This week, development activity focused on new security features. The upcoming Symfony 7.3 version added support for security voters to explain their vote, improved the IsGranted attribute to allow using PHP callables, and made some changes to enhance the DX of recent security additions.
AddToAny
Feed items
A Week of Symfony #946 (10-16 February 2025)
This week, development activity focused on the upcoming Symfony 7.3 version. We introduced a simpler way to configure DKIM and SMIME options, improved how to work with value objects in the container and added Markdown format support for tables in the console.
A Week of Symfony #945 (3-9 February 2025)
This week, the upcoming Symfony 7.3 version improved the server event streaming, introduced a new DeduplicateMiddleware in Messenger and added an option to disable translation.
A Week of Symfony #944 (27 January - 2 February 2025)
This week, Symfony released maintenance versions 6.4.18, 7.1.11 and 7.2.3. In addition, Twig published a security advisory and we shared several updates about upcoming Symfony conferences.
Get Symfony news on your favorite social network
Symfony has been active on X, Mastodon, and Bluesky for some time, but until recently, not all platforms received equal attention. Since Twitter (now X) was our first social network, all blog posts were primarily shared there.
We're excited to announce that, as of a few days ago, Symfony now publishes all blog posts across all three platforms. This change gives our community more flexibility in choosing where to follow Symfony updates.
Symfony 7.2.3 released
Symfony 7.2.3 has just been released.
Here is the list of the most important changes since 7.2.2:
Symfony 7.1.11 released
Symfony 7.1.11 has just been released.
Here is the list of the most important changes since 7.1.10:
Symfony 6.4.18 released
Symfony 6.4.18 has just been released.
Here is the list of the most important changes since 6.4.17:
Twig CVE-2025-24374: Missing output escaping for the null coalesce operator
Affected versions
Twig versions >=3.16.0,<3.19.0 are affected by this security issue.
The issue has been fixed in Twig 3.19.0.
Description
When using the null coalesce operator (??), output escaping was missing for the expression on the left side of the operator.
Resolution
Output escaping for the ?? operator has been fixed.
The patch for this issue is available here for the 3.x branch.
A Week of Symfony #943 (20-26 January 2025)
This week, the upcoming Symfony 7.3 version improved the invokable command feature, deprecated the use of option arrays for configuring validation constraints, and updated the JsonEncoder component to allow warming up objects and lists.