Symfony 7.4

Apply the PHP 8.4 baseline first. These rules cover the Symfony 7.4 LTS line, which requires PHP 8.2 or later. Read each release range against the installed version of the component that owns the API, because Symfony does not tag every component in every patch release.

Requests, forms, and validation

• Bind requests to narrow DTOs or form types and never map arbitrary request data directly to entities. Use #[MapRequestPayload(acceptFormat: 'json')] for JSON endpoints and explicit format allowlists elsewhere; keep Symfony Validator enabled and set the operation's validationGroups. Installing a YAML encoder must not make YAML an accepted request format by accident.
• Define form fields explicitly, keep protected values mapped=false, and retain allow_extra_fields=false so undeclared input fails rather than disappearing silently.
• Require $form->isSubmitted() && $form->isValid() before persisting form data or performing side effects.
• Apply validators to lengths, ranges, formats, collections, files, and cross-field invariants. Set validationFailedStatusCode deliberately for mapped arguments; MapRequestPayload defaults to 422 and MapQueryString to 404.
• Reject extra fields where ambiguity or mass assignment could change protected state. Keep Serializer groups, #[Ignore], class maps and output DTOs application-owned so hashes, tokens and internal audit fields stay out of responses.
• Bound request bodies, forms, multipart data, files, pagination, nesting, and validation work before mapping or collecting denormalization errors.
• Keep