Symfony has released maintenance version 6.4.46. Fabien Potencier tagged the release on 15 September. The published changelog for v6.4.46 lists about 60 merged pull requests compared with 6.4.45.

Several fixes affect security-relevant code paths. The Security component no longer follows redirects on the OIDC UserInfo endpoint and now reads OIDC verified claims as booleans. The Mailer’s Sendgrid integration verifies the webhook signature before parsing the payload, the Vonage Notifier bridge checks the payload_hash claim of signed webhooks, and the Twilio webhook parser rejects an empty secret. The Mime component rejects header names with non-printable or non-ASCII characters and never emits raw control characters in headers. A malformed Webhook request body now returns a 406 status instead of a 500.

HttpFoundation received several corrections: HeaderUtils::split() no longer backtracks on ambiguous input, IpUtils::anonymize() handles non-canonical IPv4-mapped addresses, and path matching uses the DOTALL modifier. Messenger drops messages queued by a failed nested dispatch, honors sub-second delays in the in-memory transport, and no longer crashes on Redis stream entries that are not JSON objects.

The Finder component got fixes for gitignore handling, prune filters in nested directories, and ignoreVCSIgnored() through symlinks. Console completion for bash and zsh was hardened, including a fix that stops zsh completion from evaluating the command line. Cache now supports Relay 0.50 and avoids closing lock handles still in use. Validator translations were reviewed or completed for Romanian, Hungarian, Catalan, Arabic, Traditional Chinese, Italian and Bosnian.