❦The Daily Commit❦ ☾The Nightly Build☽

Symfony has released version 6.4.43, tagged and signed by Fabien Potencier on 29 July. It is a patch-level update for the 6.4 branch.

The 6.4.43 changelog contains more than 80 merged fixes. Several touch security-sensitive behavior: SecurityBundle now constrains redirect targets to the current host even when no session is active; HttpFoundation validates the characters allowed in cookie paths and domains; HttpClient strips the Proxy-Authorization header and the original Host header on cross-authority redirects and fails when an https proxy is configured that libcurl cannot use; SmtpTransport rejects control characters in setLocalDomain().

HttpClient also replaces the native "dechunk" stream filter with a pure PHP implementation and fixes escaping of the generated curl command. Serializer gains multiple corrections, including preferring the serialized name over the raw property key, a class check in MimeMessageNormalizer, and fixes for discriminator attributes and nested array support checks.

Further fixes span Cache (support for relay 0.40, a Relay class-not-found error with RedisCluster/RedisArray, PhpArrayAdapter initialization), Mailer (a fatal TypeError when sending a RawMessage via API transports, AsyncAws exception wrapping in AmazonSqs and SES), Messenger (ack/reject on deleted Redis stream entries, ErrorDetailsStamp trace stripping), Console (multibyte width crashes, table borders with colspan cells, independent stdout/stderr decoration), Yaml (NaN handling, integers with leading plus signs, line folding after trailing backslashes), String (multibyte splice, out-of-range offsets, AsciiSlugger locale TypeError), AssetMapper, Routing, PropertyInfo, Dotenv, EventDispatcher and ErrorHandler. The Validator now rejects misplaced "X" characters in ISBN-10 and IpUtils gained RFC2544, RFC5180, RFC5737 and RFC3849 ranges. The release also permits Twig 4, prepares for PHP 8.6 error-message changes, and updates validator translations in roughly two dozen languages. Symfony 6.4 users should update via Composer as usual.