* 4.0.12 (2018-06-25)

* bug #27626 [TwigBundle][DX] Only add the Twig WebLinkExtension if the WebLink component is enabled (thewilkybarkid)

* bug #27701 [SecurityBundle] Dont throw if "security.http_utils" is not found (nicolas-grekas)

* bug #27690 [DI] Resolve env placeholder in logs (ro0NL)

* bug #26534 allow_extra_attributes does not throw an exception as documented (deviantintegral)

* bug #27668 [Lock] use 'r+' for fopen (fixes issue on Solaris) (fritzmg)

* bug #27669 [Filesystem] fix file lock on SunOS (fritzmg)

* bug #27662 [HttpKernel] fix handling of nested Error instances (xabbuh)

* bug #26845 [Config] Fixing GlobResource when inside phar archive (vworldat)

* bug #27382 [Form] Fix error when rendering a DateIntervalType form with exactly 0 weeks (krixon)

* bug #27309 Fix surrogate not using original request (Toflar)

* bug #27467 [HttpKernel] fix session tracking in surrogate master requests (nicolas-grekas)

* bug #27630 [Validator][Form] Remove BOM in some xlf files (gautierderuette)

* bug #27596 [Framework][Workflow] Added support for interfaces (vudaltsov)

* bug #27593 [ProxyManagerBridge] Fixed support of private services (nicolas-grekas)

* bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (nicolas-grekas)

* bug #27581 Fix bad method call with guard authentication + session migration (weaverryan)

* bug #27576 [Cache] Fix expiry comparisons in array-based pools (nicolas-grekas)

* bug #27556 Avoiding session migration for stateless firewall UsernamePasswordJsonAuthenticationListener (weaverryan)

* bug #27452 Avoid migration on stateless firewalls (weaverryan)

* bug #27568 [DI] Deduplicate generated proxy classes (nicolas-grekas)

* bug #27326 [Serializer] deserialize from xml: Fix a collection that contains the only one element (webnet-fr)

* bug #27567 [PhpUnitBridge] Fix error on some Windows OS (Nsbx)

* bug #27357 [Lock] Remove released semaphore (jderusse)

* bug #27416 TagAwareAdapter over non-binary memcached connections corrupts memcache (Aleksey Prilipko)

* bug #27514 [Debug] Pass previous exception to FatalErrorException (pmontoya)

* bug #27516 Revert "bug #26138 [HttpKernel] Catch HttpExceptions when templating is not installed (cilefen)" (nicolas-grekas)

* bug #27318 [Cache] memcache connect should not add duplicate entries on sequential calls (Aleksey Prilipko)

* bug #27389 [Serializer] Fix serializer tries to denormalize null values on nullable properties (ogizanagi)

* bug #27272 [FrameworkBundle] Change priority of AddConsoleCommandPass to TYPE_BEFORE_REMOVING (upyx)

* bug #27396 [HttpKernel] fix registering IDE links (nicolas-grekas)

* bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski)

* bug #27303 [Process] Consider "executable" suffixes first on Windows (sanmai)

* bug #27297 Triggering RememberMe's loginFail() when token cannot be created (weaverryan)

* bug #27344 [HttpKernel] reset kernel start time on reboot (kiler129)

* bug #27365 [Serializer] Check the value of enable_max_depth if defined (dunglas)

* bug #27358 [PhpUnitBridge] silence some stderr outputs (ostrolucky)

* bug #27366 [DI] never inline lazy services (nicolas-grekas)