Symfony’s GitHub release page lists v6.4.48, which the platform records as published on 14 October at 06:43. Fabien Potencier signed the tag, and commit 4468c3c carries GitHub’s verified signature.

The maintenance release updates Form and Validator translations. Changes cover Tagalog, Bulgarian, Greek, Urdu, Japanese, Turkish, Russian audio validation, Persian and Serbian. Malformed translation placeholders were corrected. PhpUnitBridge no longer suppresses `__sleep` and `__wakeup` deprecations.

DependencyInjection now processes environment-variable processors correctly after resolving variables. It dumps strings such as `50 of 100` correctly, reports circular parent definitions before compiler passes, and generates anonymous service IDs independently of the project directory. Service locator IDs are reproducible, and closures for `Class::method` callables are dumped correctly. HttpClient keeps the original base URIs when `RetryableHttpClient::withOptions()` is used, while its timeout passed to `curl_multi_select()` is capped.

HttpKernel releases container services when the kernel shuts down. `DateTimeValueResolver` uses the clock for relative dates. HttpCache no longer leaks an output buffer when an ESI fragment fails and returns a 503 for stale ESI entries when the cache is locked. The release also fixes container build-lock cleanup, session ID handling after a failed session read, and tracing of responses that HttpCache cannot store. BrowserKit corrects cookie parsing and path matching. VarDumper handles exception traces containing arrays or objects in extra keys.

Clock fixes cover `DatePoint` and `MockClock::sleep()` around dates before 1970, plus the DST fall-back hour. Uid corrects fractional-second dates for time-based UUIDs before 1970. Security permits `OidcTokenHandler` without `symfony/clock`, keeps session security tokens out of logs, and improves lazy evaluation and cache warming for `#[IsGranted]` and `access_control` expressions. ExpressionLanguage now keeps evaluated and compiled expressions consistent, limits parsed tree depth, handles chained ternaries correctly, and avoids evaluating an expression again after a null-safe operator short-circuits it.

Messenger fixes cover AMQP routing for zero-delay retries, queue selection with `--queues`, empty-queue in-flight counting, publisher confirms after timeouts and delayed messages lost during retries. Doctrine transport commit failures are reported correctly. Serialization changes validate stamps on decoded envelopes, reject non-sendable stamps, preserve validation data in XML, turn decoder errors into `MessageDecodingFailedException`, and keep handler results out of transports. Moving messages between transports with different formats is also corrected. Scheduler now inspects the Envelope when describing a task.

Yaml handles fractional timestamps before 1970, NUL-prefixed mapping keys, quoted `<<` keys, whitespace in multiline quoted scalars, the `...` document marker, numeric strings with underscores, `.inf` and `.nan`, and literal blocks with leading spaces or tags. HttpFoundation adjusts deeply nested request input handling and makes `HeaderUtils::split()` work with whitespace separators. FrameworkBundle fixes workflow configuration crashes, Monolog handling of `php_errors.log: false`, and the display of abstract-service aliases in `debug:autowiring`. Other corrections affect PagerDuty payload timestamps, inherited `SYMFONY_DOTENV_VARS`, `waitUntil()`, CLI `phpinfo()`, lazy signal listeners, `AssetMapper`, lock promotion and demotion, zero timestamps in `touch()`, and the PsrHttpMessageBridge.

String improves terminal width calculations for escape sequences, OSC sequences ending in BEL, emoji, keycaps, Hangul and format characters. Its `wcswidth` data is updated for Unicode 18. The release also fixes Doctrine Messenger commit masking, cache handling for parsed attribute expressions, and several YAML and serialization round-trip cases.