/
CHANGELOG-3.4.md
1564 lines (1449 loc) · 120 KB
/
CHANGELOG-3.4.md
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
CHANGELOG for 3.4.x
===================
This changelog references the relevant changes (bug and security fixes) done
in 3.4 minor versions.
To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash
To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v3.4.0...v3.4.1
* 3.4.49 (2021-05-19)
* security #cve-2021-21424 [Security\Core] Fix user enumeration via response body on invalid credentials (chalasr)
* 3.4.48 (2021-05-12)
* security #cve-2021-21424 [Security][Guard] Prevent user enumeration (chalasr)
* 3.4.47 (2020-11-27)
* bug #38628 [DoctrineBridge] indexBy could reference to association columns (juanmiguelbesada)
* 3.4.46 (2020-10-28)
* bug #38669 [Serializer] fix decoding float XML attributes starting with 0 (Marcin Kruk)
* bug #38595 [TwigBridge] do not translate null placeholders or titles (xabbuh)
* bug #38652 [Filesystem] Check if failed unlink was caused by permission denied (Nyholm)
* bug #38604 [DoctrineBridge] indexBy does not refer to attributes, but to column names (xabbuh)
* bug #38606 [WebProfilerBundle] Hide debug toolbar in print view (jt2k)
* bug #38582 [DI] Fix Reflection file name with eval()\'d code (maxime-aknin)
* bug #38516 [HttpFoundation] Fix Range Requests (BattleRattle)
* bug #38510 [PropertyInfo] Support for the mixed type (derrabus)
* bug #38444 [PhpUnitBridge] fix running parallel tests with phpunit 9 (nicolas-grekas)
* bug #38442 [VarDumper] fix truncating big arrays (nicolas-grekas)
* bug #38380 [Form] propagate validation groups to subforms (johanderuijter, xabbuh)
* bug #38360 [BrowserKit] Cookie expiration at current timestamp (iquito)
* 3.4.45 (2020-09-27)
* bug #38228 [Yaml Parser] Fix edge cases when parsing multiple documents (digilist)
* bug #38229 [Yaml] fix parsing comments not prefixed by a space (xabbuh)
* bug #38131 [Validator] allow consumers to mock all methods (xabbuh)
* bug #37097 DateTime validator support for trailing data (stefankleff)
* bug #38116 [Console] Silence warnings on sapi_windows_cp_set() call (chalasr)
* bug #38114 [Console] guard $argv + $token against null, preventing unnecessary exceptions (bilogic)
* bug #38099 Prevent parsing invalid octal digits as octal numbers (julienfalque)
* bug #38091 [DI] fix ContainerBuilder on PHP8 (nicolas-grekas)
* bug #38080 [Console] Make sure $maxAttempts is an int or null (derrabus)
* bug #38073 [VarDumper] Fix caster for invalid SplFileInfo objects on php 8 (derrabus)
* bug #38071 [PhpUnitBridge] Adjust output parsing of CoverageListenerTrait for PHPUnit 9.3 (sanmai, derrabus)
* bug #38049 [Debug] Parse "x not found" errors correctly on php 8 (derrabus)
* bug #38024 [Console] Fix undefined index for inconsistent command name definition (chalasr)
* 3.4.44 (2020-08-31)
* bug #37949 [Yaml] fix more numeric cases changing in PHP 8 (xabbuh)
* bug #37921 [Yaml] account for is_numeric() behavior changes in PHP 8 (xabbuh)
* bug #37912 [ExpressionLanguage] fix passing arguments to call_user_func_array() on PHP 8 (xabbuh)
* bug #37853 [Validator] ensure that the validator is a mock object for backwards-compatibility (xabbuh)
* bug #37845 [Serializer] Fix variadic support when using type hints (fabpot)
* bug #37725 [Form] Fix Guess phpdoc return type (franmomu)
* bug #37771 Use PHPUnit 9.3 on php 8 (derrabus)
* bug #35843 [Validator] Add target guards for Composite nested constraints (ogizanagi)
* bug #37744 [Yaml] Fix for #36624; Allow PHP constant as first key in block (jnye)
* bug #37767 [Form] fix mapping errors from unmapped forms (xabbuh)
* bug #37763 Fix deprecated libxml_disable_entity_loader (jderusse)
* bug #37774 [Console] Make sure we pass a numeric array of arguments to call_user_func_array() (derrabus)
* bug #37701 [Serializer] Fix that it will never reach DOMNode (TNAJanssen)
* bug #37671 [Cache] fix saving no-expiry items with ArrayAdapter (philipp-kolesnikov)
* bug #37700 [VarDumper] Improve previous fix on light array coloration (l-vo)
* 3.4.43 (2020-07-24)
* bug #37635 [Cache] fix catching auth errors (nicolas-grekas)
* bug #37572 [FrameworkBundle] set default session.handler alias if handler_id is not provided (Youssef BENHSSAIEN)
* bug #37607 Fix checks for phpunit releases on Composer 2 (colinodell)
* bug #37562 [Cache] Use the default expiry when saving (not when creating) items (philipp-kolesnikov)
* bug #37563 Fix DBAL deprecation (nicolas-grekas)
* bug #37521 [Form] Fix ChoiceType translation domain (VincentLanglet)
* bug #37520 [Form] silently ignore uninitialized properties when mapping data to forms (ph-fritsche)
* bug #37526 [Cache][Config] ensure compatibility with PHP 8 stack traces (xabbuh)
* bug #37461 [Process] Fix Permission Denied error when writing sf_proc_00 lock files on Windows (JasonStephensTAMU)
* bug #37505 [Form] fix handling null as empty data (xabbuh)
* bug #37385 [Console] Fixes question input encoding on Windows (YaFou)
* bug #37447 [Validator] fix validating lazy properties that evaluate to null (xabbuh)
* bug #37464 [ErrorHandler] fix throwing from __toString() (nicolas-grekas)
* bug #37291 [MimeType] Duplicated MimeType due to PHP Bug (juanmrad)
* bug #37425 [Form] fix guessing form types for DateTime types (xabbuh)
* bug #37392 [Validator] fix handling typed properties as constraint options (xabbuh)
* bug #37389 [HttpFondation] Change file extension of "audio/mpeg" from "mpga" to "mp3" (YaFou)
* bug #37383 [VarDumper] Support for cURL handler objects (derrabus)
* bug #37345 [Form] collect all transformation failures (xabbuh)
* bug #37340 Fix support for PHP8 union types (nicolas-grekas)
* bug #37275 [DI] tighten detection of local dirs to prevent false positives (nicolas-grekas)
* bug #37090 [PhpUnitBridge] Streamline ansi/no-ansi of composer according to phpunit --colors option (kick-the-bucket)
* bug #36230 [VarDumper] Fix CliDumper coloration on light arrays (l-vo)
* bug #37270 [FrameworkBundle] preserve dots in query-string when redirecting (nicolas-grekas)
* bug #37342 [Cache] fix compat with DBAL v3 (nicolas-grekas)
* 3.4.42 (2020-06-12)
* bug #37103 [Form] switch the context when validating nested forms (xabbuh)
* bug #37182 [HttpKernel] Fix regression where Store does not return response body correctly (mpdude)
* bug #36913 [FrameworkBundle] fix type annotation on ControllerTrait::addFlash() (ThomasLandauer)
* bug #37169 [Cache] fix forward compatibility with Doctrine DBAL 3 (xabbuh)
* bug #37085 [Form] properly cascade validation to child forms (xabbuh)
* bug #37095 [PhpUnitBridge] Fix undefined index when output of "composer show" cannot be parsed (nicolas-grekas)
* bug #37092 [PhpUnitBridge] fix undefined var on version 3.4 (nicolas-grekas)
* 3.4.41 (2020-05-31)
* bug #36894 [Validator] never directly validate Existence (Required/Optional) constraints (xabbuh)
* bug #37007 [Console] Fix QuestionHelper::disableStty() (chalasr)
* bug #36865 [Form] validate subforms in all validation groups (xabbuh)
* bug #36907 Fixes sprintf(): Too few arguments in form transformer (pedrocasado)
* bug #37000 Add meaningful message when using ProcessHelper and Process is not installed (l-vo)
* bug #36987 Handle fetch mode deprecation of DBAL 2.11. (derrabus)
* bug #36974 [Security] Fixed handling of CSRF logout error (wouterj)
* bug #36920 [VarDumper] fix PHP 8 support (nicolas-grekas)
* bug #36917 [Cache] Accessing undefined constants raises an Error in php8 (derrabus)
* bug #36891 Address deprecation of ReflectionType::getClass() (derrabus)
* bug #36899 [VarDumper] ReflectionFunction::isDisabled() is deprecated (derrabus)
* bug #36905 [Validator] Catch expected ValueError (derrabus)
* bug #36906 [DomCrawler] Catch expected ValueError (derrabus)
* bug #36904 [PropertyAccess] Parse php 8 TypeErrors correctly (derrabus)
* bug #36896 [Config] Removed implicit cast of ReflectionProperty to string (derrabus)
* bug #36882 [PhpUnitBridge] fix installing under PHP >= 8 (nicolas-grekas)
* bug #36833 [HttpKernel] Fix that the `Store` would not save responses with the X-Content-Digest header present (mpdude)
* bug #36867 [PhpUnitBridge] fix bad detection of unsilenced deprecations (nicolas-grekas)
* bug #36855 [HttpKernel] Fix error logger when stderr is redirected to /dev/null (fabpot)
* bug #36592 [BrowserKit] Allow Referer set by history to be overridden (Slamdunk)
* bug #36794 [Serializer] fix issue with PHP 8 (nicolas-grekas)
* bug #36743 [Yaml] Fix escaped quotes in quoted multi-line string (ossinkine)
* bug #36569 [PhpUnitBridge] Mark parent class also covered in CoverageListener (lyrixx)
* bug #36690 [Yaml] prevent notice for invalid octal numbers on PHP 7.4 (xabbuh)
* bug #36497 [Filesystem] Handle paths on different drives (crishoj)
* bug #36678 [WebProfiler] Do not add src-elem CSP directives if they do not exist (ndench)
* bug #36501 [DX] Show the ParseException message in all YAML file loaders (fancyweb)
* bug #36683 [Yaml] fix parse error when unindented collections contain a comment (wdiesveld)
* bug #36672 [Validator] Skip validation when email is an empty object (acrobat)
* bug #36673 [PhpUnitBridge] fix PHP 5.3 compat again (nicolas-grekas)
* bug #36627 [Validator] fix lazy property usage. (bendavies)
* bug #36625 [PhpUnitBridge] fix compat with PHP 5.3 (nicolas-grekas)
* 3.4.40 (2020-04-28)
* bug #36566 [PhpUnitBridge] Use COMPOSER_BINARY env var if available (fancyweb)
* bug #36560 [YAML] escape DEL(\x7f) (sdkawata)
* bug #36539 [PhpUnitBridge] fix compatibility with phpunit 9 (garak)
* bug #36555 [Cache] skip APCu in chains when the backend is disabled (nicolas-grekas)
* bug #36523 [Form] apply automatically step=1 for datetime-local input (ottaviano)
* bug #36498 [Security/Core] fix escape for username in LdapBindAuthenticationProvider.php (stoccc)
* bug #36506 [FrameworkBundle] Fix session.attribute_bag service definition (fancyweb)
* bug #36490 [HttpFoundation] workaround PHP bug in the session module (nicolas-grekas)
* bug #36483 [SecurityBundle] fix accepting env vars in remember-me configurations (zek)
* bug #36343 [Form] Fixed handling groups sequence validation (HeahDude)
* bug #36460 [Cache] Avoid memory leak in TraceableAdapter::reset() (lyrixx)
* bug #36411 [Form] RepeatedType should always have inner types mapped (biozshock)
* bug #36441 [DI] fix loading defaults when using the PHP-DSL (nicolas-grekas)
* bug #36434 [HttpKernel] silence E_NOTICE triggered since PHP 7.4 (xabbuh)
* bug #36365 [Validator] Fixed default group for nested composite constraints (HeahDude)
* bug #35591 [Validator] do not merge constraints within interfaces (greedyivan)
* bug #36375 [Workflow] Use a strict comparison when retrieving raw marking in MarkingStore (lyrixx)
* bug #36305 [PropertyInfo][ReflectionExtractor] Check the array mutator prefixes last when the property is singular (fancyweb)
* bug #35656 [HttpFoundation] Fixed session migration with custom cookie lifetime (Guite)
* bug #36315 [WebProfilerBundle] Support for Content Security Policy style-src-elem and script-src-elem in WebProfiler (ampaze)
* bug #36286 [Validator] Allow URL-encoded special characters in basic auth part of URLs (cweiske)
* bug #36332 [Serializer] Fix unitialized properties (from PHP 7.4.2) when serializing context for the cache key (alanpoulain)
* bug #36239 [HttpKernel][LoggerDataCollector] Prevent keys collisions in the sanitized logs processing (fancyweb)
* bug #36245 [Validator] Fixed calling getters before resolving groups (HeahDude)
* bug #36252 [Security/Http] Allow setting cookie security settings for delete_cookies (wouterj)
* bug #36261 [FrameworkBundle] revert to legacy wiring of the session when circular refs are detected (nicolas-grekas)
* 3.4.39 (2020-03-30)
* bug #36216 [Validator] Assert Valid with many groups (phucwan91)
* bug #36222 [Console] Fix OutputStream for PHP 7.4 (guillbdx)
* bug #36175 [Security/Http] Remember me: allow to set the samesite cookie flag (dunglas)
* bug #36173 [Http Foundation] Fix clear cookie samesite (guillbdx)
* bug #36176 [Security] Check if firewall is stateless before checking for session/previous session (koenreiniers)
* bug #36149 [Form] Support customized intl php.ini settings (jorrit)
* bug #36172 [Debug] fix for PHP 7.3.16+/7.4.4+ (nicolas-grekas)
* bug #36141 Prevent warning in proc_open() (BenMorel)
* bug #36121 [VarDumper] fix side-effect by not using mt_rand() (nicolas-grekas)
* bug #36073 [PropertyAccess][DX] Improved errors when reading uninitialized properties (HeahDude)
* bug #36063 [FrameworkBundle] start session on flashbag injection (William Arslett)
* bug #36020 [Form] ignore microseconds submitted by Edge (xabbuh)
* bug #36041 fix import from config file using type: glob (Tobion)
* bug #35987 [DoctrineBridge][DoctrineExtractor] Fix wrong guessed type for "json" type (fancyweb)
* bug #35938 [Form] Handle false as empty value on expanded choices (fancyweb)
* bug #36004 [Yaml] fix dumping strings containing CRs (xabbuh)
* bug #35982 [DI] Fix XmlFileLoader bad error message (przemyslaw-bogusz)
* bug #35937 Revert "bug symfony#28179 [DomCrawler] Skip disabled fields processing in Form" (dmaicher)
* bug #35910 [SecurityBundle] Minor fixes in configuration tree builder (HeahDude)
* 3.4.38 (2020-02-29)
* bug #35781 [Form] NumberToLocalizedStringTransformer return int if scale = 0 (VincentLanglet)
* bug #35846 [Serializer] prevent method calls on null values (xabbuh)
* bug #35839 [Security] Allow switching to another user when already switched (chalasr)
* bug #35817 [DoctrineBridge] Use new Types::* constants and support new json type (fancyweb)
* bug #35707 [ExpressionLanguage] Fixed collisions of character operators with object properties (Andrej-in-ua)
* bug #35794 [DoctrineBridge][DoctrineExtractor] Fix indexBy with custom and some core types (fancyweb)
* bug #35787 [PhpUnitBridge] Use trait instead of extending deprecated class (marcello-moenkemeyer)
* bug #35792 [Security] Prevent TypeError in case RememberMetoken has no attached user (nikophil)
* bug #35772 [Config] don't throw on missing excluded paths (nicolas-grekas)
* bug #35774 [Ldap] force default network timeout (nicolas-grekas)
* bug #35702 [VarDumper] fixed DateCaster not displaying additional fields (Makdessi Alex)
* bug #35722 [HttpKernel] Set previous exception when rethrown from controller resolver (danut007ro)
* bug #35718 [HttpKernel] fix registering DebugHandlersListener regardless of the PHP_SAPI (nicolas-grekas)
* bug #35693 [Finder] Fix unix root dir issue (chr-hertel)
* bug #35696 [Console] Don't load same-namespace alternatives on exact match (chalasr)
* bug #35605 [HttpFoundation][FrameworkBundle] fix support for samesite in session cookies (fabpot)
* bug #35609 [DoctrineBridge] Fixed submitting ids with query limit or offset (HeahDude)
* bug #34123 [Form] Fix handling of empty_data's \Closure value in Date/Time form types (yceruto)
* bug #35546 [Validator] check for __get method existence if property is uninitialized (alekitto)
* bug #35332 [Yaml][Inline] Fail properly on empty object tag and empty const tag (fancyweb)
* bug #35489 [PhpUnitBridge] Fix running skipped tests expecting only deprecations (chalasr)
* bug #35161 [FrameworkBundle] Check non-null type for numeric type (Arman-Hosseini)
* bug #34059 [DomCrawler] Skip disabled fields processing in Form (sbogx)
* bug #34114 [Console] SymonfyStyle - Check value isset to avoid PHP notice (leevigraham)
* bug #35557 [Config] dont catch instances of Error (nicolas-grekas)
* bug #35532 [Validator] fix access to uninitialized property when getting value (greedyivan)
* bug #35305 [HttpKernel] Fix stale-if-error behavior, add tests (mpdude)
* 3.4.37 (2020-01-21)
* bug #35065 [Security] Use supportsClass in addition to UnsupportedUserException (linaori)
* bug #35343 [Security] Fix RememberMe with null password (jderusse)
* bug #35318 [Yaml] fix PHP const mapping keys using the inline notation (xabbuh)
* bug #35304 [HttpKernel] Fix that no-cache MUST revalidate with the origin (mpdude)
* bug #35299 Avoid `stale-if-error` in FrameworkBundle's HttpCache if kernel.debug = true (mpdude)
* bug #35151 [DI] deferred exceptions in ResolveParameterPlaceHoldersPass (Islam93)
* bug #35254 [PHPUnit-Bridge] Fail-fast in simple-phpunit if one of the passthru() commands fails (mpdude)
* bug #34643 [Dotenv] Fixed infinite loop with missing quote followed by quoted value (naitsirch)
* bug #35239 [Security\Http] Prevent canceled remember-me cookie from being accepted (chalasr)
* bug #35267 [Debug] fix ClassNotFoundFatalErrorHandler (nicolas-grekas)
* bug #35193 [TwigBridge] button_widget now has its title attr translated even if its label = null or false (stephen-lewis)
* bug #35219 [PhpUnitBridge] When using phpenv + phpenv-composer plugin, composer executable is wrapped into a bash script (oleg-andreyev)
* bug #35170 [FrameworkBundle][TranslationUpdateCommand] Do not output positive feedback on stderr (fancyweb)
* bug #35134 [PropertyInfo] Fix BC issue in phpDoc Reflection library (jaapio)
* bug #35125 [Translator] fix performance issue in MessageCatalogue and catalogue operations (ArtemBrovko)
* bug #35103 [Translation] Use `locale_parse` for computing fallback locales (alanpoulain)
* bug #35094 [Console] Fix filtering out identical alternatives when there is a command loader (fancyweb)
* bug #35039 [DI] skip looking for config class when the extension class is anonymous (nicolas-grekas)
* bug #35049 [ProxyManager] fix generating proxies for root-namespaced classes (nicolas-grekas)
* bug #35022 [Dotenv] FIX missing getenv (mccullagh)
* bug #35010 [VarDumper] ignore failing __debugInfo() (nicolas-grekas)
* bug #35000 [Console][SymfonyQuestionHelper] Handle multibytes question choices keys and custom prompt (fancyweb)
* bug #29839 [Validator] fix comparisons with null values at property paths (xabbuh)
* bug #34900 [DoctrineBridge] Fixed submitting invalid ids when using queries with limit (HeahDude)
* bug #34791 [Serializer] Skip uninitialized (PHP 7.4) properties in PropertyNormalizer and ObjectNormalizer (vudaltsov)
* bug #34915 [FrameworkBundle] Fix invalid Windows path normalization in TemplateNameParser (mvorisek)
* bug #34981 stop using deprecated Doctrine persistence classes (xabbuh)
* bug #34904 [Validator][ConstraintValidator] Safe fail on invalid timezones (fancyweb)
* bug #34918 [Translation] fix memoryleak in PhpFileLoader (nicolas-grekas)
* bug #34438 [HttpFoundation] Use `Cache-Control: must-revalidate` only if explicit lifetime has been given (mpdude)
* bug #34449 [Yaml] Implement multiline string as scalar block for tagged values (natepage)
* bug #34601 [MonologBridge] Fix debug processor datetime type (mRoca)
* bug #34842 [ExpressionLanguage] Process division by zero (tigr1991)
* bug #34902 [PropertyAccess] forward caught exception (xabbuh)
* bug #34888 [TwigBundle] add tags before processing them (xabbuh)
* bug #34762 [Config] never try loading failed classes twice with ClassExistenceResource (nicolas-grekas)
* bug #34839 [Cache] fix memory leak when using PhpArrayAdapter (nicolas-grekas)
* bug #34812 [Yaml] fix parsing negative octal numbers (xabbuh)
* bug #34788 [SecurityBundle] Properly escape regex in AddSessionDomainConstraintPass (fancyweb)
* bug #34755 [FrameworkBundle] resolve service locators in `debug:*` commands (nicolas-grekas)
* bug #34832 [Validator] Allow underscore character "_" in URL username and password (romainneutron)
* bug #34738 [SecurityBundle] Passwords are not encoded when algorithm set to "true" (nieuwenhuisen)
* bug #34779 [Security] do not validate passwords when the hash is null (xabbuh)
* bug #34757 [DI] Fix making the container path-independent when the app is in /app (nicolas-grekas)
* 3.4.36 (2019-12-01)
* bug #34649 more robust initialization from request (dbu)
* bug #34671 [Security] Fix clearing remember-me cookie after deauthentication (chalasr)
* bug #34711 Fix the translation commands when a template contains a syntax error (fabpot)
* bug #34560 [Config][ReflectionClassResource] Handle parameters with undefined constant as their default values (fancyweb)
* bug #34695 [Config] don't break on virtual stack frames in ClassExistenceResource (nicolas-grekas)
* bug #34716 [DependencyInjection] fix dumping number-like string parameters (xabbuh)
* bug #34558 [Console] Fix autocomplete multibyte input support (fancyweb)
* bug #34130 [Console] Fix commands description with numeric namespaces (fancyweb)
* bug #34632 [Console] Fix trying to access array offset on value of type int (Tavafi)
* bug #34668 [Cache] Make sure we get the correct number of values from redis::mget() (thePanz)
* bug #34533 [Monolog Bridge] Fixed accessing static property as non static. (Sander-Toonen)
* bug #34385 Avoid empty "If-Modified-Since" header in validation request (mpdude)
* bug #34458 [Validator] ConstraintValidatorTestCase: add missing return value to mocked validate method calls (ogizanagi)
* bug #34366 [HttpFoundation] Allow redirecting to URLs that contain a semicolon (JayBizzle)
* bug #34410 [HttpFoundation] Fix MySQL column type definition. (jbroutier)
* bug #34396 [Finder] Allow ssh2 stream wrapper for sftp (damienalexandre)
* bug #34381 [WebProfilerBundle] Require symfony/twig-bundle (fancyweb)
* 3.4.35 (2019-11-13)
* bug #34344 [Console] Constant STDOUT might be undefined (nicolas-grekas)
* security #cve-2019-18889 [Cache] forbid serializing AbstractAdapter and TagAwareAdapter instances (nicolas-grekas)
* security #cve-2019-18888 [HttpFoundation] fix guessing mime-types of files with leading dash (nicolas-grekas)
* security #cve-2019-18887 [HttpKernel] Use constant time comparison in UriSigner (stof)
* 3.4.34 (2019-11-11)
* bug #34297 [DI] fix locators with numeric keys (nicolas-grekas)
* bug #34282 [DI] Dont cache classes with missing parents (nicolas-grekas)
* bug #34181 [Stopwatch] Fixed bug in getDuration when counting multiple ongoing periods (TimoBakx)
* bug #34179 [Stopwatch] Fixed a bug in StopwatchEvent::getStartTime (TimoBakx)
* bug #34203 [FrameworkBundle] [HttpKernel] fixed correct EOL and EOM month (erics86)
* 3.4.33 (2019-11-01)
* bug #33998 [Config] Disable default alphabet sorting in glob function due of unstable sort (hurricane-voronin)
* bug #34144 [Serializer] Improve messages for unexpected resources values (fancyweb)
* bug #34080 [SecurityBundle] correct types for default arguments for firewall configs (shieldo)
* bug #33999 [Form] Make sure to collect child forms created on *_SET_DATA events (yceruto)
* bug #34021 [TwigBridge] do not render errors for checkboxes twice (xabbuh)
* bug #34041 [HttpKernel] fix wrong removal of the just generated container dir (nicolas-grekas)
* bug #34023 [Dotenv] allow LF in single-quoted strings (nicolas-grekas)
* bug #33818 [Yaml] Throw exception for tagged invalid inline elements (gharlan)
* bug #33948 [PropertyInfo] Respect property name case when guessing from public method name (antograssiot)
* bug #33962 [Cache] fixed TagAwareAdapter returning invalid cache (v-m-i)
* bug #33965 [HttpFoundation] Add plus character `+` to legal mime subtype (ilzrv)
* bug #32943 [Dotenv] search variable values in ENV first then env file (soufianZantar)
* bug #33943 [VarDumper] fix resetting the "bold" state in CliDumper (nicolas-grekas)
* 3.4.32 (2019-10-07)
* bug #33834 [Validator] Fix ValidValidator group cascading usage (fancyweb)
* bug #33841 [VarDumper] fix dumping uninitialized SplFileInfo (nicolas-grekas)
* bug #33799 [Security]: Don't let falsy usernames slip through impersonation (j4nr6n)
* bug #33814 [HttpFoundation] Check if data passed to SessionBagProxy::initialize is an array (mynameisbogdan)
* bug #33805 [FrameworkBundle] Fix wrong returned status code in ConfigDebugCommand (jschaedl)
* bug #33781 [AnnotationCacheWarmer] add RedirectController to annotation cache (jenschude)
* bug #33777 Fix the :only-of-type pseudo class selector (jakzal)
* bug #32051 [Serializer] Add CsvEncoder tests for PHP 7.4 (ro0NL)
* feature #33776 Copy phpunit.xsd to a predictable path (julienfalque)
* bug #33759 [Security/Http] fix parsing X509 emailAddress (nicolas-grekas)
* bug #33733 [Serializer] fix denormalization of string-arrays with only one element (mkrauser)
* bug #33754 [Cache] fix known tag versions ttl check (SwenVanZanten)
* bug #33646 [HttpFoundation] allow additinal characters in not raw cookies (marie)
* bug #33748 [Console] Do not include hidden commands in suggested alternatives (m-vo)
* bug #33625 [DependencyInjection] Fix wrong exception when service is synthetic (k0d3r1s)
* bug #32522 [Validator] Accept underscores in the URL validator, as the URL will load (battye)
* bug #32437 Fix toolbar load when GET params are present in "_wdt" route (Molkobain)
* bug #32925 [Translation] Collect original locale in case of fallback translation (digilist)
* bug #31198 [FrameworkBundle] Fix framework bundle lock configuration not working as expected (HypeMC)
* bug #33719 [Cache] dont override native Memcached options (nicolas-grekas)
* bug #33675 [PhpUnit] Fix usleep mock return value (fabpot)
* bug #33618 fix tests depending on other components' tests (xabbuh)
* bug #33626 [PropertyInfo] ensure compatibility with type resolver 0.5 (xabbuh)
* bug #33620 [Twig] Fix Twig config extra keys (fabpot)
* bug #33571 [Inflector] add support 'see' to 'ee' for singularize 'fees' to 'fee' (maxhelias)
* bug #32763 [Console] Get dimensions from stty on windows if possible (rtek)
* bug #33518 [Yaml] don't dump a scalar tag value on its own line (xabbuh)
* bug #32818 [HttpKernel] Fix getFileLinkFormat() to avoid returning the wrong URL in Profiler (Arman-Hosseini)
* bug #33487 [HttpKernel] Fix Apache mod_expires Session Cache-Control issue (pbowyer)
* bug #33439 [Validator] Sync string to date behavior and throw a better exception (fancyweb)
* bug #32903 [PHPUnit Bridge] Avoid registering listener twice (alexpott)
* bug #33402 [Finder] Prevent unintentional file locks in Windows (jspringe)
* bug #33396 Fix #33395 PHP 5.3 compatibility (kylekatarnls)
* bug #33385 [Console] allow Command::getName() to return null (nicolas-grekas)
* bug #33353 Return null as Expire header if it was set to null (danrot)
* bug #33382 [ProxyManager] remove ProxiedMethodReturnExpression polyfill (nicolas-grekas)
* bug #33377 [Yaml] fix dumping not inlined scalar tag values (xabbuh)
* 3.4.31 (2019-08-26)
* bug #33335 [DependencyInjection] Fixed the `getServiceIds` implementation to always return aliases (pdommelen)
* bug #33244 [Router] Fix TraceableUrlMatcher behaviour with trailing slash (Xavier Leune)
* bug #33172 [Console] fixed a PHP notice when there is no function in the stack trace of an Exception (fabpot)
* bug #33157 Fix getMaxFilesize() returning zero (ausi)
* bug #33139 [Intl] Cleanup unused language aliases entry (ro0NL)
* bug #33066 [Serializer] Fix negative DateInterval (jderusse)
* bug #33033 [Lock] consistently throw NotSupportException (xabbuh)
* bug #32516 [FrameworkBundle][Config] Ignore exceptions thrown during reflection classes autoload (fancyweb)
* bug #32981 Fix tests/code for php 7.4 (jderusse)
* bug #32992 [ProxyManagerBridge] Polyfill for unmaintained version (jderusse)
* bug #32933 [PhpUnitBridge] fixed PHPUnit 8.3 compatibility: method handleError was renamed to __invoke (karser)
* bug #32947 [Intl] Support DateTimeInterface in IntlDateFormatter::format (pierredup)
* bug #32838 [FrameworkBundle] Detect indirect env vars in routing (ro0NL)
* bug #32918 [Intl] Order alpha2 to alpha3 mapping (ro0NL)
* bug #32902 [PhpUnitBridge] Allow sutFqcnResolver to return array (VincentLanglet)
* bug #32682 [HttpFoundation] Revert getClientIp @return docblock (ossinkine)
* bug #32910 [Yaml] PHP-8: Uncaught TypeError: abs() expects parameter 1 to be int or float, string given (Aleksandr Dankovtsev)
* bug #32870 #32853 Check if $this->parameters is array. (ABGEO07)
* bug #32868 [PhpUnitBridge] Allow symfony/phpunit-bridge > 4.2 to be installed with phpunit 4.8 (jderusse)
* bug #32767 [Yaml] fix comment in multi line value (soufianZantar)
* bug #32790 [HttpFoundation] Fix `getMaxFilesize` (bennyborn)
* bug #32796 [Cache] fix warning on PHP 7.4 (jpauli)
* bug #32806 [Console] fix warning on PHP 7.4 (rez1dent3)
* bug #32809 Don't add object-value of static properties in the signature of container metadata-cache (arjenm)
* bug #30096 [DI] Fix dumping Doctrine-like service graphs (bis) (weaverryan, nicolas-grekas)
* bug #32799 [HttpKernel] do not stopwatch sections when profiler is disabled (Tobion)
* 3.4.30 (2019-07-27)
* bug #32503 Fix multiSelect ChoiceQuestion when answers have spaces (IceMaD)
* bug #32688 [Yaml] fix inline handling when dumping tagged values (xabbuh)
* bug #32644 [WebProfileBundle] Avoid getting right to left style (Arman-Hosseini)
* bug #32679 [Intl] relax some date parser patterns (xabbuh)
* bug #31303 [VarDumper] Use \ReflectionReference for determining if a key is a reference (php >= 7.4) (dorumd, nicolas-grekas)
* bug #32485 [Validator] Added support for validation of giga values (kernig)
* bug #32572 Bump minimum version of symfony/phpunit-bridge (fancyweb)
* bug #32438 [Serializer] XmlEncoder: don't cast padded strings (ogizanagi)
* bug #32579 [Config] Do not use absolute path when computing the vendor freshness (lyrixx)
* bug #32563 Container*::getServiceIds() should return strings (mathroc)
* bug #32466 [Config] Fix for signatures of typed properties (tvandervorm)
* bug #32500 [Debug][DebugClassLoader] Include found files instead of requiring them (fancyweb)
* bug #32464 [WebProfilerBundle] Fix Twig 1.x compatibility (yceruto)
* bug #31620 [FrameworkBundle] Inform the user when save_path will be ignored (gnat42)
* bug #32096 Don't assume port 0 for X-Forwarded-Port (alexbowers, xabbuh)
* bug #31267 [Translator] Load plurals from mo files properly (Stadly)
* bug #31266 [Translator] Load plurals from po files properly (Stadly)
* bug #32421 [EventDispatcher] Add tag kernel.rest on 'debug.event_dispatcher' service (lyrixx)
* bug #32379 [SecurityBundle] conditionally register services (xabbuh)
* bug #32363 [FrameworkBundle] reset cache pools between requests (nicolas-grekas)
* bug #32365 [DI] fix processing of regular parameter bags by MergeExtensionConfigurationPass (nicolas-grekas)
* bug #32187 [PHPUnit] Fixed composer error on Windows (misterx)
* bug #32206 Catch JsonException and rethrow in JsonEncode (phil-davis)
* bug #32200 [Security/Core] work around sodium_compat issue (nicolas-grekas)
* 3.4.29 (2019-06-26)
* bug #32137 [HttpFoundation] fix accessing session bags (xabbuh)
* bug #32164 [EventDispatcher] collect called listeners information only once (xabbuh)
* bug #32173 [FrameworkBundle] Fix calling Client::getProfile() before sending a request (dunglas)
* bug #32163 [DoctrineBridge] Fix type error (norkunas)
* bug #32170 [Security/Core] Don't use ParagonIE_Sodium_Compat (nicolas-grekas)
* bug #32123 [Form] fix translation domain (xabbuh)
* bug #32116 [FrameworkBundle] tag the FileType service as a form type (xabbuh)
* bug #32090 [Debug] workaround BC break in PHP 7.3 (nicolas-grekas)
* bug #32071 Fix expired lock not cleaned (jderusse)
* bug #32057 [HttpFoundation] Fix SA/phpdoc JsonResponse (ro0NL)
* bug #32025 SimpleCacheAdapter fails to cache any item if a namespace is used (moufmouf)
* bug #32037 [Form] validate composite constraints in all groups (xabbuh)
* bug #32007 [Serializer] Handle true and false appropriately in CSV encoder (battye)
* bug #32000 [Routing] fix absolute url generation when scheme is not known (Tobion)
* bug #32024 [VarDumper] fix dumping objects that implement __debugInfo() (nicolas-grekas)
* bug #31962 Fix reporting unsilenced deprecations from insulated tests (nicolas-grekas)
* bug #31865 [Form] Fix wrong DateTime on outdated ICU library (aweelex)
* bug #31863 [HttpFoundation] Fixed case-sensitive handling of cache-control header in RedirectResponse constructor (Ivo)
* bug #31869 Fix json-encoding when JSON_THROW_ON_ERROR is used (nicolas-grekas)
* bug #31860 [HttpFoundation] work around PHP 7.3 bug related to json_encode() (nicolas-grekas)
* bug #31407 [Security] added support for updated "distinguished name" format in x509 authentication (Robert Kopera)
* bug #31654 [HttpFoundation] Do not set X-Accel-Redirect for paths outside of X-Accel-Mapping (vilius-g)
* 3.4.28 (2019-05-28)
* bug #31584 [Workflow] Do not trigger extra guards (lyrixx)
* bug #31349 [WebProfilerBundle] Use absolute URL for profiler links (Alumbrados)
* bug #31541 [DI] fix using bindings with locators of service subscribers (nicolas-grekas)
* bug #31568 [Process] Fix infinite waiting for stopped process (mshavliuk)
* bug #31551 [ProxyManager] isProxyCandidate() does not take into account interfaces (andrerom)
* bug #31335 [Doctrine] Respect parent class contract in ContainerAwareEventManager (Koc)
* bug #31421 [Routing][AnnotationClassLoader] fix utf-8 encoding in default route name (przemyslaw-bogusz)
* bug #31510 Use the current working dir as default first arg in 'link' binary (lyrixx)
* bug #31535 [Debug] Wrap call to require_once in a try/catch (lyrixx)
* bug #31438 [Serializer] Fix denormalization of object with variadic constructor typed argument (ajgarlag)
* bug #31475 [HttpFoundation] Allow set 'None' on samesite cookie flag (markitosgv)
* bug #31261 [Console] Commands with an alias should not be recognized as ambiguous when using register (Simperfit)
* bug #31371 [DI] Removes number of elements information in debug mode (jschaedl)
* bug #31418 [FrameworkBundle] clarify the possible class/interface of the cache (xabbuh)
* bug #31411 [Intl] Fix root fallback locale (ro0NL)
* bug #31377 [Console] Fix auto-complete for ChoiceQuestion (multi-select answers) (battye)
* bug #31380 [WebProfilerBundle] Don't filter submitted IP values (javiereguiluz)
* 3.4.27 (2019-05-01)
* bug #31338 Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)" (nicolas-grekas)
* bug #31326 fix ConsoleFormatter - call to a member function format() on string (keksa)
* bug #31331 [Workflow] Fixed dumping when many transition with same name exist (lyrixx)
* bug #31302 [FramworkBundle] mark any env vars found in the ide setting as used (nicolas-grekas)
* bug #31290 [TwigBundle] Use the apply tag instead of the filter tag (greg0ire)
* bug #31275 [Translator] Preserve default domain when extracting strings from php files (Stadly)
* bug #31213 [WebProfilerBundle] Intercept redirections only for HTML format (javiereguiluz)
* 3.4.26 (2019-04-17)
* bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)
* bug #31142 Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)" (chalasr)
* security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas)
* security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof)
* security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)
* security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli)
* security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas)
* 3.4.25 (2019-04-16)
* bug #29944 [DI] Overriding services autowired by name under _defaults bind not working (przemyslaw-bogusz, renanbr)
* bug #31076 [HttpKernel] Fixed LoggerDataCollector crashing on empty file (althaus)
* bug #31071 property normalizer should also pass format and context to isAllowedAttribute (dbu)
* bug #31059 Show more accurate message in profiler when missing stopwatch (linaori)
* bug #30423 [Security] Rework firewall's access denied rule (dimabory)
* bug #31012 [Process] Fix missing $extraDirs when open_basedir returns (arsonik)
* bug #30907 [Serializer] Respect ignored attributes in cache key of normalizer (dbu)
* bug #30085 Fix TestRunner compatibility to PhpUnit 8 (alexander-schranz)
* bug #30977 [serializer] prevent mixup in normalizer of the object to populate (dbu)
* bug #30976 [Debug] Fixed error handling when an error is already handled when another error is already handled (5) (lyrixx)
* bug #30979 Fix the configurability of CoreExtension deps in standalone usage (stof)
* bug #30918 [Cache] fix using ProxyAdapter inside TagAwareAdapter (dmaicher)
* bug #30961 [Form] fix translating file validation error message (xabbuh)
* bug #30951 Handle case where no translations were found (greg0ire)
* bug #29800 [Validator] Only traverse arrays that are cascaded into (corphi)
* bug #30921 [Translator] Warm up the translations cache in dev (tgalopin)
* bug #30922 [TwigBridge] fix horizontal spacing of inlined Bootstrap forms (xabbuh)
* bug #30895 [Form] turn failed file uploads into form errors (xabbuh)
* bug #30919 [Translator] Fix wrong dump for PO files (deguif)
* bug #30889 [DependencyInjection] Fix a wrong error when using a factory (Simperfit)
* bug #30879 [Form] Php doc fixes and cs + optimizations (Jules Pietri)
* bug #30883 [Console] Fix stty not reset when aborting in QuestionHelper::autocomplete() (Simperfit)
* bug #30878 [Console] Fix inconsistent result for choice questions in non-interactive mode (chalasr)
* 3.4.24 (2019-04-02)
* bug #30660 [Bridge][Twig] DebugCommand - fix escaping and filter (SpacePossum)
* bug #30720 Fix getSetMethodNormalizer to correctly ignore the attributes specified in "ignored_attributes" (Emmanuel BORGES)
* bug #30749 [Serializer] Added check of constuctor modifiers to AbstractNormalizer (NekaKawaii)
* bug #30776 [Routing] Fix routes annotation loading with glob pattern (snoob)
* bug #30773 [DependencyInjection] Fix hardcoded hotPathTagName (jderusse)
* bug #30737 [Validator] Improve constraint default option check (vudaltsov)
* bug #30736 [Validator] Fix annotation default for @Count and @Length (vudaltsov)
* bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)
* bug #30640 [Phpunit] fixed support for PHP 5.3 (fabpot)
* bug #30595 Do not validate child constraints if form has no validation groups (maryo)
* bug #30479 Check if Client exists when test.client does not exist, to provide clearer exception message (SerkanYildiz)
* feature #30584 [Intl] Add compile binary (ro0NL)
* bug #30487 Fix Cache error while using anonymous class (Emmanuel BORGES)
* bug #30548 Correct language code for ukrainian language (stanleyk)
* bug #30518 [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers (nicolas-grekas)
* bug #30515 [Cache] Only delete one key at a time when on Predis + Cluster (andrerom)
* bug #30507 [Routing] Fixed XML options resolution (Jules Pietri)
* bug #30506 [TwigBridge] remove deprecation triggered when using Twig 2.7 (nicolas-grekas)
* bug #30496 [PHPUnit-Bridge] override some Composer environment variables (nicoweb)
* bug #30505 [TwigBridge] Remove usages of the spaceless tag (nicolas-grekas)
* bug #30474 compatibility with phpunit8 (garak)
* bug #30497 [HttpKernel] Change default log level for output streams (yceruto)
* bug #30498 [translation] Update defaut format from yml to yaml (GaryPEGEOT)
* bug #30437 [Debug] detect annotations before blank docblock lines (xabbuh)
* bug #30392 [PropertyAccess] Fixed PropertyPathBuilder remove that fails to reset internal indexes (GregOriol)
* 3.4.23 (2019-03-03)
* bug #26532 [HttpKernel] Correctly merging cache directives in HttpCache/ResponseCacheStrategy (aschempp)
* bug #30363 Fixed the DebugClassLoader compatibility with eval()'d code on Darwin (skalpa)
* bug #30329 [Form] IntegerType: reject submitted non-integer numbers (xabbuh)
* bug #30347 [Security] Change FormAuthenticator if condition (PReimers)
* bug #30354 [Console] handles multi-byte characters in autocomplete (jls-esokia)
* bug #30351 Fix getItems() performance issue with RedisCluster (php-redis) (andrerom)
* bug #30350 [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning (nicolas-grekas)
* bug #30327 [HttpKernel] Fix possible infinite loop of exceptions (enumag)
* bug #27601 [Routing] fix URL generation with look-around requirements (nasimnabavi)
* bug #30277 [Console] Prevent ArgvInput::getFirstArgument() from returning an option value (chalasr)
* bug #29981 [Security] Complain about an empty decision strategy (corphi)
* bug #29822 [EventDispatcher] Fix unknown priority (ro0NL)
* bug #30324 [Validator] Fixed duplicate UUID (ralfkuehnel)
* bug #30265 [Form] do not validate non-submitted form fields in PATCH requests (xabbuh)
* bug #30313 Avoid mutating the Finder when building the iterator (stof)
* bug #30271 [Console] Fix command testing with missing user inputs (chalasr)
* bug #30278 Remove unnecessary ProgressBar stdout writes (fixes flickering) (ostrolucky)
* bug #30274 [VarDumper] fix serializing Stub instances (nicolas-grekas)
* bug #30247 Don't resolve the Deprecation error handler mode until a deprecation is triggered (ossinkine)
* bug #30264 [Debug][ErrorHandler] Preserve next error handler (fancyweb)
* bug #30090 [FrameworkBundle] add constraint validators before optimizations (xabbuh)
* feature #30126 [Form] forward valid numeric values to transform() (xabbuh)
* bug #30122 [Security] fix switch user without having current token (Antoine Lamirault)
* bug #30136 use PropertyAccessorInterface instead of PropertyAccessor (nick-zh)
* bug #30124 Fix KernelTestCase compatibility for PhpUnit 8 (bis) (nicolas-grekas)
* bug #30061 [Form] render integer types with grouping as text input (xabbuh)
* bug #30063 [Form] don't lose int precision with not needed type casts (xabbuh)
* bug #30076 [Form] ignore _method forms in NativeRequestHandler (xabbuh)
* bug #30084 Fix KernelTestCase compatibility for PhpUnit 8 (alexander-schranz)
* bug #29884 [Form] CsrfValidationListener marks the token as invalid if it is not a string (umpirsky)
* bug #30062 [Form] do not overwrite the constraint being evaluated (xabbuh)
* bug #30087 [PhpUnitBridge] fix PHP 5.3 compat (nicolas-grekas)
* 3.4.22 (2019-02-03)
* bug #30046 [DI] Fix dumping Doctrine-like service graphs (nicolas-grekas)
* bug #30028 [Form] fix some docblocks and type checks (xabbuh)
* bug #30037 Disable Twig in the profiler menu when Twig is not used (javiereguiluz)
* bug #30026 [VarDumper] dont implement Serializable in Stub (nicolas-grekas)
* bug #30034 [Config] ensure moving away from Serializable wont break cache:clear (nicolas-grekas)
* bug #30006 [Security] don't do nested calls to serialize() (nicolas-grekas, Renan)
* bug #30007 [FrameworkBundle] Support use of hyphen in asset package name (damaya, XuruDragon)
* bug #29764 [HttpFoundation] Check file exists before unlink (adam-mospan)
* bug #29783 [HttpFoundation] MemcachedSessionHandler::close() must close connection (grachevko)
* bug #29844 [Console] Fixed #29835: ConfirmationQuestion with default true for answer '0' (mrthehud)
* bug #29869 [Debug][ErrorHandler] Preserve our error handler when a logger sets another one (fancyweb)
* bug #29926 [Form] Changed UrlType input type to text when default_protocol is not null (MatTheCat)
* bug #29961 [Translation] Concatenated translation messages (Stadly)
* bug #29920 [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends (fancyweb)
* bug #29863 [Security] Do not mix password_*() API with libsodium one (chalasr)
* bug #29894 [DependencyInjection] the string "0" is a valid service identifier (xabbuh)
* bug #29885 Update MimeType extensions (fabpot)
* bug #29875 [TwigBridge] fix compatibility with Twig >= 2.6.1 (xabbuh)
* bug #29873 [Debug] remove return type hint for PHP 5 compatibility (xabbuh)
* bug #29837 Fix SwiftMailerHandler to support Monolog's latest reset functionality (Seldaek)
* bug #29853 Revert "bug #29597 [DI] fix reporting bindings on overriden services as unused" (mmarynich)
* bug #29833 [DebugClassLoader] expose proxyfied findFile() method (fancyweb)
* 3.4.21 (2019-01-06)
* bug #29494 [HttpFoundation] Fix request uri when it starts with double slashes (alquerci)
* bug #29679 [HttpKernel] Correctly Render Signed URIs Containing Fragments (zanbaldwin)
* bug #29754 Ensure final input of CommandTester works with default (Firehed)
* bug #29695 [Form] Do not ignore the choice groups for caching (vudaltsov)
* bug #29738 [Intl] handle null date and time types (xabbuh)
* bug #29704 [FrameworkBundle] improve errors in tests missing the BrowserKit component (xabbuh)
* bug #29617 [Console] Add specific replacement for help text in single command applications (codedmonkey)
* bug #29714 [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset() callStack to null (mlievertz)
* bug #29597 [DI] fix reporting bindings on overriden services as unused (nicolas-grekas)
* bug #29639 [Yaml] detect circular references (xabbuh)
* bug #29411 [EventDispatcher] Revers event tracing order (ro0NL)
* bug #29533 Fixed public directory when configured in composer.json (alexander-schranz)
* bug #29619 [Console] OutputFormatter: move strtolower to createStyleFromString (ogizanagi)
* bug #29621 [Security] Prefer clone() over unserialize(serialize()) for user refreshment (chalasr)
* bug #29587 [Debug] ignore underscore vs backslash namespaces in DebugClassLoader (nicolas-grekas)
* bug #29584 [FrameworkBundle] fix describing routes with no controllers (nicolas-grekas)
* bug #29582 [DI] move RegisterServiceSubscribersPass before DecoratorServicePass (kbond)
* bug #29527 [TwigBridge][Form] Prevent multiple rendering of form collection prototypes (Shoplifter)
* bug #29571 [Yaml] ensures that the mb_internal_encoding is reset to its initial value (Jörn Lang)
* bug #29513 [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument (karser)
* bug #29323 [Security] defer log message in guard authenticator (eschultz-magix)
* bug #29531 [Validator] Added IBAN format for Vatican City State (raulfraile)
* bug #29307 [Form] Filter arrays out of scalar form types (nicolas-grekas)
* bug #29500 [Form] filter out invalid Intl values (xabbuh)
* bug #29499 [Validator] Fixed grouped composite constraints (HeahDude)
* 3.4.20 (2018-12-06)
* security #cve-2018-19790 [Security\Http] detect bad redirect targets using backslashes (xabbuh)
* security #cve-2018-19789 [Form] Filter file uploads out of regular form types (nicolas-grekas)
* bug #29436 [Cache] Fixed Memcached adapter doClear()to call flush() (raitocz)
* bug #29441 [Routing] ignore trailing slash for non-GET requests (nicolas-grekas)
* bug #29432 [DI] dont inline when lazy edges are found (nicolas-grekas)
* bug #29413 [Serializer] fixed DateTimeNormalizer to maintain microseconds when a different timezone required (rvitaliy)
* bug #29424 [Routing] fix taking verb into account when redirecting (nicolas-grekas)
* bug #29414 [DI] Fix dumping expressions accessing single-use private services (chalasr)
* bug #29375 [Validator] Allow `ConstraintViolation::__toString()` to expose codes that are not null or emtpy strings (phansys)
* bug #29376 [EventDispatcher] Fix eventListener wrapper loop in TraceableEventDispatcher (jderusse)
* bug #29343 [Form] Handle all case variants of "nan" when parsing a number (mwhudson, xabbuh)
* bug #29355 [PropertyAccess] calculate cache keys for property setters depending on the value (xabbuh)
* bug #29369 [DI] fix combinatorial explosion when analyzing the service graph (nicolas-grekas)
* bug #29349 [Debug] workaround opcache bug mutating "$this" !?! (nicolas-grekas)
* 3.4.19 (2018-11-26)
* bug #29318 [Console] Move back root exception to stack trace in verbose mode (chalasr)
* bug #29332 [PropertyAccess] make cache keys encoding bijective (nicolas-grekas)
* bug #29297 [Routing] fix trailing slash redirection when using RedirectableUrlMatcher (nicolas-grekas)
* bug #29313 [PropertyAccessor] fix encoding of cache keys (nicolas-grekas)
* bug #28917 [DoctrineBridge] catch errors while converting to db values in data collector (alekitto)
* bug #29317 [WebProfiler] Detect non-file paths in file viewer (ro0NL)
* bug #29305 [EventDispatcher] Unwrap wrapped listeners internally (ro0NL)
* bug #27314 [DoctrineBridge] fix case sensitivity issue in RememberMe\DoctrineTokenProvider (PF4Public)
* bug #29308 [Translation] Use XLIFF source rather than resname when there's no target (thewilkybarkid)
* bug #26244 [BrowserKit] fixed BC Break for HTTP_HOST header (brizzz)
* bug #28147 [DomCrawler] exclude fields inside "template" tags (Gorjunov)
* bug #29222 [Dotenv] properly parse backslashes in unquoted env vars (xabbuh)
* bug #29256 [HttpFoundation] Fixed absolute Request URI with default port (thomasbisignani)
* bug #29274 [Routing] Remove duplicate schemes and methods for invokable controllers (claudusd)
* bug #29271 [HttpFoundation] Fix trailing space for mime-type with parameters (Sascha Dens)
* bug #29243 [Cache] fix optimizing Psr6Cache for AdapterInterface pools (nicolas-grekas)
* bug #29247 [DI] fix taking lazy services into account when dumping the container (nicolas-grekas)
* bug #29249 [Form] Fixed empty data for compound date interval (HeahDude)
* bug #29265 [Bridge/PhpUnit] Use composer to download phpunit (nicolas-grekas)
* bug #28769 [FrameworkBundle] deal with explicitly enabled workflow nodes (xabbuh)
* bug #29223 [Validator] Added the missing constraints instance checks (thomasbisignani)
* bug #28966 [PropertyAccessor] Fix unable to write to singular property using setter while plural adder/remover exist (karser)
* bug #29182 [Form] Fixed empty data for compound date types (HeahDude)
* bug #29185 [Form] Fixed keeping hash of equal \DateTimeInterface on submit (HeahDude)
* bug #29137 [Workflow][FrameworkBundle] fixed guard event names for transitions (destillat, lyrixx)
* bug #28731 [Form] invalidate forms on transformation failures (xabbuh)
* bug #29152 [Config] Unset key during normalization (ro0NL)
* bug #29165 [DI] align IniFileLoader to PHP bugfix #76965 (nicolas-grekas)
* bug #29115 Change button_widget class to btn-primary (neFAST)
* bug #29131 [Dotenv] dont use getenv() to read SYMFONY_DOTENV_VARS (nicolas-grekas)
* bug #29057 [HttpFoundation] replace any preexisting Content-Type headers (nicolas-grekas)
* bug #29104 [DI] fix dumping inlined services (nicolas-grekas)
* bug #29054 [VarDumper] fix dump of closures created from callables (nicolas-grekas)
* bug #29102 [DI] fix GraphvizDumper ignoring inline definitions (nicolas-grekas)
* bug #29107 [DI] dont track classes/interfaces used to compute autowiring error messages (nicolas-grekas)
* 3.4.18 (2018-11-03)
* bug #28820 [DependencyInjection] Fix tags on multiple decorated service (Soner Sayakci)
* bug #29020 Fix ini_get() for boolean values (deguif)
* feature #28893 [TwigBundle] Fix usage of TwigBundle without FrameworkBundle (tgalopin)
* bug #28861 [DependencyInjection] Skip empty proxy code (olvlvl)
* bug #28801 Convert InsufficientAuthenticationException to HttpException with 401 status code (vincentchalamon)
* bug #28840 add missing double-quotes to extra_fields output message (danielkay)
* bug #28712 [Form] reverse transform RFC 3339 formatted dates (xabbuh)
* bug #28813 Fix for race condition in console output stream write (rudolfratusinski)
* bug #27772 [Console] Fixes multiselect choice question defaults in non-interactive mode (veewee)
* bug #28835 [FrameworkBundle] Setting missing default paths under BC layer (yceruto)
* bug #28760 [DI] fix dumping inline services again (nicolas-grekas)
* bug #28689 [Process] fix locking of pipe files on Windows (nicolas-grekas)
* bug #28704 [Form] fix multi-digit seconds fraction handling (xabbuh)
* bug #28793 [SecurityBundle] do not override custom access decision configs (xabbuh)
* bug #28783 [FrameworkBundle] add missing cache prefix seed attribute to XSD (xabbuh)
* bug #28072 [Security] Do not deauthenticate user when the first refreshed user has changed (gpekz)
* bug #28735 [FWBundle] Automatically enable PropertyInfo when using Flex (dunglas)
* 3.4.17 (2018-10-03)
* bug #28604 [Finder] fixed root directory access for ftp/sftp wrapper (DerDu)
* bug #28688 [FWBundle] Throw if PropertyInfo is enabled, but the component isn't installed (dunglas)
* bug #28648 [PHPUnitBridge] Fix ClockMock microtime() format (acasademont)
* bug #28678 [DI] fix dumping setters before their inlined instances (nicolas-grekas)
* bug #28672 [DI] fix error in dumped container (nicolas-grekas)
* bug #28664 [Console] Don't return early as this bypasses the auto exit feature (duncan3dc)
* 3.4.16 (2018-09-30)
* bug #28376 [TwigBundle] Fixed caching of templates in src/Resources/<BundleName>/views on cache warmup (yceruto)
* bug #28565 [HttpFoundation][Security] forward locale and format to subrequests (nicolas-grekas)
* bug #28561 [Cache] prevent getting older entries when the version key is evicted (nicolas-grekas)
* bug #28562 [HttpFoundation] fix hidding warnings from session handlers (nicolas-grekas)
* bug #28545 [Console] Send the right exit code to console.terminate listeners (mpdude)
* bug #28553 [Debug] Fix false-positive "MicroKernelTrait::loadRoutes()" method is considered internal" (nicolas-grekas)
* bug #28466 [Form] fail reverse transforming invalid RFC 3339 dates (xabbuh)
* bug #28540 [Intl] parse numbers terminated with decimal separator (xabbuh)
* bug #28548 [Console] Fixed boxed table style with colspan (ro0NL)
* bug #28433 [HttpFoundation] Allow reuse of Session between requests if ID did not change (tgalopin)
* bug #28508 [Form] forward false label option to nested types (xabbuh)
* bug #28471 [MonologBridge] Re-add option option to ignore empty context and extra data (mpdude)
* bug #28464 [Form] forward the invalid_message option in date types (xabbuh)
* bug #28524 [PhpUnitBridge] fix disabling DeprecationErrorHandler using phpunit.xml file (soerenbernstein)
* bug #28512 [DI] fix infinite loop involving self-references in decorated services (nicolas-grekas)
* bug #28507 [DI] fix dumping lazy services (nicolas-grekas)
* bug #28495 [PhpUnitBridge] Implement startTest rather than startTestSuite (greg0ire)
* bug #28480 [DI] Detect circular references with ChildDefinition parent (Seb33300)
* bug #28497 [VarDumper] Fix global dump function return value for PHP7 (patrickcarlohickman)
* bug #28499 [Ldap] Use shut up operator on connection errors at ldap_start_tls (Andras Debreczeni)
* bug #28372 [Form] Fix DateTimeType html5 input format (franzwilding, mcfedr)
* bug #28396 [Intl] Blacklist Eurozone and United Nations in Region Data Generator (gregurco)
* bug #28393 [Console] fixed corrupt error output for unknown multibyte short option (downace)
* bug #28411 [Debug] fix detecting overriden final/internal methods implemented using traits (nicolas-grekas)
* bug #28404 [Controller][ServiceValueResolver] Making method access case insensitive (nicoweb)
* bug #28401 [Console] Fix SymfonyQuestionHelper::askQuestion() with choice value as default (chalasr)
* bug #28388 [DI] configure inlined services before injecting them when dumping the container (nicolas-grekas)
* bug #28377 fix fopen flags (SpacePossum)
* bug #27764 [TwigBundle] Fixed caching of templates in default path on cache warmup (yceruto)
* bug #28366 [DI] Fix dumping some complex service graphs (nicolas-grekas)
* bug #27970 [FileValidator] Format file size in validation message according to binaryFormat option (jfredon)
* bug #28029 [TwigBundle] remove cache warmers when Twig cache is disabled (xabbuh)
* bug #28344 [HttpKernel][FrameworkBundle] Fix escaping of serialized payloads passed to test clients (nicolas-grekas)
* bug #28183 [WebProfilerBundle] fix wrong url when base path is the index (ismail1432)
* 3.4.15 (2018-08-28)
* bug #28278 [HttpFoundation] Fix unprepared BinaryFileResponse sends empty file (wackymole)
* bug #28284 [PhpUnitBridge] keep compat with composer 1.0 (nicolas-grekas)
* bug #28241 [HttpKernel] fix forwarding trusted headers as server parameters (nicolas-grekas)
* bug #28220 [PropertyAccess] fix type error handling when writing values (xabbuh)
* bug #28249 [Cache] enable Memcached::OPT_TCP_NODELAY to fix perf of misses (nicolas-grekas)
* bug #28252 [DoctrineBridge] support __toString as documented for UniqueEntityValidator (dmaicher)
* bug #28100 [Security] Call AccessListener after LogoutListener (chalasr)
* bug #28060 [DI] Fix false-positive circular ref leading to wrong exceptions or infinite loops at runtime (nicolas-grekas)
* bug #28144 [HttpFoundation] fix false-positive ConflictingHeadersException (nicolas-grekas)
* bug #28012 [PropertyInfo] Allow nested collections (jderusse)
* bug #28055 [PropertyInfo] Allow nested collections (jderusse)
* bug #28083 Remove the Expires header when calling Response::expire() (javiereguiluz)
* 3.4.14 (2018-08-01)
* security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (nicolas-grekas)
* security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (nicolas-grekas)
* bug #28003 [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet (netiul)
* bug #28007 [FrameworkBundle] fixed guard event names for transitions (destillat)
* bug #28045 [HttpFoundation] Fix Cookie::isCleared (ro0NL)
* bug #28080 [HttpFoundation] fixed using _method parameter with invalid type (Phobetor)
* bug #28052 [HttpKernel] Fix merging bindings for controllers' locators (nicolas-grekas)
* 3.4.13 (2018-07-23)
* bug #28005 [HttpKernel] Fixed templateExists on parse error of the template name (yceruto)
* bug #27997 Serbo-Croatian has Serbian plural rule (kylekatarnls)
* bug #26193 Fix false-positive deprecation notices for TranslationLoader and WriteCheckSessionHandler (iquito)
* bug #27941 [WebProfilerBundle] Fixed icon alignment issue using Bootstrap 4.1.2 (jmsche)
* bug #27937 [HttpFoundation] reset callback on StreamedResponse when setNotModified() is called (rubencm)
* bug #27927 [HttpFoundation] Suppress side effects in 'get' and 'has' methods of NamespacedAttributeBag (webnet-fr)
* bug #27923 [Form/Profiler] Massively reducing memory footprint of form profiling pages... (VincentChalnot)
* bug #27918 [Console] correctly return parameter's default value on "--" (seschwar)
* bug #27904 [Filesystem] fix lock file permissions (fritzmg)
* bug #27903 [Lock] fix lock file permissions (fritzmg)
* bug #27889 [Form] Replace .initialism with .text-uppercase. (vudaltsov)
* bug #27902 Fix the detection of the Process new argument (stof)
* bug #27885 [HttpFoundation] don't encode cookie name for BC (nicolas-grekas)
* bug #27782 [DI] Fix dumping ignore-on-uninitialized references to synthetic services (nicolas-grekas)
* bug #27435 [OptionResolver] resolve arrays (Doctrs)
* bug #27728 [TwigBridge] Fix missing path and separators in loader paths list on debug:twig output (yceruto)
* bug #27837 [PropertyInfo] Fix dock block lookup fallback loop (DerManoMann)
* bug #27758 [WebProfilerBundle] Prevent toolbar links color override by css (alcalyn)
* bug #27834 [DI] Don't show internal service id on binding errors (nicolas-grekas)
* bug #27831 Check for Hyper terminal on all operating systems. (azjezz)
* bug #27794 Add color support for Hyper terminal . (azjezz)
* bug #27809 [HttpFoundation] Fix tests: new message for status 425 (dunglas)
* bug #27618 [PropertyInfo] added handling of nullable types in PhpDoc (oxan)
* bug #27659 [HttpKernel] Make AbstractTestSessionListener compatible with CookieClearingLogoutHandler (thewilkybarkid)
* bug #27752 [Cache] provider does not respect option maxIdLength with versioning enabled (Constantine Shtompel)
* bug #27776 [ProxyManagerBridge] Fix support of private services (bis) (nicolas-grekas)
* bug #27714 [HttpFoundation] fix session tracking counter (nicolas-grekas, dmaicher)
* bug #27747 [HttpFoundation] fix registration of session proxies (nicolas-grekas)
* bug #27722 Redesign the Debug error page in prod (javiereguiluz)
* bug #27716 [DI] fix dumping deprecated service in yaml (nicolas-grekas)
* 3.4.12 (2018-06-25)
* bug #27626 [TwigBundle][DX] Only add the Twig WebLinkExtension if the WebLink component is enabled (thewilkybarkid)
* bug #27701 [SecurityBundle] Dont throw if "security.http_utils" is not found (nicolas-grekas)
* bug #27690 [DI] Resolve env placeholder in logs (ro0NL)
* bug #26534 allow_extra_attributes does not throw an exception as documented (deviantintegral)
* bug #27668 [Lock] use 'r+' for fopen (fixes issue on Solaris) (fritzmg)
* bug #27669 [Filesystem] fix file lock on SunOS (fritzmg)
* bug #27662 [HttpKernel] fix handling of nested Error instances (xabbuh)
* bug #26845 [Config] Fixing GlobResource when inside phar archive (vworldat)
* bug #27382 [Form] Fix error when rendering a DateIntervalType form with exactly 0 weeks (krixon)
* bug #27309 Fix surrogate not using original request (Toflar)
* bug #27467 [HttpKernel] fix session tracking in surrogate master requests (nicolas-grekas)
* bug #27630 [Validator][Form] Remove BOM in some xlf files (gautierderuette)
* bug #27596 [Framework][Workflow] Added support for interfaces (vudaltsov)
* bug #27593 [ProxyManagerBridge] Fixed support of private services (nicolas-grekas)
* bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (nicolas-grekas)
* bug #27581 Fix bad method call with guard authentication + session migration (weaverryan)
* bug #27576 [Cache] Fix expiry comparisons in array-based pools (nicolas-grekas)
* bug #27556 Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener (weaverryan)
* bug #27452 Avoid migration on stateless firewalls (weaverryan)
* bug #27568 [DI] Deduplicate generated proxy classes (nicolas-grekas)
* bug #27326 [Serializer] deserialize from xml: Fix a collection that contains the only one element (webnet-fr)
* bug #27567 [PhpUnitBridge] Fix error on some Windows OS (Nsbx)
* bug #27357 [Lock] Remove released semaphore (jderusse)
* bug #27416 TagAwareAdapter over non-binary memcached connections corrupts memcache (Aleksey Prilipko)
* bug #27514 [Debug] Pass previous exception to FatalErrorException (pmontoya)
* bug #27516 Revert "bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)" (nicolas-grekas)
* bug #27318 [Cache] memcache connect should not add duplicate entries on sequential calls (Aleksey Prilipko)
* bug #27389 [Serializer] Fix serializer tries to denormalize null values on nullable properties (ogizanagi)
* bug #27272 [FrameworkBundle] Change priority of AddConsoleCommandPass to TYPE_BEFORE_REMOVING (upyx)
* bug #27396 [HttpKernel] fix registering IDE links (nicolas-grekas)
* bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski)
* bug #27303 [Process] Consider "executable" suffixes first on Windows (sanmai)
* bug #27297 Triggering RememberMe's loginFail() when token cannot be created (weaverryan)
* bug #27344 [HttpKernel] reset kernel start time on reboot (kiler129)
* bug #27365 [Serializer] Check the value of enable_max_depth if defined (dunglas)
* bug #27358 [PhpUnitBridge] silence some stderr outputs (ostrolucky)
* bug #27366 [DI] never inline lazy services (nicolas-grekas)
* 3.4.11 (2018-05-25)
* bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (nicolas-grekas)
* bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas)
* security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured
* security #cve-2018-11406 clear CSRF tokens when the user is logged out
* security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener
* security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation
* security #cve-2018-11385 Adding session strategy to ALL listeners to avoid *any* possible fixation
* security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode
* bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (yceruto)
* bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (emilielorenzo)
* 3.4.10 (2018-05-21)
* bug #27264 [Validator] Use strict type in URL validator (mimol91)
* bug #27267 [DependencyInjection] resolve array env vars (jamesthomasonjr)
* bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer's divisions on transform() (syastrebov)
* bug #27286 [Translation] Add Occitan plural rule (kylekatarnls)
* bug #27271 [DI] Allow defining bindings on ChildDefinition (nicolas-grekas)
* bug #27246 Disallow invalid characters in session.name (ostrolucky)
* bug #27287 [PropertyInfo] fix resolving parent|self type hints (nicolas-grekas)
* bug #27281 [HttpKernel] Fix dealing with self/parent in ArgumentMetadataFactory (fabpot)
* bug #24805 [Security] Fix logout (MatTheCat)
* bug #27265 [DI] Shared services should not be inlined in non-shared ones (nicolas-grekas)
* bug #27141 [Process] Suppress warnings when open_basedir is non-empty (cbj4074)
* bug #27250 [Session] limiting :key for GET_LOCK to 64 chars (oleg-andreyev)
* bug #27237 [Debug] Fix populating error_get_last() for handled silent errors (nicolas-grekas)
* bug #27232 [Cache][Lock] Fix usages of error_get_last() (nicolas-grekas)
* bug #27236 [Filesystem] Fix usages of error_get_last() (nicolas-grekas)
* bug #27191 [DI] Display previous error messages when throwing unused bindings (nicolas-grekas)
* bug #27231 [FrameworkBundle] Fix cache:clear on vagrant (nicolas-grekas)
* bug #27222 [WebProfilerBundle][Cache] Fix misses calculation when calling getItems (fsevestre)
* bug #27227 [HttpKernel] Handle NoConfigurationException "onKernelException()" (nicolas-grekas)
* bug #27152 [HttpFoundation] use brace-style regex delimiters (xabbuh)
* bug #27158 [Cache] fix logic for fetching tag versions on TagAwareAdapter (dmaicher)
* bug #27143 [Console] By default hide the short exception trace line from exception messages in Symfony's commands (yceruto)
* bug #27133 [Doctrine Bridge] fix priority for doctrine event listeners (dmaicher)
* bug #27135 [FrameworkBundle] Use the correct service id for CachePoolPruneCommand in its compiler pass (DemonTPx)
* 3.4.9 (2018-04-30)
* feature #24896 Add CODE_OF_CONDUCT.md (egircys)
* bug #27074 [Debug][WebProfilerBundle] Fix setting file link format (lyrixx, nicolas-grekas)
* bug #27088 ResolveBindingsPass: Don't throw error for unused service, missing parent class (weaverryan)
* bug #27086 [PHPUnitBridge] Add an implementation just for php 7.0 (greg0ire)
* bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)
* bug #27007 [Cache] TagAwareAdapterInterface::invalidateTags() should commit deferred items (nicolas-grekas)
* bug #27067 [HttpFoundation] Fix setting session-related ini settings (e-moe)
* bug #27061 [HttpKernel] Don't clean legacy containers that are still loaded (nicolas-grekas)
* bug #27064 [VarDumper] Fix HtmlDumper classes match (ogizanagi)
* bug #27016 [Security][Guard] GuardAuthenticationProvider::authenticate cannot return null (biomedia-thomas)
* bug #26831 [Bridge/Doctrine] count(): Parameter must be an array or an object that implements Countable (gpenverne)
* bug #27044 [Security] Skip user checks if not implementing UserInterface (chalasr)
* bug #27025 [DI] Add check of internal type to ContainerBuilder::getReflectionClass (upyx)
* bug #26994 [PhpUnitBridge] Add type hints (greg0ire)
* bug #26014 [Security] Fixed being logged out on failed attempt in guard (iltar)
* bug #25348 [HttpFoundation] Send cookies using header() to fix "SameSite" ones (nicolas-grekas, cvilleger)
* bug #26910 Use new PHP7.2 functions in hasColorSupport (johnstevenson)
* bug #26999 [VarDumper] Fix dumping of SplObjectStorage (corphi)
* bug #25841 [DoctrineBridge] Fix bug when indexBy is meta key in PropertyInfo\DoctrineExtractor (insekticid)
* bug #26983 [TwigBridge] [Bootstrap 4] Fix PercentType error rendering. (alexismarquis)
* bug #26980 [TwigBundle] fix formatting arguments in plaintext format (xabbuh)
* bug #26886 Don't assume that file binary exists on *nix OS (teohhanhui)
* bug #26959 [Console] Fix PSR exception context key (scaytrase)
* bug #26899 [Routing] Fix loading multiple class annotations for invokable classes (1ed)
* bug #26643 Fix that ESI/SSI processing can turn a "private" response "public" (mpdude)
* bug #26932 [Form] Fixed trimming choice values (HeahDude)
* bug #26922 [TwigBundle] fix rendering exception stack traces (xabbuh)
* bug #26773 [HttpKernel] Make ServiceValueResolver work if controller namespace starts with a backslash in routing (mathieutu)
* bug #26870 Add d-block to bootstrap 4 alerts (Normunds)
* bug #26857 [HttpKernel] Dont create mock cookie for new sessions in tests (nicolas-grekas)
* bug #26875 [Console] Don't go past exact matches when autocompleting (nicolas-grekas)
* bug #26823 [Validator] Fix LazyLoadingMetadataFactory with PSR6Cache for non classname if tested values isn't existing class (Pascal Montoya, pmontoya)
* bug #26834 [Yaml] Throw parse error on unfinished inline map (nicolas-grekas)
* 3.4.8 (2018-04-06)
* bug #26802 [Security] register custom providers on ExpressionLanguage directly (dmaicher)
* bug #26794 [PhpUnitBridge] Catch deprecation error handler (cvilleger)
* bug #26788 [Security] Load the user before pre/post auth checks when needed (chalasr)
* bug #26792 [Routing] Fix throwing NoConfigurationException instead of 405 (nicolas-grekas)
* bug #26774 [SecurityBundle] Add missing argument to security.authentication.provider.simple (i3or1s, chalasr)
* bug #26763 [Finder] Remove duplicate slashes in filenames (helhum)
* bug #26758 [WebProfilerBundle][HttpKernel] Make FileLinkFormatter URL format generation lazy (nicolas-grekas)
* 3.4.7 (2018-04-03)
* bug #26387 [Yaml] Fix regression when trying to parse multiline (antograssiot)
* bug #26749 Add PHPDbg support to HTTP components (hkdobrev)
* bug #26609 [Console] Fix check of color support on Windows (mlocati)
* bug #26727 [HttpCache] Unlink tmp file on error (Chansig)
* bug #26675 [HttpKernel] DumpDataCollector: do not flush when a dumper is provided (ogizanagi)
* bug #26663 [TwigBridge] Fix rendering of currency by MoneyType (ro0NL)
* bug #26595 [DI] Do not suggest writing an implementation when multiple exist (chalasr)
* bug #26662 [DI] Fix hardcoded cache dir for warmups (nicolas-grekas)
* bug #26677 Support phpdbg SAPI in Debug::enable() (hkdobrev)
* bug #26600 [Routing] Fixed the importing of files using glob patterns that match multiple resources (skalpa)
* bug #26589 [Ldap] cast to string when checking empty passwords (ismail1432)
* bug #26626 [WebProfilerBundle] use the router to resolve file links (nicolas-grekas)
* bug #26635 [DI] Dont tell about autoregistration in strict autowiring mode (nicolas-grekas)
* bug #26621 [Form] no type errors with invalid submitted data types (xabbuh)
* bug #26612 [PHPunit] suite variable should be used (prisis)
* bug #26337 [Finder] Fixed leading/trailing / in filename (lyrixx)
* bug #26584 [TwigBridge] allow html5 compatible rendering of forms with null names (systemist)
* bug #24401 [Form] Change datetime to datetime-local for HTML5 datetime input (pierredup)
* bug #26513 [FrameworkBundle] Respect debug mode when warm up annotations (Strate)
* bug #26370 [Security] added userChecker to SimpleAuthenticationProvider (i3or1s)
* bug #26569 [BrowserKit] Fix cookie path handling when $domain is null (dunglas)
* bug #26273 [Security][Profiler] Display the original expression in 'Access decision log' (lyrixx)
* bug #26427 [DependencyInjection] fix regression when extending the Container class without a constructor (lsmith77)
* bug #26562 [Bridge\PhpUnit] Cannot autoload class "\Symfony\Bridge\PhpUnit\SymfonyTestsListener" (Jake Bishop)
* bug #26598 Fixes #26563 (open_basedir restriction in effect) (temperatur)
* bug #26568 [Debug] Reset previous exception handler earlier to prevent infinite loop (nicolas-grekas)
* bug #26590 Make sure form errors is valid HTML (Nyholm)
* bug #26567 [DoctrineBridge] Don't rely on ClassMetadataInfo->hasField in DoctrineOrmTypeGuesser anymore (fancyweb)
* feature #26408 Readd 'form_label_errors' block to disable errors on form labels (birkof)
* bug #26591 [TwigBridge] Make sure we always render errors. Eventhough labels are disabled (Nyholm)
* bug #26356 [FrameworkBundle] HttpCache is not longer abstract (lyrixx)
* bug #26548 [DomCrawler] Change bad wording in ChoiceFormField::untick (dunglas)
* bug #26482 [PhpUnitBridge] Ability to use different composer.json file (amcastror)
* bug #26443 [Fix][HttpFoundation] Fix the updating of timestamp in the MemcachedSessionHandler (Alessandro Loffredo)
* bug #26400 [Config] ReflectionClassResource check abstract class (andrey1s)
* bug #26433 [DomCrawler] extract(): fix a bug when the attribute list is empty (dunglas)
* bug #26041 Display the Welcome Page when there is no homepage defined (javiereguiluz)
* bug #26452 [Intl] Load locale aliases to support alias fallbacks (jakzal)
* bug #26450 [CssSelector] Fix CSS identifiers parsing - they can start with dash (jakubkulhan)
* 3.4.6 (2018-03-05)
* bug #26393 [DI] Skip resource tracking if disabled (chalasr)
* bug #26355 [DI] Fix missing "id" normalization when dumping the container (nicolas-grekas)
* bug #26368 [WebProfilerBundle] Fix Debug toolbar breaks app (xkobal)
* bug #26369 Use fill instead of style for svg colors (rpkamp)
* bug #26358 [FrameworkBundle] Silence "Failed to remove directory" on cache:clear (nicolas-grekas)
* 3.4.5 (2018-03-01)
* bug #26327 [Form][WCAG] Errors sign for people that do not see colors (Nyholm)
* bug #26326 [Form][WCAG] Added role="presentation" on tables & removed bootstrap4 table (Nyholm)
* bug #26325 [Form][WCAG] Add hidden labels on date and time fields (Nyholm)
* bug #26338 [Debug] Keep previous errors of Error instances (Philipp91)
* bug #26328 [Form][WCAG] Fixed HTML errors (Nyholm)
* bug #26290 [FrameworkBundle] [Console][DX] add a warning when command is not found (Simperfit)
* bug #26318 [Routing] Fix GC control of PHP-DSL (nicolas-grekas)
* bug #26312 [Routing] Don't throw 405 when scheme requirement doesn't match (nicolas-grekas)
* bug #26275 Set controller without __invoke method from invokable class (Tobion)
* bug #26298 Fix ArrayInput::toString() for InputArgument::IS_ARRAY args (maximium)
* bug #26177 Update excluded_ajax_paths for sf4 (jenaye)
* bug #26286 [Security] Add missing use for RoleInterface (tony-tran)
* bug #26265 [PropertyInfo] throw exception if docblock factory does not exist (xabbuh)
* bug #26247 [Translation] Process multiple segments within a single unit. (timewasted)
* bug #26254 fix custom radios/inputs for checkbox/radio type (mssimi)
* bug #26234 [FrameworkBundle] Add missing XML config for circular_reference_handler (dunglas)
* bug #26236 [PropertyInfo] ReflectionExtractor: give a chance to other extractors if no properties (dunglas)
* bug #26227 Add support for URL-like DSNs for the PdoSessionHandler (stof)