Symfony’s proxy system, used for lazy service initialization and Doctrine’s entity proxies, has historically relied on code generation. The proxy classes were generated at cache warmup, stored as files, and loaded when needed. It worked, but it added real complexity: generated files to manage, cache to invalidate, code that looked nothing like the class it proxied.
PHP 8.4 added native lazy objects. Symfony 8.0 uses them. The LazyGhostTrait and LazyProxyTrait that powered the old system are removed. Proxy creation is now a runtime operation backed by the engine itself, not a code generation step.
For application developers the change is mostly invisible: lazy services still work. For framework and library authors, a significant surface of complexity just disappears.
Multi-step forms have always been a DIY exercise in Symfony. Session management, step tracking, partial validation, navigation between steps: every project rolled its own solution or pulled in a third-party bundle.
8.0 introduces FormFlow: a built-in mechanism for multi-step form wizards. Steps are defined as a sequence of form types, partial validation is scoped to the current step, and session management is handled automatically.
#[AsFormFlow]
class CheckoutFlow extends AbstractFormFlow
{
protected function defineSteps(): Steps
{
return Steps::create()
->add('shipping', ShippingType::class)
->add('payment', PaymentType::class)
->add('review', ReviewType::class);
}
}
The 7.4 deprecation of the fluent PHP configuration format becomes a hard removal in 8.0. XML configuration also exits as a first-class format. The supported formats for application configuration are now YAML and PHP arrays. The footprint shrinks, but what remains is genuinely better.
ContainerAwareInterface and ContainerAwareTraitLazyGhostTrait and LazyProxyTraitSymfony 8.0 is a clean break, and that kind of break only becomes possible when the PHP floor rises. PHP 8.4’s lazy objects are the clearest example: the feature now exists in the language, so the framework can just stop implementing it.
Invokable commands get a significant upgrade. The #[Input] attribute turns a DTO into the command’s argument/option bag. No more calling $input->getArgument() inside the handler:
#[AsCommand(name: 'app:send-report')]
class SendReportCommand
{
public function __invoke(
#[Input] SendReportInput $input,
): int {
// $input->email, $input->dryRun, etc.
return Command::SUCCESS;
}
}
BackedEnum is supported in invokable commands, so an option declared as a Status enum gets validated and cast automatically. Interactive commands get #[Interact] and #[Ask] attributes to declare question prompts inline. CommandTester works with invokable commands without any extra wiring.
Routes defined via #[Route] on controller classes are auto-registered without needing an explicit resource: entry in config/routes.yaml. The tag routing.controller is applied automatically. You still control which directories are scanned, but your YAML config shrinks to a pointer at a directory rather than a manual file list.
#[Route] also gains a _query parameter for setting query parameters at generation time, and multiple environments in the env option.
#[IsCsrfTokenValid] gets a $tokenSource argument so you can specify where the token comes from (header, cookie, form field) rather than relying on a fixed convention. SameOriginCsrfTokenManager adds Sec-Fetch-Site header validation, a browser-native CSRF protection mechanism that doesn’t need token injection at all.
The security:oidc-token:generate command creates tokens for testing OIDC-protected endpoints locally. Multiple OIDC discovery endpoints are supported now, useful in multi-tenant setups where each tenant has its own identity provider.
Two new Twig functions: access_decision() and access_decision_for_user() expose the authorization voter result in templates without going through the security facade. #[IsGranted] can be subclassed for repeated authorization patterns that deserve their own named attribute.
Both components introduced in 7.x graduate to stable in 8.0. ObjectMapper maps between objects without hand-written transformers, using attribute-based configuration. JsonStreamer reads and writes large JSON without loading the full document into memory, and it now supports synthetic properties: virtual fields computed at serialization time.
JsonStreamer also drops its dependency on nikic/php-parser. The code generation for the reader/writer now uses a simpler internal mechanism, cutting a heavy dev dependency.
UuidFactory now generates UUIDv7 by default instead of UUIDv4. The difference: v7 is time-ordered, so generated UUIDs sort chronologically. That matters a lot for database index performance. MockUuidFactory provides deterministic UUID generation in tests.
Previously, a YAML file with two identical keys silently kept the last one. 8.0 raises a parse error. This catches real bugs: duplicate keys in services.yaml or config/packages/*.yaml are almost always copy-paste mistakes and you definitely want to know about them.
A Video constraint joins the Image constraint for validating uploaded video files (MIME type, duration, codec). The Url constraint accepts protocols: ['*'] to allow any RFC 3986-compliant scheme, useful when storing arbitrary URLs that include git+ssh://, file://, or custom app schemes.
SQS transport can now use its own native retry and dead-letter queue configuration instead of Symfony’s retry middleware. For high-volume queues on AWS, this removes a round-trip through PHP for transient failures. A MessageSentToTransportsEvent fires after a message is dispatched, carrying information about which transports actually received it.
messenger:consume gets --exclude-receivers to pair with --all.
A new transport sends mail via the Microsoft Graph API, which is what Microsoft recommends for applications on Azure Active Directory these days. The other options (SMTP relay, Exchange EWS) still work, but Graph is the right choice for new Azure deployments.
Transitions can now declare weights. When multiple transitions are enabled from the same place, the highest-weight one wins. This lets you express priority directly in the workflow definition without adding a guard that reads an external counter.
return (new Definition(states: ['draft', 'review', 'published']))
->addTransition(new Transition('publish', 'review', 'published', weight: 10))
->addTransition(new Transition('reject', 'review', 'draft', weight: 1));
LockKeyNormalizer normalizes a lock key to a consistent string before hashing. Useful when the key is derived from user input or external data that may vary in whitespace or casing: the normalizer makes sure the same logical key always maps to the same lock.
The IETF QUERY method (a safe, idempotent method with a body, unlike GET) is now supported throughout the stack: Request, HTTP cache, WebProfiler, and HttpClient. If you build search APIs that need a structured request body and also want caching, QUERY is the right semantic choice.
Request::createFromGlobals() now parses the body of PUT, DELETE, PATCH, and QUERY requests automatically.
Symfony 8.0 auto-generates a JSON Schema file for each configuration section. IDEs that support JSON Schema for YAML files (VS Code, PhpStorm) can now validate config/packages/*.yaml against these schemas and provide autocompletion without any plugin. The schema is generated during cache warmup and placed at config/reference.php.
The Runtime component detects FrankenPHP automatically and activates worker mode without any extra package or environment variable. If $_SERVER['APP_RUNTIME'] is set, that runtime class takes precedence. You can also pick the error renderer based on APP_RUNTIME_MODE, which is useful when running the same codebase in HTTP and CLI contexts with different error presentation needs.
Transport security in Messenger has always been the application’s problem to solve. 7.4 adds message signing: a stamp-based mechanism that signs dispatched messages and validates signatures on reception.
The target use case is multi-tenant or external transport scenarios where you need cryptographic proof that a message wasn’t tampered with or injected from outside. Configuration lives at the transport level:
framework:
messenger:
transports:
async:
dsn: '%env(MESSENGER_TRANSPORT_DSN)%'
options:
signing_key: '%env(MESSENGER_SIGNING_KEY)%'
Symfony’s configuration formats have always been YAML (default), XML, and PHP. The PHP format existed but it was awkward: a fluent builder DSL that required method chaining and gave your IDE nothing useful to work with.
7.4 swaps the fluent format for standard PHP arrays. IDEs can now actually analyze it, config/reference.php is auto-generated as a type-annotated reference, and the result reads like data rather than code:
return static function (FrameworkConfig $framework): void {
$framework->router()->strictRequirements(null);
$framework->session()->enabled(true);
};
The fluent format is deprecated. Arrays are the future, and honestly it’s a better format.
#[IsSignatureValid] validates signed URLs directly in controllers, cutting out the boilerplate of manual validation. OpenID Connect now supports multiple discovery endpoints, and a new security:oidc-token:generate command makes dev and testing a lot less painful.
7.4 LTS: bugs until November 2028, security fixes until November 2029. The path to 8.4 LTS (the next long-term target) goes through 7.4’s deprecation notices and the PHP 8.4 upgrade. Fix the deprecations now and the jump to 8.x will be much less painful.
#[CurrentUser] now accepts union types, which matters in practice when a route can be reached by more than one user class:
public function index(#[CurrentUser] AdminUser|Customer $user): Response
#[Route] accepts an array for the env option, so a debug route active only in dev and test no longer needs two separate definitions. #[AsDecorator] is now repeatable, meaning one class can decorate multiple services at once. #[AsEventListener] method signatures accept union event types. #[IsGranted] gets a methods option to scope an authorization check to specific HTTP verbs without duplicating the route.
Request::get() is deprecated, and honestly good riddance. The method searched route attributes, then query parameters, then request body, in that order, silently returning whatever it found first. That ambiguity caused real bugs. It’s gone in 8.0; in 7.4 it still works but triggers a deprecation. The replacements are explicit: $request->attributes->get(), $request->query->get(), $request->request->get().
Body parsing for PUT, PATCH, DELETE, and QUERY requests arrives at the same time. Previously Symfony only parsed application/x-www-form-urlencoded and multipart/form-data for POST. Those same content types now get parsed for the other writable methods too, which kills a common REST API workaround.
HTTP method override for GET, HEAD, CONNECT, and TRACE is deprecated. Overriding a safe method with a header was always semantically broken anyway. You can now explicitly allow only the methods that make sense for your app:
Request::setAllowedHttpMethodOverride(['PUT', 'PATCH', 'DELETE']);
Workflow places and transitions can now be defined with PHP backed enums, both in YAML (via the !php/enum tag) and in PHP config. The marking store works with enum values directly, so your domain model and your workflow definition finally use the same types:
framework:
workflows:
blog_publishing:
initial_marking: !php/enum App\Status\PostStatus::Draft
places: !php/enum App\Status\PostStatus
transitions:
publish:
from: !php/enum App\Status\PostStatus::Review
to: !php/enum App\Status\PostStatus::Published
Ever needed to add validation or serialization metadata to a class from a bundle you don’t own? 7.4 has #[ExtendsValidationFor] and #[ExtendsSerializationFor] for that. You write a companion class with your extra annotations, point the attribute at the target class, and Symfony merges the metadata at container compilation time:
#[ExtendsValidationFor(UserRegistration::class)]
abstract class UserRegistrationValidation
{
#[Assert\NotBlank(groups: ['my_app'])]
#[Assert\Length(min: 3, groups: ['my_app'])]
public string $name = '';
#[Assert\Email(groups: ['my_app'])]
public string $email = '';
}
Symfony verifies at compile time that the declared properties actually exist on the target class. A rename won’t silently break your validation.
The Question helper in Console accepts a timeout. Ask the user to confirm something, and if they don’t respond in N seconds, the default answer kicks in. Very handy in deployment scripts that can’t afford to wait forever for a human.
messenger:consume gets --exclude-receivers. Combined with --all, it lets you consume from every transport except specific ones:
bin/console messenger:consume --all --exclude-receivers=low_priority
FrankenPHP worker mode is now auto-detected. If the process is running inside FrankenPHP, Symfony switches to worker mode automatically. No extra package needed.
The debug:router command hides the Scheme and Host columns when all routes use ANY, which removes a lot of noise from the default output. HTTP methods are now color-coded too.
Functional tests get $client->getSession() before the first request. Previously you had to make at least one request to access the session, which was annoying. Now you can pre-seed CSRF tokens or A/B testing flags up front:
$session = $client->getSession();
$session->set('_csrf/checkout', 'test-token');
$session->save();
DynamoDbStore lands as a new Lock backend. Useful in AWS-native deployments where Redis isn’t in the stack, and it works exactly like any other store:
$store = new DynamoDbStore('dynamodb://default/locks');
$factory = new LockFactory($store);
Two new Doctrine column types: day_point stores a date-only value (no time component) and time_point stores a time-only value, both mapping to DatePoint. Good when your domain genuinely separates date from time:
#[ORM\Column(type: 'day_point')]
public DatePoint $birthDate;
#[ORM\Column(type: 'time_point')]
public DatePoint $openingTime;
The _query key in URL generation lets you set query parameters explicitly, separate from route parameters. This matters when a route parameter and a query parameter share the same name:
$url = $urlGenerator->generate('report', [
'site' => 'fr',
'_query' => ['site' => 'us'],
]);
// /report/fr?site=us
HttpHeaderParser parses Link response headers into structured objects. Before this, parsing Link headers from API responses meant either pulling in a third-party library or writing regex. The use case is HTTP APIs that advertise related resources or pagination via Link headers, like GitHub’s API does.
DomCrawler and HtmlSanitizer switch to PHP 8.4’s native HTML5 parser when available. No code changes needed on your end. The native parser is faster and more spec-compliant than the previous fallback. On PHP 8.2 or 8.3 nothing changes.
StaticMessage implements TranslatableInterface but intentionally doesn’t translate. It passes the string through unchanged regardless of locale. The use case is API responses that must stay in a fixed language regardless of the user’s locale, or audit log entries where you need to preserve the original text as-is.
Functional pipelines in PHP have always been a mess. Chaining transformations meant either nesting function calls inside out, or breaking them into intermediate variables:
// before — read right to left
$result = array_sum(array_map('strlen', array_filter($strings, 'strlen')));
// or verbose but readable
$filtered = array_filter($strings, 'strlen');
$lengths = array_map('strlen', $filtered);
$result = array_sum($lengths);
// after — read left to right
$result = $strings
|> array_filter(?, 'strlen')
|> array_map('strlen', ?)
|> array_sum(?);
The |> operator passes the left-hand value into the right-hand expression. The ? placeholder marks where it goes. Pipelines now read in the order operations happen: left to right, top to bottom.
This pairs well with first-class callables from PHP 8.1. The two features compose nicely:
$result = $input |> trim(...) |> strtolower(...) |> $this->normalize(...);
Handling URIs in PHP has always meant either reaching for a third-party library or cobbling together parse_url() (returns an array, not an object), http_build_query(), and manual string concatenation.
The new Uri extension gives you a proper object-oriented API:
$uri = Uri\Uri::parse('https://example.com/path?query=value#fragment');
$modified = $uri->withPath('/new-path')->withQuery('key=val');
echo $modified; // https://example.com/new-path?key=val#fragment
Immutable value objects, RFC-compliant parsing, modify individual components without parsing and reconstructing the whole string. Long overdue.
A new attribute that generates a warning when the return value is ignored:
#[\NoDiscard("Use the returned collection, the original is unchanged")]
public function filter(callable $fn): static { ... }
Useful for immutable methods where ignoring the return value is almost certainly a bug. Common in other languages for years, now in PHP where it belongs.
Cloning an object with modified properties without using property hooks or a custom with() method:
$updated = clone($point) with { x: 10, y: 20 };
Clean syntax for a pattern readonly objects needed: you clone to “modify” since direct mutation isn’t allowed.
PHP 8.5 has a functional streak. The pipe operator and URI extension together make data transformation code meaningfully easier to read. The language keeps moving in a consistent direction.
A constraint that’s been baked in since PHP 5: constant expressions (attribute arguments, property defaults, parameter defaults, const declarations) couldn’t contain closures or first-class callables. 8.5 removes that.
#[Validate(fn($v) => $v > 0)]
public int $count = 0;
const NORMALIZER = strtolower(...);
class Config {
public function __construct(
public readonly Closure $transform = trim(...),
) {}
}
This is the missing piece that makes attributes genuinely expressive for validation and transformation rules. Before 8.5, you had to pass class names or string references to attributes and let the framework look them up. Now the callable lives directly in the attribute.
The #[\Deprecated] attribute from 8.4 couldn’t be applied to const declarations. 8.5 adds attribute support for constants generally:
const OLD_LIMIT = 100;
#[\Deprecated('Use RATE_LIMIT instead', since: '3.0')]
const API_TIMEOUT = 30;
const RATE_LIMIT = 60;
ReflectionConstant, a new reflection class in 8.5, exposes getAttributes() so tools can read them. Combined with closures in constant expressions, attributes on constants become a real metadata layer for compile-time values.
PHP 8.3 brought #[\Override] for methods. 8.5 extends it to properties:
class Base {
public string $name = 'default';
}
class Derived extends Base {
#[\Override]
public string $name = 'derived';
}
If the property doesn’t exist in the parent, PHP throws an error. Particularly useful with property hooks from 8.4: you can now signal that a hooked property is intentionally overriding a parent’s.
8.4 introduced asymmetric visibility (public private(set)) for instance properties. 8.5 brings that to static properties too:
class Registry {
public static private(set) array $items = [];
public static function register(string $key, mixed $value): void {
self::$items[$key] = $value;
}
}
echo Registry::$items['foo']; // readable
Registry::$items['bar'] = 1; // Error: cannot write outside class
Straightforward pattern: expose a static collection for reading, block external mutation.
Property promotion in constructors has existed since PHP 8.0. The final modifier on promoted properties was the missing piece, 8.5 adds it:
class ValueObject {
public function __construct(
public final readonly string $id,
public final readonly string $name,
) {}
}
A subclass can’t override $id or $name with a property of the same name. The final readonly combination on promoted properties makes value objects as locked down as possible without sealing the whole class.
Another gap in constant expressions: no type casts. 8.5 allows them:
const PRECISION = (int) 3.7; // 3
const THRESHOLD = (float) '1.5'; // 1.5
const FLAG = (bool) 1; // true
Sounds minor until you have configuration constants derived from environment variables that need type coercion right at the declaration.
Before 8.5, a fatal error (out-of-memory, stack overflow, type error in certain contexts) produced a message with no context about where in the code it happened. Finding the cause meant inserting debug logging and reproducing.
8.5 adds stack backtraces to fatal error messages, in the same format as exception backtraces. A new INI directive, fatal_error_backtraces, controls the behavior. It’s on by default.
PHP has had reset() and end() for accessing the first and last elements of an array since PHP 3. Both mutate the array’s internal pointer (not safe to call on a reference), and they return false for empty arrays in a way that’s indistinguishable from a stored false value.
$values = [10, 20, 30];
$first = array_first($values); // 10
$last = array_last($values); // 30
$first = array_first([]); // null
The new functions return null for empty arrays, don’t touch the internal pointer, and work on any array expression without needing a variable. reset($this->getItems()) was a deprecation warning waiting to happen.
PHP has set_error_handler() and set_exception_handler(). Getting the current handler meant either storing it yourself before setting it, or calling set_error_handler(null) and capturing what came back, which also cleared the handler in the process.
8.5 adds:
$current = get_error_handler();
$current = get_exception_handler();
Handy in middleware chains where you want to wrap the existing handler without losing it, or in tests where you want to verify a handler was actually installed.
Formatting a list with locale-appropriate conjunctions has always needed manual string assembly. 8.5 adds IntlListFormatter:
$formatter = new IntlListFormatter('en_US', IntlListFormatter::TYPE_AND);
echo $formatter->format(['apples', 'oranges', 'pears']);
// "apples, oranges, and pears"
$formatter = new IntlListFormatter('fr_FR', IntlListFormatter::TYPE_OR);
echo $formatter->format(['rouge', 'bleu', 'vert']);
// "rouge, bleu ou vert"
The class wraps ICU’s ListFormatter. Three types: TYPE_AND, TYPE_OR, TYPE_UNITS. Width constants control whether you get “and” or “&”. Oxford comma handling, locale-specific conjunction placement, all handled by ICU.
filter_var() returns false on validation failure, which produces the classic false vs null vs 0 ambiguity when you’re filtering untrusted input. A new flag changes that:
try {
$email = filter_var($input, FILTER_VALIDATE_EMAIL, FILTER_THROW_ON_FAILURE);
} catch (Filter\FilterFailedException $e) {
// explicitly invalid, not ambiguously false
}
The Filter\FilterFailedException and Filter\FilterException classes are new in 8.5. The flag can’t be combined with FILTER_NULL_ON_FAILURE: the behaviors are mutually exclusive.
The backtick operator (`command` as an alias for shell_exec()) is deprecated. It’s an obscure syntax that surprises anyone reading the code and is inconsistent with every other PHP function call.
Non-canonical cast names ((boolean), (integer), (double), (binary)) are deprecated in favor of their short forms: (bool), (int), (float), (string). The long forms have been undocumented for years; 8.5 starts the formal removal.
Semicolon-terminated case statements are deprecated:
// deprecated
switch ($x) {
case 1;
break;
}
// correct
switch ($x) {
case 1:
break;
}
The semicolon form has been syntactically valid since PHP 4 but nobody uses it on purpose. It’s a typo PHP happened to accept.
__sleep() and __wakeup() are deprecated in favor of __serialize() and __unserialize(), which return and receive arrays and compose correctly with inheritance. The old methods had messy semantics around property visibility.
A new startup-only INI directive: max_memory_limit. It sets a ceiling that memory_limit can’t exceed at runtime. If a script calls ini_set('memory_limit', '10G') and max_memory_limit is 512M, PHP warns and caps the value.
Useful in shared hosting environments, or anywhere you want to make sure a bug or a malicious payload can’t convince PHP to raise its own limit and eat the whole machine’s RAM.
In 8.5, Opcache is always compiled into the PHP binary and always loaded. The old situation (Opcache as a loadable extension that might or might not be present depending on build configuration) is gone.
You can still disable it: opcache.enable=0 works fine. What changes is the guarantee that the Opcache API (opcache_get_status(), opcache_invalidate(), etc.) is always available, regardless of how PHP was compiled. Any code that checks extension_loaded('opcache') before calling Opcache functions can drop the check.
*.traefik.me at 127.0.0.1, download a wildcard certificate from the same domain, drop it into Traefik, and every local service gets a clean HTTPS URL with no IP in the address bar. No Let’s Encrypt rate limits, no mkcert to explain to teammates, no self-signed warnings to click through. Just https://myapp.traefik.me and a green padlock.
Then in March 2025, Let’s Encrypt revoked the certificate. The wildcard cert for traefik.me is gone and it’s not coming back.
traefik.me is a wildcard DNS resolver. Type anything.traefik.me and it resolves to 127.0.0.1. Type anything.10.0.0.1.traefik.me and it resolves to 10.0.0.1. No account, no configuration, no infrastructure to maintain. The DNS part still works fine, by the way.
The certificate was the bonus: a wildcard cert for *.traefik.me that pyrou, the maintainer, generated with Let’s Encrypt and distributed at https://traefik.me/cert.pem and https://traefik.me/privkey.pem. It was convenient precisely because it was shared: download, drop into Traefik, done.
Sharing a private key is why it died.
The CA/Browser Forum Baseline Requirements, section 9.6.3, require subscribers to “maintain sole control” over their private key. Distributing it to anyone who visits a URL is the exact opposite of sole control. Let’s Encrypt sent a notice, blocked future issuance for the domain, and revoked the existing certificate. Pyrou confirmed the situation and recommended mkcert as an alternative. The project will live on as a DNS resolver only.
The cert had already been revoked twice before 2025. Third time was the last.
sslip.io is also a wildcard DNS resolver, with one difference: the IP is encoded in the hostname rather than resolved from a fallback. 10-0-0-1.sslip.io resolves to 10.0.0.1. myapp.192-168-1-10.sslip.io resolves to 192.168.1.10. IPv6 works too.
The infrastructure behind sslip.io is also more visible: three nameservers in Singapore, the US, and Poland, handling over 10,000 requests per second, with public monitoring. About 1,000 GitHub stars and active maintenance under the Apache 2.0 licence.
Strip away the certificate story and the comparison is pretty straightforward:
| traefik.me | sslip.io | |
|---|---|---|
| DNS wildcard | yes | yes |
| Fallback to 127.0.0.1 | yes | no |
| IPv6 | no | yes |
| Wildcard certificate | no | |
| Infrastructure | opaque | documented |
| Project activity | stalled | active |
traefik.me’s only remaining advantage is the 127.0.0.1 fallback: URLs without an IP segment. That matters if you really want myapp.traefik.me instead of myapp.127-0-0-1.sslip.io. Whether that difference is worth the infrastructure uncertainty is a short conversation.
mkcert creates a local certificate authority, installs it in the system trust store and whatever browsers it finds, then issues certificates signed by that CA. Browsers see a trusted chain. No warning, no click-through, no “proceed anyway”.
mkcert -install
That’s the one-time setup. After that, generating a certificate is one command:
mkcert "*.127-0-0-1.sslip.io"
# produces _wildcard.127-0-0-1.sslip.io.pem
# _wildcard.127-0-0-1.sslip.io-key.pem
The limitation is that mkcert’s CA is local. Other machines on the network won’t trust it by default. For a solo dev setup that’s fine. For a shared team environment, you’d need to distribute the CA root, which is essentially the same operational problem traefik.me was trying to avoid, just smaller in scope.
The setup is the same regardless of which DNS service you pick. Traefik needs the certificate mounted as a volume and a static file provider pointing at a TLS configuration file.
# traefik/config/tls.yml
tls:
certificates:
- certFile: /certs/cert.pem
keyFile: /certs/key.pem
stores:
default:
defaultCertificate:
certFile: /certs/cert.pem
keyFile: /certs/key.pem
The key practice: run Traefik in its own Compose project, separate from the services it routes to. Each service project connects to Traefik through a shared external network. Start and stop services independently without touching the reverse proxy.
Start by creating the external network once:
docker network create traefik-public
traefik/compose.yml - Traefik alone, owning the network:
services:
traefik:
image: traefik:v3
ports:
- "80:80"
- "443:443"
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- ./config:/etc/traefik/config
- ./certs:/certs
command:
- --entrypoints.web.address=:80
- --entrypoints.websecure.address=:443
- --providers.docker=true
- --providers.docker.network=traefik-public
- --providers.file.directory=/etc/traefik/config
networks:
- traefik-public
networks:
traefik-public:
external: true
Copy the mkcert output into ./certs/, rename to cert.pem and key.pem, then:
docker compose -f traefik/compose.yml up -d
Traefik is up, listening on 80 and 443, watching Docker for new containers. Nothing is routed yet.
whoami/compose.yml - a service that joins the same network:
services:
whoami:
image: traefik/whoami
labels:
- "traefik.enable=true"
- "traefik.http.routers.whoami.rule=Host(`whoami.127-0-0-1.sslip.io`)"
- "traefik.http.routers.whoami.tls=true"
- "traefik.http.routers.whoami.entrypoints=websecure"
networks:
- traefik-public
networks:
traefik-public:
external: true
docker compose -f whoami/compose.yml up -d
Traefik detects the new container via the Docker provider, reads its labels, and adds the route. https://whoami.127-0-0-1.sslip.io responds immediately. Bring whoami down and the route disappears. Traefik keeps running without noticing.
The external: true declaration is the load-bearing line. Without it, Compose creates a project-scoped network: Traefik and whoami end up on different networks and can’t reach each other, even though both are running. The external network is the shared bus every service project must explicitly opt into.
If you prefer traefik.me URLs, replace the mkcert command and the host label:
mkcert "*.traefik.me"
- "traefik.http.routers.whoami.rule=Host(`whoami.traefik.me`)"
The DNS fallback to 127.0.0.1 handles the rest.
The certificate distribution model was always fragile. A “public-private key pair” is a contradiction in terms. Every revocation was a warning that the next one could be permanent. Eventually it was.
The lesson isn’t specific to traefik.me. Any service that provides convenience by quietly removing a security boundary will eventually hit that boundary. mkcert is the right tool for this problem because it operates entirely within your own trust domain: you generate the CA, you install it, you issue the certificates. Nothing depends on a third party’s continued willingness to bend certificate issuance rules.
sslip.io solves the DNS part cleanly. mkcert solves the TLS part cleanly. They compose well. The traefik.me setup was simpler, for a while. Until it wasn’t.
]]>For twenty years, if you wanted behavior on property access in PHP you had to write getters and setters:
class User {
private string $_name;
public function getName(): string { return $this->_name; }
public function setName(string $name): void {
$this->_name = strtoupper($name);
}
}
PHP 8.4 adds hooks directly on the property:
class User {
public string $name {
set(string $name) {
$this->name = strtoupper($name);
}
}
}
You can define get and set hooks independently. A property with only a get hook is computed on access:
class Circle {
public float $area {
get => M_PI * $this->radius ** 2;
}
public function __construct(public float $radius) {}
}
No backing storage, no explicit getter method, full IDE support. Interfaces can declare properties with hooks too, which means contracts can now specify behavior on property access, something that was flat-out impossible before.
A lighter option for when you just want public read, private write:
class Version {
public private(set) string $value = '1.0.0';
}
$v = new Version();
echo $v->value; // works
$v->value = '2.0'; // Error
Kills the private $x + public getX() pattern for read-only public properties without needing full readonly semantics.
$first = array_find($users, fn($u) => $u->isActive());
$any = array_any($users, fn($u) => $u->isPremium());
$all = array_all($users, fn($u) => $u->isVerified());
These have been in every other language’s standard library for decades. In PHP, you had to use array_filter() + index access or write a manual loop. They exist now: array_find(), array_find_key(), array_any(), array_all().
// before
(new MyClass())->method();
// after
new MyClass()->method();
A syntax restriction that was always annoying and never justified is gone.
Objects whose initialization is deferred until first property access:
$user = $reflector->newLazyProxy(fn() => $repository->find($id));
// No database call yet
$user->name; // Now the proxy initializes
The direct audience is framework ORM and DI container authors, not application developers. But the effect shows up in every app that uses Doctrine or Symfony: lazy loading implemented at the language level rather than through code generation.
PHP 8.4 is a language that barely resembles the PHP 5 most of us started with. Property hooks in particular: they’re not a workaround, they’re a design feature.
PHP has emitted deprecation notices for built-in functions for years. 8.4 lets you wire the same mechanism into your own code:
class ApiClient {
#[\Deprecated(
message: 'Use fetchJson() instead',
since: '2.0',
)]
public function get(string $url): string { ... }
}
Calling a deprecated method now emits E_USER_DEPRECATED, just like calling mysql_connect(). IDEs pick it up, static analyzers flag it, the error log captures it. Before this, the only option was a @deprecated PHPDoc comment: fine for IDEs, completely invisible to the engine.
The bcmath functions have been in PHP since forever, but their procedural API makes chaining anything painful. 8.4 adds BcMath\Number, an object wrapper with operator overloading:
$a = new BcMath\Number('10.5');
$b = new BcMath\Number('3.2');
$result = $a + $b; // BcMath\Number('13.7')
$result = $a * $b - new BcMath\Number('1');
echo $result; // 32.6
The +, -, *, /, **, % operators all work. The object is immutable. Scale propagates automatically through operations. Financial calculations, which used to mean chains of bcadd(bcmul(...), ...), now just read like arithmetic.
New procedural functions complete the picture: bcceil(), bcfloor(), bcround(), bcdivmod().
round() has always taken a $mode int from a set of PHP_ROUND_* constants. 8.4 replaces that with a RoundingMode enum with cleaner names and four additional modes that weren’t available before:
round(2.5, mode: RoundingMode::HalfAwayFromZero); // 3
round(2.5, mode: RoundingMode::HalfTowardsZero); // 2
round(2.5, mode: RoundingMode::HalfEven); // 2 (banker's rounding)
round(2.5, mode: RoundingMode::HalfOdd); // 3
// The four new modes (only available via the enum)
round(2.3, mode: RoundingMode::TowardsZero); // 2
round(2.7, mode: RoundingMode::AwayFromZero); // 3
round(2.3, mode: RoundingMode::PositiveInfinity); // 3
round(2.3, mode: RoundingMode::NegativeInfinity); // 2
The old PHP_ROUND_* constants still work. The enum is the path forward.
mb_trim(), mb_ltrim(), mb_rtrim(): trim functions that respect multibyte character boundaries, not just ASCII whitespace. Also new: mb_ucfirst() and mb_lcfirst() for proper title-casing of multibyte strings.
$s = "\u{200B}hello\u{200B}"; // Zero-width spaces
echo mb_trim($s); // "hello"
echo mb_ucfirst('über'); // "Über"
These fill gaps that have been sitting there since mbstring was introduced.
PHP automatically parses application/x-www-form-urlencoded and multipart/form-data into $_POST and $_FILES, but only for POST requests. PATCH and PUT requests with the same content types needed manual parsing with file_get_contents('php://input') and custom code.
// Inside a PATCH handler
[$_POST, $_FILES] = request_parse_body();
The function returns a tuple. Same parsing logic PHP uses for POST, now available for any HTTP method.
The existing DOMDocument API was built on an older DOM level 3 spec with PHP-specific quirks layered on top. 8.4 adds a parallel Dom\ namespace that implements the WHATWG Living Standard:
$doc = Dom\HTMLDocument::createFromString('<p class="lead">Hello</p>');
$p = $doc->querySelector('p');
echo $p->classList; // "lead"
echo $p->id; // ""
$doc2 = Dom\HTMLDocument::createFromFile('page.html');
Dom\HTMLDocument parses HTML5 correctly, tag soup included. Dom\XMLDocument handles strict XML. The new classes are strict about types, return proper node types, and expose modern properties like classList, id, className. The old DOMDocument stays, unchanged, for backward compatibility.
PDO::connect() and direct instantiation now return driver-specific subclasses when available:
$pdo = PDO::connect('mysql:host=localhost;dbname=test', 'user', 'pass');
// $pdo is now a Pdo\Mysql instance
$pdo = new Pdo\Pgsql('pgsql:host=localhost;dbname=test', 'user', 'pass');
Each driver subclass (Pdo\Mysql, Pdo\Pgsql, Pdo\Sqlite, Pdo\Firebird, Pdo\Odbc, Pdo\DbLib) can expose driver-specific methods without polluting the base PDO interface. Doctrine, Laravel, and similar ORMs can now type-hint against the specific driver class when they need driver-specific behavior.
openssl_pkey_new() and related functions now support Curve25519 and Curve448, the modern elliptic curves that have replaced older NIST curves in most security recommendations:
$key = openssl_pkey_new(['curve_name' => 'ed25519', 'private_key_type' => OPENSSL_KEYTYPE_EC]);
$details = openssl_pkey_get_details($key);
x25519 and x448 for key exchange, ed25519 and ed448 for signatures. All four now work with openssl_sign() and openssl_verify().
The bundled PCRE2 library update (10.44) brings variable-length lookbehind assertions, something Perl and Python regex engines had and PHP couldn’t do:
// Match "bar" only when preceded by "foo" or "foooo"
preg_match('/(?<=foo+)bar/', 'foooobar', $matches);
Lookbehind assertions used to require a fixed-width pattern. Now they can match patterns of variable length. The r modifier (PCRE2_EXTRA_CASELESS_RESTRICT) is also new: it prevents mixing ASCII and non-ASCII characters in case-insensitive matches, closing a class of Unicode confusion attacks.
$dt = DateTimeImmutable::createFromTimestamp(1700000000.5);
echo $dt->getMicrosecond(); // 500000
$with_micros = $dt->setMicrosecond(123456);
createFromTimestamp() accepts a float for sub-second precision. getMicrosecond() and setMicrosecond() round out the API for the microsecond component that’s been inside DateTime internally but inaccessible directly.
pow(0, -2) in PHP has historically returned an implementation-defined value. 8.4 deprecates pow() with a zero base and negative exponent and introduces fpow(), which strictly follows IEEE 754: fpow(0, -2) returns INF, as the standard defines:
echo fpow(2.0, 3.0); // 8.0
echo fpow(0.0, -1.0); // INF
echo fpow(-1.0, INF); // 1.0
Worth knowing in any code doing mathematical computations where IEEE compliance matters.
The default cost for password_hash() with PASSWORD_BCRYPT went from 10 to 12. This hits any code calling password_hash($pass, PASSWORD_BCRYPT) without an explicit cost. The goal is to keep the default roughly “a few hundred milliseconds on modern hardware” as hardware gets faster.
If you store bcrypt hashes and upgrade to 8.4, existing hashes stay valid: password_verify() reads the cost from the hash itself. New hashes use cost 12. password_needs_rehash() returns true for old hashes if you pass ['cost' => 12], so you can upgrade them on next login.
Implicitly nullable parameters are deprecated. If a parameter has a default of null, the type has to say so explicitly:
// Deprecated in 8.4
function foo(string $s = null) {}
// Correct
function foo(?string $s = null) {}
function foo(string|null $s = null) {}
trigger_error() with E_USER_ERROR is deprecated: replace it with an exception or exit(). The E_USER_ERROR level was always an awkward hybrid between a recoverable error and a fatal one, and nobody was sure which.
lcg_value() is deprecated too. Use Random\Randomizer::getFloat() instead. The LCG generator had poor randomness properties and no seeding control.
The most visible removal: Doctrine annotations. @Route, @ORM\Column, @Assert - gone. Native PHP attributes have been the recommended approach since Symfony 5.2. 7.0 just makes it official.
The migration from annotations to attributes is mostly mechanical: syntax changes from @ to #[], and the class references move from Doctrine annotation classes to PHP attribute classes:
// before
/** @Route('/users', methods={"GET"}) */
// after
#[Route('/users', methods: ['GET'])]
The real win isn’t just the syntax: attributes are validated by the PHP engine, not a docblock parser. IDEs can resolve them without custom plugins. Static analysis tools understand them natively. No more “it fails silently at runtime because of a typo in a comment.”
Workflow event listeners and guards can now be registered via attributes:
#[AsGuard(workflow: 'order', transition: 'ship')]
public function canShip(Event $event): void
{
if (!$event->getSubject()->isPaymentConfirmed()) {
$event->setBlocked(true);
}
}
The workflow profiler, a dedicated panel showing the current marking and available transitions, is a genuinely useful debugging tool if you’re working with complex state machines.
DatePoint, the immutable DateTime with strict error handling introduced in 6.4, is now the recommended way to work with dates. Combine it with PHP 8.2’s readonly properties and date value objects in domain code become almost trivially clean:
readonly class Order {
public function __construct(
public DatePoint $createdAt,
public ?DatePoint $shippedAt = null,
) {}
}
The full removal list: Doctrine annotations support, the Templating component bridge, ProxyManager bridge, the Monolog bridge for versions below 3.0, and the Sendinblue transport (replaced by Brevo). PHP 8.0 and 8.1 support also ends. 8.2 is the floor now.
Upgrade from 6.4 with all deprecation notices fixed, and 7.0 is smooth. Skip that step and you’re in for a bad time.
Two components that shipped as experimental in 6.3 are now stable: Scheduler and AssetMapper. Stable means locked APIs, no more @experimental caveats, and they show up properly in the upgrade guide. You can actually rely on them now.
Scheduler gets #[AsCronTask] and #[AsPeriodicTask] for attribute-based task registration, runtime schedule modification with heap recalculation, FailureEvent, and a --date option on schedule:debug. AssetMapper adds CSS file support in importmap, an outdated command, an audit command, and automatic preloading via WebLink.
#[AsCronTask('0 2 * * *')]
class NightlyReportMessage {}
#[AsPeriodicTask(frequency: '1 hour')]
class HourlyCleanupMessage {}
#[AutowireLocator] and #[AutowireIterator] landed in 6.4 and graduate to stable in 7.0. They replace the verbose XML/YAML tagged service locator config with something you can just put directly in PHP:
class HandlerRegistry
{
public function __construct(
#[AutowireLocator('app.handler', indexAttribute: 'key')]
private ContainerInterface $handlers,
) {}
}
#[Target] also gets smarter: when a service has a named autowiring alias like invoice.lock.factory, you can now write #[Target('invoice')] instead of the full alias name. Less noise when the type already tells you what you want.
RejectRedeliveredMessageException tells the worker to not retry a message, which is handy when a message arrives twice because of a transport ack timeout and you need exactly-once semantics. messenger:failed:remove --all clears the entire failure transport in one shot, no loop required. Failed retries can also go directly to the failure transport, bypassing the retry queue entirely.
Multiple Redis Sentinel hosts are now supported in the DSN:
redis-sentinel://host1:26379,host2:26379,host3:26379/mymaster
SignalMap maps signal integers to their POSIX names. When a worker catches SIGTERM, the log now says SIGTERM instead of 15. Small thing, real improvement. ConsoleTerminateEvent is dispatched even when the process exits via signal, which wasn’t the case before 7.0.
Command profiling lands too: pass --profile to bin/console and the collected data goes straight into the Symfony profiler, browsable from the web UI.
ChoiceType gets a duplicate_preferred_choices option. Set it to false and you stop showing the same option twice when preferred choices overlap with the full list. FormEvent::setData() is deprecated for events where the data is already locked at that point in the lifecycle. The self-closing slash on <input> elements is also gone: <input> is a void element in HTML5 and the slash was technically invalid.
Enum support in forms is a nice one: ChoiceType renders backed enums directly, and translatable enums get their labels through the translator without any custom wiring.
Response::send() gets a $flush parameter. Pass false to buffer the output without flushing to the client, useful when chaining middleware that needs to inspect the response before it leaves the process.
UriSigner moves from HttpKernel to HttpFoundation, where it belongs semantically. Same class name, different namespace.
Cookies get CHIPS support (Cookies Having Independent Partitioned State), the browser mechanism for cross-site cookies in a first-party partition. Only matters if you build embeddable widgets, but good to know it’s there.
Phrase joins Crowdin and Lokalise as a supported translation provider. Configure it in config/packages/translation.yaml and the translation:push / translation:pull commands handle the sync.
translation:pull gets an --as-tree option that writes translation files in nested YAML rather than flat dot-notation keys. Whether that’s actually better depends entirely on your team.
LocaleSwitcher::runWithLocale() now passes the current locale as an argument to the callback, saving you a getLocale() call inside:
$switcher->runWithLocale('fr', function (string $locale) use ($mailer) {
$mailer->send($this->buildEmail($locale));
});
The Serializer’s Context attribute can now target specific classes, so a single DTO can behave differently during (de)serialization depending on which class holds the context. TranslatableNormalizer lands for normalizing objects that implement TranslatableInterface: the translator is called during normalization, not before.
Crawler::attr() gains a $default parameter. Instead of null-checking the return value, pass a fallback:
$src = $crawler->attr('src', '/placeholder.png');
assertAnySelectorText() and assertAnySelectorTextContains() join the DomCrawler assertion set. They pass if at least one matching element satisfies the condition, rather than requiring all of them to match.
MockResponse now accepts HAR (HTTP Archive) files. Record real HTTP interactions in your browser or with a proxy, drop the .har file in your test fixtures, and replay them:
$client = new MockHttpClient(HarFileResponseFactory::createFromFile(__DIR__.'/fixtures/api.har'));
Much better than writing response stubs by hand when you’re dealing with a complex API.
]]>Modern frontend tooling in Symfony meant Webpack Encore. Encore works: it handles transpilation, bundling, versioning, hot reload. It also requires Node.js, a separate build step, and a non-trivial amount of configuration for what is often a pretty modest frontend.
AssetMapper takes a different position. Modern browsers support ES modules natively. Instead of bundling, ship the files as-is, let the browser resolve imports through an importmap, and manage vendor dependencies through downloaded files rather than npm packages.
composer require symfony/asset-mapper
php bin/console importmap:require lodash
No Node.js. No npm. No build step. JavaScript and CSS files are versioned and served directly, with a digest in the URL for cache busting. For apps where the frontend is not the primary engineering concern, this removes an entire toolchain from the equation.
6.4 adds CSS files to the importmap, automatic CSS preloading via WebLink, and commands to audit and update vendor dependencies. The package.json experience, minus npm.
The Scheduler component (periodic and cron-style task scheduling without an external job runner) exits experimental and becomes stable. The API uses attributes:
#[AsCronTask('0 * * * *')]
class HourlyReport implements ScheduledTaskInterface
{
public function run(): void { ... }
}
Backed by Messenger transports, tasks run in any environment where a worker is running. For many use cases, this replaces the classic cron entry + console command pattern.
Also graduating from experimental: the Webhook component handles incoming webhooks from external services. Instead of writing raw controllers that parse payloads and dispatch events by hand, you configure parsers for known services (Stripe, GitHub, Mailgun) and get typed events.
A new DatePoint class in the Clock component: an immutable DateTime wrapper that throws exceptions on invalid modifiers instead of silently returning false. Small thing, but meaningful for code that manipulates dates and actually wants to know when something goes wrong.
6.4 LTS gets bug fixes until November 2026 and security fixes until November 2027. The path from 6.4 to 7.4 (the next LTS) runs through the 6.4 deprecation notices, as usual.
FQCN-based route aliases are now generated automatically. If a controller method has a single route, Symfony creates an alias using its fully qualified class name:
// Previously: only 'blog_index' worked
// Now: both work identically
$this->urlGenerator->generate('blog_index');
$this->urlGenerator->generate(BlogController::class.'::index');
For invokable controllers, the alias is just the class name. The practical benefit is IDE navigation and refactoring safety: you’re referencing a class constant, not a string that can silently drift.
#[AutowireLocator] and #[AutowireIterator] join the DI attribute family. Instead of configuring service locators and tagged iterables in YAML, you just declare them on constructor parameters:
public function __construct(
#[AutowireLocator([FooHandler::class, BarHandler::class])]
private ContainerInterface $handlers,
) {}
Aliases, optional services (prefixed with ?), and parameter injection via SubscribedService are all supported. The locator lazy-loads, so only the handlers you actually call get instantiated.
Three new message classes cover common tasks that previously required custom handlers.
RunProcessMessage dispatches a Process command through the bus. RunCommandMessage does the same for console commands. Both return a context object with the exit code and output. PingWebhookMessage pings a URL, which is useful for monitoring scheduled tasks without spinning up a dedicated health-check service:
$this->bus->dispatch(new RunCommandMessage('cache:clear'));
$this->bus->dispatch(new PingWebhookMessage('GET', 'https://healthchecks.io/ping/abc123'));
The subprocess inheritance problem also got addressed with PhpSubprocess. When you run PHP with a custom memory limit (-d memory_limit=-1), child processes launched with Process don’t inherit it. PhpSubprocess does:
$sub = new PhpSubprocess(['bin/console', 'app:heavy-import']);
The profiler now shows how security badges were resolved during authentication: which ones passed, which failed, and why. Before, you had to add debug output manually when a custom authenticator wasn’t behaving.
Login throttling via RateLimiter now hashes PII in logs automatically. IP addresses and usernames get hashed with the kernel secret before they’re written. No config needed, no regex on log lines.
Firewall patterns now accept arrays:
firewalls:
no_security:
pattern:
- "^/register$"
- "^/api/webhooks/"
No more regex gymnastics for multi-path exclusions.
The logout route used to require a controller that did nothing but throw an exception, with a comment explaining that yes, this is intentional. 6.4 eliminates that:
# config/routes/security.yaml
_security_logout:
resource: security.route_loader.logout
type: service
The route loader handles it. The dummy controller is gone. Flex updates the recipe.
Three serializer improvements that each solve a real problem.
Class-level #[Groups] attribute: apply a group to the entire class, then override per property. Useful when a resource has a default serialization group and a few fields that need finer control.
Translatable objects now have a dedicated normalizer. Translatable strings (wrapping Doctrine’s TranslatableInterface) get translated to the locale passed via NORMALIZATION_LOCALE_KEY during normalization. Before this, you had to write a custom normalizer.
In debug mode, JSON decoding errors now use seld/jsonlint for better messages. Instead of “Syntax error”, you get the line and what actually went wrong:
Parse error on line 1: {'foo': 'bar'}
^ Invalid string, used single quotes instead of double quotes
The command profiler extends the existing profiler to console commands. Add --profile to any command and get a full profiler entry: input/output, execution time, memory, database queries, log messages. Commands that used to need --verbose plus manual timing now have the same debugging experience as HTTP requests.
The workflow profiler does the same for state machines. A new panel shows a graphical representation of your workflows and which transitions fired during the request. Zero configuration.
Several smaller additions that compound.
renderBlock() and renderBlockView() on AbstractController let you render a named Twig block and return it as a Response or string. Handy for Turbo Stream responses where you want to update a fragment without a full controller action.
The defined env var processor returns a boolean rather than the value: true if the variable exists and is non-empty, false otherwise. Useful for feature flags driven by environment variables:
parameters:
is_feature_enabled: '%env(defined:FEATURE_FLAG_KEY)%'
HttpClient now accepts max_retries per request, overriding the global retry strategy. The Finder component’s filter() method accepts a second argument to prune entire directories early, which matters when you’re searching large trees.
The BrowserKit click() method now accepts server parameters as extra headers, useful in functional tests that need to simulate authenticated API calls while following links.
Two new Twig helpers: impersonation_path() and impersonation_url(). They generate the correct URLs including the switch-user query parameter, which is configurable and has no business being hardcoded in templates. Pair them with the existing impersonation_exit_path() for the full admin impersonation flow.
Three gaps filled. TemplatedEmail now has a locale() method for rendering emails in the recipient’s language. The locale switcher’s runWithLocale() now passes the locale as an argument to the callback, so you don’t have to capture it from the outer scope. And app.enabledLocales is available in Twig, so you can build language switchers without hardcoding locale lists.
APP_BUILD_DIR is now an environment variable recognized by the kernel. Set it to redirect compiled artifacts (router cache, Doctrine proxies, preloaded translations) to a directory that exists, even when the default cache directory doesn’t. The MicroKernelTrait uses it automatically. The WarmableInterface gained a $buildDir parameter to support this separation: custom cache warmers that write read-only artifacts should update accordingly.
Class constants have been untyped since their introduction. PHP 8.3 fixes that:
interface HasVersion {
const string VERSION;
}
class App implements HasVersion {
const string VERSION = '1.0.0';
}
Without typed constants, an interface constant could be overridden with a completely different type in an implementing class and nothing would complain. Typed constants close that gap, and on interface-driven codebases the impact is immediate.
A gap that required a workaround since constants were introduced:
$name = 'STATUS';
echo MyClass::{$name}; // now works
Before, accessing a constant with a dynamic name meant calling constant('MyClass::STATUS'). The new syntax is consistent with how PHP already handles variable variables and dynamic method calls.
A specific but genuinely annoying limitation of 8.1 readonly: you couldn’t clone an object and change a readonly property. 8.3 adds the ability to reinitialize readonly properties during cloning, which makes immutable value objects usable in a lot more patterns.
if (json_validate($string)) {
$data = json_decode($string);
}
Before 8.3, the only way to validate a JSON string was to decode it and check for errors. json_validate() checks without allocating the decoded structure, which matters when you only need to know if the string is valid JSON, not what’s in it.
getBytesFromString() generates a random string composed only of characters from a given set:
$rng = new Random\Randomizer();
$token = $rng->getBytesFromString('abcdefghijklmnopqrstuvwxyz0123456789', 32);
The previous approach: str_split, array_map, random selection, implode. It worked, but it was longer than it had any right to be.
8.3 is for the teams that adopt PHP versions quickly and want the incremental improvements. The typed constants alone are worth it on any codebase with interface constants.
Before 8.3, nothing stopped you from writing a method you thought was overriding a parent’s, when you had a typo in the name or the parent had quietly removed it. Silent bugs, zero feedback from the engine.
class Cache {
#[\Override]
public function get(string $key): mixed {
// Engine verifies this method exists in a parent or interface
}
}
If the method doesn’t exist in any parent class or implemented interface, PHP throws an error. Same concept as Java’s @Override or C#’s override, finally in PHP.
Traits have always had rough edges in PHP’s OOP model. One specific problem: a class using a trait could override any of its methods, undermining whatever guarantees the trait was trying to provide. 8.3 lets the trait itself mark a method as final:
trait Singleton {
final public static function getInstance(): static {
// ...
}
}
Now a class using the trait cannot override getInstance(). The guarantee holds.
PHP 8.1 brought readonly classes. Anonymous classes were left out for some reason. 8.3 fixes that:
$point = new readonly class(3, 4) {
public function __construct(
public float $x,
public float $y,
) {}
};
Handy when you need a throwaway immutable value object without the ceremony of naming it.
A small but long-standing restriction: static variable initializers only accepted constant expressions, no function calls. 8.3 drops that constraint:
function connection(): PDO {
static $pdo = new PDO(getenv('DATABASE_URL'));
return $pdo;
}
The initializer runs once on first call, the static variable persists. Achievable with a null-check before, this is just cleaner.
str_pad() has always been byte-aware, not character-aware. For multibyte strings (Arabic, Japanese, accented characters) it produced wrong output. 8.3 finally adds the multibyte variant:
$padded = mb_str_pad('日本', 10, '*', STR_PAD_BOTH);
The function respects character boundaries, not byte counts.
PHP’s ++ operator on strings has a history of quirks: it increments letter sequences ('a' → 'b', 'z' → 'aa'), but -- never worked symmetrically. The behavior was surprising enough that 8.3 deprecates ++/-- on non-alphanumeric strings and introduces explicit functions:
echo str_increment('a'); // b
echo str_increment('Az'); // Ba
echo str_decrement('b'); // a
echo str_decrement('Ba'); // Az
The functions make the intent obvious and the behavior predictable.
8.3 fills in the float side of the Randomizer API:
$rng = new Random\Randomizer();
// A float in [0.0, 1.0)
$f = $rng->nextFloat();
// A float in a specific range with controlled boundary inclusion
$f = $rng->getFloat(1.5, 3.5, Random\IntervalBoundary::ClosedOpen);
IntervalBoundary is a new enum with four values: ClosedOpen, ClosedClosed, OpenClosed, OpenOpen. This matters for statistical correctness: the naive approach of rand() / getrandmax() doesn’t produce a uniform distribution over floats.
Date/time errors in PHP used to throw generic exceptions with no way to tell “malformed string” from “invalid timezone” without parsing the message yourself. 8.3 adds a proper hierarchy:
try {
new DateTimeImmutable('not a date');
} catch (DateMalformedStringException $e) {
// specifically a parsing failure
} catch (DateException $e) {
// other date-related errors
}
The full tree: DateError (engine-level), DateException (base), with specific subclasses for invalid timezone, malformed interval string, malformed period string, and malformed date string.
gc_status() now returns eight additional fields: running, protected, full, buffer_size, and timing breakdowns (application_time, collector_time, destructor_time, free_time). If you’re profiling memory pressure or GC pauses, this data was previously unavailable without pulling in an extension.
strrchr() (find the last occurrence of a character, return from there to end) now accepts a $before_needle boolean, matching the API of strstr():
$path = '/var/www/html/index.php';
echo strrchr($path, '/', before_needle: true); // /var/www/html
echo strrchr($path, '/'); // /index.php
A function that’s been in PHP since 1994, finally consistent with its sibling.
get_class() and get_parent_class() without arguments now emit deprecation notices. The argumentless forms relied on implicit $this context, which was easy to misread. Pass the object explicitly.
assert_options() and the ASSERT_* constants are deprecated in favor of the zend.assertions INI directive, which is the right tool for controlling assertion behavior across environments.
The ++/-- operators on empty strings and non-numeric non-alphanumeric strings now emit deprecation warnings. The behavior was undefined territory. 8.3 starts the migration toward defined behavior in 9.0.
Two new INI directives: zend.max_allowed_stack_size sets a hard limit on PHP’s stack depth, and zend.reserved_stack_size sets aside a buffer for cleanup after a limit is hit. Before 8.3, deeply recursive code could just crash at the OS level. Now PHP catches it and throws an Error with a useful message.
PHP has always allowed adding properties to objects that weren’t declared in the class:
class User {}
$user = new User();
$user->name = 'Alice'; // no declaration, no error... until now
In 8.2, this triggers a deprecation notice. In PHP 9.0 it becomes a fatal error. The grace period exists, but the migration clock is running.
The reasoning is solid: dynamic properties are a classic source of typos that silently pass (write $user->nmae and PHP just creates a new property instead of complaining). Explicit declarations make the class contract clear and make tooling actually useful.
Migration is mostly mechanical: declare the properties, or slap #[AllowDynamicProperties] on legacy classes you can’t touch yet.
8.1 added readonly for individual properties. 8.2 adds it to the class declaration itself:
readonly class Point {
public function __construct(
public float $x,
public float $y,
public float $z,
) {}
}
All promoted and explicitly declared properties become readonly automatically. Value objects (coordinates, money amounts, identifiers) are the obvious target. The syntax is clean and the intent reads clearly.
One constraint: readonly classes can’t have non-typed properties, which were already a bad idea with readonly anyway.
Disjunctive Normal Form types let you combine union and intersection types:
function process(Countable&Iterator|null $collection): void { ... }
(Countable&Iterator)|null: an object that implements both interfaces, or null. This covers type expressions that 8.0 union types and 8.1 intersection types each got partway to but couldn’t represent together.
A dedicated Random extension replaces the scattered rand(), mt_rand(), random_int() functions with an object-oriented API:
$rng = new Random\Randomizer();
$rng->getInt(1, 100);
$rng->shuffleArray($items);
Engines are swappable: Mersenne Twister, PCG64, Xoshiro256StarStar, or CryptoSafeEngine for security-sensitive contexts. Same code, seeded deterministic engine in tests, cryptographic engine in production.
8.2 is a consolidation release. The dynamic properties deprecation is the one decision you need to make now.
null, false, and true as standalone typesPHP has had nullable types since 7.1 and union types since 8.0, but null as a standalone type declaration wasn’t valid. 8.2 fixes that:
function alwaysNull(): null {
return null;
}
function disabled(): false {
return false;
}
function enabled(): true {
return true;
}
false and true as standalone types are useful when you need to be precise about what a function can actually return. It’s narrow but correct: a function that returns false on failure and a string on success should declare string|false, and now both sides of that union are real types.
Traits could hold properties and methods. Constants were the odd gap. 8.2 closes it:
trait Timestamps {
public const DATE_FORMAT = 'Y-m-d H:i:s';
public function formatCreatedAt(): string {
return $this->createdAt->format(self::DATE_FORMAT);
}
}
class Article {
use Timestamps;
}
echo Article::DATE_FORMAT; // 'Y-m-d H:i:s'
The constant belongs to the class that uses the trait, not the trait itself, so you can’t access Timestamps::DATE_FORMAT directly. Expected scoping behavior, consistent with how trait methods already work.
#[SensitiveParameter]Stack traces have always been a liability: function arguments get logged verbatim, which means passwords and tokens end up in your error logs and monitoring dashboards. 8.2 adds an attribute to stop that:
function authenticate(
string $user,
#[\SensitiveParameter] string $password,
): bool {
// if this throws, the stack trace shows:
// authenticate('alice', Object(SensitiveParameterValue))
return hash('sha256', $password) === getStoredHash($user);
}
The parameter value in the trace gets replaced with a SensitiveParameterValue object. One attribute, zero excuses not to add it to every function that touches credentials.
Two ways to interpolate expressions inside strings are deprecated in 8.2:
$name = 'world';
// These are deprecated:
echo "Hello ${name}"; // use "$name" or "{$name}"
echo "Hello ${getName()}"; // use "{$this->getName()}"
The ${...} forms created ambiguity between variable variables and expressions. The cleaner {$...} syntax has always been there and does the same thing. This is mostly a search-and-replace job in codebases that picked up the deprecated forms out of habit.
utf8_encode() and utf8_decode() deprecatedThese two functions are deprecated in 8.2 and gone in 9.0. Their behavior was always narrower than the names suggested: utf8_encode() converts ISO-8859-1 to UTF-8, not “any encoding to UTF-8.”
// Deprecated in 8.2:
$utf8 = utf8_encode($latin1String);
// Use instead:
$utf8 = mb_convert_encoding($latin1String, 'UTF-8', 'ISO-8859-1');
mb_convert_encoding() or iconv() handle the general case. If you’re actually dealing with Latin-1 input, the replacement is a direct swap.
Several string functions silently varied behavior based on the system locale, producing different results in production versus a dev container. In 8.2, they’re locale-independent and ASCII-only:
// strtolower, strtoupper, stristr, stripos, strripos,
// lcfirst, ucfirst, ucwords, str_ireplace now do ASCII case conversion only.
// For locale-aware behavior, use mb_* equivalents:
$lowered = mb_strtolower($text, 'UTF-8');
This is a correctness fix. If your code was relying on locale-sensitive behavior from these functions, it was already broken on systems with different locale configurations. 8.2 makes the behavior deterministic everywhere, which is what you actually wanted.
str_split() on empty stringA quiet behavior change worth noting:
// PHP 8.1: str_split('') === ['']
// PHP 8.2: str_split('') === []
The new behavior makes more sense: splitting nothing produces nothing. If you’re checking count(str_split($input)), an empty input no longer produces a count of 1.
The setup made sense at the time. One VM per project, provisioned with shell scripts or Ansible, shared via a versioned Vagrantfile. Onboarding was theoretically vagrant up and you’re done.
In practice, it was vagrant up, wait four minutes, watch the provision fail on a package that changed its download URL, fix it, reprovision, wait again. Vagrantfiles accumulated configuration over time: workarounds for specific machines, OS version pinning, memory tweaks for the team member whose laptop had 8GB. The files became historical documents nobody wanted to touch.
The VM itself was the other problem. Booting took time. Running took memory and CPU that could have gone to the application. File syncing between host and guest added latency that made PHP apps feel slower than they had any right to be. The overhead was significant for what was ultimately just “run a web server.”
We lived with it because everyone did. Vagrant was the standard for local PHP development, and the alternative (each developer managing their own LAMP stack) was clearly worse.
The shift wasn’t a decision we made. It was a project that arrived already containerized.
A new client project had a docker-compose.yml at the root, a Dockerfile, and a README that said docker compose up. We ran it. The containers started in seconds. PHP-FPM, nginx, PostgreSQL, Redis: all running, all networked, no provisioning step. Stop the containers, start them again, same state.
The contrast with our Vagrant setup was immediate. Not faster by a percentage: faster by a different order. And the Compose file was actually readable: each service, its image, its volumes, its environment variables, its dependencies. Compared to a provision script that SSHed into a VM and ran apt-get, this was legible.
We migrated everything. Not gradually, all at once, over a sprint. Every project got a docker-compose.yml. Every Vagrantfile was deleted. The transition was the most painful three weeks of infrastructure work I remember, and also the most clearly worth it.
Beyond the speed, Compose changed the mental model. Vagrant abstracted a machine. Compose abstracted a set of processes. The distinction matters: with Compose, you can stop the database without stopping the application server, scale a worker service independently, swap the PostgreSQL image for a newer version without touching anything else.
The services declaration also replaced the VM provisioning problem entirely. If a new developer joins, they don’t run a provision script that may or may not work on their OS version. They run docker compose up and get the exact same images everyone else runs.
CI/CD got simpler too. The same docker-compose.yml that ran locally could run in the pipeline. The environment parity that Vagrant promised but rarely delivered was actually real with Compose.
For years, the command was docker-compose: a separate binary, installed independently from Docker itself, written in Python, versioned independently. We used it, it worked, nobody thought much about it.
At some point a colleague mentioned that Docker had integrated Compose directly into the docker CLI. The new command was docker compose, no hyphen, Go rewrite, bundled with Docker Desktop. The old docker-compose binary was deprecated.
We had been using v1 for two years after v2 shipped. Our CI scripts, our Makefiles, our documentation all said docker-compose. Nothing had broken because Docker maintained the old binary for a long time. But the ecosystem had moved on quietly, and we’d missed it.
The migration was trivial: a hyphen removed from every script, a few aliases updated. The lesson was less trivial. Infrastructure tooling evolves without ceremony. The announcement happened, the blog posts were written, the deprecation notices were there. We just weren’t paying attention.
Looking back across Vagrant → docker-compose → docker compose, the pattern is less about the tools and more about the defaults.
Vagrant defaulted to “it works on my VM.” The overhead of sharing that VM was permanent.
Compose defaulted to “it works in these containers.” The images are the artifacts; the host machine is irrelevant.
The hyphen between docker and compose was always cosmetic. What mattered was the shift from provisioned machines to declarative services. That shift happened the day we ran a project someone else containerized and realized we never wanted to go back.