] clarify error handler restoring process (@xabbuh)
• bug #32730 [Inflector] Fix pluralizing words ending with "son" (@norkunas)
• bug #32715 [DI] fix perf issue with lazy autowire error messages (@nicolas-grekas)
• bug #32503 Fix multiSelect ChoiceQuestion when answers have spaces (@IceMaD)
• bug #32688 [Yaml] fix inline handling when dumping tagged values (@xabbuh)
• bug #32710 [Security/Core] align defaults for sodium with PHP 7.4 (@nicolas-grekas)
• bug #32644 [WebProfileBundle] Avoid getting right to left style (@Arman-Hosseini)
• bug #32689 [HttpClient] rewind stream when using Psr18Client (@nicolas-grekas)
• bug #32700 [Messenger] Flatten collection of stamps collected by the traceable middleware (@ogizanagi)
• bug #32699 [HttpClient] fix canceling responses in a streaming loop (@nicolas-grekas)
• bug #32679 [Intl] relax some date parser patterns (@xabbuh)
• bug #31303 [VarDumper] Use \ReflectionReference for determining if a key is a reference (php >= 7.4) (@dorumd, @nicolas-grekas)
• bug #32485 [Validator] Added support for validation of giga values (@kernig)
• bug #32567 [Messenger] pass transport name to factory (@Tobion)
• bug #32568 [Messenger] Fix UnrecoverableExceptionInterface handling (@LanaiGrunt)
• bug #32604 Properly handle optional tag attributes for !tagged_iterator (@apfelbox)
• bug #32571 [HttpClient] fix debug output added to stderr at shutdown (@nicolas-grekas)
• bug #32443 [PHPUnitBridge] Mute deprecations triggered from phpunit (@greg0ire)
• bug #32572 Bump minimum version of symfony/phpunit-bridge (@fancyweb)
• bug #32438 [Serializer] XmlEncoder: don't cast padded strings (@ogizanagi)
• bug #32579 [Config] Do not use absolute path when computing the vendor freshness (@lyrixx)
• bug #32563 Container*::getServiceIds() should return strings (@mathroc)
• bug #32553 [Mailer] Allow register mailer configuration in xml format (@Koc)
• bug #32442 Adding missing event_dispatcher wiring for messenger.middleware.send_message (@weaverryan)
• bug #32466 [Config] Fix for signatures of typed properties (@tvandervorm)
• bug #32501 [FrameworkBundle] Fix descriptor of routes described as callable array (@ribeiropaulor)
• bug #32500 [Debug][DebugClassLoader] Include found files instead of requiring them (@fancyweb)
• bug #32464 [WebProfilerBundle] Fix Twig 1.x compatibility (@yceruto)
• bug #31620 [FrameworkBundle] Inform the user when save_path will be ignored (@gnat42)
• bug #32096 Don't assume port 0 for X-Forwarded-Port (@alexbowers, @xabbuh)
• bug #31820 [SecurityBundle] Fix profiler dump for non-invokable security listeners (@chalasr)
• bug #32392 [Messenger] Doctrine Transport: Support setting auto_setup from DSN (@bendavies)
• bug #31267 [Translator] Load plurals from mo files properly (@Stadly)
• bug #31266 [Translator] Load plurals from po files properly (@Stadly)
• bug #32383 [Serializer] AbstractObjectNormalizer ignores the property types of discriminated classes (@sandergo90)
• bug #32413 [Messenger] fix publishing headers set on AmqpStamp (@Tobion)
• bug #32421 [EventDispatcher] Add tag kernel.rest on 'debug.event_dispatcher' service (@lyrixx)
• bug #32398 [Messenger] Removes deprecated call to ReflectionType::__toString() on MessengerPass (@brunowowk)
• bug #32379 [SecurityBundle] conditionally register services (@xabbuh)
• bug #32380 [Messenger] fix broken key normalization (@Tobion)
• bug #32363 [FrameworkBundle] reset cache pools between requests (@nicolas-grekas)
• bug #32365 [DI] fix processing of regular parameter bags by MergeExtensionConfigurationPass (@nicolas-grekas)
• bug #32187 [PHPUnit] Fixed composer error on Windows (@misterx)
• bug #32299 [Lock] Stores must implement putOffExpiration (@jderusse)
• bug #32302 [Mime] Remove @Internal annotations for the serialize methods (@francoispluchino)
• bug #32334 [Messenger] Fix authentication for redis transport (@alexander-schranz)
• bug #32309 Fixing validation for messenger transports retry_strategy service key (@weaverryan)
• bug #32331 [Workflow] only decorate when an event dispatcher was passed (@xabbuh)
• bug #32236 [Cache] work aroung PHP memory leak (@nicolas-grekas)
• bug #32206 Catch JsonException and rethrow in JsonEncode (@phil-davis)
• bug #32211 [Mailer] Fix error message when connecting to a stream raises an error before connect() (@fabpot)
• bug #32210 [Mailer] Fix timeout type hint (@fabpot)
• bug #32199 [EventDispatcher] improve error messages in the event dispatcher (@xabbuh)
• bug #32200 [Security/Core] work around sodium_compat issue (@nicolas-grekas)

[PR] #32788

Changelog (since v4.3.1...v4.3.2)

• bug #31954 [PhpunitBridge] Read environment variable from superglobals (@greg0ire)
• bug #32131 [Mailgun Mailer] fixed issue when using html body (@alOneh)
• bug #31730 [PhpUnitBridge] More accurate grouping (@greg0ire)
• bug #31966 [Messenger] Doctrine Connection find and findAll now correctly decode headers (@TimoBakx)
• bug #31972 Add missing rendering of form help block. (@alexsegura)
• bug #32141 [HttpClient] fix dealing with 1xx informational responses (@nicolas-grekas)
• bug #32138 [Filesystem] fix mirroring directory into parent directory (@xabbuh)
• bug #32137 [HttpFoundation] fix accessing session bags (@xabbuh)
• bug #32147 [HttpClient] fix timing measurements with NativeHttpClient (@nicolas-grekas)
• bug #32165 revert #30525 due to performance penalty (@bendavies)
• bug #32164 [EventDispatcher] collect called listeners information only once (@xabbuh)
• bug #32173 [FrameworkBundle] Fix calling Client::getProfile() before sending a request (@dunglas)
• bug #32163 [DoctrineBridge] Fix type error (@norkunas)
• bug #32154 [Messenger] fix retrying handlers using DoctrineTransactionMiddleware (@Tobion)
• bug #32169 [Security/Core] require libsodium >= 1.0.14 (@nicolas-grekas)
• bug #32170 [Security/Core] Don't use ParagonIE_Sodium_Compat (@nicolas-grekas)
• bug #32156 [Workflow] re-add workflow.definition tag to workflow services (@nikossvnk)
• bug #32053 [Messenger] No need for retry to require SentStamp (@Tobion)
• bug #32083 [HttpClient] fixing passing debug info to progress callback (@nicolas-grekas)
• bug #32129 [DebugBundle] fix register ReflectionCaster::unsetClosureFileInfo caster in var cloner service (@alekitto)
• bug #32027 [Messenger] Remove DispatchAfterCurrentBusStamp when message is put on internal queue (@Nyholm)
• bug #32125 [Form] accept floats for input="string" in NumberType (@xabbuh)
• bug #32094 [Validator] Use LogicException for missing Property Access Component in comparison constraints (@Lctrs)
• bug #32136 [FrameworkBundle] sync require-dev and conflict constraints (@xabbuh)
• bug #32123 [Form] fix translation domain (@xabbuh)
• bug #32115 [SecurityBundle] don't validate IP addresses from env var placeholders (@xabbuh)
• bug #32116 [FrameworkBundle] tag the FileType service as a form type (@xabbuh)
• bug #32109 [Messenger] fix delay exchange recreation after disconnect (@Tobion)
• bug #32090 [Debug] workaround BC break in PHP 7.3 (@nicolas-grekas)
• bug #32076 [Lock] Fix PDO prune not called (@jderusse)
• bug #32071 Fix expired lock not cleaned (@jderusse)
• bug #32052 [Messenger] fix AMQP delay queue to be per exchange (@Tobion)
• bug #32065 [HttpClient] throw DecodingExceptionInterface when toArray() fails because of content-type error (@nicolas-grekas)
• bug #32057 [HttpFoundation] Fix SA/phpdoc JsonResponse (@ro0NL)
• bug #32040 [DI] Show the right class autowired when providing a non-existing class (@Simperfit)
• bug #32035 [Messenger] fix delay delivery for non-fanout exchanges (@Tobion)
• bug #32025 SimpleCacheAdapter fails to cache any item if a namespace is used (@moufmouf)
• bug #32022 [HttpClient] Don't use CurlHttpClient on Windows when curl.cainfo is not set (@nicolas-grekas)
• bug #32037 [Form] validate composite constraints in all groups (@xabbuh)
• bug #32007 [Serializer] Handle true and false appropriately in CSV encoder (@battye)
• bug #32036 [Messenger] improve logs (@Tobion)
• bug #31998 Parameterize Mailgun's region (@jderusse)
• bug #32000 [Routing] fix absolute url generation when scheme is not known (@Tobion)
• bug #32012 Add statement to fileLink to ignore href code when no fileLink. (@bmxmale)
• bug #32024 [VarDumper] fix dumping objects that implement __debugInfo() (@nicolas-grekas)
• bug #32014 Do not log or call the proxy function when the locale is the same (@gmponos)
• bug #32011 [HttpClient] fix closing debug stream prematurely (@nicolas-grekas)
• bug #32017 [Contracts] add missing required dependencies (@mbessolov)
• bug #31992 Fix sender/recipients in SMTP Envelope (@fabpot)
• bug #31999 [PhpunitBridge] Restore php 5.5 compat (@greg0ire)
• bug #31991 [EventDispatcher] collect called listeners information only once (@xabbuh)
• bug #31988 [TwigBridge] add back possibility to use form themes without translations (@xabbuh)
• bug #31982 [HttpClient] fix Psr18Client handling of non-200 response codes (@nicolas-grekas)
• bug #31953 [DoctrineBridge] fix handling nested embeddables (@xabbuh)
• bug #31962 Fix reporting unsilenced deprecations from insulated tests (@nicolas-grekas)
• bug #31936 PropertyInfoLoader should not try to add validation to non-existent property (@weaverryan)
• bug #31923 [Serializer] Fix DataUriNormalizer deprecation (MIME type guesser is optional) (@ogizanagi)
• bug #31928 [FrameworkBundle] avoid service id conflicts with Swiftmailer (@xabbuh)
• bug #31925 [Form] fix usage of legacy TranslatorInterface (@nicolas-grekas)
• bug #31908 [Validator] fix deprecation layer of ValidatorBuilder (@nicolas-grekas)

[PR] #32195

Changelog (since v4.3.0...v4.3.1)

• bug #31894 Fix wrong requirements for ocramius/proxy-manager in root composer.json (@henrikvolmer)
• bug #31865 [Form] Fix wrong DateTime on outdated ICU library (@aweelex)
• bug #31893 [HttpKernel] fix link to source generation (@nicolas-grekas)
• bug #31880 [FrameworkBundle] fix BC-breaking property in WebTestAssertionsTrait (@nicolas-grekas)
• bug #31881 [FramworkBundle][HttpKernel] fix KernelBrowser BC layer (@nicolas-grekas)
• bug #31879 [Cache] Pass arg to get callback everywhere (@fancyweb)
• bug #31874 [Doctrine Bridge] Check field type before adding Length constraint (@belinde)
• bug #31872 [Messenger] Add missing runtime check for ext redis version (@chalasr)
• bug #31864 [Cache] Fixed undefined variable in ArrayTrait (@eXtreme)
• bug #31863 [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor (@ivo)
• bug #31850 [HttpClient] add $response->cancel() (@nicolas-grekas)
• bug #31871 [HttpClient] revert bad logic around JSON_THROW_ON_ERROR (@nicolas-grekas)
• bug #31869 Fix json-encoding when JSON_THROW_ON_ERROR is used (@nicolas-grekas)
• bug #31868 [HttpKernel] Fix handling non-catchable fatal errors (@nicolas-grekas)
• bug #31834 [HttpClient] Don't throw InvalidArgumentException on bad Location header (@nicolas-grekas)
• bug #31846 [Mailer] Set default crypto method (@bpolaszek)
• bug #31849 [Console] Add check for Konsole/Yakuake to disable hyperlinks (@belinde)
• bug #31854 Rename the Symfony Mailer service implementation to avoid conflict with SwitMailer (@tgalopin)
• bug #31856 [VarDumper] fix dumping the cloner itself (@nicolas-grekas)
• bug #31861 [HttpClient] work around PHP 7.3 bug related to json_encode() (@nicolas-grekas)
• bug #31860 [HttpFoundation] work around PHP 7.3 bug related to json_encode() (@nicolas-grekas)
• bug #31852 [Form] add missing symfony/service-contracts dependency (@nicolas-grekas)
• bug #31836 [DoctrineBridge] do not process private properties from parent class (@xabbuh)
• bug #31790 [Messenger] set amqp content_type based on serialization format (@Tobion)
• bug #31832 [HttpClient] fix unregistering the debug buffer when using curl (@nicolas-grekas)
• bug #31407 [Security] added support for updated "distinguished name" format in x509 authentication (@robert Kopera)
• bug #31774 [Mailer] Fix the possibility to set a From header from MessageListener (@fabpot)
• bug #31811 [DoctrineBridge] don't add embedded properties to wrapping class metadata (@xabbuh)
• bug #31786 [Translation] Fixed case sensitivity of lint:xliff command (@javiereguiluz)
• bug #31815 [Translator] Collect locale details earlier in the process (@pierredup)
• bug #31761 [TwigBridge] suggest Translation Component when TranslationExtension is used (@nicolas-grekas)
• bug #31748 [Messenger] Inject RoutableMessageBus instead of bus locator (@chalasr)
• bug #31763 [Security\Core] Make SodiumPasswordEncoder validate BCrypt-ed passwords (@nicolas-grekas)
• bug #31744 [Validator] Fix TimezoneValidator default option (@ro0NL)
• bug #31749 [DoctrineBridge][Validator] do not enable validator auto mapping by default (@xabbuh)
• bug #31757 [DomCrawler] Fix type error with null Form::$currentUri (@chalasr)
• bug #31721 [PHPUnitBridge] Use a more appropriate group when deprecating mode (@greg0ire)

[PR] #31901

Changelog (since v4.3.0-RC1...v4.3.0)

• bug #31654 [HttpFoundation] Do not set X-Accel-Redirect for paths outside of X-Accel-Mapping (@vilius-g)

[PR] #31717

Changelog (since v4.3.0-BETA2...v4.3.0-RC1)

• bug #31650 Create an abstract HTTP transport and extend it in all HTTP transports (@bocharsky-bw)
• feature #31641 [HttpClient] make $response->getInfo('debug') return extended logs about the HTTP transaction (@nicolas-grekas)
• feature #31571 [Contracts] split in one package per sub-contracts (@nicolas-grekas)
• bug #31625 [Messenger] Disable the SchemaAssetsFilter when setup the transport (@vincenttouzet)
• bug #31621 [Messenger] Fix missing auto_setup for RedisTransport (@chalasr)
• bug #31584 [Workflow] Do not trigger extra guards (@lyrixx)
• bug #31632 [Messenger] Use "real" memory usage to honor --memory-limit (@chalasr)
• bug #31610 [HttpClient] fix handling exceptions thrown before first mock chunk (@nicolas-grekas)
• bug #31615 Allow WrappedListener to describe uncallable listeners (@derrabus)
• bug #31599 [Translation] Fixed issue with new vs old TranslatorInterface in TranslationDataCollector (@althaus)
• bug #31565 [Mime][HttpFoundation] Added mime type audio/x-hx-aac-adts (@ifaridjalilov)
• bug #31591 [FrameworkBundle] fix named autowiring aliases for TagAwareCacheInterface (@nicolas-grekas)
• bug #31590 [Cache] improve logged messages (@nicolas-grekas)
• bug #31586 [HttpClient] display proper error message on TransportException when curl is used (@nicolas-grekas)
• bug #31349 [WebProfilerBundle] Use absolute URL for profiler links (@Alumbrados)
• bug #31541 [DI] fix using bindings with locators of service subscribers (@nicolas-grekas)
• bug #31568 [Process] Fix infinite waiting for stopped process (@mshavliuk)

[PR] #31652

Changelog (since v4.3.0-BETA1...v4.3.0-BETA2)

• bug #31569 [HttpClient] Only use CURLMOPT_MAX_HOST_CONNECTIONS & CURL_VERSION_HTTP2 if defined (@GawainLynch)
• bug #31566 [Security] fixed a fatal error when upgrading from 4.2 (@fabpot)
• bug #31219 [HttpClient] Allow arrays as query parameters (@sleepyboy)
• bug #31482 [Messenger][DoctrineBridge] Throws UnrecoverableMessageHandlingException when passed invalid entity manager name (@Koc)
• feature #31471 [Messenger] Add "non sendable" stamps (@weaverryan)
• bug #31545 [Messenger] Fix redis Connection::get() should be non blocking by default (@chalasr)
• bug #31537 [Workflow] use method marking store (@noniagriconomie)
• bug #31551 [ProxyManager] isProxyCandidate() does not take into account interfaces (@andrerom)
• bug #31542 [HttpClient] add missing argument check (@nicolas-grekas)
• bug #31544 [Messenger] Fix undefined index on read timeout (@chalasr)
• bug #31335 [Doctrine] Respect parent class contract in ContainerAwareEventManager (@Koc)
• bug #31421 [Routing][AnnotationClassLoader] fix utf-8 encoding in default route name (@przemyslaw-bogusz)
• bug #31493 [EventDispatcher] Removed "callable" type hint from WrappedListener constructor (@wskorodecki)
• bug #31502 [WebProfilerBundle][Form] The form data collector return serialized data (@Simperfit)
• bug #31510 Use the current working dir as default first arg in 'link' binary (@lyrixx)
• bug #31524 [HttpFoundation] prevent deprecation when filesize matches error code (@xabbuh)
• bug #31535 [Debug] Wrap call to require_once in a try/catch (@lyrixx)
• feature #31030 [Serializer] Deprecate calling createChildContext without the format parameter (@dbu)
• bug #31459 Fix the interface incompatibility of EventDispatchers (@keulinho)
• bug #31463 [DI] default to service id - not FQCN - when building tagged locators (@nicolas-grekas)
• feature #31294 [Form] Add intl/choice_translation_locale option to TimezoneType (@ro0NL)
• feature #31452 [FrameworkBundle] Add cache configuration for PropertyInfo (@alanpoulain)
• feature #31486 [Doctrine][PropertyInfo] Detect if the ID is writeable (@dunglas)
• bug #31481 [Validator] Autovalidation: skip readonly props (@dunglas)
• bug #31480 Update dependencies in the main component (@DavidPrevot)
• bug #31477 [PropertyAccess] Add missing property to PropertyAccessor (@vudaltsov)
• bug #31479 [Cache] fix saving unrelated keys in recursive callback calls (@nicolas-grekas)
• bug #30930 [FrameworkBundle] Fixed issue when a parameter contains a '' (@lyrixx)
• bug #31438 [Serializer] Fix denormalization of object with variadic constructor typed argument (@ajgarlag)
• bug #31445 [Messenger] Making cache rebuild correctly when message subscribers change (@weaverryan)
• bug #31442 [Validator] Fix finding translator parent definition in compiler pass (@deguif)
• bug #31475 [HttpFoundation] Allow set 'None' on samesite cookie flag (@markitosgv)
• feature #31454 [Messenger] remove send_and_handle which can be achieved with SyncTransport (@Tobion)
• bug #31425 [Messenger] On failure retry, make message appear received from original sender (@weaverryan)
• bug #31472 [Messenger] Fix routable message bus default bus (@weaverryan)
• bug #31465 [Serializer] Fix BC break: DEPTH_KEY_PATTERN must be public (@dunglas)
• bug #31458 [TwigBundle] Fix Mailer integration in Twig (@fabpot)
• bug #31456 Remove deprecated usage of some Twig features (@fabpot)
• bug #31207 [Routing] Fixed unexpected 404 NoConfigurationException (@yceruto)
• bug #31261 [Console] Commands with an alias should not be recognized as ambiguous when using register (@Simperfit)
• bug #31371 [DI] Removes number of elements information in debug mode (@jschaedl)
• bug #31418 [FrameworkBundle] clarify the possible class/interface of the cache (@xabbuh)

[PR] #31577

Changelog (since v4.2.7...v4.2.8)

• bug #31338 Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)" (@nicolas-grekas)
• bug #31326 fix ConsoleFormatter - call to a member function format() on string (@keksa)
• bug #31331 [Workflow] Fixed dumping when many transition with same name exist (@lyrixx)
• bug #31302 [FramworkBundle] mark any env vars found in the ide setting as used (@nicolas-grekas)
• bug #31290 [TwigBundle] Use the apply tag instead of the filter tag (@greg0ire)
• bug #31275 [Translator] Preserve default domain when extracting strings from php files (@Stadly)
• bug #31240 Fix url matcher edge cases with trailing slash (@arjenm)
• bug #31201 [Form] resolve class name parameters (@xabbuh)
• bug #31213 [WebProfilerBundle] Intercept redirections only for HTML format (@javiereguiluz)
• bug #31210 [PhpUnitBridge] fix reading phpunit.xml on bootstrap (@nicolas-grekas)
• bug #31023 [Routing] Fix route URL generation in CLI context (@X-Coder264)
• bug #31117 [FrameworkBundle] fix math depth handler configuration (@Raulnet)
• bug #31182 [Routing] fix trailing slash matching with empty-matching trailing vars (@nicolas-grekas)
• bug #31167 [Routing] fix matching trailing vars with defaults (@nicolas-grekas)
• bug #31164 [Validator] fix LegacyTranslatorProxy (@nicolas-grekas)
• bug #31156 [FrameworkBundle] call method with Translator component only (@xabbuh)

[PR] #31347

Changelog (since v4.2.6...v4.2.7)

• bug #31107 [Routing] fix trailing slash redirection with non-greedy trailing vars (@nicolas-grekas)
• bug #31108 [FrameworkBundle] decorate the ValidatorBuilder's translator with LegacyTranslatorProxy (@nicolas-grekas)
• bug #31121 [HttpKernel] Fix get session when the request stack is empty (@yceruto)
• bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (@vermeirentony)
• bug #31142 Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)" (@chalasr)
• security #cve-2019-10910 [DI] Check service IDs are valid (@nicolas-grekas)
• security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (@stof)
• security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (@nicolas-grekas)
• security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (@pborreli)
• security #cve-2019-10913 [HttpFoundation] reject invalid method override (@nicolas-grekas)

[PR] #31148
[SECURITY] Security release

Changelog (since v4.2.5...v4.2.6)

• bug #31088 [DI] fix removing non-shared definition while inlining them (@nicolas-grekas)
• bug #29944 [DI] Overriding services autowired by name under _defaults bind not working (@przemyslaw-bogusz, @renanbr)
• bug #30993 [FrameworkBundle] Fix for Controller DEPRECATED when using composer --optimized (@aweelex)
• bug #31076 [HttpKernel] Fixed LoggerDataCollector crashing on empty file (@althaus)
• bug #31071 property normalizer should also pass format and context to isAllowedAttribute (@dbu)
• bug #31059 Show more accurate message in profiler when missing stopwatch (@linaori)
• bug #31026 [Serializer] Add default object class resolver (@jdecool)
• bug #31031 [Serializer] MetadataAwareNameConverter: Do not assume that property names are strings (@soyuka)
• bug #31043 [VarExporter] support PHP7.4 __serialize & __unserialize (@nicolas-grekas)
• bug #30423 [Security] Rework firewall's access denied rule (@dimabory)
• bug #31020 [VarExporter] fix exporting classes with private constructors (@nicolas-grekas)
• bug #31012 [Process] Fix missing $extraDirs when open_basedir returns (@arsonik)
• bug #30852 [Console] fix buildTableRows when Colspan is use with content too long (@Raulnet)
• bug #30950 [Serializer] Also validate callbacks when given in the normalizer context (@dbu)
• bug #30907 [Serializer] Respect ignored attributes in cache key of normalizer (@dbu)
• bug #30085 Fix TestRunner compatibility to PhpUnit 8 (@alexander-schranz)
• bug #30999 Fix dark themed componnents (@ro0NL)
• bug #30977 [serializer] prevent mixup in normalizer of the object to populate (@dbu)
• bug #30976 [Debug] Fixed error handling when an error is already handled when another error is already handled (5) (@lyrixx)
• bug #30979 Fix the configurability of CoreExtension deps in standalone usage (@stof)
• bug #30918 [Cache] fix using ProxyAdapter inside TagAwareAdapter (@dmaicher)
• bug #30961 [Form] fix translating file validation error message (@xabbuh)
• bug #30951 Handle case where no translations were found (@greg0ire)
• bug #29800 [Validator] Only traverse arrays that are cascaded into (@corphi)
• bug #30921 [Translator] Warm up the translations cache in dev (@tgalopin)
• bug #30922 [TwigBridge] fix horizontal spacing of inlined Bootstrap forms (@xabbuh)
• bug #30860 [Profiler] Fix dark theme elements color (@dFayet)
• bug #30895 [Form] turn failed file uploads into form errors (@xabbuh)
• bug #30919 [Translator] Fix wrong dump for PO files (@deguif)
• bug #30889 [DependencyInjection] Fix a wrong error when using a factory (@Simperfit)
• bug #30911 [Console] Fix table trailing backslash (@maidmaid)
• bug #30903 [Messenger] Uses the SerializerStamp when deserializing the envelope (@sroze)
• bug #30879 [Form] Php doc fixes and cs + optimizations (@jules Pietri)
• bug #30883 [Console] Fix stty not reset when aborting in QuestionHelper::autocomplete() (@Simperfit)
• bug #30878 [Console] Fix inconsistent result for choice questions in non-interactive mode (@chalasr)
• bug #30825 [Routing] Fix: annotation loader ignores method's default values (@voronkovich)

[PR] #31125

Changelog (since v4.2.4...v4.2.5)

• bug #30660 [Bridge][Twig] DebugCommand - fix escaping and filter (@SpacePossum)
• bug #30784 [Translator] Add resource path to exception message for schema valida… (@jschaedl)
• bug #30720 Fix getSetMethodNormalizer to correctly ignore the attributes specified in "ignored_attributes" (@emmanuel BORGES)
• bug #30749 [Serializer] Added check of constuctor modifiers to AbstractNormalizer (@NekaKawaii)
• bug #30776 [Routing] Fix routes annotation loading with glob pattern (@snoob)
• bug #30773 [DependencyInjection] Fix hardcoded hotPathTagName (@jderusse)
• bug #30737 [Validator] Improve constraint default option check (@vudaltsov)
• bug #30736 [Validator] Fix annotation default for @count and @Length (@vudaltsov)
• bug #30621 [Cache] Ensure key exists before checking array value (@jrjohnson)
• bug #30711 [Serializer] Use object class resolver when extracting attributes (@joelwurtz)
• bug #30641 [FrameworkBundle] properly describe service definitions without class (@xabbuh)
• bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (@dmaicher)
• bug #30648 Debug finalized config in debug:config (@ro0NL)
• bug #30640 [Phpunit] fixed support for PHP 5.3 (@fabpot)
• bug #30616 Fix case when multiple loaders are providing paths for the same namespace (@yceruto)
• bug #30595 Do not validate child constraints if form has no validation groups (@maryo)
• bug #30440 [TwigBridge] Fix DebugCommand when chain loader is involved (@yceruto)
• bug #30479 Check if Client exists when test.client does not exist, to provide clearer exception message (@SerkanYildiz)
• bug #30597 [Form] Added ResetInterface to CachingFactoryDecorator (@HeahDude)
• bug #30593 Fixed usage of TranslatorInterface in form extension (fixes #30591) (@althaus)
• feature #30584 [Intl] Add compile binary (@ro0NL)
• bug #30487 Fix Cache error while using anonymous class (@emmanuel BORGES)
• bug #30576 [Cache] fix LockRegistry (@nicolas-grekas)
• bug #30548 Correct language code for ukrainian language (@stanleyk)
• bug #30518 [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers (@nicolas-grekas)
• bug #30515 [Cache] Only delete one key at a time when on Predis + Cluster (@andrerom)
• bug #30511 [Process] fix using argument $php of new PhpProcess() (@nicolas-grekas)
• bug #30507 [Routing] Fixed XML options resolution (@jules Pietri)
• bug #30506 [TwigBridge] remove deprecation triggered when using Twig 2.7 (@nicolas-grekas)
• bug #30496 [PHPUnit-Bridge] override some Composer environment variables (@nicoweb)
• bug #30505 [TwigBridge] Remove usages of the spaceless tag (@nicolas-grekas)
• bug #30466 [Messenger] Make 'headers' key optional for encoded messages (@yceruto)
• bug #30474 compatibility with phpunit8 (@garak)
• bug #30497 [HttpKernel] Change default log level for output streams (@yceruto)
• bug #30498 [translation] Update defaut format from yml to yaml (@GaryPEGEOT)
• bug #30490 Don't resolve the Deprecation error handler mode until a deprecation is triggered (@emmanuel BORGES)
• bug #30396 [Form] Avoid a form type extension appears many times in debug:form (@markitosgv)
• bug #30361 [PropertyInfo] Fix undefined variable fromConstructor when passing context to getTypes (@mantis)
• bug #30361 [PropertyInfo] Fix undefined variable fromConstructor when passing context to getTypes (@mantis, @OskarStark)
• bug #30410 [Monolog] Really reset logger when calling logger::reset() (@lyrixx)
• bug #30437 [Debug] detect annotations before blank docblock lines (@xabbuh)
• bug #30417 Autoconfig: don't automatically tag decorators (@dunglas)
• bug #30392 [PropertyAccess] Fixed PropertyPathBuilder remove that fails to reset internal indexes (@GregOriol)

[PR] #30838

Changelog (since v4.2.3...v4.2.4)

• bug #30383 [WebProfilerBundle] toolbar: invisible route name in Firefox (@inmarelibero)
• bug #26532 [HttpKernel] Correctly merging cache directives in HttpCache/ResponseCacheStrategy (@aschempp)
• bug #30363 Fixed the DebugClassLoader compatibility with eval()'d code on Darwin (@skalpa)
• bug #30329 [Form] IntegerType: reject submitted non-integer numbers (@xabbuh)
• bug #30331 [Cache] fix warming up cache.system and apcu (@nicolas-grekas)
• bug #30347 [Security] Change FormAuthenticator if condition (@PReimers)
• bug #30354 [Console] handles multi-byte characters in autocomplete (@jls-esokia)
• bug #30351 Fix getItems() performance issue with RedisCluster (php-redis) (@andrerom)
• bug #30350 [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning (@nicolas-grekas)
• bug #30327 [HttpKernel] Fix possible infinite loop of exceptions (@enumag)
• bug #27601 [Routing] fix URL generation with look-around requirements (@nasimnabavi)
• bug #30277 [Console] Prevent ArgvInput::getFirstArgument() from returning an option value (@chalasr)
• bug #29981 [Security] Complain about an empty decision strategy (@corphi)
• bug #29822 [EventDispatcher] Fix unknown priority (@ro0NL)
• bug #30324 [Validator] Fixed duplicate UUID (@ralfkuehnel)
• bug #30265 [Form] do not validate non-submitted form fields in PATCH requests (@xabbuh)
• bug #30313 Avoid mutating the Finder when building the iterator (@stof)
• bug #30294 [FrameworkBundle] Fix Descriptor throwing on non existent parent (@GuilhemN)
• bug #30271 [Console] Fix command testing with missing user inputs (@chalasr)
• bug #30278 Remove unnecessary ProgressBar stdout writes (fixes flickering) (@ostrolucky)
• bug #30274 [VarDumper] fix serializing Stub instances (@nicolas-grekas)
• bug #30273 [Validator] Added missing use statement for UnexpectedTypeException (@devrck)
• bug #30247 Don't resolve the Deprecation error handler mode until a deprecation is triggered (@ossinkine)
• bug #30264 [Debug][ErrorHandler] Preserve next error handler (@fancyweb)
• bug #30245 fix lost namespace in eval (@fizzka)
• bug #30090 [FrameworkBundle] add constraint validators before optimizations (@xabbuh)
• feature #30126 [Form] forward valid numeric values to transform() (@xabbuh)
• bug #30122 [Security] fix switch user without having current token (@antoine Lamirault)
• bug #30136 use PropertyAccessorInterface instead of PropertyAccessor (@nick-zh)
• bug #30124 Fix KernelTestCase compatibility for PhpUnit 8 (bis) (@nicolas-grekas)
• bug #30061 [Form] render integer types with grouping as text input (@xabbuh)
• bug #30063 [Form] don't lose int precision with not needed type casts (@xabbuh)
• bug #30076 [Form] ignore _method forms in NativeRequestHandler (@xabbuh)
• bug #30084 Fix KernelTestCase compatibility for PhpUnit 8 (@alexander-schranz)
• bug #30093 [DependencyInjection] add $lazyLoad context to the generated code for lazy non-shared service by PhpDumper (@XuruDragon)
• bug #30102 [Workflow] Graphviz dumper escape not always a string (@Korbeil)
• bug #29884 [Form] CsrfValidationListener marks the token as invalid if it is not a string (@umpirsky)
• bug #30058 [Routing] fix perf issue when dumping large number of routes (@nicolas-grekas)
• bug #30062 [Form] do not overwrite the constraint being evaluated (@xabbuh)
• bug #30074 Fix wrong value in file id attribute for Xliff 2.0 (@deguif)
• bug #30078 [Messenger] Fix DataCollector template (@ottaviano)
• bug #30087 [PhpUnitBridge] fix PHP 5.3 compat (@nicolas-grekas)

[PR] #30431

Changelog (since v4.2.2...v4.2.3)

• bug #30050 [Cache] fix pruning pdo cache for vendors that throw on execute (@bendavies)
• bug #30046 [DI] Fix dumping Doctrine-like service graphs (@nicolas-grekas)
• bug #30028 [Form] fix some docblocks and type checks (@xabbuh)
• bug #30037 Disable Twig in the profiler menu when Twig is not used (@javiereguiluz)
• bug #30026 [VarDumper] dont implement Serializable in Stub (@nicolas-grekas)
• bug #30034 [Config] ensure moving away from Serializable wont break cache:clear (@nicolas-grekas)
• bug #29532 [Messenger] fixed RabbitMQ arguments not passed as integer values (@thePanz)
• bug #30013 [Routing] dont redirect routes with greedy trailing vars with no explicit slash (@nicolas-grekas)
• bug #30006 [Security] don't do nested calls to serialize() (@nicolas-grekas, @renan)
• bug #30007 [FrameworkBundle] Support use of hyphen in asset package name (@damaya, @XuruDragon)
• bug #30004 Fix format strings for deprecation notices (@TysonAndre)
• bug #29984 [VarDumper] Fixed search bar (@ro0NL)
• bug #29764 [HttpFoundation] Check file exists before unlink (@adam-mospan)
• bug #29783 [HttpFoundation] MemcachedSessionHandler::close() must close connection (@grachevko)
• bug #29794 Always pass $key to NullAdapter->createCacheItem (@TysonAndre)
• bug #29844 [Console] Fixed #29835: ConfirmationQuestion with default true for answer '0' (@mrthehud)
• bug #29869 [Debug][ErrorHandler] Preserve our error handler when a logger sets another one (@fancyweb)
• bug #29900 [Cache] PDO-based cache pool table autocreation does not work (@errogaht)
• bug #29926 [Form] Changed UrlType input type to text when default_protocol is not null (@MatTheCat)
• bug #29961 [Translation] Concatenated translation messages (@Stadly)
• bug #29847 [Cache] fix used variable name (@xabbuh)
• bug #29920 [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends (@fancyweb)
• bug #29922 Avoid dots in generated class names (@derrabus)
• bug #29863 [Security] Do not mix password_*() API with libsodium one (@chalasr)
• bug #29894 [DependencyInjection] the string "0" is a valid service identifier (@xabbuh)
• bug #29885 Update MimeType extensions (@fabpot)
• bug #29875 [TwigBridge] fix compatibility with Twig >= 2.6.1 (@xabbuh)
• bug #29873 [Debug] remove return type hint for PHP 5 compatibility (@xabbuh)
• bug #29837 Fix SwiftMailerHandler to support Monolog's latest reset functionality (@Seldaek)
• bug #29853 Revert "bug #29597 [DI] fix reporting bindings on overriden services as unused" (@mmarynich)
• bug #29833 [DebugClassLoader] expose proxyfied findFile() method (@fancyweb)

[PR] #30068

Changelog (since v4.1.10...v4.1.11)

• bug #30013 [Routing] dont redirect routes with greedy trailing vars with no explicit slash (@nicolas-grekas)
• bug #30006 [Security] don't do nested calls to serialize() (@nicolas-grekas, @renan)
• bug #30007 [FrameworkBundle] Support use of hyphen in asset package name (@damaya, @XuruDragon)
• bug #29764 [HttpFoundation] Check file exists before unlink (@adam-mospan)
• bug #29783 [HttpFoundation] MemcachedSessionHandler::close() must close connection (@grachevko)
• bug #29844 [Console] Fixed #29835: ConfirmationQuestion with default true for answer '0' (@mrthehud)
• bug #29869 [Debug][ErrorHandler] Preserve our error handler when a logger sets another one (@fancyweb)
• bug #29926 [Form] Changed UrlType input type to text when default_protocol is not null (@MatTheCat)
• bug #29961 [Translation] Concatenated translation messages (@Stadly)
• bug #29920 [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends (@fancyweb)
• bug #29863 [Security] Do not mix password_*() API with libsodium one (@chalasr)
• bug #29894 [DependencyInjection] the string "0" is a valid service identifier (@xabbuh)
• bug #29885 Update MimeType extensions (@fabpot)
• bug #29875 [TwigBridge] fix compatibility with Twig >= 2.6.1 (@xabbuh)
• bug #29873 [Debug] remove return type hint for PHP 5 compatibility (@xabbuh)
• bug #29837 Fix SwiftMailerHandler to support Monolog's latest reset functionality (@Seldaek)
• bug #29853 Revert "bug #29597 [DI] fix reporting bindings on overriden services as unused" (@mmarynich)
• bug #29833 [DebugClassLoader] expose proxyfied findFile() method (@fancyweb)

[PR] #30016

Changelog (since v4.2.1...v4.2.2)

• bug #29494 [HttpFoundation] Fix request uri when it starts with double slashes (@alquerci)
• bug #29697 [DI] Fixed wrong factory method in exception (@wojciech Gorczyca)
• bug #29679 [HttpKernel] Correctly Render Signed URIs Containing Fragments (@zanbaldwin)
• bug #29754 Ensure final input of CommandTester works with default (@Firehed)
• bug #29695 [Form] Do not ignore the choice groups for caching (@vudaltsov)
• bug #29738 [Intl] handle null date and time types (@xabbuh)
• bug #29708 [FrameworkBundle] access the container getting it from the kernel (@xabbuh)
• bug #29676 [HttpFoundation] Fix erasing cookies issue (@eiannone)
• bug #29741 [VarExporter] fix exporting array indexes (@xabbuh)
• bug #29704 [FrameworkBundle] improve errors in tests missing the BrowserKit component (@xabbuh)
• bug #29721 [SecurityBundle] Fix traceable voters (@ro0NL)
• bug #29617 [Console] Add specific replacement for help text in single command applications (@codedmonkey)
• bug #29714 [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset() callStack to null (@mlievertz)
• bug #29597 [DI] fix reporting bindings on overriden services as unused (@nicolas-grekas)
• bug #29639 [Yaml] detect circular references (@xabbuh)
• bug #29644 [Cache] fix bad optim (@nicolas-grekas)
• bug #29648 [Cache] fix Simple\Psr6Cache proxying of metadata (@nicolas-grekas)
• bug #29569 [FrameworkBundle] decouple debug:autowiring from phpdocumentor/reflection-docblock (@SerkanYildiz)
• bug #29546 [DI] map snake-case ids of service subscribers to camel-case autowiring aliases (@nicolas-grekas)
• bug #29409 Fix env fallback to an unresolved variable (@jderusse)
• bug #29626 [Routing] fix trailing slash redirections involving a trailing var (@nicolas-grekas)
• bug #29411 [EventDispatcher] Revers event tracing order (@ro0NL)
• bug #29533 Fixed public directory when configured in composer.json (@alexander-schranz)
• bug #29619 [Console] OutputFormatter: move strtolower to createStyleFromString (@ogizanagi)
• bug #29621 [Security] Prefer clone() over unserialize(serialize()) for user refreshment (@chalasr)
• bug #29591 [Cache] Fix undefined variable in ArrayTrait (@eXtreme)
• bug #29558 [Messenger] Restore message handlers laziness (@chalasr)
• bug #29589 [VarExporter] dont call userland code with uninitialized objects (@nicolas-grekas)
• bug #29542 [Routing] fix dumping same-path routes with placeholders (@nicolas-grekas)
• bug #29587 [Debug] ignore underscore vs backslash namespaces in DebugClassLoader (@nicolas-grekas)
• bug #29584 [FrameworkBundle] fix describing routes with no controllers (@nicolas-grekas)
• bug #29582 [DI] move RegisterServiceSubscribersPass before DecoratorServicePass (@kbond)
• bug #29527 [TwigBridge][Form] Prevent multiple rendering of form collection prototypes (@Shoplifter)
• bug #29571 [Yaml] ensures that the mb_internal_encoding is reset to its initial value (@jörn Lang)
• bug #29513 [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument (@karser)
• bug #29323 [Security] defer log message in guard authenticator (@eschultz-magix)
• bug #29539 [WebProfilerBundle][TwigBundle] CSS fixes (@ro0NL)
• bug #29543 [Cache] Don't erase processed redis dsn (@chalasr)
• bug #29531 [Validator] Added IBAN format for Vatican City State (@raulfraile)
• bug #29501 [Form] filter out invalid language values (@xabbuh)
• bug #29307 [Form] Filter arrays out of scalar form types (@nicolas-grekas)
• bug #29500 [Form] filter out invalid Intl values (@xabbuh)
• bug #29499 [Validator] Fixed grouped composite constraints (@HeahDude)

[PR] #29803

Changelog (since v4.2.0...v4.2.1)

• security #cve-2018-19790 [Security\Http] detect bad redirect targets using backslashes (@xabbuh)
• security #cve-2018-19789 [Form] Filter file uploads out of regular form types (@nicolas-grekas)
• bug #29481 [TwigBridge] Deprecating legacy Twig paths in DebugCommand and simplifications (@yceruto)
• bug #29436 [Cache] Fixed Memcached adapter doClear()to call flush() (@raitocz)
• bug #29482 Fixes sprintf(): Too few arguments in MessageFormatter::choiceFormat (@stephanedelprat)
• bug #29461 [Contracts] extract LocaleAwareInterface out of TranslatorInterface (@nicolas-grekas)
• bug #29446 [VarExporter] fix dumping private properties from abstract classes (@nicolas-grekas)
• bug #29441 [Routing] ignore trailing slash for non-GET requests (@nicolas-grekas)
• bug #29445 [FrameworkBundle] Fix empty output for debug:autowiring when reflection-docblock is not installed (@chalasr)
• bug #29444 [Workflow] Fixed BC break for Workflow metadata (@lyrixx)
• bug #29432 [DI] dont inline when lazy edges are found (@nicolas-grekas)
• bug #29413 [Serializer] fixed DateTimeNormalizer to maintain microseconds when a different timezone required (@rvitaliy)
• bug #29424 [Routing] fix taking verb into account when redirecting (@nicolas-grekas)
• bug #29418 [VarExporter] fix dumping protected property from abstract classes (@nicolas-grekas)
• bug #29414 [DI] Fix dumping expressions accessing single-use private services (@chalasr)
• bug #28853 [LDAP] Add TIMEOUT Option to LDAP Connection Options (@lmatte7)
• bug #29399 [FrameworkBundle] define doctrine as default_pdo_provider only if the package is installed (@nicolas-grekas)
• bug #29375 [Validator] Allow ConstraintViolation::__toString() to expose codes that are not null or emtpy strings (@phansys)
• bug #29376 [EventDispatcher] Fix eventListener wrapper loop in TraceableEventDispatcher (@jderusse)
• bug #29386 undeprecate the single-colon notation for controllers (@fbourigault)
• bug #29393 [DI] fix edge case in InlineServiceDefinitionsPass (@nicolas-grekas)
• bug #29394 [Config] fix path exclusion during glob discovery (@nicolas-grekas)
• bug #29395 [FrameworkBundle][Messenger] Restore check for messenger serializer default id (@ogizanagi)
• bug #29380 [Routing] fix greediness of trailing slash (@nicolas-grekas)

[PR] #29493
[SECURITY] Security release

Changelog (since v2.8.48...v2.8.49)

• security #cve-2018-19790 [Security\Http] detect bad redirect targets using backslashes (@xabbuh)
• security #cve-2018-19789 [Form] Filter file uploads out of regular form types (@nicolas-grekas)
• security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (@nicolas-grekas)
• security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (@nicolas-grekas)

[PR] #29487
[SECURITY] Security release

Changelog (since v4.2.0-RC1...v4.2.0)

• bug #29343 [Form] Handle all case variants of "nan" when parsing a number (@mwhudson, @xabbuh)
• bug #29373 [Routing] fix trailing slash redirection (@nicolas-grekas)
• bug #29355 [PropertyAccess] calculate cache keys for property setters depending on the value (@xabbuh)
• bug #29369 [DI] fix combinatorial explosion when analyzing the service graph (@nicolas-grekas)
• bug #29349 [Debug] workaround opcache bug mutating "$this" !?! (@nicolas-grekas)
• bug #29344 Fixes sprintf(): Too few arguments in Translator (@stephanedelprat)
• bug #29318 [Console] Move back root exception to stack trace in verbose mode (@chalasr)

[PR] #29383

Changelog (since v4.2.0-BETA2...v4.2.0-RC1)

• bug #29332 [PropertyAccess] make cache keys encoding bijective (@nicolas-grekas)
• bug #29298 [Routing] fix trailing slash redirection when using RedirectableUrlMatcher (@nicolas-grekas)
• bug #29297 [Routing] fix trailing slash redirection when using RedirectableUrlMatcher (@nicolas-grekas)
• bug #29313 [PropertyAccessor] fix encoding of cache keys (@nicolas-grekas)
• bug #29328 [HttpKernel] handle anonymous classes when generating the dumped container class name (@nicolas-grekas)
• bug #28917 [DoctrineBridge] catch errors while converting to db values in data collector (@alekitto)
• bug #29317 [WebProfiler] Detect non-file paths in file viewer (@ro0NL)
• bug #29305 [EventDispatcher] Unwrap wrapped listeners internally (@ro0NL)
• bug #29302 [Contracts][Cache] allow retrieving metadata of cached items (@nicolas-grekas)
• bug #29315 [DI] fix copying expression providers when analyzing the service graph (@nicolas-grekas)
• bug #27314 [DoctrineBridge] fix case sensitivity issue in RememberMe\DoctrineTokenProvider (@PF4Public)
• bug #29310 [MonologBridge] Return empty list for unknown requests (@ro0NL)
• bug #29316 [VarDumper] Fix ClassStub ellipsis (@ro0NL)
• bug #29300 [Translation] fix dumping catalogues cache (@nicolas-grekas)
• bug #29308 [Translation] Use XLIFF source rather than resname when there's no target (@thewilkybarkid)
• bug #26244 [BrowserKit] fixed BC Break for HTTP_HOST header (@brizzz)
• bug #28147 [DomCrawler] exclude fields inside "template" tags (@Gorjunov)
• bug #29260 [Lock] Fixed PdoStore::putOffExpiration(), PdoStore::getHashedKey() (@PavelPrischepa)
• bug #29222 [Dotenv] properly parse backslashes in unquoted env vars (@xabbuh)
• bug #29256 [HttpFoundation] Fixed absolute Request URI with default port (@thomasbisignani)
• bug #29274 [Routing] Remove duplicate schemes and methods for invokable controllers (@claudusd)
• bug #29285 [HttpKernel][WebProfilerBundle] Getting the cached client mime type instead of guessing it again (@yceruto)
• bug #29271 [HttpFoundation] Fix trailing space for mime-type with parameters (@sascha Dens)
• feature #29167 [Messenger] Add a trait for synchronous query & command buses (@ogizanagi)
• bug #29243 [Cache] fix optimizing Psr6Cache for AdapterInterface pools (@nicolas-grekas)
• bug #29247 [DI] fix taking lazy services into account when dumping the container (@nicolas-grekas)
• bug #29249 [Form] Fixed empty data for compound date interval (@HeahDude)
• bug #29265 [Bridge/PhpUnit] Use composer to download phpunit (@nicolas-grekas)
• bug #28769 [FrameworkBundle] deal with explicitly enabled workflow nodes (@xabbuh)

[PR] #29339

Changelog (since v4.2.0-BETA1...v4.2.0-BETA2)

• bug #29190 [Debug][HttpKernel] remove frames added by DebugClassLoader in stack traces (@nicolas-grekas)
• bug #29233 [FrameworkBundle] metadata_update_threshold default value must be an int (@dunglas)
• bug #29226 [Messenger] Improved message when handler class does not exist (@neeckeloo)
• bug #29223 [Validator] Added the missing constraints instance checks (@thomasbisignani)
• bug #28966 [PropertyAccessor] Fix unable to write to singular property using setter while plural adder/remover exist (@karser)
• bug #29182 [Form] Fixed empty data for compound date types (@HeahDude)
• bug #29224 [SecurityBundle] Fix remember-me cookie framework inheritance when session is disabled (@fbourigault)
• bug #29220 [Translation] make intl+icu format seamless by handling it in MessageCatalogue (@nicolas-grekas)
• feature #29166 [Messenger] Add handled & sent stamps (@ogizanagi)
• bug #29209 [VarExporter] fix handling of __sleep() (@nicolas-grekas)
• bug #29196 [Messenger] Fix collecting messages (@ro0NL)
• bug #29205 [Dotenv] skip loading "local" env twice (@nicolas-grekas)
• bug #29204 [FrameworkBundle][WebServerBundle] Revert deprecation of --env and --no-debug console options (@chalasr)
• bug #29191 [Routing] generate(null) should throw an exception (@nicolas-grekas)
• bug #29199 [FrameworkBundle] conflict with Dotenv <4.2 to simplify recipes (@nicolas-grekas)
• bug #29197 Revert "bug #29154 [FrameworkBundle] Define APP_ENV/APP_DEBUG from argv via Application::bootstrapEnv() (@nicolas-grekas)
• bug #29185 [Form] Fixed keeping hash of equal \DateTimeInterface on submit (@HeahDude)
• bug #29183 [HttpKernel] Fix collecting uploaded files (@ro0NL)
• bug #29141 [Workflow] Fixed bug of buildTransitionBlockerList when many transition are enabled (@Tetragramat, @lyrixx)
• bug #29137 [Workflow][FrameworkBundle] fixed guard event names for transitions (@destillat, @lyrixx)
• bug #29184 [WebProfilerBundle] Fix theme settings (@ro0NL)
• feature #29159 [Messenger] collect all stamps added on Envelope as collections (@nicolas-grekas)
• bug #29171 [Dotenv] load .env.dist when it exists and .env is not found (@nicolas-grekas)
• bug #28731 [Form] invalidate forms on transformation failures (@xabbuh)
• bug #29152 [Config] Unset key during normalization (@ro0NL)
• bug #29165 [DI] align IniFileLoader to PHP bugfix #76965 (@nicolas-grekas)
• bug #29154 [FrameworkBundle] Define APP_ENV/APP_DEBUG from argv via Application::bootstrapEnv() (@chalasr)
• bug #29129 [Dotenv] add loadEnv(), a smoother alternative to loadForEnv() (@nicolas-grekas)
• bug #29113 [Routing] fix dumping conditions that use the request (@nicolas-grekas)
• bug #29115 Change button_widget class to btn-primary (@neFAST)
• bug #29131 [Dotenv] dont use getenv() to read SYMFONY_DOTENV_VARS (@nicolas-grekas)
• bug #29057 [HttpFoundation] replace any preexisting Content-Type headers (@nicolas-grekas)
• bug #29076 [Serializer] Allow null values when denormalizing with constructor missing data (@danut007ro)
• bug #29128 [FrameworkBundle] Cleaning translation commands and fix a bug for --all option (@yceruto)
• bug #29104 [DI] fix dumping inlined services (@nicolas-grekas)
• bug #29054 [VarDumper] fix dump of closures created from callables (@nicolas-grekas)
• bug #29102 [DI] fix GraphvizDumper ignoring inline definitions (@nicolas-grekas)
• bug #29090 LoggingTranslator should implement Symfony\Contracts\Translation\TranslatorInterface (@desmax)
• bug #29095 [TwigBridge] require the needed symfony/contracts package (@xabbuh)
• bug #29107 [DI] dont track classes/interfaces used to compute autowiring error messages (@nicolas-grekas)
• bug #29094 Add samesite attribute to session cookie after session migration (@rpkamp)
• bug #29080 [FrameworkBundle] fix deps (@ro0NL)

[PR] #29237

Changelog (since v4.1.2...v4.1.3)

• security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (@nicolas-grekas)
• security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (@nicolas-grekas)
• bug #28003 [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet (@netiul)
• bug #28007 [FrameworkBundle] fixed guard event names for transitions (@destillat)
• bug #28045 [HttpFoundation] Fix Cookie::isCleared (@ro0NL)
• bug #28080 [HttpFoundation] fixed using _method parameter with invalid type (@Phobetor)
• bug #28059 [Messenger] Fix error message on undefined message class for non-subscriber handler (@chalasr)
• bug #28052 [HttpKernel] Fix merging bindings for controllers' locators (@nicolas-grekas)
• bug #28014 [Messenger] Fix chaining senders with their aliases (@sroze)

[PR] #28104
[SECURITY] Security release

Changelog (since v4.1.1...v4.1.2)

• bug #28005 [HttpKernel] Fixed templateExists on parse error of the template name (@yceruto)
• bug #28013 [Messenger] Add missing typehint on chain sender (@sroze)
• bug #27997 Serbo-Croatian has Serbian plural rule (@kylekatarnls)
• bug #26193 Fix false-positive deprecation notices for TranslationLoader and WriteCheckSessionHandler (@iquito)
• bug #27827 [Serializer] Supports nested abstract items (@sroze)
• bug #27958 [Form] Remaining changes for bootstrap 4 file fields (@apfelbox)
• bug #27919 [Form] Improve rendering of file field in bootstrap 4 (@apfelbox)
• bug #27941 [WebProfilerBundle] Fixed icon alignment issue using Bootstrap 4.1.2 (@jmsche)
• bug #27937 [HttpFoundation] reset callback on StreamedResponse when setNotModified() is called (@rubencm)
• bug #27927 [HttpFoundation] Suppress side effects in 'get' and 'has' methods of NamespacedAttributeBag (@webnet-fr)
• bug #27913 [EventDispatcher] Clear orphaned events on reset (@acasademont)
• bug #27923 [Form/Profiler] Massively reducing memory footprint of form profiling pages... (@VincentChalnot)
• bug #27918 [Console] correctly return parameter's default value on "--" (@seschwar)
• bug #27826 [Serializer] Fix serialization of items with groups across entities and discrimination map (@sroze)
• bug #27904 [Filesystem] fix lock file permissions (@fritzmg)
• bug #27903 [Lock] fix lock file permissions (@fritzmg)
• bug #27889 [Form] Replace .initialism with .text-uppercase. (@vudaltsov)
• bug #27902 Fix the detection of the Process new argument (@stof)
• bug #27885 [HttpFoundation] don't encode cookie name for BC (@nicolas-grekas)
• bug #27782 [DI] Fix dumping ignore-on-uninitialized references to synthetic services (@nicolas-grekas)
• bug #27435 [OptionResolver] resolve arrays (@Doctrs)
• bug #27728 [TwigBridge] Fix missing path and separators in loader paths list on debug:twig output (@yceruto)
• bug #27837 [PropertyInfo] Fix dock block lookup fallback loop (@DerManoMann)
• bug #27848 [Workflow] Fixed BC break (@lyrixx)
• bug #27758 [WebProfilerBundle] Prevent toolbar links color override by css (@alcalyn)
• bug #27847 [Security] Fix accepting null as $uidKey in LdapUserProvider (@louhde)
• bug #27820 [Messenger] Fix a bug when having more than one named handler per message subscriber (@sroze)
• bug #27834 [DI] Don't show internal service id on binding errors (@nicolas-grekas)
• bug #27831 Check for Hyper terminal on all operating systems. (@azjezz)
• bug #27794 Add color support for Hyper terminal . (@azjezz)
• bug #27809 [HttpFoundation] Fix tests: new message for status 425 (@dunglas)
• bug #27618 [PropertyInfo] added handling of nullable types in PhpDoc (@oxan)
• bug #27659 [HttpKernel] Make AbstractTestSessionListener compatible with CookieClearingLogoutHandler (@thewilkybarkid)
• bug #27752 [Cache] provider does not respect option maxIdLength with versioning enabled (@Constantine Shtompel)
• bug #27773 [Serializer] Class discriminator and serialization groups (@sroze)
• bug #27710 [DependencyInjection] fix handling of empty DI extension configs (@xabbuh)
• bug #27776 [ProxyManagerBridge] Fix support of private services (bis) (@nicolas-grekas)
• bug #27714 [HttpFoundation] fix session tracking counter (@nicolas-grekas, @dmaicher)
• bug #27727 [Routing] Disallow object usage inside Route (@paxal)
• bug #27736 [Routing] fix too much greediness in host-matching regex (@nicolas-grekas)
• bug #27747 [HttpFoundation] fix registration of session proxies (@nicolas-grekas)
• bug #27754 [HttpFoundation] missing namespace for RedisProxy (@Bonfante)
• bug #27722 Redesign the Debug error page in prod (@javiereguiluz)
• bug #27716 [DI] fix dumping deprecated service in yaml (@nicolas-grekas)

[PR] #28043

Changelog (since v4.1.0...v4.1.1)

• bug #27626 [TwigBundle][DX] Only add the Twig WebLinkExtension if the WebLink component is enabled (@thewilkybarkid)
• bug #27702 [TwigBundle] bump lowest deps to fix issue with "double-colon" controller service refs (@nicolas-grekas)
• bug #27701 [SecurityBundle] Dont throw if "security.http_utils" is not found (@nicolas-grekas)
• bug #27690 [DI] Resolve env placeholder in logs (@ro0NL)
• bug #27687 [HttpKernel] fix argument's error messages in ServiceValueResolver (@nicolas-grekas)
• bug #27614 [VarDumper] Fix dumping by splitting Server/Connection out of Dumper/ServerDumper (@nicolas-grekas)
• bug #27681 [DI] Avoid leaking unused env placeholders (@ro0NL)
• bug #26534 allow_extra_attributes does not throw an exception as documented (@deviantintegral)
• bug #27664 [FrameworkBundle] Ignore keepQueryParams attribute when generating route redirect (@vudaltsov)
• bug #27668 [Lock] use 'r+' for fopen (fixes issue on Solaris) (@fritzmg)
• bug #27669 [Filesystem] fix file lock on SunOS (@fritzmg)
• bug #27662 [HttpKernel] fix handling of nested Error instances (@xabbuh)
• bug #27651 [Messenger] Fixed MessengerPass::guessHandledClasses return type (@massimilianobraglia)
• bug #26845 [Config] Fixing GlobResource when inside phar archive (@vworldat)
• bug #27382 [Form] Fix error when rendering a DateIntervalType form with exactly 0 weeks (@krixon)
• bug #27309 Fix surrogate not using original request (@Toflar)
• bug #27467 [HttpKernel] fix session tracking in surrogate master requests (@nicolas-grekas)
• bug #27632 [HttpFoundation] Ensure RedisSessionHandler::updateTimestamp returns a boolean (@MatTheCat)
• bug #27630 [Validator][Form] Remove BOM in some xlf files (@gautierderuette)
• bug #27596 [Framework][Workflow] Added support for interfaces (@vudaltsov)
• bug #27593 [ProxyManagerBridge] Fixed support of private services (@nicolas-grekas)
• bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (@nicolas-grekas)
• bug #27528 [FrameworkBundle] give access to non-shared services when using test.service_container (@nicolas-grekas)
• bug #27584 Avoid calling eval when there is no script embedded in the toolbar (@stof)
• bug #27581 Fix bad method call with guard authentication + session migration (@weaverryan)
• bug #27576 [Cache] Fix expiry comparisons in array-based pools (@nicolas-grekas)
• bug #27566 [FrameworkBundle] fix for allowing single colon controller notation (@dmaicher)
• bug #27556 Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener (@weaverryan)
• bug #27452 Avoid migration on stateless firewalls (@weaverryan)
• bug #27568 [DI] Deduplicate generated proxy classes (@nicolas-grekas)
• bug #27511 [Routing] fix matching host patterns, utf8 prefixes and non-capturing groups (@nicolas-grekas)
• bug #27326 [Serializer] deserialize from xml: Fix a collection that contains the only one element (@webnet-fr)
• bug #27562 [HttpKernel] Log/Collect exceptions at prio 0 (@ro0NL)
• bug #27567 [PhpUnitBridge] Fix error on some Windows OS (@Nsbx)
• bug #27357 [Lock] Remove released semaphore (@jderusse)
• bug #27416 TagAwareAdapter over non-binary memcached connections corrupts memcache (@aleksey Prilipko)
• bug #27514 [Debug] Pass previous exception to FatalErrorException (@pmontoya)
• bug #27516 Revert "bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)" (@nicolas-grekas)
• bug #27501 [FrameworkBundle] Fix test-container on kernel reboot, revert to returning the real container from Client::getContainer() (@nicolas-grekas)
• bug #27472 [DI] Ignore missing tree root nodes on validate (@ro0NL)
• bug #27458 [WebProfilerBundle] fixed getSession when no session has been set deprecation warnings (@GregOriol)
• bug #27318 [Cache] memcache connect should not add duplicate entries on sequential calls (@aleksey Prilipko)
• bug #27498 [Routing] Don't reorder past variable-length placeholders (@nanocom, @nicolas-grekas)
• bug #27496 [DebugBundle] DebugBundle::registerCommands should be noop (@ogizanagi)
• bug #27485 [BrowserKit] Fix a BC break in Client affecting Panthère (@dunglas)
• bug #27470 [DI] Remove default env type check on validate (@ro0NL)
• bug #27454 [FrameworkBundle][TwigBridge] Fix BC break from strong dependency on CSRF token storage (@tgalopin)
• bug #27389 [Serializer] Fix serializer tries to denormalize null values on nullable properties (@ogizanagi)
• bug #27272 [FrameworkBundle] Change priority of AddConsoleCommandPass to TYPE_BEFORE_REMOVING (@upyx)
• bug #27396 [HttpKernel] fix registering IDE links (@nicolas-grekas)
• bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (@kmadejski)
• bug #27303 [Process] Consider "executable" suffixes first on Windows (@sanmai)
• bug #27297 Triggering RememberMe's loginFail() when token cannot be created (@weaverryan)

[PR] #27706

Changelog (since v4.1.0-BETA3...v4.1.0)

• bug #27420 Revert "feature #26702 Mark ExceptionInterfaces throwable (ostrolucky)" (@nicolas-grekas)
• bug #27415 Insert correct parameter_bag service in AbstractController (@curry684)

[PR] #27424

Changelog (since v4.1.0-BETA2...v4.1.0-BETA3)

• bug #27388 [Routing] Account for greediness when merging route patterns (@nicolas-grekas)
• bug #27344 [HttpKernel] reset kernel start time on reboot (@kiler129)
• bug #27365 [Serializer] Check the value of enable_max_depth if defined (@dunglas)
• bug #27358 [PhpUnitBridge] silence some stderr outputs (@ostrolucky)
• bug #27366 [DI] never inline lazy services (@nicolas-grekas)
• bug #27352 Remove reference to the test container after kernel shutdown (@stof)
• bug #27350 [HttpKernel] fix deprecation in AbstractTestSessionListener (@alekitto)
• bug #27367 [FrameworkBundle] cleanup generated test container (@nicolas-grekas)
• bug #27379 [FrameworkBundle] Fix using test.service_container when Client is rebooted (@nicolas-grekas)
• bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (@nicolas-grekas)
• bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (@nicolas-grekas)
• security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
• security #cve-2018-11406 clear CSRF tokens when the user is logged out
• security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener
• security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener
• security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
• security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation
• security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
• bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (@yceruto)
• bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (@emilielorenzo)
• bug #27292 [Serializer] Fix and improve constraintViolationListNormalizer's RFC7807 compliance (@dunglas)

[PR] #27390

Changelog (since v4.0.10...v4.0.11)

• bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (@nicolas-grekas)
• bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (@nicolas-grekas)
• security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
• security #cve-2018-11406 clear CSRF tokens when the user is logged out
• security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener
• security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
• security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation
• security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
• bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (@yceruto)
• bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (@emilielorenzo)

[PR] #27383
[SECURITY] Security release

Changelog (since v4.0.7...v4.0.8)

• bug #26802 [Security] register custom providers on ExpressionLanguage directly (@dmaicher)
• bug #26794 [PhpUnitBridge] Catch deprecation error handler (@cvilleger)
• bug #26788 [Security] Load the user before pre/post auth checks when needed (@chalasr)
• bug #26792 [Routing] Fix throwing NoConfigurationException instead of 405 (@nicolas-grekas)
• bug #26774 [SecurityBundle] Add missing argument to security.authentication.provider.simple (@i3or1s, @chalasr)
• bug #26763 [Finder] Remove duplicate slashes in filenames (@helhum)
• bug #26758 [WebProfilerBundle][HttpKernel] Make FileLinkFormatter URL format generation lazy (@nicolas-grekas)

[PR] #26849

Changelog (since v4.0.6...v4.0.7)

• bug #26387 [Yaml] Fix regression when trying to parse multiline (@antograssiot)
• bug #26749 Add PHPDbg support to HTTP components (@hkdobrev)
• bug #26609 [Console] Fix check of color support on Windows (@mlocati)
• bug #26727 [HttpCache] Unlink tmp file on error (@Chansig)
• bug #26675 [HttpKernel] DumpDataCollector: do not flush when a dumper is provided (@ogizanagi)
• bug #26663 [TwigBridge] Fix rendering of currency by MoneyType (@ro0NL)
• bug #26595 [DI] Do not suggest writing an implementation when multiple exist (@chalasr)
• bug #26662 [DI] Fix hardcoded cache dir for warmups (@nicolas-grekas)
• bug #26677 Support phpdbg SAPI in Debug::enable() (@hkdobrev)
• bug #26600 [Routing] Fixed the importing of files using glob patterns that match multiple resources (@skalpa)
• bug #26589 [Ldap] cast to string when checking empty passwords (@ismail1432)
• bug #26626 [WebProfilerBundle] use the router to resolve file links (@nicolas-grekas)
• bug #26634 [DI] Cleanup remainings from autoregistration (@nicolas-grekas)
• bug #26635 [DI] Dont tell about autoregistration in strict autowiring mode (@nicolas-grekas)
• bug #26621 [Form] no type errors with invalid submitted data types (@xabbuh)
• bug #26612 [PHPunit] suite variable should be used (@prisis)
• bug #26337 [Finder] Fixed leading/trailing / in filename (@lyrixx)
• bug #26584 [TwigBridge] allow html5 compatible rendering of forms with null names (@systemist)
• bug #24401 [Form] Change datetime to datetime-local for HTML5 datetime input (@pierredup)
• bug #26513 [FrameworkBundle] Respect debug mode when warm up annotations (@Strate)
• bug #26370 [Security] added userChecker to SimpleAuthenticationProvider (@i3or1s)
• bug #26569 [BrowserKit] Fix cookie path handling when $domain is null (@dunglas)
• bug #26273 [Security][Profiler] Display the original expression in 'Access decision log' (@lyrixx)
• bug #26427 [DependencyInjection] fix regression when extending the Container class without a constructor (@lsmith77)
• bug #26562 [Bridge\PhpUnit] Cannot autoload class "\Symfony\Bridge\PhpUnit\SymfonyTestsListener" (@jake Bishop)
• bug #26598 Fixes #26563 (open_basedir restriction in effect) (@temperatur)
• bug #26568 [Debug] Reset previous exception handler earlier to prevent infinite loop (@nicolas-grekas)
• bug #26590 Make sure form errors is valid HTML (@Nyholm)
• bug #26567 [DoctrineBridge] Don't rely on ClassMetadataInfo->hasField in DoctrineOrmTypeGuesser anymore (@fancyweb)
• feature #26408 Readd 'form_label_errors' block to disable errors on form labels (@birkof)
• bug #26591 [TwigBridge] Make sure we always render errors. Eventhough labels are disabled (@Nyholm)
• bug #26356 [FrameworkBundle] HttpCache is not longer abstract (@lyrixx)
• bug #26548 [DomCrawler] Change bad wording in ChoiceFormField::untick (@dunglas)
• bug #26482 [PhpUnitBridge] Ability to use different composer.json file (@amcastror)
• bug #26443 [Fix][HttpFoundation] Fix the updating of timestamp in the MemcachedSessionHandler (@Alessandro Loffredo)
• bug #26400 [Config] ReflectionClassResource check abstract class (@andrey1s)
• bug #26433 [DomCrawler] extract(): fix a bug when the attribute list is empty (@dunglas)
• bug #26041 Display the Welcome Page when there is no homepage defined (@javiereguiluz)
• bug #26452 [Intl] Load locale aliases to support alias fallbacks (@jakzal)
• bug #26450 [CssSelector] Fix CSS identifiers parsing - they can start with dash (@jakubkulhan)

[PR] #26752

Changelog (since v4.0.5...v4.0.6)

• bug #26393 [DI] Skip resource tracking if disabled (@chalasr)
• bug #26403 fix the handling of timestamp in the MongoDBSessionHandler (@hjanuschka)
• bug #26355 [DI] Fix missing "id" normalization when dumping the container (@nicolas-grekas)
• bug #26368 [WebProfilerBundle] Fix Debug toolbar breaks app (@xkobal)
• bug #26369 Use fill instead of style for svg colors (@rpkamp)
• bug #26358 [FrameworkBundle] Silence "Failed to remove directory" on cache:clear (@nicolas-grekas)

[PR] #26418

Changelog (since v4.0.4...v4.0.5)

• bug #26327 [Form][WCAG] Errors sign for people that do not see colors (@Nyholm)
• bug #26326 [Form][WCAG] Added role="presentation" on tables & removed bootstrap4 table (@Nyholm)
• bug #26325 [Form][WCAG] Add hidden labels on date and time fields (@Nyholm)
• bug #26338 [Debug] Keep previous errors of Error instances (@Philipp91)
• bug #26328 [Form][WCAG] Fixed HTML errors (@Nyholm)
• bug #26290 [FrameworkBundle] [Console][DX] add a warning when command is not found (@Simperfit)
• bug #26318 [Routing] Fix GC control of PHP-DSL (@nicolas-grekas)
• bug #26312 [Routing] Don't throw 405 when scheme requirement doesn't match (@nicolas-grekas)
• bug #26275 Set controller without __invoke method from invokable class (@Tobion)
• bug #26298 Fix ArrayInput::toString() for InputArgument::IS_ARRAY args (@maximium)
• bug #26177 Update excluded_ajax_paths for sf4 (@jenaye)
• bug #26289 [Security] Add missing use of Role (@tony-tran)
• bug #26286 [Security] Add missing use for RoleInterface (@tony-tran)
• bug #26265 [PropertyInfo] throw exception if docblock factory does not exist (@xabbuh)
• bug #26247 [Translation] Process multiple segments within a single unit. (@timewasted)
• bug #26254 fix custom radios/inputs for checkbox/radio type (@mssimi)
• bug #26234 [FrameworkBundle] Add missing XML config for circular_reference_handler (@dunglas)
• bug #26236 [PropertyInfo] ReflectionExtractor: give a chance to other extractors if no properties (@dunglas)
• bug #26227 Add support for URL-like DSNs for the PdoSessionHandler (@stof)
• bug #25557 [WebProfilerBundle] add a way to limit ajax request (@Simperfit)
• bug #26088 [FrameworkBundle] Fix using annotation_reader in compiler pass to inject configured cache provider (@Laizerox)
• bug #26157 [HttpKernel] Send new session cookie from AbstractTestSessionListener after session invalidation (@rpkamp)
• bug #26230 [WebProfilerBundle] Fix anchor CSS (@ro0NL)
• bug #26228 [HttpFoundation] Fix missing "throw" in JsonResponse (@nicolas-grekas)
• bug #26211 [Console] Suppress warning from sapi_windows_vt100_support (@adawolfa)
• bug #26176 Retro-fit proxy code to make it deterministic for older proxy manager implementations (@lstrojny)
• bug #25787 Yaml parser regression with comments and non-strings (@alexpott)
• bug #26156 Fixes #26136: Avoid emitting warning in hasParameterOption() (@greg-1-anderson)
• bug #26183 [DI] Add null check for removeChild (@changmin.keum)
• bug #26167 [TwigBridge] Apply some changes to support Bootstrap4-stable (@mpiot, @Nyholm)
• bug #26173 [Security] fix accessing request values (@xabbuh)
• bug #26089 [PhpUnitBridge] Added support for PHPUnit 7 in Coverage Listener (@lyrixx)
• bug #26170 [PHPUnit bridge] Avoid running the remove command without any packages (@stof)
• bug #26159 created validator.tl.xlf for Form/Translations (@ergiegonzaga)
• bug #26100 [Routing] Throw 405 instead of 404 when redirect is not possible (@nicolas-grekas)
• bug #26119 [TwigBundle][WebProfilerBundle] Fix JS collision (@ro0NL)
• bug #26040 [Process] Check PHP_BINDIR before $PATH in PhpExecutableFinder (@nicolas-grekas)
• bug #26067 [YAML] Issue #26065: leading spaces in YAML multi-line string literals (@tamc)
• bug #26012 Exit as late as possible (@greg0ire)
• bug #26082 [Cache][WebProfiler] fix collecting cache stats with sub-requests + allow clearing calls (@dmaicher)
• bug #26024 [PhpBridge] add PHPUnit 7 support to SymfonyTestsListener (@shieldo)
• bug #26020 [Lock] Log already-locked errors as "notice" instead of "warning" (@Simperfit)
• bug #26043 [Serialized] add context to serialize and deserialize (@andrey1s)
• bug #26127 Deterministic time in cache items for reproducible builds (@lstrojny)
• bug #26128 Make kernel build time optionally deterministic (@lstrojny)
• bug #26117 isCsrfTokenValid() replace string by ?string (@GaylordP)
• bug #26112 Env var maps to undefined constant. (@dsmink)
• bug #26111 [Security] fix merge of 2.7 into 2.8 + add test case (@dmaicher)
• bug #25893 [Console] Fix hasParameterOption / getParameterOption when used with multiple flags (@greg-1-anderson)
• bug #25756 [TwigBundle] Register TwigBridge extensions first (@fancyweb)
• bug #26051 [WebProfilerBundle] Fix sub request link (@ro0NL)
• bug #25947 PhpDocExtractor::getTypes() throws fatal error when type omitted (@jared Farrish)
• bug #25940 [Form] keep the context when validating forms (@xabbuh)
• bug #26057 [SecurityBundle] use libsodium to run Argon2i related tests (@xabbuh)
• bug #25373 Use the PCRE_DOLLAR_ENDONLY modifier in route regexes (@mpdude)
• bug #24435 [Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2 (@Nyholm)
• bug #25762 [DependencyInjection] always call the parent class' constructor (@xabbuh)
• bug #25976 [Config] Handle Service/EventSubscriberInterface in ReflectionClassResource (@nicolas-grekas)
• bug #25989 [DI][Routing] Fix tracking of globbed resources (@nicolas-grekas, @sroze)
• bug #26009 [SecurityBundle] Allow remember-me factory creation when multiple user providers are configured. (@iisisrael)
• bug #26010 [CssSelector] For AND operator, the left operand should have parentheses, not only right operand (@arnaud CHASSEUX)
• bug #26000 Fixed issue #25985 (@KevinFrantz)
• bug #25996 Don't show wanna-be-private services as public in debug:container (@chalasr)
• bug #25914 [HttpKernel] collect extension information as late as possible (@xabbuh)
• bug #25981 [DI] Fix tracking of source class changes for lazy-proxies (@nicolas-grekas)
• bug #25971 [Debug] Fix bad registration of exception handler, leading to mem leak (@nicolas-grekas)
• bug #25962 [Routing] Fix trailing slash redirection for non-safe verbs (@nicolas-grekas)
• bug #25948 [Form] Fixed empty data on expanded ChoiceType and FileType (@HeahDude)
• bug #25978 Deterministic proxy names (@lstrojny)
• bug #25972 support sapi_windows_vt100_support for php 7.2+ (@jhdxr)
• bug #25744 [TwigBridge] Allow label translation to be safe (@MatTheCat)
• bug #25932 Don't stop PSR-4 service discovery if a parent class is missing (@derrabus)

[PR] #26363

Changelog (since v4.0.3...v4.0.4)

• bug #25922 [HttpFoundation] Use the correct syntax for session gc based on Pdo driver (@tanasecosminromeo)
• bug #25933 Disable CSP header on exception pages only in debug (@ostrolucky)
• bug #25926 [Form] Fixed Button::setParent() when already submitted (@HeahDude)
• bug #25927 [Form] Fixed submitting disabled buttons (@HeahDude)
• bug #25397 [Console] Provide a DX where an array could be passed (@Simperfit)
• bug #25858 [DI] Fix initialization of legacy containers by delaying include_once (@nicolas-grekas)
• bug #25891 [DependencyInjection] allow null values for root nodes in YAML configs (@xabbuh)
• bug #24864 Have weak_vendors ignore deprecations from outside (@greg0ire)
• bug #25873 [Console] Fix using finally where the catch can also fail (@nicolas-grekas)
• bug #25848 [Validator] add missing parent isset and add test (@Simperfit)
• bug #25869 [Process] Skip environment variables with false value in Process (@francoispluchino)
• bug #25864 [Yaml] don't split lines on carriage returns when dumping (@xabbuh)
• bug #25863 [Yaml] trim spaces from unquoted scalar values (@xabbuh)
• bug #25861 do not conflict with egulias/email-validator 2.0+ (@xabbuh)
• bug #25851 [Validator] Conflict with egulias/email-validator 2.0 (@emodric)
• bug #25837 [SecurityBundle] Don't register in memory users as services (@chalasr)
• bug #25835 [HttpKernel] DebugHandlersListener should always replace the existing exception handler (@nicolas-grekas)
• bug #25829 [Debug] Always decorate existing exception handlers to deal with fatal errors (@nicolas-grekas)
• bug #25823 [Security] Notify that symfony/expression-language is not installed if ExpressionLanguage is used (@giovannialbero1992)
• bug #25824 Fixing a bug where the dump() function depended on bundle ordering (@weaverryan)
• bug #25763 [OptionsResolver] Fix options resolver with array allowed types (@mcg-web)
• bug #25789 Enableable ArrayNodeDefinition is disabled for empty configuration (@kejwmen)
• bug #25822 [Cache] Fix handling of apcu_fetch() edgy behavior (@nicolas-grekas)
• bug #25816 Problem in phar see mergerequest