This PR was merged into the 4.3-dev branch.
Discussion
----------
[Security] Add Argon2idPasswordEncoder
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | #28093
| License | MIT
| Doc PR | TODO
Currently we have a `Argon2iPasswordEncoder` that may hash passwords using `argon2id` instead of `argon2i` (platform-dependent) which is not good.
This deprecates producing/validating `argon2id` hashed passwords using the `Argon2iPasswordEncoder`, and adds a `Argon2idPasswordEncoder` able to produce/validate `argon2id` hashed passwords only.
#EUFOSSA
Commits
-------
0c82173b24 [Security] Add Argon2idPasswordEncoder
This PR was merged into the 4.3-dev branch.
Discussion
----------
Prepare for the new serialization mechanism
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
#eufossa
Should I maybe split this component by component ?
https://wiki.php.net/rfc/custom_object_serialization has been accepted.
Best viewed in "split" mode.
This work is kind of required for https://github.com/symfony/symfony/issues/30304 so we don't trigger 30 deprecations from our own code base.
Commits
-------
d412e77a9c Prepare for the new serialization mechanism
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Security] undeprecate the RoleHierarchyInterface
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | https://github.com/symfony/symfony/pull/22048#discussion_r260247046
| License | MIT
| Doc PR |
Instead of deprecating the interface it is sufficient to deprecate its
getReachableRoles() method and add a new getReachableRoleNames() method
in Symfony 5.
Commits
-------
2d3f2b7a74 undeprecate the RoleHierarchyInterface
Instead of deprecating the interface it is sufficient to deprecate its
getReachableRoles() method and add a new getReachableRoleNames() method
in Symfony 5.
This PR was merged into the 4.3-dev branch.
Discussion
----------
[EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | -
| License | MIT
| Doc PR | -
PR green and ready. From UPGRADE files:
EventDispatcher
---------------
* The signature of the `EventDispatcherInterface::dispatch()` method should be updated to `dispatch($event, string $eventName = null)`, not doing so is deprecated
HttpKernel
----------
* Renamed `FilterControllerArgumentsEvent` to `ControllerArgumentsEvent`
* Renamed `FilterControllerEvent` to `ControllerEvent`
* Renamed `FilterResponseEvent` to `ResponseEvent`
* Renamed `GetResponseEvent` to `RequestEvent`
* Renamed `GetResponseForControllerResultEvent` to `ViewEvent`
* Renamed `GetResponseForExceptionEvent` to `ExceptionEvent`
* Renamed `PostResponseEvent` to `TerminateEvent`
Security
---------
* The `ListenerInterface` is deprecated, turn your listeners into callables instead.
* The `Firewall::handleRequest()` method is deprecated, use `Firewall::callListeners()` instead.
Commits
-------
75369dabb8 [EventDispatcher] swap arguments of dispatch() to allow registering events by FQCN
This PR was squashed before being merged into the 4.3-dev branch (closes#29661).
Discussion
----------
[Filesystem] Support resources and deprecate using arrays in dumpFile() and appendToFile()
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Running PHPStan on my project picked up that passing a resource to `Filesystem::dumpFile()` didn't match the documented type.
I found this has been discussed in #20980 and #28019, without a clear result. But, my reading is that only strings should be supported. While I think that not supporting streams makes this a lot less useful (and I'm going to switch away from it), this does need to be resolved. So, I've deprecated using arrays and resources.
Commits
-------
0eaf9d2474 [Filesystem] Support resources and deprecate using arrays in dumpFile() and appendToFile()
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Form] deprecate using invalid names for buttons
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | #28964
| License | MIT
| Doc PR |
Commits
-------
405aa548eb deprecate using invalid names for buttons
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Yaml] Fixed invalid Parser behavior
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes
| New feature? | no
| BC breaks? | no
| Deprecations? | no
| Tests pass? | yes
| Fixed tickets | #27874
| License | MIT
| Doc PR | NA
This fixes#27874
I'm not sure about the update in composer.json though. It seems a good idea because I was able to run composer update without the zip extension. If required, I'll remove it.
Commits
-------
7bf83815bd Added deprecation notice when mapping keys are found in multi-line blocks
This PR was merged into the 4.3-dev branch.
Discussion
----------
[Form] deprecate some options for single_text widgets
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
Commits
-------
89ff331865 deprecate some options for single_text widgets
This PR was squashed before being merged into the 4.3-dev branch (closes#28858).
Discussion
----------
[DI] Deprecated using env vars with cannotBeEmpty()
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | yes-ish
| New feature? | yes
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | yes
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #28827
| License | MIT
| Doc PR | symfony/symfony-docs#... <!-- required for new features -->
Continuation of #28838 for 4.2
Using environment variables for nodes marked `cannotBeEmpty()` is semantically not possible, we'll never know the value is empty yes/no during compile time. Neither we should assume one or another.
Commits
-------
397c19ee5f [DI] Deprecated using env vars with cannotBeEmpty()
* 4.1:
Undeprecate the single-colon notation for controllers
Command::addOption should allow int in $default
Update symfony links to https
[Form] Fixed keeping hash of equal \DateTimeInterface on submit
[PhpUnitBridge] Fix typo
[Routing] generate(null) should throw an exception
[Form] Minor fixes in docs and cs
[Workflow] Made code simpler
[Config] Unset key during normalization
[Form] Fixed empty data for compound date types
invalidate forms on transformation failures
[FrameworkBundle] fixed guard event names for transitions
method buildTransitionBlockerList returns TransitionBlockerList of expected transition
[FrameworkBundle] fixed guard event names for transitions
[PropertyAccessor] Fix unable to write to singular property using setter while plural adder/remover exist
This notation is the only way to support controllers as services in the 3.4
LTS version.
This deprecation has only a very small benefit for the Symfony codebase (the
amount of code involved is very small), but has a huge cost for the community
which cannot avoid this deprecation without dropping support for the LTS or
making crazy logic to switch routing files (as they cannot switch things
inline in YAML or XML files).
This deprecation will be delayed until a future 5.x version, when the current
LTS will be 4.4 (which supports the new notation).
This PR was merged into the 4.2-dev branch.
Discussion
----------
[HttpKernel] Deprecate usage of getRootDir() and kernel.root_dir
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no <!-- don't forget to update src/**/CHANGELOG.md files -->
| BC breaks? | no <!-- see https://symfony.com/bc -->
| Deprecations? | no <!-- don't forget to update UPGRADE-*.md and src/**/CHANGELOG.md files -->
| Tests pass? | yes <!-- please add some, will be required by reviewers -->
| Fixed tickets | #24293
| License | MIT
| Doc PR | n/a
<!--
Write a short README entry for your feature/bugfix here (replace this comment block.)
This will help people understand your PR and can be used as a start of the Doc PR.
Additionally:
- Bug fixes must be submitted against the lowest branch where they apply
(lowest branches are regularly merged to upper ones so they get the fixes too).
- Features and deprecations must be submitted against the master branch.
-->
Commits
-------
0b851c6956 [HttpKernel] deprecated usage of getRootDir() and kernel.root_dir
This PR was merged into the 4.2-dev branch.
Discussion
----------
[Translator] Deprecated transChoice and moved it away from contracts
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | Issue: https://github.com/symfony/symfony-docs/issues/10264
This will address comment made here: https://github.com/symfony/symfony/pull/27399#pullrequestreview-151929117
This PR moves the `transChoice()` method away from Contracts and back to the component. I also reverted changes in the `IdentityTranslator`. I will still use the deprecated `MessageSelector` but this is not fine since `transChoice()` is also deprecated.
Commits
-------
dc5f3bfff7 Make trans + %count% parameter resolve plurals
d870a850bd [Translator] Deprecated transChoice and moved it away from contracts
This PR was merged into the 4.2-dev branch.
Discussion
----------
[Security] Deprecate simple_preauth and simple_form in favor of Guard
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | n/a
| License | MIT
| Doc PR | n/a
Commits
-------
5093b9fb47 [Security] Deprecate simple_preauth and simple_form in favor of Guard
This PR was merged into the 4.2-dev branch.
Discussion
----------
[Translation] marked getFallbackLocales() as internal
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | #28579
| License | MIT
| Doc PR |
Added the deprication trigger error function to getFallbackLocales in the Translation component.
(Its my first PR, please tell me if i need to change something)
Commits
-------
9d67a68816 [Translation] marked getFallbackLocales() as internal
This PR was merged into the 4.2-dev branch.
Discussion
----------
[HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | yes
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets | #26731
| License | MIT
| Doc PR | -
By creating Cookie instances using `null` for the `$secure` argument, this PR allows making cookies inherit their "secure" attribute from the request.
This PR also adds a forward to make $secure=null and samesite=lax the defaults in Symfony 5.0:
- either define all constructor's arguments explicitly
- or use the new `Cookie::create()` factory
Commits
-------
9493cfd5f2 [HttpFoundation] make cookies auto-secure when passing them $secure=null + plan to make it and samesite=lax the defaults in 5.0
This PR was merged into the 4.2-dev branch.
Discussion
----------
Trigger deprecation notices when inherited class calls parent method but misses adding new arguments
| Q | A
| ------------- | ---
| Branch? | master
| Bug fix? | no
| New feature? | no
| BC breaks? | no
| Deprecations? | yes
| Tests pass? | yes
| Fixed tickets |
| License | MIT
| Doc PR |
This Pull Request concern severals components, the purpose here is to notify in dev mode that in a case of inherit class, a function will have a new or severals arguments in Symfony 5.0, therefore not implement it is deprecated since Symfony 4.2
The function is made by these conditions :
1- ```(func_num_args() < $x)``` where [x] is the number of arguments we will have in Symfony 5.0
this check allow to verify that the arguments are missing
2- ```(__CLASS__ !== \get_class($this))```
this check allow to verify that the name of the class is different than the base class, therefore that we are in the child class
3- ```(__CLASS__ !== (new \ReflectionMethod($this, __FUNCTION__))->getDeclaringClass()->getName())```
this check allow to verify that the class of the current function is different than the base class, therefore the function has been rewrote into the child class
Code exemple :
```
public function method(/* void $myNewArgument = null */)
{
if ((func_num_args() < 1) && (__CLASS__ !== \get_class($this)) && (__CLASS__ !== (new \ReflectionMethod($this, __FUNCTION__))->getDeclaringClass()->getName())){
@trigger_error(sprintf('The "%s()" method will have one `void $myNewArgument = null` argument in version 5.0 and higher.Not defining it is deprecated since Symfony 4.2.', __METHOD__ ), E_USER_DEPRECATED);
}
// do something
}
```
The unit test are made by creating a child Class using for the tested function ```return parent::function()``` and by calling this child class and catching the expected depreciation message
Commits
-------
f75fffa997 Trigger deprecation notices when inherited class calls parent method but misses adding new arguments
Uses `session.cookie_samesite` for PHP >= 7.3. For PHP < 7.3 it first
does a session_start(), find the emitted header, changes it, and emits
it again with the value for SameSite added.
Nicolas Grekas
Thomas Calvet
Gregor Harlan
Robin Chalas
Fabien Potencier
Jules Pietri
Valentin
Grégoire Pineau
neghmurken
Roland Franssen
Christian Flothmann
Chris Wilkinson
Javier Eguiluz
renanbr
guiguiboy
Christophe Coevoet
Florent Mata
Remon van de Kamp
Yonel Ceruto
Alexis Lefebvre
Simon D. Müller
kevin.nadin
Samuel ROZE
ProgMiner
Kévin Dunglas
