What Is New in Symfony 6.3
Symfony 6.3 introduces a range of new features, improvements, and deprecations to streamline development. This release focuses on enhancing existing components and adding quality-of-life improvements for developers.
| Category | Key Changes |
|---|---|
| New Features | PDO Session Handler, HtmlSanitizer Component, Notifier UI, MapQueryString attribute, Clock component integration. |
| Improvements | Enhanced HttpClient, Mailer, Messenger, Security, and Serializer components. |
| Deprecations | PhpSessionStorage, AbstractController::render() shortcut, and several other methods/classes. |
| Bug Fixes | Various fixes across the framework core and components. |
What new components were added in Symfony 6.3?
Symfony 6.3 brings two major new components into the core framework. The HtmlSanitizer component provides a secure way to clean HTML input, preventing XSS attacks. This is a standalone library that's now integrated and ready for use.
The second major addition is the formal integration of the PHP Clock interface via the Symfony Clock component. It offers a time abstraction, making it easier to test time-dependent code. You can now type-hint Psr\Clock\ClockInterface and get a Symfony clock service.
How does the new MapQueryString attribute work?
The #[MapQueryString] attribute automatically maps query string parameters to a typed object in your controller arguments. It uses the Symfony Serializer to populate the object, validating types and enabling smart parameter conversion.
In practice, you define a DTO with properties matching your query parameters. When a request hits the controller, Symfony instantiates and populates this object for you. This replaces manual $request->query->get() calls with a clean, declarative approach.
use Symfony\Component\HttpFoundation\QueryString;
class FilterDto
{
public ?string $q = null;
public ?int $page = 1;
}
// In your controller:
public function index(#[MapQueryString] ?FilterDto $filter = null)
{
// $filter is a populated FilterDto object
}What improvements were made to the Notifier component?
The Notifier component now includes a built-in UI for testing and previewing notifications during development. This is a game-changer for debugging chat messages, SMS, or emails. You can access it via a new /_notifier/ route when the profiler is enabled.
Additionally, support for multiple Slack channels and Microsoft Teams was added. The component also gained the ability to resend failed notifications, improving resilience in production systems where third-party services might be temporarily unavailable.
What is the new PDO Session Handler and why use it?
Symfony 6.3 introduces a native PdoSessionHandler to replace the legacy NativeSessionHandler. This handler uses modern PDO for database connections, offering better performance and reliability. It supports lazy connections and works seamlessly with read-replica database setups.
This matters because the old handler had limitations with connection pooling and failover. The new implementation is more aligned with how Doctrine DBAL handles connections, making session management in scalable applications much smoother. The old handler is now deprecated.
What are the key deprecations to be aware of?
Several deprecations pave the way for Symfony 7. The PhpSessionStorage class and related alias are deprecated in favor of the new NativeSessionStorage. If you extended this class, you'll need to update your codebase.
The AbstractController::render() shortcut method is also deprecated. You should use the renderView() method followed by a Response object instead. Other deprecations include the DoctrineDbalCacheAdapterSchemaSubscriber and the uid constraint's strict option.
FAQ
Should I upgrade to Symfony 6.3 immediately?
Yes, if you're on a 6.x version, the upgrade path is straightforward. Review the deprecation notices in your profiler and update any usage of deprecated features. The new features are additive and won't break existing code.
How do I start using the HtmlSanitizer?
The component is available as a service. Inject HtmlSanitizer\SanitizerInterface and call its sanitize() method. You can configure custom sanitizer profiles in the framework configuration to define allowed elements and attributes.
Does the new PDO Session Handler require a different database schema?
No, it uses the same session table schema as the previous handler. You can switch the handler in your configuration without modifying your database. The change is transparent but offers improved connection handling.
What happens if I ignore the MapQueryString attribute's validation?
The attribute uses the Serializer, which will throw a PartialDenormalizationException if type conversion fails (e.g., passing a string where an integer is expected). You should handle this exception to provide proper validation feedback to users.
Is the Notifier UI available in production?
No, the UI is only available when the application is in debug mode. It's a development tool to preview notification formats and payloads. It's automatically disabled in a production environment for security reasons.