symfony/security-http

Changelog (v8.1.5...v8.1.6)

• bug #65735 Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65677 Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• bug #65685 Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65655 Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)
• minor #65657 Clarify AuthenticatorManager constructor docblock for deprecated eraseCredentials argument (@webdevsamran)

Changelog (v8.1.1...v8.1.5)

• bug #65524 Match check paths given as a route alias (@nicolas-grekas)
• bug #65502 Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65422 Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)

Changelog (v8.1.0...v8.1.1)

• minor #64663 Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64404 Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)

Changelog (v8.1.0-RC1...v8.1.0)

• no significant changes

Changelog (v8.1.0-BETA3...v8.1.0-RC1)

• security #cve-2026-48489 Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• bug #64337 Initialize lazy users before serializing them (@MatTheCat)

Changelog (v8.0.13...v8.0.14)

• minor #64663 Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64404 Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)

Changelog (v8.0.12...v8.0.13)

• security #cve-2026-48489 Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• bug #64337 Initialize lazy users before serializing them (@MatTheCat)

Changelog (v7.4.19...v7.4.20)

• bug #66421 Bind discovered OIDC keys to issuers (@thomas-chauchefoin-tob)
• minor #66118 Fix the type declared for the event dispatcher (@nicolas-grekas)

Changelog (v7.4.18...v7.4.19)

• minor #66070 Explain why a remember-me login counts as interactive (@nicolas-grekas)
• bug #65953 Do not follow redirects on the OIDC JWKS, OAuth2 introspection and CAS validation endpoints (@nicolas-grekas)
• bug #65952 Do not follow redirects on the OIDC UserInfo endpoint (@nicolas-grekas)
• bug #65913 Read the OAuth2 verified claims as booleans (@nicolas-grekas)
• bug #65912 Read the OIDC verified claims as booleans (@nicolas-grekas)
• bug #65881 Read the "active" member of an introspection response as a boolean (@Spomky)
• bug #65870 Answer 401 instead of 500 when the introspection request fails (@Spomky)
• bug #65859 Reset the login rate limiter on successful login with a peekable limiter (@lazerg)

Changelog (v7.4.17...v7.4.18)

• bug #65735 Avoid failing when PersistentRememberMeHandler handles a malformed cookie (@Seldaek)
• bug #65734 Reject malformed login link parameters instead of throwing a TypeError (@davidszkiba, @nicolas-grekas)
• bug #65677 Reject OIDC discovery endpoints that downgrade to plain HTTP (@nicolas-grekas)
• bug #65685 Narrow the race that lets a login link exceed max_uses (@nicolas-grekas)
• bug #65655 Apply "signature_properties" when a remember-me token provider is used (@nicolas-grekas)

Changelog (v7.4.14...v7.4.17)

• bug #65524 Match check paths given as a route alias (@nicolas-grekas)
• bug #65502 Refresh the impersonator while impersonating (@nicolas-grekas)
• bug #65422 Reject malformed login link parameters instead of throwing a TypeError (@nicolas-grekas)

Changelog (v7.4.13...v7.4.14)

• minor #64663 Fix PHPDoc of OidcTokenGenerateCommand::addGenerator (@dfinchenko)
• bug #64404 Fix state leak in LogoutUrlGenerator in async environments (@KevinMartinsDev, @nicolas-grekas)
• bug #64566 Harden __toString trampolines via __unserialize() (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• minor #64524 Make tests compatible with PHPUnit 13.2 and Twig 3.28 (@nicolas-grekas)