-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 04 Nov 2026 15:16:43 +0100
Source: symfony
Architecture: source
Version: 8.1.11+dfsg-1
Distribution: experimental
Urgency: medium
Maintainer: Debian PHP PEAR Maintainers <pkg-php-pear@lists.alioth.debian.org>
Changed-By: David Prévot <taffit@debian.org>
Changes:
symfony (8.1.11+dfsg-1) experimental; urgency=medium
.
[ Nicolas Grekas ]
* [Config] Do not validate XML documents on parse (GHSA-5jff-8h8q-r5qx)
* [HtmlSanitizer] Fix meta refresh URL sanitization bypass
(GHSA-wm2w-4mgj-vw33)
* [Validator] Reject non-public IP addresses in the no-priv, no-res
and only-public modes (GHSA-4qpf-57w4-m3wc)
* [HtmlSanitizer] Require special schemes and scheme-relative URLs to
carry a non-empty authority [CVE-2026-118517]
* [HttpClient] Don't send the options of the default scope to other
origins in ScopingHttpClient (GHSA-gq53-v8w2-gjhj)
* [Security] Run the checkPostAuth() method of user checkers when
authenticating users programmatically (GHSA-8f57-m8wj-x65w)
* [HttpClient] Pin the IP of cached hosts in NoPrivateNetworkHttpClient
(GHSA-c7hm-wqwp-f9v8)
* [Serializer] Lowercase the scheme of data URIs before opening them
(GHSA-pxj9-jh84-vhm5)
* [Security] Parse the DN into RDNs before extracting the user identifier
[CVE-2026-118513]
* [HttpKernel] Don't decode CSV and YAML payloads unless acceptFormat
lists them (GHSA-hwfg-qwvh-2wfx)
* [Serializer] Don't build UploadedFile and other file objects from
denormalized data [CVE-2026-118515]
* [HtmlSanitizer] Apply the URL policy to srcset and imagesrcset
(GHSA-q8jq-xrf4-v5j8)
* [HttpFoundation] Add the list of private ranges usable as trusted proxies
(GHSA-xg2q-4rrq-657q)
* [HttpKernel] Restore the router context of the parent request after a
sub-request (GHSA-wg5q-m2ww-f3c9)
* [Routing] Prevent host placeholders from matching the path in compiled
matchers [CVE-2026-118516]
* [Filesystem] Only treat a valid URI scheme as the root of a path
(GHSA-6prc-h956-hxjq)
* [Serializer] Ignore undeclared property paths when denormalizing
(GHSA-hqp2-7rr8-hf26)
* [HttpFoundation] Match HEAD requests when GET is listed in a RequestMatcher
[CVE-2026-118514]
* [HttpFoundation] Don't let Request::getBaseUrl() start with a host chosen by
the client (GHSA-5mx8-mwrp-5693)
* [JsonPath] Evaluate absolute queries in filters once per query instead of
once per node (GHSA-cpww-5vpx-72x7)
.
[ Fabien Potencier ]
* Update VERSION for 8.1.11
.
[ Jack Worman ]
* [HttpFoundation] Don't match the script name in Request::getBaseUrl() when
it's only the start of a path segment (GHSA-3h27-hjv7-fqjx)
.
[ David Prévot ]
* Set Multi-Arch: foreign for php-symfony-redis-messenger
Checksums-Sha1:
3cc45ba96ef928aa5c51d475bcb2a821beeb5081 19343 symfony_8.1.11+dfsg-1.dsc
003fba13cdc576d4952b5e77e9fb85b3b6847ba2 10740776 symfony_8.1.11+dfsg.orig.tar.xz
5b0c4da5a59a57c8103f8deac3af1517cf0fbb25 85764 symfony_8.1.11+dfsg-1.debian.tar.xz
7f572c7fcda2c662bed700d8a6b946bafed6cc61 75667 symfony_8.1.11+dfsg-1_amd64.buildinfo
Checksums-Sha256:
04a1c399d6ee5d15bf0aea2ab14ab5cf322a549e238a6b14496ff29d3f7982c1 19343 symfony_8.1.11+dfsg-1.dsc
3f89c83fef00e073ba894a00fc0ad338e4b4377e5c6cd63213d56d56fa64decb 10740776 symfony_8.1.11+dfsg.orig.tar.xz
cebad521b543e09731a866b5c7a091a42598abe6c8b5f0cde1aae4a1663bd7a4 85764 symfony_8.1.11+dfsg-1.debian.tar.xz
a2ed7f319a8364120b67ec67a821c2fe551a08c2b97ec1938de85eb83ba92198 75667 symfony_8.1.11+dfsg-1_amd64.buildinfo
Files:
f0f079d4f9a93e847c2ba726ecf7ea5a 19343 php optional symfony_8.1.11+dfsg-1.dsc
05b4227f72c58640da475d02d37d9ef5 10740776 php optional symfony_8.1.11+dfsg.orig.tar.xz
87dfaa880d46159a1d5c00221a173ad7 85764 php optional symfony_8.1.11+dfsg-1.debian.tar.xz
95bcabedf0d7e20f24b88efbcacc5bb1 75667 php optional symfony_8.1.11+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEEeHVNB7wJXHRI941mBYwc+UT2vTwFAmrrXvsSHHRhZmZpdEBk
ZWJpYW4ub3JnAAoJEAWMHPlE9r08tMEH/01esqwQPhyEAgwkGln4Nru191ePEbU7
EWiot+/IDlVy3JzCQmHncq3SV6wi78uKWl1WXpKYQEPML+g8rJoVfKodXcyroCIj
jfqRi9wZCsXTV53dsh+clMShzLCzYQE0PutZqUdX8x525GUq7QlWroftrneCEGsu
6ffJNcynmeoEBfBhsLkecURA38NtjUDo/Jg33N0bpSdTPvnHNf7BtSnVuj1OkPgi
Y+2K7uCMJBdgc6m16YM8dhZhOAvuI/07uNOzxu7S+DmHxMMO3brCvWj2ZPZmFiSI
Bkdps/VvyU52uR9+oYQiCj8ugwruXbbjGXe+mQU4kfWpUBR4ODa51zc=
=o1uU
-----END PGP SIGNATURE-----
