Merge branch '6.4' into 7.4

nicolas-grekas · nicolas-grekas · commit 637f5cac1ac2 · 2026-05-13T14:04:42.000+02:00
* 6.4:
  Allow defining security provider factories without config
  [FrameworkBundle] Bump Request/Session value resolver priority above EntityValueResolver
  [Security] Remove the legacy nested unserialize() call from token and exception classes
  [Yaml] Reject non-stringables when using "!!binary"
  [Messenger][Amqp] delayed quorum queues
  [Notifier] Use `hash_equals()` to compare webhook signatures for Vonage
  [Inflector][String] Fixed singularize `traces` &gt; `trace`
  [AssetMapper] Warn on missing bare CSS and JSON imports
  When pushing, run GHA only on "*.*" branches
  [Console] Fix signal handler scoping
  [Security] Preserve webserver base URL in HttpUtils::createRequest()
diff --git a/Resources/config/web.php b/Resources/config/web.php
@@ -83,10 +83,13 @@
             ->tag('controller.argument_value_resolver', ['priority' => 100, 'name' => RequestAttributeValueResolver::class])
 
         ->set('argument_resolver.request', RequestValueResolver::class)
-            ->tag('controller.argument_value_resolver', ['priority' => 50, 'name' => RequestValueResolver::class])
+            // Run before EntityValueResolver (DoctrineBundle, priority 110) so type-hinted
+            // Request arguments do not trigger entity-manager bootstrap. Keep this above
+            // DoctrineBundle's EntityValueResolver priority if it ever changes.
+            ->tag('controller.argument_value_resolver', ['priority' => 120, 'name' => RequestValueResolver::class])
 
         ->set('argument_resolver.session', SessionValueResolver::class)
-            ->tag('controller.argument_value_resolver', ['priority' => 50, 'name' => SessionValueResolver::class])
+            ->tag('controller.argument_value_resolver', ['priority' => 120, 'name' => SessionValueResolver::class])
 
         ->set('argument_resolver.service', ServiceValueResolver::class)
             ->args([
diff --git a/Tests/DependencyInjection/FrameworkExtensionTestCase.php b/Tests/DependencyInjection/FrameworkExtensionTestCase.php
@@ -181,6 +181,22 @@ public function testPropertyAccessCacheWithDebug()
         $this->assertSame(ArrayAdapter::class, $cache->getClass(), 'ArrayAdapter should be used in debug mode');
     }
 
+    public function testRequestAndSessionValueResolversRunBeforeEntityValueResolver()
+    {
+        $container = $this->createContainerFromFile('full');
+
+        // DoctrineBundle ships EntityValueResolver at priority 110. Lower priorities trigger an
+        // entity-manager bootstrap on every Request/Session controller argument before the
+        // dedicated resolver is asked, costing tens of ms per request.
+        $entityValueResolverPriority = 110;
+
+        $requestTag = $container->getDefinition('argument_resolver.request')->getTag('controller.argument_value_resolver');
+        $this->assertGreaterThan($entityValueResolverPriority, $requestTag[0]['priority']);
+
+        $sessionTag = $container->getDefinition('argument_resolver.session')->getTag('controller.argument_value_resolver');
+        $this->assertGreaterThan($entityValueResolverPriority, $sessionTag[0]['priority']);
+    }
+
     public function testCsrfProtectionNeedsSessionToBeEnabled()
     {
         $this->expectException(\LogicException::class);
