-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 04 Nov 2026 15:16:43 +0100 Source: symfony Architecture: source Version: 8.1.11+dfsg-1 Distribution: experimental Urgency: medium Maintainer: Debian PHP PEAR Maintainers <[email protected]> Changed-By: David Prévot <[email protected]> Changes: symfony (8.1.11+dfsg-1) experimental; urgency=medium . [ Nicolas Grekas ] * [Config] Do not validate XML documents on parse (GHSA-5jff-8h8q-r5qx) * [HtmlSanitizer] Fix meta refresh URL sanitization bypass (GHSA-wm2w-4mgj-vw33) * [Validator] Reject non-public IP addresses in the no-priv, no-res and only-public modes (GHSA-4qpf-57w4-m3wc) * [HtmlSanitizer] Require special schemes and scheme-relative URLs to carry a non-empty authority [CVE-2026-118517] * [HttpClient] Don't send the options of the default scope to other origins in ScopingHttpClient (GHSA-gq53-v8w2-gjhj) * [Security] Run the checkPostAuth() method of user checkers when authenticating users programmatically (GHSA-8f57-m8wj-x65w) * [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient (GHSA-c7hm-wqwp-f9v8) * [Serializer] Lowercase the scheme of data URIs before opening them (GHSA-pxj9-jh84-vhm5) * [Security] Parse the DN into RDNs before extracting the user identifier [CVE-2026-118513] * [HttpKernel] Don't decode CSV and YAML payloads unless acceptFormat lists them (GHSA-hwfg-qwvh-2wfx) * [Serializer] Don't build UploadedFile and other file objects from denormalized data [CVE-2026-118515] * [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset (GHSA-q8jq-xrf4-v5j8) * [HttpFoundation] Add the list of private ranges usable as trusted proxies (GHSA-xg2q-4rrq-657q) * [HttpKernel] Restore the router context of the parent request after a sub-request (GHSA-wg5q-m2ww-f3c9) * [Routing] Prevent host placeholders from matching the path in compiled matchers [CVE-2026-118516] * [Filesystem] Only treat a valid URI scheme as the root of a path (GHSA-6prc-h956-hxjq) * [Serializer] Ignore undeclared property paths when denormalizing (GHSA-hqp2-7rr8-hf26) * [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher [CVE-2026-118514] * [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by the client (GHSA-5mx8-mwrp-5693) * [JsonPath] Evaluate absolute queries in filters once per query instead of once per node (GHSA-cpww-5vpx-72x7) . [ Fabien Potencier ] * Update VERSION for 8.1.11 . [ Jack Worman ] * [HttpFoundation] Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment (GHSA-3h27-hjv7-fqjx) . [ David Prévot ] * Set Multi-Arch: foreign for php-symfony-redis-messenger Checksums-Sha1: 3cc45ba96ef928aa5c51d475bcb2a821beeb5081 19343 symfony_8.1.11+dfsg-1.dsc 003fba13cdc576d4952b5e77e9fb85b3b6847ba2 10740776 symfony_8.1.11+dfsg.orig.tar.xz 5b0c4da5a59a57c8103f8deac3af1517cf0fbb25 85764 symfony_8.1.11+dfsg-1.debian.tar.xz 7f572c7fcda2c662bed700d8a6b946bafed6cc61 75667 symfony_8.1.11+dfsg-1_amd64.buildinfo Checksums-Sha256: 04a1c399d6ee5d15bf0aea2ab14ab5cf322a549e238a6b14496ff29d3f7982c1 19343 symfony_8.1.11+dfsg-1.dsc 3f89c83fef00e073ba894a00fc0ad338e4b4377e5c6cd63213d56d56fa64decb 10740776 symfony_8.1.11+dfsg.orig.tar.xz cebad521b543e09731a866b5c7a091a42598abe6c8b5f0cde1aae4a1663bd7a4 85764 symfony_8.1.11+dfsg-1.debian.tar.xz a2ed7f319a8364120b67ec67a821c2fe551a08c2b97ec1938de85eb83ba92198 75667 symfony_8.1.11+dfsg-1_amd64.buildinfo Files: f0f079d4f9a93e847c2ba726ecf7ea5a 19343 php optional symfony_8.1.11+dfsg-1.dsc 05b4227f72c58640da475d02d37d9ef5 10740776 php optional symfony_8.1.11+dfsg.orig.tar.xz 87dfaa880d46159a1d5c00221a173ad7 85764 php optional symfony_8.1.11+dfsg-1.debian.tar.xz 95bcabedf0d7e20f24b88efbcacc5bb1 75667 php optional symfony_8.1.11+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmrrXvsSHHRhZmZpdEBk ZWJpYW4ub3JnAAoJEAWMHPlE9r08tMEH/01esqwQPhyEAgwkGln4Nru191ePEbU7 EWiot+/IDlVy3JzCQmHncq3SV6wi78uKWl1WXpKYQEPML+g8rJoVfKodXcyroCIj jfqRi9wZCsXTV53dsh+clMShzLCzYQE0PutZqUdX8x525GUq7QlWroftrneCEGsu 6ffJNcynmeoEBfBhsLkecURA38NtjUDo/Jg33N0bpSdTPvnHNf7BtSnVuj1OkPgi Y+2K7uCMJBdgc6m16YM8dhZhOAvuI/07uNOzxu7S+DmHxMMO3brCvWj2ZPZmFiSI Bkdps/VvyU52uR9+oYQiCj8ugwruXbbjGXe+mQU4kfWpUBR4ODa51zc= =o1uU -----END PGP SIGNATURE-----
pgp7NZknfAF7a.pgp
Description: PGP signature
