Affected versions Symfony versions >=2.2.0, =3.0.0, <3.1.0 of the Symfony UX Autocomplete component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description The Stimulus controller shipped…
Affected versions Symfony versions >=2.22.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description When using symfony/ux-live-component,…
Affected versions Symfony versions >=2.5.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description Symfony\UX\LiveComponent\Controller\BatchActionController::__invoke()…
Affected versions Symfony versions >=2.8.0, =3.0.0, <3.1.0 of the Symfony UX Live Component component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description When a #[LiveProp] is typed…
Affected versions Symfony versions >=2.2.0, =3.0.0, <3.1.0 of the Symfony UX Autocomplete component are affected by this security issue. The issue has been fixed in Symfony 2.36.0, 3.1.0. Description Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause()…
Symfony UX 3.1.0 is the first feature release on the 3.x branch. It brings a brand-new Calendar Link component, provide() and inject() functions for Twig components, a modern custom element and Twig component for Turbo Mercure streams, Turbo Frame request…
Symfony UX 2.36.0 is a security release for the 2.x branch: it fixes seven vulnerabilities in the LiveComponent and Autocomplete packages, two of them rated medium severity. If your application depends on symfony/ux-live-component or symfony/ux-autocomplete,…
Save the date! SymfonyOnline June 2026 will take place online on June 11-12, 2026, with 15 expert speakers streaming directly to you. 🎤 Speaker announcement! Guillaume Loulier, Technical Expert, SensioLabs, will be taking the virtual stage to present…
A fun look at making coding assistants talk less, and what that actually saves in practice. The main takeaway is that shorter replies help, but most token cost still comes from the actual work: reading, reasoning, coding, and checking. Read more
PHP has undergone a remarkable transformation in recent years, and The PHP Foundation has played a major role in contributing to the development and maintenance of the language. The upcoming JetBrains PHPverse conference is a great opportunity to reflect on what has been done to reinforce PHP's position as a robust, modern language for web development. Elizabeth Barron, The PHP Foundation’s Executive Director, is joining the lineup of JetBrains PHPverse 2026 speakers with a keynote talk…
Video version at: https://youtu.be/R_-NG_frTiw Last month, two developers on a team I was working with both merged their branches to main within minutes of each other. The first merge was fine but the the second introduced a conflict in a shared service class that nobody caught until the CI pipeline deployed a broken build to […] The post Branching Workflows: Choosing the Right Git Strategy for Your Team appeared first on PHP Architect.
Composer and Packagist share a solid overview of the supply chain security work already in place, what is shipping now, and what is coming next. Worth reading if you maintain PHP packages or care about how the ecosystem is hardening against package compromise. Read more
SymfonyOnline June 2026 is officially scheduled for June 11 and 12, 2026! Join us online for two tracks of cutting-edge tech talks: one full day dedicated to AI and another full day focus on Symfony Deep Dive. 🎤 Speaker announcement! We are excited…
Symfony includes two components dedicated to working with JSON: JsonStreamer encodes PHP data into JSON and decodes JSON back into PHP objects by streaming the contents, which provides high performance and low memory usage even for large payloads; JsonPath…
Affected versions Twig versions <=3.26.0 are affected by this security issue. The issue has been fixed in Twig 3.27.0. Description This is a residual bypass of CVE-2026-47732 / GHSA-pr2w-4gpj-cpq4 left after the initial fix for unguarded __toString()…