Changelog (v7.4.12...v7.4.13)

• security #cve-2026-48747 [Mailer] Pin Mailomat webhook signature algorithm to SHA-256 (@nicolas-grekas)
• security #cve-2026-48761 [HtmlSanitizer] Sanitize URL attributes on , , <iframe>, , and the URL inside content (@nicolas-grekas)
• security #cve-2026-48760 [HtmlSanitizer] Reject percent-encoded BiDi marks and Unicode whitespace in URLs (@nicolas-grekas)
• security #cve-2026-48736 [HttpFoundation] Block IPv6 transition forms in IpUtils::PRIVATE_SUBNETS (@nicolas-grekas)
• security #cve-2026-48736 [HttpClient] Block IPv6 transition forms in NoPrivateNetworkHttpClient (@nicolas-grekas)
• security #cve-2026-48489 [Security] Don't honor user-supplied _failure_path on failure_forward (@nicolas-grekas)
• security #cve-2026-48784 [Routing] Fix dot-segment encoding for chained "../" and "./" in generated URLs (@nicolas-grekas)
• bug [Console] Format message in ConsoleSectionOutput::overwrite() #64355 [Console] Format message in ConsoleSectionOutput::overwrite() (@nicolas-grekas)
• bug [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() #64349 [HttpClient] ntlm regression on authPersistNonNTLM=false connections with reset() (Dooij)
• bug [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally #64348 [FrameworkBundle] Allow to pass doctrine_open_transaction_logger’s entity manager name positionally (@MatTheCat)
• bug [Mime][String] Reject objects in typed-string properties during __unserialize #64345 [Mime][String] Reject objects in typed-string properties during __unserialize (@nicolas-grekas)
• bug [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist #64344 [Mailer][Notifier] Harden Mailchimp signature comparison and Smsbox IP allowlist (@nicolas-grekas)
• bug [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() #64330 [Cache] Fix strlen(null) deprecation on RelayCluster path in RedisTrait::doClear() (@signor-pedro)
• bug [Scheduler] Recover pending RecurringMessages after consumer stops midway #64335 [Scheduler] Recover pending RecurringMessages after consumer stops midway (@ousamabenyounes)
• bug [SecurityBundle] Fix Security::login() across firewalls #64338 [SecurityBundle] Fix Security::login() across firewalls (@ousamabenyounes)
• bug [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses #64347 [Process] Stop leaking CGI/FastCGI request-context vars to subprocesses (@nicolas-grekas)
• bug [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines #64343 [Mime][RateLimiter][Routing][Security] Harden __unserialize against __toString trampolines (@nicolas-grekas)
• bug [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats #64342 [HtmlSanitizer] Honor universal attribute sanitizers, apply maxInputLength to text contexts, document forceAttribute and allowAttribute caveats (@nicolas-grekas)
• bug [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers #64341 [FrameworkBundle][Mailer] Harden default IP allowlist for Postmark and Brevo webhook parsers (@nicolas-grekas)
• bug [Security] Initialize lazy users before serializing them #64337 [Security] Initialize lazy users before serializing them (@MatTheCat)
• bug [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args #64346 [Runtime] Trust argv on CLI-like SAPIs to fix subprocess args (@nicolas-grekas)
• bug [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() #64336 [Cache] Accept '_' and ':' in prefix passed to AbstractAdapter::clear() (@nicolas-grekas)
• bug [Yaml] Allow trailing newlines after the end-of-document marker #64316 [Yaml] Allow trailing newlines after the end-of-document marker (@nicolas-grekas)
• bug [Translation] Don’t check the error message to know if Lokalise keys are missing #64289 [Translation] Don’t check the error message to know if Lokalise keys are missing (@MatTheCat)
• bug [AssetMapper] Rewrite relative paths in export ... from statements #64208 [AssetMapper] Rewrite relative paths in export ... from statements (@ousamabenyounes)
• bug [DependencyInjection] Fix service() as invokable factory in array-based PHP config #64311 [DependencyInjection] Fix service() as invokable factory in array-based PHP config (@nicolas-grekas)
• bug [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning #64310 [HttpKernel][WebProfilerBundle] Check logs priority name for both WARNING and warning (@MatTheCat)
• bug [HttpClient] Various fixes and hardenings #64260 [HttpClient] Various fixes and hardenings (@Lctrs)
• bug [FrameworkBundle] Sign transports for unrouted messages too #64309 [FrameworkBundle] Sign transports for unrouted messages too (@nicolas-grekas)