Http Foundation Laravel Package

Changelog (https://github.com/symfony/http-foundation/compare/v5.4.50...v5.4.54)

• bug #66491 Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)
• bug #66251 Make session handlers non-serializable (@mcdruid)
• bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)
• bug #66048 Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
• minor #65836 Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)
• bug #65775 Match paths with the DOTALL modifier (@nicolas-grekas)
• bug #65753 Combine trusted host patterns into a single regexp (@nicolas-grekas)
• bug #65743 Encode the path in the X-Accel-Redirect header (@Athorcis)
• bug #65729 Reject reserved characters in the cookie path and domain (@nicolas-grekas)
• bug #65741 Reject invalid paths (@nicolas-grekas)
• bug #65725 Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• bug #65684 Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
• bug #65683 Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
• bug #65682 Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)

[SECURITY] Security release

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.7...v8.1.8)

• bug #66251 Make session handlers non-serializable (@mcdruid)
• bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.4...v8.1.5)

• bug #65372 Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65252 Combine trusted host patterns into a single regexp (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.16...v7.4.17)

• bug #65372 Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65252 Combine trusted host patterns into a single regexp (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.43...v6.4.44)

• bug #65372 Declare create_sid() on session handlers (@nicolas-grekas)
• bug #65252 Combine trusted host patterns into a single regexp (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.2...v8.1.4)

• bug #65187 Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.15...v7.4.16)

• bug #65187 Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.1...v8.1.2)

• bug #65023 Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #65020 Fix newline handling in server event fields (@nicolas-grekas)
• bug #65001 Fix retry field being dropped across server event streams (@nicolas-grekas)
• bug #64945 Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.14...v8.0.15)

• bug #65023 Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #65020 Fix newline handling in server event fields (@nicolas-grekas)
• bug #65001 Fix retry field being dropped across server event streams (@nicolas-grekas)
• bug #64945 Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.14...v7.4.15)

• bug #65023 Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #65020 Fix newline handling in server event fields (@nicolas-grekas)
• bug #65001 Fix retry field being dropped across server event streams (@nicolas-grekas)
• bug #64945 Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.42...v6.4.43)

• bug #65023 Validate the characters allowed in a cookie path and domain (@nicolas-grekas)
• bug #65022 Don't crash on a non-string signature in UriSigner (@nicolas-grekas)
• bug #64945 Throw when IpUtils::isPrivateIp() receives a non-canonical IP address (@Amoifr)
• bug #64783 Add additional IP ranges for RFC2544 and RFC5180 (@thePanz)
• bug #64789 Add RFC5737 and RFC3849 to IpUtils::PRIVATE_SUBNETS (@thePanz)
• bug #64701 Fix Absolute URL generation by ignore tel: mailto: and other app links (@tomm1996, @alexander-schranz)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.0...v8.1.1)

• bug #64617 Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64468 Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.13...v8.0.14)

• bug #64617 Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64468 Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.13...v7.4.14)

• bug #64617 Restore compat with DBAL 4.5 (@nicolas-grekas)
• bug #64588 Migrate table definitions to DBAL's TableEditor API (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64468 Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)
• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.41...v6.4.42)

• bug #64617 Restore compat with DBAL 4.5 (@nicolas-grekas)
• minor #64476 Unsafe unserialize phpstan rule (@jack-worman)
• bug #64468 Add RFC6598 Shared Address Space to IpUtils::PRIVATE_SUBNETS (@derflocki)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.0-RC1...v8.1.0)

• bug #64389 Migrate configureSchema() to DBAL's editor API (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.0-BETA3...v8.1.0-RC1)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.7...v8.0.13)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.7...v7.4.13)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.35...v6.4.41)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.1.0-BETA1...v8.1.0-BETA3)

• bug #64269 Various fixes and hardenings (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.13...v8.1.0-BETA1)

• security #cve-2026-48736 Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)
• feature #60008 Add SessionHasFlashMessage test constraint (@Pierstoval)
• feature #63585 Deprecate erase_credentials config, container parameter and AuthenticatorManager constructor argument (@guillaumeVDP)
• feature #63541 Deprecate setting public properties of Request and Response objects directly (@nicolas-grekas)
• feature #63373 Add BinaryFileResponse::shouldDeleteFileAfterSend() (@lacatoire)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.7...v8.0.8)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.7...v7.4.8)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.6...v8.0.7)

• bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.6...v7.4.7)

• bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.34...v6.4.35)

• bug #63603 Fix session cookie_lifetime not applied in mock session storage (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.5...v8.0.6)

• bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
• bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
• bug #63262 Reject invalid paths (@nicolas-grekas)
• bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
• bug #63230 fix engine declaration on mysql pdo table creations (@tandev)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.5...v7.4.6)

• bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
• bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
• bug #63262 Reject invalid paths (@nicolas-grekas)
• bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
• bug #63230 fix engine declaration on mysql pdo table creations (@tandev)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.33...v6.4.34)

• bug #63448 Handle empty session data in updateTimestamp() to fix compat with PHP 8.6 (@nicolas-grekas)
• bug #63319 BinaryFileResponse: always return 206 if Range is valid (@Jimbolino)
• bug #63262 Reject invalid paths (@nicolas-grekas)
• bug #54304 When calling UploadedFile::getErrorMessage() to a file which has no error and is uploaded successfully, it should not return an error (@ArmCyber)
• bug #63230 fix engine declaration on mysql pdo table creations (@tandev)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.4...v8.0.5)

• bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@samy-mahmoudi)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.4...v7.4.5)

• bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@samy-mahmoudi)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.10...v7.3.11)

• bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@samy-mahmoudi)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.32...v6.4.33)

• bug #63137 Fix PdoSessionHandler charset-collation mismatch with the Doctrine DBAL (@samy-mahmoudi)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.3...v8.0.4)

• bug #63012 Fix double-prefixing of session keys when using redis/memcached (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.3...v7.4.4)

• bug #63012 Fix double-prefixing of session keys when using redis/memcached (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.9...v7.3.10)

• bug #63012 Fix double-prefixing of session keys when using redis/memcached (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.31...v6.4.32)

• bug #63012 Fix double-prefixing of session keys when using redis/memcached (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.2...v8.0.3)

• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.2...v7.4.3)

• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.8...v7.3.9)

• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.30...v6.4.31)

• bug symfony/symfony#62799 [Cache][HttpFoundation] Fix VARBINARY columns on sqlsrv (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.0...v8.0.1)

• bug symfony/symfony#62663 [HttpFoundation] Improve logic in Request::createFromGlobals() (@nicolas-grekas)
• bug symfony/symfony#62502 [HttpFoundation] Fix Expires response header for EventStream (@4513)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.0...v7.4.1)

• bug symfony/symfony#62663 [HttpFoundation] Improve logic in Request::createFromGlobals() (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.7...v7.3.8)

• bug symfony/symfony#62502 [HttpFoundation] Fix Expires response header for EventStream (@4513)
• bug symfony/symfony#62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@yoeunes)

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.29...v6.4.30)

• bug symfony/symfony#62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@yoeunes)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.0-RC3...v7.4.0)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.0-RC3...v8.0.0)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v8.0.0-BETA2...v8.0.0-RC1)

• bug symfony/symfony#62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@yoeunes)
• bug symfony/symfony#62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.4.0-BETA2...v7.4.0-RC1)

• bug symfony/symfony#62287 [HttpFoundation] Fix AcceptHeader overwrites items with different parameters (@yoeunes)
• bug symfony/symfony#62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.6...v7.3.7)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v6.4.28...v6.4.29)

• no significant changes

Changelog (https://github.com/symfony/http-foundation/compare/v5.4.49...v5.4.50)

• security symfony/symfony#cve-2025-64500 [HttpFoundation] Fix parsing pathinfo with no leading slash (@nicolas-grekas)

Changelog (https://github.com/symfony/http-foundation/compare/v7.3.5...v7.3.6)

• bug symfony/symfony#62324 [HttpFoundation] Fix parsing hosts and schemes in URLs (@nicolas-grekas)
• bug symfony/symfony#62246 [HttpFoundation] Allow Request::setFormat() to override predefined formats (@longwave)