What Is New in Symfony 6.1
Symfony 6.1 introduces a set of focused enhancements and new components, continuing the framework's evolution. This release brings quality-of-life improvements for developers, expands integration capabilities, and lays groundwork for future updates.
| Category | Key Changes |
|---|---|
| New Features | New Messenger Serializer, PSR-7/17 compatibility for HttpClient, Uid factory functions, HtmlSanitizer component. |
| Improvements | Autowiring support for Security voters, Enum support in ExpressionLanguage, improved UX for translations, cache pool configuration. |
| Deprecations | Legacy session handling, some security voter methods, legacy mailer configuration. |
How does Symfony 6.1 improve messaging with the new serializer?
A new Symfony\Component\Messenger\Transport\Serialization\PhpSerializer is now the default. This built-in serializer handles most objects without extra configuration, simplifying setup. It's more secure than the old one because it only unserializes allowed classes from an explicit denylist. In practice, this means fewer third-party dependencies for basic message serialization tasks.
What HttpClient updates should Symfony developers know about?
The HttpClient component now returns PSR-7-compatible responses by default when using the Psr18Client. This aligns Symfony with broader PHP ecosystem standards, making it easier to integrate with libraries expecting PSR-7/17 interfaces. You can also inject your own PSR-17 factories for full control over the request/response objects.
// Example: Getting a PSR-7 response
$client = HttpClient::create();
$response = $client->request('GET', 'https://...');
// $response implements Psr\Http\Message\ResponseInterface
Are there new shortcuts for generating UUIDs and ULIDs?
Yes, new global factory functions make creating UIDs much cleaner. You can now use uuid_v1(), uuid_v4(), uuid_v6(), ulid(), and others directly in your code. This reduces boilerplate and improves readability compared to instantiating objects manually.
What does the new HtmlSanitizer component do?
This new standalone component provides a secure way to clean untrusted HTML input. It's built for performance and uses a allowlist approach, stripping out dangerous elements and attributes while keeping safe markup. This matters because it offers a standardized, framework-agnostic solution for a common security need.
How is Enum support enhanced in 6.1?
The ExpressionLanguage component now natively supports PHP 8.1 enums. You can use enum cases directly in expressions, making security rules and business logic conditions more type-safe and expressive. This is a natural integration that reflects modern PHP practices within the Symfony ecosystem.
// Example in an expression
is_granted('POST_COMMENT', subject)
// Can now use enum cases like ArticleStatus::PUBLISHED
FAQ
What is the main reason to upgrade to Symfony 6.1?
The new default Messenger serializer reduces configuration overhead and improves security for message handling. The PSR-7/17 support in HttpClient also improves interoperability with other PHP libraries.
Are there any significant breaking changes in 6.1?
Not many, but there are deprecations. The legacy session handling using the PhpBridgeSessionStorageFactory is deprecated, as are some security voter methods. Check the deprecation notices in your profiler.
How does the new UID function syntax work?
Symfony now provides global functions like uuid_v4() and ulid() that return the corresponding Uid objects. They are autoloaded, so no extra includes are needed.
Is the HtmlSanitizer component ready for production use?
Yes, it's a stable new component included in the core. It's designed to be fast and secure, suitable for sanitizing user-generated content like comments or forum posts.
Does the new Messenger serializer support all my existing messages?
It supports most objects serializable by PHP's native serialize(). However, for complex serialization needs (like involving private properties of parent classes), you might still need a custom serializer like the Symfony Serializer.