CHANGELOG-3.4.md

CHANGELOG for 3.4.x

This changelog references the relevant changes (bug and security fixes) done in 3.4 minor versions.

To get the diff for a specific change, go to https://github.com/symfony/symfony/commit/XXX where XXX is the change hash To get the diff between two versions, go to https://github.com/symfony/symfony/compare/v3.4.0...v3.4.1

• 3.4.27 (2019-05-01)

• bug #31338 Revert "bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)" (nicolas-grekas)

• bug #31326 fix ConsoleFormatter - call to a member function format() on string (keksa)

• bug #31331 [Workflow] Fixed dumping when many transition with same name exist (lyrixx)

• bug #31302 [FramworkBundle] mark any env vars found in the ide setting as used (nicolas-grekas)

• bug #31290 [TwigBundle] Use the apply tag instead of the filter tag (greg0ire)

• bug #31275 [Translator] Preserve default domain when extracting strings from php files (Stadly)

• bug #31213 [WebProfilerBundle] Intercept redirections only for HTML format (javiereguiluz)

• 3.4.26 (2019-04-17)

• bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony)

• bug #31142 Revert "bug #30423 [Security] Rework firewall's access denied rule (dimabory)" (chalasr)

• security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas)

• security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof)

• security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas)

• security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli)

• security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas)

• 3.4.25 (2019-04-16)

• bug #29944 [DI] Overriding services autowired by name under _defaults bind not working (przemyslaw-bogusz, renanbr)

• bug #31076 [HttpKernel] Fixed LoggerDataCollector crashing on empty file (althaus)

• bug #31071 property normalizer should also pass format and context to isAllowedAttribute (dbu)

• bug #31059 Show more accurate message in profiler when missing stopwatch (linaori)

• bug #30423 [Security] Rework firewall's access denied rule (dimabory)

• bug #31012 [Process] Fix missing $extraDirs when open_basedir returns (arsonik)

• bug #30907 [Serializer] Respect ignored attributes in cache key of normalizer (dbu)

• bug #30085 Fix TestRunner compatibility to PhpUnit 8 (alexander-schranz)

• bug #30977 [serializer] prevent mixup in normalizer of the object to populate (dbu)

• bug #30976 [Debug] Fixed error handling when an error is already handled when another error is already handled (5) (lyrixx)

• bug #30979 Fix the configurability of CoreExtension deps in standalone usage (stof)

• bug #30918 [Cache] fix using ProxyAdapter inside TagAwareAdapter (dmaicher)

• bug #30961 [Form] fix translating file validation error message (xabbuh)

• bug #30951 Handle case where no translations were found (greg0ire)

• bug #29800 [Validator] Only traverse arrays that are cascaded into (corphi)

• bug #30921 [Translator] Warm up the translations cache in dev (tgalopin)

• bug #30922 [TwigBridge] fix horizontal spacing of inlined Bootstrap forms (xabbuh)

• bug #30895 [Form] turn failed file uploads into form errors (xabbuh)

• bug #30919 [Translator] Fix wrong dump for PO files (deguif)

• bug #30889 [DependencyInjection] Fix a wrong error when using a factory (Simperfit)

• bug #30879 [Form] Php doc fixes and cs + optimizations (Jules Pietri)

• bug #30883 [Console] Fix stty not reset when aborting in QuestionHelper::autocomplete() (Simperfit)

• bug #30878 [Console] Fix inconsistent result for choice questions in non-interactive mode (chalasr)

• 3.4.24 (2019-04-02)

• bug #30660 [Bridge][Twig] DebugCommand - fix escaping and filter (SpacePossum)

• bug #30720 Fix getSetMethodNormalizer to correctly ignore the attributes specified in "ignored_attributes" (Emmanuel BORGES)

• bug #30749 [Serializer] Added check of constuctor modifiers to AbstractNormalizer (NekaKawaii)

• bug #30776 [Routing] Fix routes annotation loading with glob pattern (snoob)

• bug #30773 [DependencyInjection] Fix hardcoded hotPathTagName (jderusse)

• bug #30737 [Validator] Improve constraint default option check (vudaltsov)

• bug #30736 [Validator] Fix annotation default for @Count and @Length (vudaltsov)

• bug #30620 [FrameworkBundle][HttpFoundation] make session service resettable (dmaicher)

• bug #30640 [Phpunit] fixed support for PHP 5.3 (fabpot)

• bug #30595 Do not validate child constraints if form has no validation groups (maryo)

• bug #30479 Check if Client exists when test.client does not exist, to provide clearer exception message (SerkanYildiz)

• feature #30584 [Intl] Add compile binary (ro0NL)

• bug #30487 Fix Cache error while using anonymous class (Emmanuel BORGES)

• bug #30548 Correct language code for ukrainian language (stanleyk)

• bug #30518 [Cache] Fix perf when using RedisCluster by reducing roundtrips to the servers (nicolas-grekas)

• bug #30515 [Cache] Only delete one key at a time when on Predis + Cluster (andrerom)

• bug #30507 [Routing] Fixed XML options resolution (Jules Pietri)

• bug #30506 [TwigBridge] remove deprecation triggered when using Twig 2.7 (nicolas-grekas)

• bug #30496 [PHPUnit-Bridge] override some Composer environment variables (nicoweb)

• bug #30505 [TwigBridge] Remove usages of the spaceless tag (nicolas-grekas)

• bug #30474 compatibility with phpunit8 (garak)

• bug #30497 [HttpKernel] Change default log level for output streams (yceruto)

• bug #30498 [translation] Update defaut format from yml to yaml (GaryPEGEOT)

• bug #30437 [Debug] detect annotations before blank docblock lines (xabbuh)

• bug #30392 [PropertyAccess] Fixed PropertyPathBuilder remove that fails to reset internal indexes (GregOriol)

• 3.4.23 (2019-03-03)

• bug #26532 [HttpKernel] Correctly merging cache directives in HttpCache/ResponseCacheStrategy (aschempp)

• bug #30363 Fixed the DebugClassLoader compatibility with eval()'d code on Darwin (skalpa)

• bug #30329 [Form] IntegerType: reject submitted non-integer numbers (xabbuh)

• bug #30347 [Security] Change FormAuthenticator if condition (PReimers)

• bug #30354 [Console] handles multi-byte characters in autocomplete (jls-esokia)

• bug #30351 Fix getItems() performance issue with RedisCluster (php-redis) (andrerom)

• bug #30350 [VarDumper] Keep a ref to objects to ensure their handle cannot be reused while cloning (nicolas-grekas)

• bug #30327 [HttpKernel] Fix possible infinite loop of exceptions (enumag)

• bug #27601 [Routing] fix URL generation with look-around requirements (nasimnabavi)

• bug #30277 [Console] Prevent ArgvInput::getFirstArgument() from returning an option value (chalasr)

• bug #29981 [Security] Complain about an empty decision strategy (corphi)

• bug #29822 [EventDispatcher] Fix unknown priority (ro0NL)

• bug #30324 [Validator] Fixed duplicate UUID (ralfkuehnel)

• bug #30265 [Form] do not validate non-submitted form fields in PATCH requests (xabbuh)

• bug #30313 Avoid mutating the Finder when building the iterator (stof)

• bug #30271 [Console] Fix command testing with missing user inputs (chalasr)

• bug #30278 Remove unnecessary ProgressBar stdout writes (fixes flickering) (ostrolucky)

• bug #30274 [VarDumper] fix serializing Stub instances (nicolas-grekas)

• bug #30247 Don't resolve the Deprecation error handler mode until a deprecation is triggered (ossinkine)

• bug #30264 [Debug][ErrorHandler] Preserve next error handler (fancyweb)

• bug #30090 [FrameworkBundle] add constraint validators before optimizations (xabbuh)

• feature #30126 [Form] forward valid numeric values to transform() (xabbuh)

• bug #30122 [Security] fix switch user without having current token (Antoine Lamirault)

• bug #30136 use PropertyAccessorInterface instead of PropertyAccessor (nick-zh)

• bug #30124 Fix KernelTestCase compatibility for PhpUnit 8 (bis) (nicolas-grekas)

• bug #30061 [Form] render integer types with grouping as text input (xabbuh)

• bug #30063 [Form] don't lose int precision with not needed type casts (xabbuh)

• bug #30076 [Form] ignore _method forms in NativeRequestHandler (xabbuh)

• bug #30084 Fix KernelTestCase compatibility for PhpUnit 8 (alexander-schranz)

• bug #29884 [Form] CsrfValidationListener marks the token as invalid if it is not a string (umpirsky)

• bug #30062 [Form] do not overwrite the constraint being evaluated (xabbuh)

• bug #30087 [PhpUnitBridge] fix PHP 5.3 compat (nicolas-grekas)

• 3.4.22 (2019-02-03)

• bug #30046 [DI] Fix dumping Doctrine-like service graphs (nicolas-grekas)

• bug #30028 [Form] fix some docblocks and type checks (xabbuh)

• bug #30037 Disable Twig in the profiler menu when Twig is not used (javiereguiluz)

• bug #30026 [VarDumper] dont implement Serializable in Stub (nicolas-grekas)

• bug #30034 [Config] ensure moving away from Serializable wont break cache:clear (nicolas-grekas)

• bug #30006 [Security] don't do nested calls to serialize() (nicolas-grekas, Renan)

• bug #30007 [FrameworkBundle] Support use of hyphen in asset package name (damaya, XuruDragon)

• bug #29764 [HttpFoundation] Check file exists before unlink (adam-mospan)

• bug #29783 [HttpFoundation] MemcachedSessionHandler::close() must close connection (grachevko)

• bug #29844 [Console] Fixed #29835: ConfirmationQuestion with default true for answer '0' (mrthehud)

• bug #29869 [Debug][ErrorHandler] Preserve our error handler when a logger sets another one (fancyweb)

• bug #29926 [Form] Changed UrlType input type to text when default_protocol is not null (MatTheCat)

• bug #29961 [Translation] Concatenated translation messages (Stadly)

• bug #29920 [Debug][DebugClassLoader] Match more cases for final, deprecated and internal classes / methods extends (fancyweb)

• bug #29863 [Security] Do not mix password_*() API with libsodium one (chalasr)

• bug #29894 [DependencyInjection] the string "0" is a valid service identifier (xabbuh)

• bug #29885 Update MimeType extensions (fabpot)

• bug #29875 [TwigBridge] fix compatibility with Twig >= 2.6.1 (xabbuh)

• bug #29873 [Debug] remove return type hint for PHP 5 compatibility (xabbuh)

• bug #29837 Fix SwiftMailerHandler to support Monolog's latest reset functionality (Seldaek)

• bug #29853 Revert "bug #29597 [DI] fix reporting bindings on overriden services as unused" (mmarynich)

• bug #29833 [DebugClassLoader] expose proxyfied findFile() method (fancyweb)

• 3.4.21 (2019-01-06)

• bug #29494 [HttpFoundation] Fix request uri when it starts with double slashes (alquerci)

• bug #29679 [HttpKernel] Correctly Render Signed URIs Containing Fragments (zanbaldwin)

• bug #29754 Ensure final input of CommandTester works with default (Firehed)

• bug #29695 [Form] Do not ignore the choice groups for caching (vudaltsov)

• bug #29738 [Intl] handle null date and time types (xabbuh)

• bug #29704 [FrameworkBundle] improve errors in tests missing the BrowserKit component (xabbuh)

• bug #29617 [Console] Add specific replacement for help text in single command applications (codedmonkey)

• bug #29714 [Event Dispatcher] fixed 29703: TraceableEventDispatcher reset() callStack to null (mlievertz)

• bug #29597 [DI] fix reporting bindings on overriden services as unused (nicolas-grekas)

• bug #29639 [Yaml] detect circular references (xabbuh)

• bug #29411 [EventDispatcher] Revers event tracing order (ro0NL)

• bug #29533 Fixed public directory when configured in composer.json (alexander-schranz)

• bug #29619 [Console] OutputFormatter: move strtolower to createStyleFromString (ogizanagi)

• bug #29621 [Security] Prefer clone() over unserialize(serialize()) for user refreshment (chalasr)

• bug #29587 [Debug] ignore underscore vs backslash namespaces in DebugClassLoader (nicolas-grekas)

• bug #29584 [FrameworkBundle] fix describing routes with no controllers (nicolas-grekas)

• bug #29582 [DI] move RegisterServiceSubscribersPass before DecoratorServicePass (kbond)

• bug #29527 [TwigBridge][Form] Prevent multiple rendering of form collection prototypes (Shoplifter)

• bug #29571 [Yaml] ensures that the mb_internal_encoding is reset to its initial value (Jörn Lang)

• bug #29513 [Hackday][Serializer] Deserialization ignores argument type hint from phpdoc for array in constructor argument (karser)

• bug #29323 [Security] defer log message in guard authenticator (eschultz-magix)

• bug #29531 [Validator] Added IBAN format for Vatican City State (raulfraile)

• bug #29307 [Form] Filter arrays out of scalar form types (nicolas-grekas)

• bug #29500 [Form] filter out invalid Intl values (xabbuh)

• bug #29499 [Validator] Fixed grouped composite constraints (HeahDude)

• 3.4.20 (2018-12-06)

• security #cve-2018-19790 [Security\Http] detect bad redirect targets using backslashes (xabbuh)

• security #cve-2018-19789 [Form] Filter file uploads out of regular form types (nicolas-grekas)

• bug #29436 [Cache] Fixed Memcached adapter doClear()to call flush() (raitocz)

• bug #29441 [Routing] ignore trailing slash for non-GET requests (nicolas-grekas)

• bug #29432 [DI] dont inline when lazy edges are found (nicolas-grekas)

• bug #29413 [Serializer] fixed DateTimeNormalizer to maintain microseconds when a different timezone required (rvitaliy)

• bug #29424 [Routing] fix taking verb into account when redirecting (nicolas-grekas)

• bug #29414 [DI] Fix dumping expressions accessing single-use private services (chalasr)

• bug #29375 [Validator] Allow ConstraintViolation::__toString() to expose codes that are not null or emtpy strings (phansys)

• bug #29376 [EventDispatcher] Fix eventListener wrapper loop in TraceableEventDispatcher (jderusse)

• bug #29343 [Form] Handle all case variants of "nan" when parsing a number (mwhudson, xabbuh)

• bug #29355 [PropertyAccess] calculate cache keys for property setters depending on the value (xabbuh)

• bug #29369 [DI] fix combinatorial explosion when analyzing the service graph (nicolas-grekas)

• bug #29349 [Debug] workaround opcache bug mutating "$this" !?! (nicolas-grekas)

• 3.4.19 (2018-11-26)

• bug #29318 [Console] Move back root exception to stack trace in verbose mode (chalasr)

• bug #29332 [PropertyAccess] make cache keys encoding bijective (nicolas-grekas)

• bug #29297 [Routing] fix trailing slash redirection when using RedirectableUrlMatcher (nicolas-grekas)

• bug #29313 [PropertyAccessor] fix encoding of cache keys (nicolas-grekas)

• bug #28917 [DoctrineBridge] catch errors while converting to db values in data collector (alekitto)

• bug #29317 [WebProfiler] Detect non-file paths in file viewer (ro0NL)

• bug #29305 [EventDispatcher] Unwrap wrapped listeners internally (ro0NL)

• bug #27314 [DoctrineBridge] fix case sensitivity issue in RememberMe\DoctrineTokenProvider (PF4Public)

• bug #29308 [Translation] Use XLIFF source rather than resname when there's no target (thewilkybarkid)

• bug #26244 [BrowserKit] fixed BC Break for HTTP_HOST header (brizzz)

• bug #28147 [DomCrawler] exclude fields inside "template" tags (Gorjunov)

• bug #29222 [Dotenv] properly parse backslashes in unquoted env vars (xabbuh)

• bug #29256 [HttpFoundation] Fixed absolute Request URI with default port (thomasbisignani)

• bug #29274 [Routing] Remove duplicate schemes and methods for invokable controllers (claudusd)

• bug #29271 [HttpFoundation] Fix trailing space for mime-type with parameters (Sascha Dens)

• bug #29243 [Cache] fix optimizing Psr6Cache for AdapterInterface pools (nicolas-grekas)

• bug #29247 [DI] fix taking lazy services into account when dumping the container (nicolas-grekas)

• bug #29249 [Form] Fixed empty data for compound date interval (HeahDude)

• bug #29265 [Bridge/PhpUnit] Use composer to download phpunit (nicolas-grekas)

• bug #28769 [FrameworkBundle] deal with explicitly enabled workflow nodes (xabbuh)

• bug #29223 [Validator] Added the missing constraints instance checks (thomasbisignani)

• bug #28966 [PropertyAccessor] Fix unable to write to singular property using setter while plural adder/remover exist (karser)

• bug #29182 [Form] Fixed empty data for compound date types (HeahDude)

• bug #29185 [Form] Fixed keeping hash of equal \DateTimeInterface on submit (HeahDude)

• bug #29137 [Workflow][FrameworkBundle] fixed guard event names for transitions (destillat, lyrixx)

• bug #28731 [Form] invalidate forms on transformation failures (xabbuh)

• bug #29152 [Config] Unset key during normalization (ro0NL)

• bug #29165 [DI] align IniFileLoader to PHP bugfix #76965 (nicolas-grekas)

• bug #29115 Change button_widget class to btn-primary (neFAST)

• bug #29131 [Dotenv] dont use getenv() to read SYMFONY_DOTENV_VARS (nicolas-grekas)

• bug #29057 [HttpFoundation] replace any preexisting Content-Type headers (nicolas-grekas)

• bug #29104 [DI] fix dumping inlined services (nicolas-grekas)

• bug #29054 [VarDumper] fix dump of closures created from callables (nicolas-grekas)

• bug #29102 [DI] fix GraphvizDumper ignoring inline definitions (nicolas-grekas)

• bug #29107 [DI] dont track classes/interfaces used to compute autowiring error messages (nicolas-grekas)

• 3.4.18 (2018-11-03)

• bug #28820 [DependencyInjection] Fix tags on multiple decorated service (Soner Sayakci)

• bug #29020 Fix ini_get() for boolean values (deguif)

• feature #28893 [TwigBundle] Fix usage of TwigBundle without FrameworkBundle (tgalopin)

• bug #28861 [DependencyInjection] Skip empty proxy code (olvlvl)

• bug #28801 Convert InsufficientAuthenticationException to HttpException with 401 status code (vincentchalamon)

• bug #28840 add missing double-quotes to extra_fields output message (danielkay)

• bug #28712 [Form] reverse transform RFC 3339 formatted dates (xabbuh)

• bug #28813 Fix for race condition in console output stream write (rudolfratusinski)

• bug #27772 [Console] Fixes multiselect choice question defaults in non-interactive mode (veewee)

• bug #28835 [FrameworkBundle] Setting missing default paths under BC layer (yceruto)

• bug #28760 [DI] fix dumping inline services again (nicolas-grekas)

• bug #28689 [Process] fix locking of pipe files on Windows (nicolas-grekas)

• bug #28704 [Form] fix multi-digit seconds fraction handling (xabbuh)

• bug #28793 [SecurityBundle] do not override custom access decision configs (xabbuh)

• bug #28783 [FrameworkBundle] add missing cache prefix seed attribute to XSD (xabbuh)

• bug #28072 [Security] Do not deauthenticate user when the first refreshed user has changed (gpekz)

• bug #28735 [FWBundle] Automatically enable PropertyInfo when using Flex (dunglas)

• 3.4.17 (2018-10-03)

• bug #28604 [Finder] fixed root directory access for ftp/sftp wrapper (DerDu)

• bug #28688 [FWBundle] Throw if PropertyInfo is enabled, but the component isn't installed (dunglas)

• bug #28648 [PHPUnitBridge] Fix ClockMock microtime() format (acasademont)

• bug #28678 [DI] fix dumping setters before their inlined instances (nicolas-grekas)

• bug #28672 [DI] fix error in dumped container (nicolas-grekas)

• bug #28664 [Console] Don't return early as this bypasses the auto exit feature (duncan3dc)

• 3.4.16 (2018-09-30)

• bug #28376 [TwigBundle] Fixed caching of templates in src/Resources//views on cache warmup (yceruto)

• bug #28565 [HttpFoundation][Security] forward locale and format to subrequests (nicolas-grekas)

• bug #28561 [Cache] prevent getting older entries when the version key is evicted (nicolas-grekas)

• bug #28562 [HttpFoundation] fix hidding warnings from session handlers (nicolas-grekas)

• bug #28545 [Console] Send the right exit code to console.terminate listeners (mpdude)

• bug #28553 [Debug] Fix false-positive "MicroKernelTrait::loadRoutes()" method is considered internal" (nicolas-grekas)

• bug #28466 [Form] fail reverse transforming invalid RFC 3339 dates (xabbuh)

• bug #28540 [Intl] parse numbers terminated with decimal separator (xabbuh)

• bug #28548 [Console] Fixed boxed table style with colspan (ro0NL)

• bug #28433 [HttpFoundation] Allow reuse of Session between requests if ID did not change (tgalopin)

• bug #28508 [Form] forward false label option to nested types (xabbuh)

• bug #28471 [MonologBridge] Re-add option option to ignore empty context and extra data (mpdude)

• bug #28464 [Form] forward the invalid_message option in date types (xabbuh)

• bug #28524 [PhpUnitBridge] fix disabling DeprecationErrorHandler using phpunit.xml file (soerenbernstein)

• bug #28512 [DI] fix infinite loop involving self-references in decorated services (nicolas-grekas)

• bug #28507 [DI] fix dumping lazy services (nicolas-grekas)

• bug #28495 [PhpUnitBridge] Implement startTest rather than startTestSuite (greg0ire)

• bug #28480 [DI] Detect circular references with ChildDefinition parent (Seb33300)

• bug #28497 [VarDumper] Fix global dump function return value for PHP7 (patrickcarlohickman)

• bug #28499 [Ldap] Use shut up operator on connection errors at ldap_start_tls (Andras Debreczeni)

• bug #28372 [Form] Fix DateTimeType html5 input format (franzwilding, mcfedr)

• bug #28396 [Intl] Blacklist Eurozone and United Nations in Region Data Generator (gregurco)

• bug #28393 [Console] fixed corrupt error output for unknown multibyte short option (downace)

• bug #28411 [Debug] fix detecting overriden final/internal methods implemented using traits (nicolas-grekas)

• bug #28404 [Controller][ServiceValueResolver] Making method access case insensitive (nicoweb)

• bug #28401 [Console] Fix SymfonyQuestionHelper::askQuestion() with choice value as default (chalasr)

• bug #28388 [DI] configure inlined services before injecting them when dumping the container (nicolas-grekas)

• bug #28377 fix fopen flags (SpacePossum)

• bug #27764 [TwigBundle] Fixed caching of templates in default path on cache warmup (yceruto)

• bug #28366 [DI] Fix dumping some complex service graphs (nicolas-grekas)

• bug #27970 [FileValidator] Format file size in validation message according to binaryFormat option (jfredon)

• bug #28029 [TwigBundle] remove cache warmers when Twig cache is disabled (xabbuh)

• bug #28344 [HttpKernel][FrameworkBundle] Fix escaping of serialized payloads passed to test clients (nicolas-grekas)

• bug #28183 [WebProfilerBundle] fix wrong url when base path is the index (ismail1432)

• 3.4.15 (2018-08-28)

• bug #28278 [HttpFoundation] Fix unprepared BinaryFileResponse sends empty file (wackymole)

• bug #28284 [PhpUnitBridge] keep compat with composer 1.0 (nicolas-grekas)

• bug #28241 [HttpKernel] fix forwarding trusted headers as server parameters (nicolas-grekas)

• bug #28220 [PropertyAccess] fix type error handling when writing values (xabbuh)

• bug #28249 [Cache] enable Memcached::OPT_TCP_NODELAY to fix perf of misses (nicolas-grekas)

• bug #28252 [DoctrineBridge] support __toString as documented for UniqueEntityValidator (dmaicher)

• bug #28100 [Security] Call AccessListener after LogoutListener (chalasr)

• bug #28060 [DI] Fix false-positive circular ref leading to wrong exceptions or infinite loops at runtime (nicolas-grekas)

• bug #28144 [HttpFoundation] fix false-positive ConflictingHeadersException (nicolas-grekas)

• bug #28012 [PropertyInfo] Allow nested collections (jderusse)

• bug #28055 [PropertyInfo] Allow nested collections (jderusse)

• bug #28083 Remove the Expires header when calling Response::expire() (javiereguiluz)

• 3.4.14 (2018-08-01)

• security #cve-2018-14774 [HttpKernel] fix trusted headers management in HttpCache and InlineFragmentRenderer (nicolas-grekas)

• security #cve-2018-14773 [HttpFoundation] Remove support for legacy and risky HTTP headers (nicolas-grekas)

• bug #28003 [HttpKernel] Fixes invalid REMOTE_ADDR in inline subrequest when configuring trusted proxy with subnet (netiul)

• bug #28007 [FrameworkBundle] fixed guard event names for transitions (destillat)

• bug #28045 [HttpFoundation] Fix Cookie::isCleared (ro0NL)

• bug #28080 [HttpFoundation] fixed using _method parameter with invalid type (Phobetor)

• bug #28052 [HttpKernel] Fix merging bindings for controllers' locators (nicolas-grekas)

• 3.4.13 (2018-07-23)

• bug #28005 [HttpKernel] Fixed templateExists on parse error of the template name (yceruto)

• bug #27997 Serbo-Croatian has Serbian plural rule (kylekatarnls)

• bug #26193 Fix false-positive deprecation notices for TranslationLoader and WriteCheckSessionHandler (iquito)

• bug #27941 [WebProfilerBundle] Fixed icon alignment issue using Bootstrap 4.1.2 (jmsche)

• bug #27937 [HttpFoundation] reset callback on StreamedResponse when setNotModified() is called (rubencm)

• bug #27927 [HttpFoundation] Suppress side effects in 'get' and 'has' methods of NamespacedAttributeBag (webnet-fr)

• bug #27923 [Form/Profiler] Massively reducing memory footprint of form profiling pages... (VincentChalnot)

• bug #27918 [Console] correctly return parameter's default value on "--" (seschwar)

• bug #27904 [Filesystem] fix lock file permissions (fritzmg)

• bug #27903 [Lock] fix lock file permissions (fritzmg)

• bug #27889 [Form] Replace .initialism with .text-uppercase. (vudaltsov)

• bug #27902 Fix the detection of the Process new argument (stof)

• bug #27885 [HttpFoundation] don't encode cookie name for BC (nicolas-grekas)

• bug #27782 [DI] Fix dumping ignore-on-uninitialized references to synthetic services (nicolas-grekas)

• bug #27435 [OptionResolver] resolve arrays (Doctrs)

• bug #27728 [TwigBridge] Fix missing path and separators in loader paths list on debug:twig output (yceruto)

• bug #27837 [PropertyInfo] Fix dock block lookup fallback loop (DerManoMann)

• bug #27758 [WebProfilerBundle] Prevent toolbar links color override by css (alcalyn)

• bug #27834 [DI] Don't show internal service id on binding errors (nicolas-grekas)

• bug #27831 Check for Hyper terminal on all operating systems. (azjezz)

• bug #27794 Add color support for Hyper terminal . (azjezz)

• bug #27809 [HttpFoundation] Fix tests: new message for status 425 (dunglas)

• bug #27618 [PropertyInfo] added handling of nullable types in PhpDoc (oxan)

• bug #27659 [HttpKernel] Make AbstractTestSessionListener compatible with CookieClearingLogoutHandler (thewilkybarkid)

• bug #27752 [Cache] provider does not respect option maxIdLength with versioning enabled (Constantine Shtompel)

• bug #27776 [ProxyManagerBridge] Fix support of private services (bis) (nicolas-grekas)

• bug #27714 [HttpFoundation] fix session tracking counter (nicolas-grekas, dmaicher)

• bug #27747 [HttpFoundation] fix registration of session proxies (nicolas-grekas)

• bug #27722 Redesign the Debug error page in prod (javiereguiluz)

• bug #27716 [DI] fix dumping deprecated service in yaml (nicolas-grekas)

• 3.4.12 (2018-06-25)

• bug #27626 [TwigBundle][DX] Only add the Twig WebLinkExtension if the WebLink component is enabled (thewilkybarkid)

• bug #27701 [SecurityBundle] Dont throw if "security.http_utils" is not found (nicolas-grekas)

• bug #27690 [DI] Resolve env placeholder in logs (ro0NL)

• bug #26534 allow_extra_attributes does not throw an exception as documented (deviantintegral)

• bug #27668 [Lock] use 'r+' for fopen (fixes issue on Solaris) (fritzmg)

• bug #27669 [Filesystem] fix file lock on SunOS (fritzmg)

• bug #27662 [HttpKernel] fix handling of nested Error instances (xabbuh)

• bug #26845 [Config] Fixing GlobResource when inside phar archive (vworldat)

• bug #27382 [Form] Fix error when rendering a DateIntervalType form with exactly 0 weeks (krixon)

• bug #27309 Fix surrogate not using original request (Toflar)

• bug #27467 [HttpKernel] fix session tracking in surrogate master requests (nicolas-grekas)

• bug #27630 [Validator][Form] Remove BOM in some xlf files (gautierderuette)

• bug #27596 [Framework][Workflow] Added support for interfaces (vudaltsov)

• bug #27593 [ProxyManagerBridge] Fixed support of private services (nicolas-grekas)

• bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (nicolas-grekas)

• bug #27581 Fix bad method call with guard authentication + session migration (weaverryan)

• bug #27576 [Cache] Fix expiry comparisons in array-based pools (nicolas-grekas)

• bug #27556 Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener (weaverryan)

• bug #27452 Avoid migration on stateless firewalls (weaverryan)

• bug #27568 [DI] Deduplicate generated proxy classes (nicolas-grekas)

• bug #27326 [Serializer] deserialize from xml: Fix a collection that contains the only one element (webnet-fr)

• bug #27567 [PhpUnitBridge] Fix error on some Windows OS (Nsbx)

• bug #27357 [Lock] Remove released semaphore (jderusse)

• bug #27416 TagAwareAdapter over non-binary memcached connections corrupts memcache (Aleksey Prilipko)

• bug #27514 [Debug] Pass previous exception to FatalErrorException (pmontoya)

• bug #27516 Revert "bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)" (nicolas-grekas)

• bug #27318 [Cache] memcache connect should not add duplicate entries on sequential calls (Aleksey Prilipko)

• bug #27389 [Serializer] Fix serializer tries to denormalize null values on nullable properties (ogizanagi)

• bug #27272 [FrameworkBundle] Change priority of AddConsoleCommandPass to TYPE_BEFORE_REMOVING (upyx)

• bug #27396 [HttpKernel] fix registering IDE links (nicolas-grekas)

• bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski)

• bug #27303 [Process] Consider "executable" suffixes first on Windows (sanmai)

• bug #27297 Triggering RememberMe's loginFail() when token cannot be created (weaverryan)

• bug #27344 [HttpKernel] reset kernel start time on reboot (kiler129)

• bug #27365 [Serializer] Check the value of enable_max_depth if defined (dunglas)

• bug #27358 [PhpUnitBridge] silence some stderr outputs (ostrolucky)

• bug #27366 [DI] never inline lazy services (nicolas-grekas)

• 3.4.11 (2018-05-25)

• bug #27364 [DI] Fix bad exception on uninitialized references to non-shared services (nicolas-grekas)

• bug #27359 [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization (nicolas-grekas)

• security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured

• security #cve-2018-11406 clear CSRF tokens when the user is logged out

• security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener

• security #cve-2018-11385 Adding session authentication strategy to Guard to avoid session fixation

• security #cve-2018-11385 Adding session strategy to ALL listeners to avoid any possible fixation

• security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode

• bug #27341 [WebProfilerBundle] Fixed validator/dump trace CSS (yceruto)

• bug #27337 [FrameworkBundle] fix typo in CacheClearCommand (emilielorenzo)

• 3.4.10 (2018-05-21)

• bug #27264 [Validator] Use strict type in URL validator (mimol91)

• bug #27267 [DependencyInjection] resolve array env vars (jamesthomasonjr)

• bug #26781 [Form] Fix precision of MoneyToLocalizedStringTransformer's divisions on transform() (syastrebov)

• bug #27286 [Translation] Add Occitan plural rule (kylekatarnls)

• bug #27271 [DI] Allow defining bindings on ChildDefinition (nicolas-grekas)

• bug #27246 Disallow invalid characters in session.name (ostrolucky)

• bug #27287 [PropertyInfo] fix resolving parent|self type hints (nicolas-grekas)

• bug #27281 [HttpKernel] Fix dealing with self/parent in ArgumentMetadataFactory (fabpot)

• bug #24805 [Security] Fix logout (MatTheCat)

• bug #27265 [DI] Shared services should not be inlined in non-shared ones (nicolas-grekas)

• bug #27141 [Process] Suppress warnings when open_basedir is non-empty (cbj4074)

• bug #27250 [Session] limiting :key for GET_LOCK to 64 chars (oleg-andreyev)

• bug #27237 [Debug] Fix populating error_get_last() for handled silent errors (nicolas-grekas)

• bug #27232 [Cache][Lock] Fix usages of error_get_last() (nicolas-grekas)

• bug #27236 [Filesystem] Fix usages of error_get_last() (nicolas-grekas)

• bug #27191 [DI] Display previous error messages when throwing unused bindings (nicolas-grekas)

• bug #27231 [FrameworkBundle] Fix cache:clear on vagrant (nicolas-grekas)

• bug #27222 [WebProfilerBundle][Cache] Fix misses calculation when calling getItems (fsevestre)

• bug #27227 [HttpKernel] Handle NoConfigurationException "onKernelException()" (nicolas-grekas)

• bug #27152 [HttpFoundation] use brace-style regex delimiters (xabbuh)

• bug #27158 [Cache] fix logic for fetching tag versions on TagAwareAdapter (dmaicher)

• bug #27143 [Console] By default hide the short exception trace line from exception messages in Symfony's commands (yceruto)

• bug #27133 [Doctrine Bridge] fix priority for doctrine event listeners (dmaicher)

• bug #27135 [FrameworkBundle] Use the correct service id for CachePoolPruneCommand in its compiler pass (DemonTPx)

• 3.4.9 (2018-04-30)

• feature #24896 Add CODE_OF_CONDUCT.md (egircys)

• bug #27074 [Debug][WebProfilerBundle] Fix setting file link format (lyrixx, nicolas-grekas)

• bug #27088 ResolveBindingsPass: Don't throw error for unused service, missing parent class (weaverryan)

• bug #27086 [PHPUnitBridge] Add an implementation just for php 7.0 (greg0ire)

• bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)

• bug #27007 [Cache] TagAwareAdapterInterface::invalidateTags() should commit deferred items (nicolas-grekas)

• bug #27067 [HttpFoundation] Fix setting session-related ini settings (e-moe)

• bug #27061 [HttpKernel] Don't clean legacy containers that are still loaded (nicolas-grekas)

• bug #27064 [VarDumper] Fix HtmlDumper classes match (ogizanagi)

• bug #27016 [Security][Guard] GuardAuthenticationProvider::authenticate cannot return null (biomedia-thomas)

• bug #26831 [Bridge/Doctrine] count(): Parameter must be an array or an object that implements Countable (gpenverne)

• bug #27044 [Security] Skip user checks if not implementing UserInterface (chalasr)

• bug #27025 [DI] Add check of internal type to ContainerBuilder::getReflectionClass (upyx)

• bug #26994 [PhpUnitBridge] Add type hints (greg0ire)

• bug #26014 [Security] Fixed being logged out on failed attempt in guard (iltar)

• bug #25348 [HttpFoundation] Send cookies using header() to fix "SameSite" ones (nicolas-grekas, cvilleger)

• bug #26910 Use new PHP7.2 functions in hasColorSupport (johnstevenson)

• bug #26999 [VarDumper] Fix dumping of SplObjectStorage (corphi)

• bug #25841 [DoctrineBridge] Fix bug when indexBy is meta key in PropertyInfo\DoctrineExtractor (insekticid)

• bug #26983 [TwigBridge] [Bootstrap 4] Fix PercentType error rendering. (alexismarquis)

• bug #26980 [TwigBundle] fix formatting arguments in plaintext format (xabbuh)

• bug #26886 Don't assume that file binary exists on *nix OS (teohhanhui)

• bug #26959 [Console] Fix PSR exception context key (scaytrase)

• bug #26899 [Routing] Fix loading multiple class annotations for invokable classes (1ed)

• bug #26643 Fix that ESI/SSI processing can turn a "private" response "public" (mpdude)

• bug #26932 [Form] Fixed trimming choice values (HeahDude)

• bug #26922 [TwigBundle] fix rendering exception stack traces (xabbuh)

• bug #26773 [HttpKernel] Make ServiceValueResolver work if controller namespace starts with a backslash in routing (mathieutu)

• bug #26870 Add d-block to bootstrap 4 alerts (Normunds)

• bug #26857 [HttpKernel] Dont create mock cookie for new sessions in tests (nicolas-grekas)

• bug #26875 [Console] Don't go past exact matches when autocompleting (nicolas-grekas)

• bug #26823 [Validator] Fix LazyLoadingMetadataFactory with PSR6Cache for non classname if tested values isn't existing class (Pascal Montoya, pmontoya)

• bug #26834 [Yaml] Throw parse error on unfinished inline map (nicolas-grekas)

• 3.4.8 (2018-04-06)

• bug #26802 [Security] register custom providers on ExpressionLanguage directly (dmaicher)

• bug #26794 [PhpUnitBridge] Catch deprecation error handler (cvilleger)

• bug #26788 [Security] Load the user before pre/post auth checks when needed (chalasr)

• bug #26792 [Routing] Fix throwing NoConfigurationException instead of 405 (nicolas-grekas)

• bug #26774 [SecurityBundle] Add missing argument to security.authentication.provider.simple (i3or1s, chalasr)

• bug #26763 [Finder] Remove duplicate slashes in filenames (helhum)

• bug #26758 [WebProfilerBundle][HttpKernel] Make FileLinkFormatter URL format generation lazy (nicolas-grekas)

• 3.4.7 (2018-04-03)

• bug #26387 [Yaml] Fix regression when trying to parse multiline (antograssiot)

• bug #26749 Add PHPDbg support to HTTP components (hkdobrev)

• bug #26609 [Console] Fix check of color support on Windows (mlocati)

• bug #26727 [HttpCache] Unlink tmp file on error (Chansig)

• bug #26675 [HttpKernel] DumpDataCollector: do not flush when a dumper is provided (ogizanagi)

• bug #26663 [TwigBridge] Fix rendering of currency by MoneyType (ro0NL)

• bug #26595 [DI] Do not suggest writing an implementation when multiple exist (chalasr)

• bug #26662 [DI] Fix hardcoded cache dir for warmups (nicolas-grekas)

• bug #26677 Support phpdbg SAPI in Debug::enable() (hkdobrev)

• bug #26600 [Routing] Fixed the importing of files using glob patterns that match multiple resources (skalpa)

• bug #26589 [Ldap] cast to string when checking empty passwords (ismail1432)

• bug #26626 [WebProfilerBundle] use the router to resolve file links (nicolas-grekas)

• bug #26635 [DI] Dont tell about autoregistration in strict autowiring mode (nicolas-grekas)

• bug #26621 [Form] no type errors with invalid submitted data types (xabbuh)

• bug #26612 [PHPunit] suite variable should be used (prisis)

• bug #26337 [Finder] Fixed leading/trailing / in filename (lyrixx)

• bug #26584 [TwigBridge] allow html5 compatible rendering of forms with null names (systemist)

• bug #24401 [Form] Change datetime to datetime-local for HTML5 datetime input (pierredup)

• bug #26513 [FrameworkBundle] Respect debug mode when warm up annotations (Strate)

• bug #26370 [Security] added userChecker to SimpleAuthenticationProvider (i3or1s)

• bug #26569 [BrowserKit] Fix cookie path handling when $domain is null (dunglas)

• bug #26273 [Security][Profiler] Display the original expression in 'Access decision log' (lyrixx)

• bug #26427 [DependencyInjection] fix regression when extending the Container class without a constructor (lsmith77)

• bug #26562 [Bridge\PhpUnit] Cannot autoload class "\Symfony\Bridge\PhpUnit\SymfonyTestsListener" (Jake Bishop)

• bug #26598 Fixes #26563 (open_basedir restriction in effect) (temperatur)

• bug #26568 [Debug] Reset previous exception handler earlier to prevent infinite loop (nicolas-grekas)

• bug #26590 Make sure form errors is valid HTML (Nyholm)

• bug #26567 [DoctrineBridge] Don't rely on ClassMetadataInfo->hasField in DoctrineOrmTypeGuesser anymore (fancyweb)

• feature #26408 Readd 'form_label_errors' block to disable errors on form labels (birkof)

• bug #26591 [TwigBridge] Make sure we always render errors. Eventhough labels are disabled (Nyholm)

• bug #26356 [FrameworkBundle] HttpCache is not longer abstract (lyrixx)

• bug #26548 [DomCrawler] Change bad wording in ChoiceFormField::untick (dunglas)

• bug #26482 [PhpUnitBridge] Ability to use different composer.json file (amcastror)

• bug #26443 [Fix][HttpFoundation] Fix the updating of timestamp in the MemcachedSessionHandler (Alessandro Loffredo)

• bug #26400 [Config] ReflectionClassResource check abstract class (andrey1s)

• bug #26433 [DomCrawler] extract(): fix a bug when the attribute list is empty (dunglas)

• bug #26041 Display the Welcome Page when there is no homepage defined (javiereguiluz)

• bug #26452 [Intl] Load locale aliases to support alias fallbacks (jakzal)

• bug #26450 [CssSelector] Fix CSS identifiers parsing - they can start with dash (jakubkulhan)

• 3.4.6 (2018-03-05)

• bug #26393 [DI] Skip resource tracking if disabled (chalasr)

• bug #26355 [DI] Fix missing "id" normalization when dumping the container (nicolas-grekas)

• bug #26368 [WebProfilerBundle] Fix Debug toolbar breaks app (xkobal)

• bug #26369 Use fill instead of style for svg colors (rpkamp)

• bug #26358 [FrameworkBundle] Silence "Failed to remove directory" on cache:clear (nicolas-grekas)

• 3.4.5 (2018-03-01)

• bug #26327 [Form][WCAG] Errors sign for people that do not see colors (Nyholm)

• bug #26326 [Form][WCAG] Added role="presentation" on tables & removed bootstrap4 table (Nyholm)

• bug #26325 [Form][WCAG] Add hidden labels on date and time fields (Nyholm)

• bug #26338 [Debug] Keep previous errors of Error instances (Philipp91)

• bug #26328 [Form][WCAG] Fixed HTML errors (Nyholm)

• bug #26290 [FrameworkBundle] [Console][DX] add a warning when command is not found (Simperfit)

• bug #26318 [Routing] Fix GC control of PHP-DSL (nicolas-grekas)

• bug #26312 [Routing] Don't throw 405 when scheme requirement doesn't match (nicolas-grekas)

• bug #26275 Set controller without __invoke method from invokable class (Tobion)

• bug #26298 Fix ArrayInput::toString() for InputArgument::IS_ARRAY args (maximium)

• bug #26177 Update excluded_ajax_paths for sf4 (jenaye)

• bug #26286 [Security] Add missing use for RoleInterface (tony-tran)

• bug #26265 [PropertyInfo] throw exception if docblock factory does not exist (xabbuh)

• bug #26247 [Translation] Process multiple segments within a single unit. (timewasted)

• bug #26254 fix custom radios/inputs for checkbox/radio type (mssimi)

• bug #26234 [FrameworkBundle] Add missing XML config for circular_reference_handler (dunglas)

• bug #26236 [PropertyInfo] ReflectionExtractor: give a chance to other extractors if no properties (dunglas)

• bug #26227 Add support for URL-like DSNs for the PdoSessionHandler (stof)

• bug #25557 [WebProfilerBundle] add a way to limit ajax request (Simperfit)

• bug #26088 [FrameworkBundle] Fix using annotation_reader in compiler pass to inject configured cache provider (Laizerox)

• bug #26157 [HttpKernel] Send new session cookie from AbstractTestSessionListener after session invalidation (rpkamp)

• bug #26230 [WebProfilerBundle] Fix anchor CSS (ro0NL)

• bug #26228 [HttpFoundation] Fix missing "throw" in JsonResponse (nicolas-grekas)

• bug #26211 [Console] Suppress warning from sapi_windows_vt100_support (adawolfa)

• bug #26176 Retro-fit proxy code to make it deterministic for older proxy manager implementations (lstrojny)

• bug #25787 Yaml parser regression with comments and non-strings (alexpott)

• bug #26156 Fixes #26136: Avoid emitting warning in hasParameterOption() (greg-1-anderson)

• bug #26183 [DI] Add null check for removeChild (changmin.keum)

• bug #26167 [TwigBridge] Apply some changes to support Bootstrap4-stable (mpiot, Nyholm)

• bug #26173 [Security] fix accessing request values (xabbuh)

• bug #26089 [PhpUnitBridge] Added support for PHPUnit 7 in Coverage Listener (lyrixx)

• bug #26170 [PHPUnit bridge] Avoid running the remove command without any packages (stof)

• bug #26159 created validator.tl.xlf for Form/Translations (ergiegonzaga)

• bug #26100 [Routing] Throw 405 instead of 404 when redirect is not possible (nicolas-grekas)

• bug #26119 [TwigBundle][WebProfilerBundle] Fix JS collision (ro0NL)

• bug #26040 [Process] Check PHP_BINDIR before $PATH in PhpExecutableFinder (nicolas-grekas)

• bug #26067 [YAML] Issue #26065: leading spaces in YAML multi-line string literals (tamc)

• bug #26012 Exit as late as possible (greg0ire)

• bug #26082 [Cache][WebProfiler] fix collecting cache stats with sub-requests + allow clearing calls (dmaicher)

• bug #26024 [PhpBridge] add PHPUnit 7 support to SymfonyTestsListener (shieldo)

• bug #26020 [Lock] Log already-locked errors as "notice" instead of "warning" (Simperfit)

• bug #26043 [Serialized] add context to serialize and deserialize (andrey1s)

• bug #26127 Deterministic time in cache items for reproducible builds (lstrojny)

• bug #26128 Make kernel build time optionally deterministic (lstrojny)

• bug #26112 Env var maps to undefined constant. (dsmink)

• bug #26111 [Security] fix merge of 2.7 into 2.8 + add test case (dmaicher)

• bug #25893 [Console] Fix hasParameterOption / getParameterOption when used with multiple flags (greg-1-anderson)

• bug #25756 [TwigBundle] Register TwigBridge extensions first (fancyweb)

• bug #26051 [WebProfilerBundle] Fix sub request link (ro0NL)

• bug #25947 PhpDocExtractor::getTypes() throws fatal error when type omitted (Jared Farrish)

• bug #25940 [Form] keep the context when validating forms (xabbuh)

• bug #26057 [SecurityBundle] use libsodium to run Argon2i related tests (xabbuh)

• bug #25373 Use the PCRE_DOLLAR_ENDONLY modifier in route regexes (mpdude)

• bug #24435 [Form] Make sure errors are a part of the label on bootstrap 4 - this is a requirement for WCAG2 (Nyholm)

• bug #25762 [DependencyInjection] always call the parent class' constructor (xabbuh)

• bug #25976 [Config] Handle Service/EventSubscriberInterface in ReflectionClassResource (nicolas-grekas)

• bug #25989 [DI][Routing] Fix tracking of globbed resources (nicolas-grekas, sroze)

• bug #26009 [SecurityBundle] Allow remember-me factory creation when multiple user providers are configured. (iisisrael)

• bug #26010 [CssSelector] For AND operator, the left operand should have parentheses, not only right operand (Arnaud CHASSEUX)

• bug #26000 Fixed issue #25985 (KevinFrantz)

• bug #25996 Don't show wanna-be-private services as public in debug:container (chalasr)

• bug #25914 [HttpKernel] collect extension information as late as possible (xabbuh)

• bug #25981 [DI] Fix tracking of source class changes for lazy-proxies (nicolas-grekas)

• bug #25971 [Debug] Fix bad registration of exception handler, leading to mem leak (nicolas-grekas)

• bug #25962 [Routing] Fix trailing slash redirection for non-safe verbs (nicolas-grekas)

• bug #25948 [Form] Fixed empty data on expanded ChoiceType and FileType (HeahDude)

• bug #25978 Deterministic proxy names (lstrojny)

• bug #25972 support sapi_windows_vt100_support for php 7.2+ (jhdxr)

• bug #25744 [TwigBridge] Allow label translation to be safe (MatTheCat)

• 3.4.4 (2018-01-29)

• bug #25932 Don't stop PSR-4 service discovery if a parent class is missing (derrabus)

• bug #25922 [HttpFoundation] Use the correct syntax for session gc based on Pdo driver (tanasecosminromeo)

• bug #25933 Disable CSP header on exception pages only in debug (ostrolucky)

• bug #25926 [Form] Fixed Button::setParent() when already submitted (HeahDude)

• bug #25927 [Form] Fixed submitting disabled buttons (HeahDude)

• bug #25397 [Console] Provide a DX where an array could be passed (Simperfit)

• bug #25858 [DI] Fix initialization of legacy containers by delaying include_once (nicolas-grekas)

• bug #25891 [DependencyInjection] allow null values for root nodes in YAML configs (xabbuh)

• bug #24864 Have weak_vendors ignore deprecations from outside (greg0ire)

• bug #25848 [Validator] add missing parent isset and add test (Simperfit)

• bug #25869 [Process] Skip environment variables with false value in Process (francoispluchino)

• bug #25864 [Yaml] don't split lines on carriage returns when dumping (xabbuh)

• bug #25861 do not conflict with egulias/email-validator 2.0+ (xabbuh)

• bug #25851 [Validator] Conflict with egulias/email-validator 2.0 (emodric)

• bug #25837 [SecurityBundle] Don't register in memory users as services (chalasr)

• bug #25835 [HttpKernel] DebugHandlersListener should always replace the existing exception handler (nicolas-grekas)

• bug #25829 [Debug] Always decorate existing exception handlers to deal with fatal errors (nicolas-grekas)

• bug #25823 [Security] Notify that symfony/expression-language is not installed if ExpressionLanguage is used (giovannialbero1992)

• bug #25824 Fixing a bug where the dump() function depended on bundle ordering (weaverryan)

• bug #25763 [OptionsResolver] Fix options resolver with array allowed types (mcg-web)

• bug #25789 Enableable ArrayNodeDefinition is disabled for empty configuration (kejwmen)

• bug #25822 [Cache] Fix handling of apcu_fetch() edgy behavior (nicolas-grekas)

• bug #25816 Problem in phar see mergerequest #25579 (betzholz)

• bug #25781 [Form] Disallow transform dates beyond the year 9999 (curry684)

• bug #25287 [Serializer] DateTimeNormalizer handling of null and empty values (returning it instead of new object) (Simperfit)

• bug #25249 [Form] Avoid button label translation when it's set to false (TeLiXj)

• bug #25127 [TwigBridge] Pass the form-check-inline in parent (Simperfit)

• bug #25812 Copied NO language files to the new NB locale (derrabus)

• bug #25753 [Console] Fix restoring exception handler (nicolas-grekas, fancyweb)

• bug #25801 [Router] Skip anonymous classes when loading annotated routes (pierredup)

• bug #25508 [FrameworkBundle] Auto-enable CSRF if the component + session are loaded (nicolas-grekas)

• bug #25657 [Security] Fix fatal error on non string username (chalasr)

• bug #25791 [Routing] Make sure we only build routes once (sroze)

• bug #25799 Fixed Request::__toString ignoring cookies (Toflar)

• bug #25755 [Debug] prevent infinite loop with faulty exception handlers (nicolas-grekas)

• bug #25771 [Validator] 19 digits VISA card numbers are valid (xabbuh)

• bug #25751 [FrameworkBundle] Add the missing enabled session attribute (sroze)

• bug #25750 [HttpKernel] Turn bad hosts into 400 instead of 500 (nicolas-grekas)

• bug #25699 [HttpKernel] Fix session handling: decouple "save" from setting response "private" (nicolas-grekas)

• bug #25490 [Serializer] Fixed throwing exception with option JSON_PARTIAL_OUTPUT_ON_ERROR (diversantvlz)

• bug #25737 [TwigBridge] swap filter/function and package names (xabbuh)

• bug #25731 [HttpFoundation] Always call proxied handler::destroy() in StrictSessionHandler (nicolas-grekas)

• bug #25733 [HttpKernel] Fix compile error when a legacy container is fresh again (nicolas-grekas)

• bug #25709 Tweaked some styles in the profiler tables (javiereguiluz)

• bug #25719 [HttpKernel] Uses cookies to track the requests redirection (sroze)

• bug #25696 [FrameworkBundle] Fix using "annotations.cached_reader" in after-removing passes (nicolas-grekas)

• feature #25669 [Security] Fail gracefully if the security token cannot be unserialized from the session (thewilkybarkid)

• bug #25700 Run simple-phpunit with --no-suggest option (ro0NL)

• 3.4.3 (2018-01-05)

• bug #25685 Use triggering file to determine weak vendors if when the test is run in a separate process (alexpott)

• bug #25671 Remove randomness from dumped containers (nicolas-grekas)

• bug #25532 [HttpKernel] Disable CSP header on exception pages (ostrolucky)

• bug #25678 [WebProfilerBundle] set the var in the right scope (Jochen Mandl)

• bug #25491 [Routing] Use the default host even if context is empty (sroze)

• bug #25672 [WebServerBundle] use interface_exists instead of class_exists (kbond)

• bug #25662 Dumper shouldn't use html format for phpdbg / cli-server (jhoff)

• bug #25529 [Validator] Fix access to root object when using composite constraint (ostrolucky)

• bug #25404 [Form] Remove group options without data on debug:form command (yceruto)

• bug #25430 Fixes for Oracle in PdoSessionHandler (elislenio)

• bug #25117 [FrameworkBundle] Make cache:clear "atomic" and consistent with cache:warmup (hkdobrev)

• bug #25583 [HttpKernel] Call Response->setPrivate() instead of sending raw header() when session is started (Toflar)

• bug #25601 [TwigBundle/Brige] catch missing requirements to throw meaningful exceptions (nicolas-grekas)

• bug #25547 [DX][DependencyInjection] Suggest to write an implementation if the interface cannot be autowired (sroze)

• bug #25599 Add application/ld+json format associated to json (vincentchalamon)

• bug #25623 [HttpFoundation] Fix false-positive ConflictingHeadersException (nicolas-grekas)

• bug #25624 [WebServerBundle] Fix escaping of php binary with arguments (nicolas-grekas)

• bug #25604 Add check for SecurityBundle in createAccessDeniedException (FGM)

• bug #25591 [HttpKernel] fix cleaning legacy containers (nicolas-grekas)

• bug #25526 [WebProfilerBundle] Fix panel break when stopwatch component is not installed. (umulmrum, javiereguiluz)

• bug #25606 Updating message to inform the user how to install the component (weaverryan)

• bug #25571 [SecurityBundle] allow auto_wire for SessionAuthenticationStrategy class (xavren)

• bug #25567 [Process] Fix setting empty env vars (nicolas-grekas)

• bug #25407 [Console] Commands with an alias should not be recognized as ambiguous (Simperfit)

• bug #25523 [WebServerBundle] fix a bug where require would not require the good file because of env (Simperfit)

• bug #25559 [Process] Dont use getenv(), it returns arrays and can introduce subtle breaks accros PHP versions (nicolas-grekas)

• bug #25552 [WebProfilerBundle] Let fetch() cast URL to string (ro0NL)

• bug #25521 [Console] fix a bug when you are passing a default value and passing -n would output the index (Simperfit)

• 3.4.2 (2017-12-15)

• bug #25489 [FrameworkBundle] remove esi/ssi renderers if inactive (dmaicher)

• bug #25502 Fixing wrong class_exists on interface (weaverryan)

• bug #25427 Preserve percent-encoding in URLs when performing redirects in the UrlMatcher (mpdude)

• bug #25480 [FrameworkBundle] add missing validation options to XSD file (xabbuh)

• bug #25487 [Console] Fix a bug when passing a letter that could be an alias (Simperfit)

• bug #25425 When available use AnnotationRegistry::registerUniqueLoader (jrjohnson)

• bug #25474 [DI] Optimize Container::get() for perf (nicolas-grekas)

• bug #24594 [Translation] Fix InvalidArgumentException when using untranslated plural forms from .po files (BjornTwachtmann)

• bug #25233 [TwigBridge][Form] Fix hidden currency element with Bootstrap 3 theme (julienfalque)

• bug #25413 [HttpKernel] detect deprecations thrown by container initialization during tests (nicolas-grekas)

• bug #25408 [Debug] Fix catching fatal errors in case of nested error handlers (nicolas-grekas)

• bug #25330 [HttpFoundation] Support 0 bit netmask in IPv6 (::/0) (stephank)

• bug #25378 [VarDumper] Fixed file links leave blank pages when ide is configured (antalaron)

• bug #25410 [HttpKernel] Fix logging of post-terminate errors/exceptions (nicolas-grekas)

• bug #25417 [Process] Dont rely on putenv(), it fails on ZTS PHP (nicolas-grekas)

• bug #25333 [DI] Impossible to set an environment variable and then an array as container parameter (Phantas0s)

• bug #25447 [Process] remove false-positive BC breaking exception on Windows (nicolas-grekas)

• bug #25381 [DI] Add context to service-not-found exceptions thrown by service locators (nicolas-grekas)

• bug #25438 [Yaml] empty lines don't count for indent detection (xabbuh)

• bug #25412 Extend Argon2i support check to account for sodium_compat (mbabker)

• bug #25389 [Yaml] fix some edge cases with indented blocks (xabbuh)

• bug #25396 [Form] Fix debug:form command definition (yceruto)

• bug #25398 [HttpFoundation] don't prefix cookies with "Set-Cookie:" (pableu)

• bug #25354 [DI] Fix non-string class handling in PhpDumper (nicolas-grekas, sroze)

• bug #25340 [Serializer] Unset attributes when creating child context (dunglas)

• bug #25325 [Yaml] do not evaluate PHP constant names (xabbuh)

• bug #25380 [FrameworkBundle][Cache] register system cache clearer only if it's used (xabbuh)

• bug #25323 [ExpressionLanguage] throw an SyntaxError instead of an undefined index notice (Simperfit)

• bug #25363 [HttpKernel] Disable inlining on PHP 5 (nicolas-grekas)

• bug #25364 [DependencyInjection] Prevent a loop in aliases within the findDefinition method (sroze)

• bug #25337 Remove Exclusive Lock That Breaks NFS Caching (brianfreytag)

• 3.4.1 (2017-12-04)

• bug #25304 [Bridge/PhpUnit] Prefer $_SERVER['argv'] over $argv (ricknox)

• bug #25272 [SecurityBundle] fix setLogoutOnUserChange calls for context listeners (dmaicher)

• bug #25282 [DI] Register singly-implemented interfaces when doing PSR-4 discovery (nicolas-grekas)

• bug #25274 [Security] Adding a GuardAuthenticatorHandler alias (weaverryan)

• bug #25308 [FrameworkBundle] Fix a bug where a color tag will be shown when passing an antislash (Simperfit)

• bug #25278 Fix for missing whitespace control modifier in form layout (kubawerlos)

• bug #25306 [Form][TwigBridge] Fix collision between view properties and form fields (yceruto)

• bug #25305 [Form][TwigBridge] Fix collision between view properties and form fields (yceruto)

• bug #25236 [Form][TwigBridge] Fix collision between view properties and form fields (yceruto)

• bug #25312 [DI] Fix deep-inlining of non-shared refs (nicolas-grekas)

• bug #25309 [Yaml] parse newlines in quoted multiline strings (xabbuh)

• bug #25313 [DI] Fix missing unset leading to false-positive circular ref (nicolas-grekas)

• bug #25285 [DI] Throw an exception if Expression Language is not installed (sroze)

• bug #25241 [Yaml] do not eagerly filter comment lines (xabbuh)

• bug #25297 [Validator] Fixed the @Valid(groups={"group"}) against null exception case (vudaltsov)

• bug #25255 [Console][DI] Fail gracefully (nicolas-grekas)

• bug #25264 [DI] Trigger deprecation when setting a to-be-private synthetic service (nicolas-grekas)

• bug #25258 [link] Prevent warnings when running link with 2.7 (dunglas)

• bug #25244 [DI] Add missing deprecation when fetching private services from ContainerBuilder (nicolas-grekas)

• bug #24750 [Validator] ExpressionValidator should use OBJECT_TO_STRING (Simperfit)

• bug #25247 [DI] Fix false-positive circular exception (nicolas-grekas)

• bug #25226 [HttpKernel] Fix issue when resetting DumpDataCollector (Pierstoval)

• bug #25230 Use a more specific file for detecting the bridge (greg0ire)

• bug #25232 [WebProfilerBundle] [TwigBundle] Fix Profiler breaking XHTML pages (tistre)

• 3.4.0 (2017-11-30)

• bug #25220 [HttpFoundation] Add Session::isEmpty(), fix MockFileSessionStorage to behave like the native one (nicolas-grekas)

• bug #25209 [VarDumper] Dont use empty(), it chokes on eg GMP objects (nicolas-grekas)

• bug #25200 [HttpKernel] Arrays with scalar values passed to ESI fragment renderer throw deprecation notice (Simperfit)

• bug #25201 [HttpKernel] Add a better error messages when passing a private or non-tagged controller (Simperfit)

• bug #25217 [Dotenv] Changed preg_match flags from null to 0 (deekthesqueak)

• bug #25180 [DI] Fix circular reference when using setters (nicolas-grekas)

• bug #25204 [DI] Clear service reference graph (nicolas-grekas)

• bug #25203 [DI] Fix infinite loop in InlineServiceDefinitionsPass (nicolas-grekas)

• bug #25185 [Serializer] Do not cache attributes if attributes in context (sroze)

• bug #25190 [HttpKernel] Keep legacy container files for concurrent requests (nicolas-grekas)

• bug #25182 [HttpFoundation] AutExpireFlashBag should not clear new flashes (Simperfit, sroze)

• bug #25174 [Translation] modify definitions only if the do exist (xabbuh)

• bug #25179 [FrameworkBundle][Serializer] Remove YamlEncoder definition if Yaml component isn't installed (ogizanagi)

• bug #25160 [DI] Prevent a ReflectionException during cache:clear when the parent class doesn't exist (dunglas)

• bug #25163 [DI] Fix tracking of env vars in exceptions (nicolas-grekas)

• bug #25162 [HttpKernel] Read $_ENV when checking SHELL_VERBOSITY (nicolas-grekas)

• bug #25158 [DI] Remove unreachable code (GawainLynch)

• bug #25152 [Form] Don't rely on Symfony\Component\HttpFoundation\File\File if http-foundation isn't in FileType (issei-m)

• bug #24987 [Console] Fix global console flag when used in chain (Simperfit)

• bug #25137 Adding checks for the expression language (weaverryan)

• bug #25151 [FrameworkBundle] Automatically enable the CSRF protection if CSRF manager exists (sroze)

• bug #25043 [Yaml] added ability for substitute aliases when mapping is on single line (Michał Strzelecki, xabbuh)

• 3.4.0-RC2 (2017-11-24)

• bug #25146 [DI] Dont resolve envs in service ids (nicolas-grekas)

• bug #25113 [Routing] Fix "config-file-relative" annotation loader resources (nicolas-grekas, sroze)

• bug #25065 [FrameworkBundle] Update translation commands to work with default paths (yceruto)

• bug #25109 Make debug:container search command case-insensitive (jzawadzki)

• bug #25121 [FrameworkBundle] Fix AssetsInstallCommand (nicolas-grekas)

• bug #25102 [Form] Fixed ContextErrorException in FileType (chihiro-adachi)

• bug #25130 [DI] Fix handling of inlined definitions by ContainerBuilder (nicolas-grekas)

• bug #25119 [DI] Fix infinite loop when analyzing references (nicolas-grekas)

• bug #25094 [FrameworkBundle][DX] Display a nice error message if an enabled component is missing (derrabus)

• bug #25100 [SecurityBundle] providerIds is undefined error when firewall provider is not specified (karser)

• bug #25100 [SecurityBundle] providerIds is undefined error when firewall provider is not specified (karser)

• bug #25100 [SecurityBundle] providerIds is undefined error when firewall provider is not specified (karser)

• bug #25097 [Bridge\PhpUnit] Turn "preserveGlobalState" to false by default, revert "Blacklist" removal (nicolas-grekas)

• 3.4.0-RC1 (2017-11-21)

• bug #25077 [Bridge/Twig] Let getFlashes starts the session (MatTheCat)

• bug #25082 [HttpKernel] Disable container inlining when legacy inlining has been used (nicolas-grekas)

• bug #25072 [Bridge/PhpUnit] Remove trailing "\n" from ClockMock::microtime(false) (joky)

• bug #25069 [Debug] Fix undefined variable $lightTrace (nicolas-grekas)

• bug #25053 [Serializer] Fixing PropertyNormalizer supports parent properties (Christopher Hertel)

• bug #25055 [DI] Analyze setter-circular deps more precisely (nicolas-grekas)

• feature #25056 [Bridge/PhpUnit] Sync the bridge version installed in vendor/ and in phpunit clone (nicolas-grekas)

• bug #25045 [SecurityBundle] Don't trigger auto-picking notice if provider is set per listener (chalasr)

• bug #25033 [FrameworkBundle] Dont create empty bundles directory by default (ro0NL)

• bug #25037 [DI] Skip hot_path tag for deprecated services as their class might also be (nicolas-grekas)

• bug #25038 [Cache] Memcached options should ignore "lazy" (nicolas-grekas)

• bug #25014 Move deprecation under use statements (greg0ire)

• bug #25030 [Console] Fix ability to disable lazy commands (chalasr)

• bug #25032 [Bridge\PhpUnit] Disable broken auto-require mechanism of phpunit (nicolas-grekas)

• bug #25027 [FrameworkBundle] Hide server:log command based on deps (sroze)

• bug #24991 [DependencyInjection] Single typed argument can be applied on multiple parameters (nicolas-grekas, sroze)

• bug #24983 [Validator] enter the context in which to validate (xabbuh)

• bug #24956 Fix ambiguous pattern (weltling)

• bug #24732 [DependencyInjection] Prevent service:method factory notation in PHP config (vudaltsov)

• bug #24979 [HttpKernel] remove services resetter even when it's an alias (xabbuh)

• bug #24972 [HttpKernel] Fix service arg resolver for controllers as array callables (sroze, nicolas-grekas)

• bug #24971 [FrameworkBundle] Empty event dispatcher earlier in CacheClearCommand (nicolas-grekas)

• security #24995 Validate redirect targets using the session cookie domain (nicolas-grekas)

• security #24994 Prevent bundle readers from breaking out of paths (xabbuh)

• security #24993 Ensure that submitted data are uploaded files (xabbuh)

• security #24992 Namespace generated CSRF tokens depending of the current scheme (dunglas)

• bug #24954 [DI] Fix dumping with custom base class (nicolas-grekas)

• bug #24952 [HttpFoundation] Fix session-related BC break (nicolas-grekas, sroze)

• bug #24943 [FrameworkBundle] Wire the translation.reader service instead of deprecated translation.loader in commands (ogizanagi)

• 3.4.0-BETA4 (2017-11-12)

• bug #24874 [TwigBridge] Fixed the .form-check-input class in the bs4 templates (vudaltsov)

• bug #24929 [Console] Fix traversable autocomplete values (ro0NL)

• feature #24860 [FrameworkBundle] Add default translations path option and convention (yceruto)

• bug #24921 [Debug] Remove false-positive deprecation from DebugClassLoader (nicolas-grekas)

• bug #24856 [FrameworkBundle] Add default mapping path for validator component in bundle-less app (yceruto)

• bug #24833 [FrameworkBundle] Add default mapping path for serializer component in bundle-less app (yceruto)

• bug #24908 [WebServerBundle] Prevent console.terminate from being fired when server:start finishes (kbond)

• bug #24888 [FrameworkBundle] Specifically inject the debug dispatcher in the collector (ogizanagi)

• bug #24909 [Intl] Update ICU data to 60.1 (jakzal)

• bug #24870 [YAML] Allow to parse custom tags when linting yaml files (pierredup)

• bug #24910 [HttpKernel][Debug] Remove noise from stack frames of deprecations (nicolas-grekas)

• bug #24906 [Bridge/ProxyManager] Remove direct reference to value holder property (nicolas-grekas)

• feature #24887 [Cache][Lock] Add RedisProxy for lazy Redis connections (nicolas-grekas)

• bug #24633 [Config] Fix cannotBeEmpty() (ro0NL)

• bug #24900 [Validator] Fix Costa Rica IBAN format (Bozhidar Hristov)

• bug #24904 [Validator] Add Belarus IBAN format (Bozhidar Hristov)

• bug #24837 [TwigBridge] [Bootstrap 4] Fix validation error design for expanded choiceType (ostrolucky)

• bug #24878 [HttpFoundation] Prevent PHP from sending Last-Modified on session start (nicolas-grekas)

• bug #24881 [WebserverBundle] fixed the bug that caused that the webserver would … (Serkan Yildiz)

• bug #24850 [DI] Fix cannot bind env var (ogizanagi)

• bug #24851 [TwigBridge] Fix BC break due required twig environment (ro0NL)

• 3.4.0-BETA3 (2017-11-05)

• bug #24531 [HttpFoundation] Fix forward-compat of NativeSessionStorage with PHP 7.2 (sroze)

• bug #24828 [DI] Fix the "almost-circular refs" fix (nicolas-grekas)

• bug #24665 Fix dump panel hidden when closing a dump (julienfalque)

• bug #24802 [TwigBridge] [Bootstrap 4] Fix hidden errors (ostrolucky)

• bug #24816 [Serializer] Fix extra attributes when no group specified (ogizanagi)

• bug #24822 [DI] Fix "almost-circular" dependencies handling (nicolas-grekas)

• bug #24821 symfony/form auto-enables symfony/validator, even when not present (weaverryan)

• bug #24824 [FrameworkBundle][Config] fix: do not add resource checkers for no-debug (dmaicher)

• bug #24814 [Intl] Make intl-data tests pass and save language aliases again (jakzal)

• bug #24810 [Serializer] readd default argument value (xabbuh)

• bug #24809 [Config] Fix dump of config references for deprecated nodes (chalasr)

• bug #24796 [PhpUnitBridge] Fixed fatal error in CoverageListener when something goes wrong in Test::setUpBeforeClass (lyrixx)

• bug #24774 [HttpKernel] Let the storage manage the session starts (sroze)

• bug #24735 [VarDumper] fix trailling comma when dumping an exception (Simperfit)

• bug #24770 [Validator] Fix TraceableValidator is reset on data collector instantiation (ogizanagi)

• bug #24764 [HttpFoundation] add Early Hints to Reponse to fix test (Simperfit)

• bug #24759 Removes \n or space when $context/$extra are empty (kirkmadera)

• bug #24758 Throwing exception if redis and predis unavailable (aequasi)

• 3.4.0-BETA2 (2017-10-30)

• bug #24728 [Bridge\Twig] fix bootstrap checkbox_row to render properly & remove spaceless (arkste)

• bug #24709 [HttpKernel] Move services reset to Kernel::handle()+boot() (nicolas-grekas)

• bug #24703 [TwigBridge] Bootstrap 4 form theme fixes (vudaltsov)

• bug #24744 debug:container --types: Fix bug with non-existent classes (weaverryan)

• bug #24747 [VarDumper] HtmlDumper: fix collapsing nodes with depth < maxDepth (ogizanagi)

• bug #24743 [FrameworkBundle] Do not activate the cache if Doctrine's cache is not present (sroze)

• bug #24605 [FrameworkBundle] Do not load property_access.xml if the component isn't installed (ogizanagi)

• bug #24710 [TwigBridge] Fix template paths in profiler (ro0NL)

• bug #24706 [DependencyInjection] Add the possibility to disable assets via xml (renatomefi)

• bug #24696 Ensure DeprecationErrorHandler::collectDeprecations() is triggered (alexpott)

• bug #24711 [TwigBridge] Re-add Bootstrap 3 Checkbox Layout (arkste)

• bug #24713 [FrameworkBundle] fix CachePoolPrunerPass to use correct command service id (kbond)

• bug #24686 Fix $_ENV/$_SERVER precedence in test framework (fabpot)

• bug #24691 [HttpFoundation] Fix caching of session-enabled pages (nicolas-grekas)

• bug #24606 [HttpFoundation] Fix FileBag issue with associative arrays (enumag)

• bug #24673 [DI] Throw when a service name or an alias contains dynamic values (prevent an infinite loop) (dunglas)

• bug #24684 [Security] remove invalid deprecation notice on AbstractGuardAuthenticator::supports() (kbond)

• bug #24681 Fix isolated error handling (alexpott)

• bug #24575 Ensure that PHPUnit's error handler is still working in isolated tests (alexpott)

• bug #24597 [PhpUnitBridge] fix deprecation triggering test detection (xabbuh)

• feature #24671 [DI] Handle container.autowiring.strict_mode to opt-out from legacy autowiring (nicolas-grekas)

• bug #24660 Escape trailing \ in QuestionHelper autocompletion (kamazee)

• bug #24624 [Security] Fix missing BC layer for AbstractGuardAuthenticator::getCredentials() (chalasr)

• bug #24598 Prefer line formatter on missing cli dumper (greg0ire)

• bug #24635 [DI] Register default env var provided types (ro0NL)

• bug #24620 [FrameworkBundle][Workflow] Fix deprectation when checking workflow.registry service in dump command (Jean-Beru)

• bug #24644 [Security] Fixed auth provider authenticate() cannot return void (glye)

• bug #24642 [Routing] Fix resource miss (dunglas)

• bug #24608 Adding the Form default theme files to be warmed up in Twig's cache (weaverryan)

• bug #24626 streamed response should return $this (DQNEO)

• bug #24630 [WebServerBundle] Prevent commands from being registered by convention (chalasr)

• bug #24589 Username and password in basic auth are allowed to contain '.' (Richard Quadling)

• bug #24566 Fixed unsetting from loosely equal keys OrderedHashMap (maryo)

• bug #24570 [Debug] Fix same vendor detection in class loader (Jean-Beru)

• bug #24573 Fixed pathinfo calculation for requests starting with a question mark. (syzygymsu)

• bug #24565 [Serializer] YamlEncoder: throw if the Yaml component isn't installed (dunglas)

• bug #24563 [Serializer] ObjectNormalizer: throw if PropertyAccess isn't installed (dunglas)

• bug #24571 [PropertyInfo] Add support for the iterable type (dunglas)

• bug #24579 pdo session fix (mxp100)

• bug #24536 [Security] Reject remember-me token if UserCheckerInterface::checkPostAuth() fails (kbond)

• 3.4.0-BETA1 (2017-10-18)

• feature #24583 Adding a new debug:autowiring command (weaverryan)

• feature #24523 [HttpFoundation] Make sessions secure and lazy (nicolas-grekas)

• feature #22610 [Form] [TwigBridge] Added option to disable usage of default themes when rendering a form (emodric)

• feature #23112 [OptionsResolver] Support array of types in allowed type (pierredup)

• feature #24321 added ability to handle parent classes for PropertyNormalizer (ivoba)

• feature #24505 [HttpKernel] implement reset() in DumpDataCollector (xabbuh)

• feature #24425 [Console][HttpKernel] Handle new SHELL_VERBOSITY env var, also configures the default logger (nicolas-grekas)

• feature #24387 [FORM] Prevent forms from extending itself as a parent (pierredup)

• feature #24484 [DI] Throw accurate failures when accessing removed services (nicolas-grekas)

• feature #24208 [Form] Display option definition from a given form type (yceruto, ogizanagi)

• feature #23499 [Workflow] add guard is_valid() method support (alain-flaus, lyrixx)

• feature #24388 [Security] Look at headers for switch_user username (chalasr)

• feature #23708 Added deprecation to cwd not existing Fixes #18249 (alexbowers)

• feature #24443 [Session] deprecate MemcacheSessionHandler (Tobion)

• feature #24409 [Bridge\Doctrine][FrameworkBundle] Deprecate some remaining uses of ContainerAwareTrait (nicolas-grekas)

• feature #24438 [Session][VarDumper] Deprecate accepting legacy mongo extension (Tobion)

• feature #24389 [DoctrineBridge] Deprecate dbal session handler (Tobion)

• feature #16835 [Security] Add Guard authenticator method (Amo, chalasr)

• feature #24289 [FrameworkBundle][HttpKernel] Reset profiler (derrabus)

• feature #24144 [FrameworkBundle] Expose dotenv in bin/console about (ro0NL)

• feature #24403 [FrameworkBundle][Routing] Show welcome message if no routes are configured (yceruto)

• feature #22679 [Form] Add tel and color types (apetitpa)

• feature #23845 [Validator] Add unique entity violation cause (Ilya Vertakov)

• feature #22132 [Lock] Automaticaly release lock when user forget it (jderusse)

• feature #21751 Bootstrap4 support for Twig form theme (hiddewie, javiereguiluz)

• feature #24383 [FrameworkBundle] Don't clear app pools on cache:clear (nicolas-grekas)

• feature #24148 [Form] Hide label button when its setted to false (TeLiXj)

• feature #24378 [SecurityBundle] Deprecate auto picking the first provider (ogizanagi)

• feature #24260 [Security] Add impersonation support for stateless authentication (chalasr)

• feature #24300 [HttpKernel][FrameworkBundle] Add a minimalist default PSR-3 logger (dunglas)

• feature #21604 [Security] Argon2i Password Encoder (zanbaldwin)

• feature #24372 [DowCrawler] Default to UTF-8 when possible (nicolas-grekas)

• feature #24264 [TwigBundle] Improve the overriding of bundle templates (yceruto)

• feature #24197 [Translation] Moved PhpExtractor and PhpStringTokenParser to Translation component (Nyholm)

• feature #24362 [HttpKernel] Deprecate some compiler passes in favor of tagged iterator args (nicolas-grekas)

• feature #21027 [Asset] Provide default context (ro0NL)

• feature #22200 [DI] Reference tagged services in config (ro0NL)

• feature #24337 Adding a shortcuts for the main security functionality (weaverryan, javiereguiluz)

• feature #24358 [TwigBundle] register an identity translator as fallback (xabbuh)

• feature #24357 [Yaml] include file and line no in deprecation message (xabbuh)

• feature #24330 [FrameworkBundle] register class metadata factory alias (xabbuh)

• feature #24349 [SecurityBundle] Add missing AclSchemaListener deprecation (ogizanagi)

• feature #24202 [Filesystem] deprecate relative paths in makePathRelative() (xabbuh)

• feature #21716 [Serializer] Add Support for object_to_populate in CustomNormalizer (chrisguitarguy)

• feature #21960 Remove Validator\TypeTestCase and add validator logic to base TypeTestCase (pierredup)

• feature #22113 [Lock] Include lock component in framework bundle (jderusse)

• feature #24236 [WebProfilerBundle] Render file links for twig templates (ro0NL)

• feature #21239 [Serializer] throw more specific exceptions (xabbuh)

• feature #24256 CsvEncoder handling variable structures and custom header order (Oliver Hoff)

• feature #23471 [Finder] Add a method to check if any results were found (duncan3dc)

• feature #23149 [PhpUnitBridge] Added a CoverageListener to enhance the code coverage report (lyrixx)

• feature #24318 [SecurityBundle] Deprecate ACL related code (chalasr)

• feature #24335 [Security][SecurityBundle] Deprecate the HTTP digest auth (ogizanagi)

• feature #21951 [Security][Firewall] Passing the newly generated security token to the event during user switching (klandaika)

• feature #23485 [Config] extracted the xml parsing from XmlUtils::loadFile into XmlUtils::parse (Basster)

• feature #22890 [HttpKernel] Add ability to configure catching exceptions for Client (kbond)

• feature #24239 [HttpFoundation] Deprecate compatibility with PHP <5.4 sessions (afurculita)

• feature #23882 [Security] Deprecated not being logged out after user change (iltar)

• feature #24200 Added an alias for FlashBagInterface in config (tifabien)

• feature #24295 [DI][DX] Throw exception on some ContainerBuilder methods used from extensions (ogizanagi)

• feature #24253 [Yaml] support parsing files (xabbuh)

• feature #24290 Adding Definition::addError() and a compiler pass to throw errors as exceptions (weaverryan)

• feature #24301 [DI] Add AutowireRequiredMethodsPass to fix bindings for @required methods (nicolas-grekas)

• feature #24226 [Cache] Add ResettableInterface to allow resetting any pool's local state (nicolas-grekas)

• feature #24303 [FrameworkBundle] allow forms without translations and validator (xabbuh)

• feature #24291 [SecurityBundle] Reset the authentication token between requests (derrabus)

• feature #24280 [VarDumper] Make dump() a little bit more easier to use (freekmurze)

• feature #24277 [Serializer] Getter for extra attributes in ExtraAttributesException (mdeboer)

• feature #24257 [HttpKernel][DI] Enable Kernel to implement CompilerPassInterface (nicolas-grekas)

• feature #23834 [DI] Add "PHP fluent format" for configuring the container (nicolas-grekas)

• feature #24180 [Routing] Add PHP fluent DSL for configuring routes (nicolas-grekas)

• feature #24232 [Bridge\Doctrine] Add "DoctrineType::reset()" method (nicolas-grekas)

• feature #24238 [DI] Turn services and aliases private by default, with BC layer (nicolas-grekas)

• feature #23648 [Form] Add input + regions options to TimezoneType (ro0NL)

• feature #24185 [Form] Display general forms information on debug:form (yceruto)

• feature #23747 [Serializer][FrameworkBundle] Add a DateInterval normalizer (Lctrs)

• feature #24193 [FrameworkBundle] Reset stopwatch between requests (derrabus)

• feature #24160 [HttpKernel] Deprecate bundle inheritance (fabpot)

• feature #24155 [FrameworkBundle][HttpKernel] Add DI tag for resettable services (derrabus)

• feature #23625 Feature #23583 Add current and fallback locales in WDT / Profiler (nemoneph)

• feature #24179 [TwigBundle] Add default templates directory and option to configure it (yceruto)

• feature #24104 Make as many services private as possible (nicolas-grekas)

• feature #18314 [Translation] added support for adding custom message formatter (aitboudad)

• feature #24158 deprecated profiler.matcher configuration (fabpot)

• feature #24131 [Console] Do not display short exception trace for common console exceptions (yceruto)

• feature #24080 Deprecated the web_profiler.position option (javiereguiluz)

• feature #24114 [SecurityBundle] Throw a meaningful exception when an undefined user provider is used inside a firewall (chalasr)

• feature #24122 [DI] rename ResolveDefinitionTemplatesPass to ResolveChildDefinitionsPass (nicolas-grekas)

• feature #23901 [DI] Allow processing env vars (nicolas-grekas)

• feature #24093 [FrameworkBundle] be able to enable workflow support explicitly (xabbuh)

• feature #24064 [TwigBridge] Show Twig's loader paths on debug:twig command (yceruto)

• feature #23978 [Cache] Use options from Memcached DSN (Bukashk0zzz)

• feature #24075 Implemented PruneableInterface on TagAwareAdapter (Toflar)

• feature #21414 [Console] Display file and line on Exception (arno14)

• feature #24068 [HttpKernel] Deprecate EnvParametersResource (ro0NL)

• feature #22542 [Lock] Check TTL expiration in lock acquisition (jderusse)

• feature #24031 [Routing] Add the possibility to define a prefix for all routes of a controller (fabpot)

• feature #23967 [VarDumper] add force-collapse/expand + use it for traces (nicolas-grekas)

• feature #24033 [DI] Add ContainerInterface::IGNORE_ON_UNINITIALIZED_REFERENCE (nicolas-grekas)

• feature #24026 [Security] add impersonator_user to "User was reloaded" log message (gharlan)

• feature #23603 [Cache] Add (pdo|chain) cache (adapter|simple) prune method (robfrawley)

• feature #23694 [Form] Add debug:form command (yceruto)

• feature #24028 [Yaml] mark some classes as final (xabbuh)

• feature #22543 [Lock] Expose an expiringDate and isExpired method in Lock (jderusse)

• feature #23667 [Translation] Create an TranslationReaderInterface and move TranslationLoader to TranslationComponent (Nyholm)

• feature #24024 [config] Add ability to deprecate a node (sanpii)

• feature #23668 [VarDumper] Add period caster (maidmaid)

• feature #23991 [DI] Improve psr4-based service discovery (alternative implementation) (kbond)

• feature #23947 [Translation] Adding the ability do load in xliff2.0 (Nyholm)

• feature #23887 [Console] Allow commands to provide a default name for compile time registration (chalasr, nicolas-grekas)

• feature #23874 [DI] Case sensitive parameter names (ro0NL)

• feature #23936 Remove some sf2 references (fabpot)

• feature #23680 [Webprofiler] Added blocks that allows extension of the profiler page. (Nyholm)

• feature #23665 Create an interface for TranslationWriter (Nyholm)

• feature #23890 [Translation] Adding the ability do dump in xliff2.0 (Nyholm)

• feature #23862 [SecurityBundle] resolve class name parameter inside AddSecurityVotersPass (pjarmalavicius)

• feature #23915 [DI] Allow get available services from service locator (Koc)

• feature #23792 [HttpKernel][FrameworkBundle] Add RebootableInterface, fix and un-deprecate cache:clear with warmup (nicolas-grekas)

• feature #23227 Add support for "controller" keyword for configuring routes controllers (voronkovich)

• feature #23869 [Console] Made console command shortcuts case insensitive (thanosp)

• feature #23855 [DI] Allow dumping inline services in Yaml (nicolas-grekas)

• feature #23836 [FrameworkBundle] Catch Fatal errors in commands registration (chalasr)

• feature #23805 [HttpKernel] Deprecated commands auto-registration (GuilhemN)

• feature #23816 [Debug] Detect internal and deprecated methods (GuilhemN)

• feature #23812 [FrameworkBundle] Allow micro kernel to subscribe events easily (ogizanagi)

• feature #22187 [DependencyInjection] Support local binding (GuilhemN)

• feature #23741 [DI] Generate one file per service factory (nicolas-grekas)

• feature #23807 [Debug] Trigger a deprecation when using an internal class/trait/interface (GuilhemN)

• feature #22587 [Workflow] Add transition completed event (izzyp)

• feature #23624 [FrameworkBundle] Commands as a service (ro0NL)

• feature #21111 [Validator] add groups support to the Valid constraint (xabbuh)

• feature #20361 [Config] Enable cannotBeEmpty along with requiresAtLeastOneElement (ro0NL)

• feature #23712 [DependencyInjection] Deprecate autowiring service auto-registration (GuilhemN)

• feature #23719 Autoconfigure instances of ArgumentValueResolverInterface (BPScott)

• feature #23706 [Webprofiler] Improve sql explain table display (mimol91)

• feature #23724 [Lock] Deprecate Filesystem/LockHandler (jderusse)

• feature #23593 [Workflow] Adding workflow name to the announce event (Nyholm)

• feature #20496 [Form] Allow pass filter callback to delete_empty option. (Koc)

• feature #23451 [Cache] Add (filesystem|phpfiles) cache (adapter|simple) prune method and prune command (robfrawley)

• feature #23519 [TwigBundle] Commands as a service (ro0NL)

• feature #23591 [VarDumper] Add time zone caster (maidmaid)

• feature #23510 [Console] Add a factory command loader for standalone application with lazy-loading needs (ogizanagi)

• feature #23357 [VarDumper] Add interval caster (maidmaid)

• feature #23550 [DebugBundle] Added min_depth to Configuration (james-johnston-thumbtack)

• feature #23570 [FrameworkBundle] Make RouterCacheWarmer implement ServiceSubscriberInterface (nicolas-grekas)

• feature #23437 [TwigBridge] deprecate TwigRenderer (Tobion)

• feature #23515 [VarDumper] Added setMinDepth to VarCloner (james-johnston-thumbtack)

• feature #23404 [Serializer] AbstractObjectNormalizer: Allow to disable type enforcement (ogizanagi)

• feature #21086 [MonologBridge] Add TokenProcessor (maidmaid)

• feature #22576 [Validator] Allow to use a property path to get value to compare in comparison constraints (ogizanagi)

• feature #22689 [DoctrineBridge] Add support for doctrin/dbal v2.6 types (jvasseur)

• feature #22734 [Console] Add support for command lazy-loading (chalasr)

• feature #19034 [Security] make it possible to configure a custom access decision manager service (xabbuh)

• feature #23037 [TwigBundle] Added a RuntimeExtensionInterface to take advantage of autoconfigure (lyrixx)

• feature #22176 [DI] Allow imports in string format for YAML (ro0NL)

• feature #23295 [Security] Lazy load user providers (chalasr)

• feature #23440 [Routing] Add matched and default parameters to redirect responses (artursvonda, Tobion)

• feature #22832 [Debug] Deprecate support for stacked errors (mbabker)

• feature #21469 [HttpFoundation] Find the original request protocol version (thewilkybarkid)

• feature #23431 [Validator] Add min/max amount of pixels to Image constraint (akeeman)

• feature #23223 Add support for microseconds in Stopwatch (javiereguiluz)

• feature #22341 [BrowserKit] Emulate back/forward browser navigation (e-moe)

• feature #22619 [FrameworkBundle][Translation] Move translation compiler pass (lepiaf)

• feature #22620 [FrameworkBundle][HttpKernel] Move httpkernel pass (lepiaf)

• feature #23337 [Component][Serializer][Normalizer] : Deal it with Has Method for the Normalizer/Denormalizer (jordscream)

• feature #22588 [VarDumper] Add filter in VarDumperTestTrait (maidmaid)

• feature #23288 [Yaml] deprecate the !str tag (xabbuh)

• feature #23039 [Validator] Support for parsing PHP constants in yaml loader (mimol91)

• feature #22431 [VarDumper] Add date caster (maidmaid)

• feature #23285 [Stopwatch] Add a reset method (jmgq)

• feature #23320 [WebServer] Allow * to bind all interfaces (as INADDR_ANY) (jpauli, fabpot)

• feature #23272 [FrameworkBundle] disable unusable fragment renderers (xabbuh)

• feature #23332 [Yaml] fix the displayed line number (fabpot, xabbuh)

• feature #23026 [SecurityBundle] Add user impersonation info and exit action to the profiler (yceruto)

• feature #22932 [HttpFoundation] Adds support for the immutable directive in the cache-control header (twoleds)

• feature #22554 [Profiler][Validator] Add a validator panel in profiler (ogizanagi)

• feature #22124 Shift responsibility for keeping Date header to ResponseHeaderBag (mpdude)

• feature #23122 Xml encoder optional type cast (ragboyjr)

• feature #23207 [FrameworkBundle] Allow .yaml file extension everywhere (ogizanagi)

• feature #23076 [Validator] Adds support to check specific DNS record type for URL (iisisrael)

• feature #22629 [Security] Trigger a deprecation when a voter is missing the VoterInterface (iltar)

• feature #22636 [Routing] Expose request in route conditions, if needed and possible (ro0NL)

• feature #22909 [Yaml] Deprecate using the non-specific tag (GuilhemN)

• feature #23042 Consistent error handling in remember me services (lstrojny)

• feature #22444 [Serializer] DateTimeNormalizer: allow to provide timezone (ogizanagi)

• feature #23143 [DI] Reference instead of inline for array-params (nicolas-grekas)

• feature #23154 [WebProfilerBundle] Sticky ajax window (ro0NL)

• feature #23161 [FrameworkBundle] Deprecate useless --no-prefix option (chalasr)

• feature #23105 [SecurityBundle][Profiler] Give info about called security listeners in profiler (chalasr)

• feature #23148 [FrameworkBundle] drop hard dependency on the Stopwatch component (xabbuh)

• feature #23131 [FrameworkBundle] Remove dependency on Doctrine cache (fabpot)

• feature #23114 [SecurityBundle] Lazy load security listeners (chalasr)

• feature #23111 [Process] Deprecate ProcessBuilder (nicolas-grekas)

• feature #22675 [FrameworkBundle] KernelTestCase: deprecate not using KERNEL_CLASS (ogizanagi)

• feature #22917 [VarDumper] Cycle prev/next searching in HTML dumps (ro0NL)

• feature #23044 Automatically enable the routing annotation loader (GuilhemN)

• feature #22696 [PropertyInfo] Made ReflectionExtractor's prefix lists instance variables (neemzy)

• feature #23035 Deprecate passing a concrete service in optional cache warmers (romainneutron)

• feature #23036 Implement ServiceSubscriberInterface in optional cache warmers (romainneutron)

• feature #23022 [Di] Remove closure-proxy arguments (nicolas-grekas)

• feature #22903 [DI] Deprecate XML services without ID (ro0NL)

• feature #22597 [Lock] Re-add the Lock component in 3.4 (jderusse)

• feature #22803 [DI] Deprecate Container::initialized() for privates (ro0NL)

• feature #22828 [Finder] Deprecate FilterIterator (ogizanagi)

• feature #22826 [Validator] improve strict option value deprecation (xabbuh)