Symfony 5.4

Apply these rules when writing or reviewing Symfony 5.4 applications on PHP 8.4, after the included PHP baseline. Apply component-specific rules wherever those components are installed.

Version scope and deployment

• Plan migration before this line's security support ends in February 2029; its regular bug-fix support has already ended.
• Audit the resolved Composer packages, including Twig and optional bundles, with symfony check:security. Symfony doesn't tag every component in every patch release, so split packages such as symfony/http-client, symfony/security-http, and symfony/runtime carry their own patch numbers; update every installed symfony/* package together with composer update "symfony/*" and check each one against Symfony's advisories by its own version, not the framework's.
• Set APP_ENV=prod and APP_DEBUG=0 for the web runtime, console deployment commands, cache warmup, and workers. Disable register_argc_argv in the web SAPI and keep the Runtime component patched; production flags must come from deployment configuration.
• Serve only public/ as the document root, route application requests through public/index.php, and exclude development bundles from production. Limit runtime write access to required storage such as var/cache/, var/log/, and the upload store.

Requests, forms, and deserialization

• Read input from the intended Request bag, such as query, request, or files; use Request::toArray() for JSON and handle decoding failures. Apply Validator constraints to the resulting values or DTOs before use; bag