* 2.7: (22 commits)  Tests and fix for issue in array model data in EntityType field with multiple=true  [Form] Fixed PercentToLocalizedStringTransformer to accept both comma and dot as decimal separator, if possible  removed useless PHPDoc  [Form] Fix FormInterface::submit() annotation  PdoSessionHandler: fix advisory lock for pgsql when session.sid_bits_per_character > 4  HttpCache does not consider ESI resources in HEAD requests  Fix translation for "This field was not expected"  [Routing] Enhance Route(Collection) docblocks  Added improvement for accuracy in MoneyToLocalizedStringTransformer.  Removed unused private property  Use correct verb form in the pull request template  Use PHP_MAXPATHLEN in Filesystem.  Added null as explicit return type (?TokenInterface)  [FrameworkBundle] Fix Routing\DelegatingLoader  Render all line breaks according to the exception message  [Form] Fix phpdoc  [DI] remove confusing code  [Form] Fixed GroupSequence with "constraints" option  [Validator] Clarify UUID validator behavior  [Filesystem] Fixed makePathRelative  ...

* 2.7:  fix tests

* 2.7:  [Config] Fix dumped files invalidation by OPCache

* 2.7:  [Yaml] parse references on merge keys

* 2.7:  bumped Symfony version to 2.7.36  updated VERSION for 2.7.35  update CONTRIBUTORS for 2.7.35  updated CHANGELOG for 2.7.35  [Session] fix MongoDb session handler to gc all expired sessions

released v2.8.28

* 2.7:  Fix 7.2 compat layer  Fix PHP 7.2 support  [HttpFoundation] Add missing session.lazy_write config option  [HttpFoundation] Combine Cache-Control headers  [Form] fix parsing invalid floating point numbers  Escape command usage when displaying it in the text descriptor  Use for=ID on radio/checkbox label.

* 2.7:  [Validator] added magic method __isset()  to File Constraint class  [DI] Fix possible incorrect php-code when dumped strings contains newlines  [Translation] minor: remove unused variable in test  never match invalid IP addresses

…unglas)This PR was squashed before being merged into the 2.8 branch (closessymfony#24571).Discussion----------[PropertyInfo] Add support for the iterable type| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | yes| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->| BC breaks?    | no| Deprecations? | no <!-- don't forget to update UPGRADE-*.md files -->| Tests pass?   | yes| Fixed tickets | reported on Slack| License       | MIT| Doc PR        | n/aAdd support for the `iterable` pseudo-type introduced in PHP 7.1.Commits-------a73249d [PropertyInfo] Add support for the iterable type

* 2.7:  Username and password in basic auth are allowed to contain '.'  Remove obsolete PHPDoc from UriSigner  [Serializer] ObjectNormalizer: throw if PropertyAccess isn't installed  pdo session fix  Fixed unsetting from loosely equal keys OrderedHashMap  [Debug] Fix same vendor detection in class loader  Updated the source text and translation  reject remember-me token if user check fails

… in Twig's cache (weaverryan)This PR was merged into the 2.8 branch.Discussion----------Adding the Form default theme files to be warmed up in Twig's cache| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | yes| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | none| License       | MIT| Doc PR        | not neededHiya guys!So..... during a Symfony Live workshop, we found out that the form theme Twig templates are *not* included in the Twig cache warmup process. This fixes that. I believe this is the only "weird" case where we use a Twig template that is not in a bundle and also not added to Twig as a proper namespaces.I tested this on a 2.8 project. Before the patch, the form theme templates were not warmed up. After, they are warmed up. Booya.Cheers!Commits-------2ef619f Adding the Form default theme files to be warmed up in Twig's cache

This PR was squashed before being merged into the 2.8 branch (closessymfony#24642).Discussion----------[Routing] Fix resource miss| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | yes| New feature?  | no <!-- don't forget to update src/**/CHANGELOG.md files -->| BC breaks?    | no| Deprecations? | no <!-- don't forget to update UPGRADE-*.md files -->| Tests pass?   | yes| Fixed tickets | n/a| License       | MIT| Doc PR        | n/aSome routing resources are not watched. To reproduce:1. Install Symfony 42. Change something in `config/routes.yaml`The change is not taken into account.This PR fixes this bug.Commits-------6610c25 [Routing] Fix resource miss

* 2.7:  [Security] Fixed auth provider authenticate() cannot return void  declare argument type  streamed response should return $this  content can be a resource

This PR was merged into the 2.8 branch.Discussion----------Remove inapplicable phpdoc comment| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | no| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   || Fixed tickets || License       | MIT| Doc PR        |Commits-------7a7bda7 Remove inapplicable phpdoc comment

This PR was merged into the 2.8 branch.Discussion----------[2.8] Fix some docblocks| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | no| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | -| License       | MIT| Doc PR        | -Commits-------1cfd7de [2.8] Fix some docblocks

* 2.7:  Escape trailing \ in QuestionHelper autocompletion  Add "doctrine/annotations" to top-level composer.json  nit: Fix phpdoc inconsistency and unreachable statement

* 2.7:  [DI] minor docblock fixes

* 2.7:  [HttpFoundation] Fix FileBag issue with associative arrays  fix the phpdoc that is not really inherited from response  Minor docblock cleanup  Remove redundant sprintf arguments.

…ard to avoid session fixation*cve-2018-11385-2.8:  Adding session authentication strategy to Guard to avoid session fixation

* 2.7:  clear CSRF tokens when the user is logged out

* 2.7:  [SecurityBundle] Fail if security.http_utils cannot be configured

* 2.7:  fixed constraints  bumped dep  bumped dep

* 2.7:  [HttpFoundation] Fix perf issue during MimeTypeGuesser intialization

released v2.8.41

This PR was squashed before being merged into the 2.8 branch (closessymfony#27376).Discussion----------[Github] Update the pull-request template| Q             | A| ------------- | ---| Branch?       | 2.8| Bug fix?      | no| New feature?  | no| BC breaks?    | no| Deprecations? | no| Tests pass?   | yes| Fixed tickets | ø| License       | MIT| Doc PR        | ø2.7 is end of life.Commits-------99327a6 [Github] Update the pull-request template

Necessary to fix each() function deprecation calls introduced in PHP 7.2