Changelog (v6.4.0-BETA2...v6.4.0-BETA3)

• bug[RateLimiter] CompoundLimiter was accepting requests even when some limiters already consumed all tokens #51666 [RateLimiter] CompoundLimiter was accepting requests even when some limiters already consumed all tokens (@10n)
• bug[AssetMapper] Only download a CSS file if it is explicitly advertised #52524 [AssetMapper] Only download a CSS file if it is explicitly advertised (@weaverryan)
• bug[AssetMapper] avoid caching MappedAsset inside JavaScript Import #52523 [AssetMapper] avoid caching MappedAsset inside JavaScript Import (@weaverryan)
• bug[AssetMapper] If assets are served from a subdirectory or CDN, also adjust importmap keys #52519 [AssetMapper] If assets are served from a subdirectory or CDN, also adjust importmap keys (@weaverryan)
• bug[AssetMapper] Fix jsdelivr import parsing with no imported value #52508 [AssetMapper] Fix jsdelivr import parsing with no imported value (@weaverryan)
• security #cve-2023-46734 [TwigBridge] Ensure CodeExtension's filters properly escape their input (@nicolas-grekas,@GromNaN)
• security #cve-2023-46735 [Webhook] Remove user-submitted type from HTTP response (@nicolas-grekas)
• security #cve-2023-46733 [Security] Fix possible session fixation when only thetoken changes (@RobertMe)
• bug[FrameworkBundle] Don't reference SYMFONY_IDE env var in non-debug mode #52514 [FrameworkBundle] Don't reference SYMFONY_IDE env var in non-debug mode (@nicolas-grekas)
• bug[SecurityBundle] wire the secret for Symfony 6.4 compatibility #52506 [SecurityBundle] wire the secret for Symfony 6.4 compatibility (@xabbuh)
• bug[VarDumper] Accept mixed key onDsPairStub #52496 [VarDumper] Accept mixed key onDsPairStub (@marc-mabe)
• bug[Config] PrefixingFileExistenceResource::__toString() to avoid conflict withFileResource #52502 [Config] PrefixingFileExistenceResource::__toString() to avoid conflict withFileResource (@weaverryan)
• bug[String] Method toByteString conversion using iconv is unreachable #52491 [String] Method toByteString conversion using iconv is unreachable (@Vincentv92)
• bug[HttpKernel] Fix PHP deprecation #52488 [HttpKernel] Fix PHP deprecation (@nicolas-grekas)
• bugCheck whether secrets are empty and mark them all as sensitive #52469 Check whether secrets are empty and mark them all as sensitive (@nicolas-grekas)
• feature[HttpKernel] AddControllerResolver::allowControllers() to define which callables are legit controllers when the_check_controller_is_allowed request attribute is set #52471 [HttpKernel] AddControllerResolver::allowControllers() to define which callables are legit controllers when the_check_controller_is_allowed request attribute is set (@nicolas-grekas)
• bug[Messenger] fix compatibility with Doctrine DBAL 4 #52476 [Messenger] fix compatibility with Doctrine DBAL 4 (@xabbuh)
• bug[Console][FrameworkBundle] Fix missingprofile option for console commands #52434 [Console][FrameworkBundle] Fix missingprofile option for console commands (@keulinho)
• bug[HttpFoundation] ensure string type with mbstring func overloading enabled #52474 [HttpFoundation] ensure string type with mbstring func overloading enabled (@xabbuh)
• bug[HttpClient][WebProfilerBundle] Do not generate cURL command when files are uploaded #52472 [HttpClient][WebProfilerBundle] Do not generate cURL command when files are uploaded (@MatTheCat)
• bug[Cache][HttpFoundation][Lock] Fix empty username/password for PDO PostgreSQL #52457 [Cache][HttpFoundation][Lock] Fix empty username/password for PDO PostgreSQL (@HypeMC)
• bug[Yaml] Fix uid binary parsing #52443 [Yaml] Fix uid binary parsing (@mRoca)
• feature[TwigBridge] Mark CodeExtension as @internal #52449 [TwigBridge] Mark CodeExtension as@internal (@fabpot)
• bug[HttpClient] Replaceescapeshellarg to prevent overpassingARG_MAX #52429 [HttpClient] Replaceescapeshellarg to prevent overpassingARG_MAX (@alexandre-daubois)
• bugDisable the "Copy as cURL" button when the debug info are disabled #52442 Disable the "Copy as cURL" button when the debug info are disabled (@stof)
• bugRemove full DSNs from exception messages #52444 Remove full DSNs from exception messages (@nicolas-grekas)
• feature[HttpFoundation][Lock] Makes MongoDB adapters usable withext-mongodb directly #52336 [HttpFoundation][Lock] Makes MongoDB adapters usable withext-mongodb only (@GromNaN)
• bug[HttpKernel] Preventing error 500 when function putenv is disabled #52428 [HttpKernel] Preventing error 500 when function putenv is disabled (@ShaiMagal)
• bug[Console][Process] do not let context classes extend the message classes #52427 [Console][Process] do not let context classes extend the message classes (@xabbuh)
• bug[Yaml] Fix block scalar array parsing #52408 [Yaml] Fix block scalar array parsing (@NickSdot)
• bug[Console] Fix horizontal table top border is incorrectly rendered #52132 [Console] Fix horizontal table top border is incorrectly rendered (@OskarStark)
• bug[AssetMapper] Fixing bug where JSCompiler used non-absolute importmap entry path #52368 [AssetMapper] Fixing bug where JSCompiler used non-absolute importmap entry path (@weaverryan)
• bug[Uid] Fix UuidV7 collisions within the same ms #52367 [Uid] Fix UuidV7 collisions within the same ms (@nicolas-grekas)
• bug[FrameworkBundle] Fix deprecation layer for "enable_annotations" in validation and serializer configuration #52287 [FrameworkBundle] Fix deprecation layer for "enable_annotations" in validation and serializer configuration (@lyrixx)
• bug[MonologBridge] Fix support for monolog 3.0 #52222 [MonologBridge] Fix support for monolog 3.0 (@louismariegaborit)