Symfony 8.1

Apply the PHP 8.5 baseline first. These rules cover the Symfony 8.1 line. Read each release range against the installed version of the component that owns the API, because Symfony does not tag every component in every patch release.

Requests, forms, and validation

• Bind requests to narrow DTOs or form types and never map arbitrary request data directly to entities. Set explicit accepted formats and validation groups for #[MapRequestPayload]; installing another encoder must not silently enable an unwanted input format.
• Define form fields explicitly, omit protected entity fields, and retain allow_extra_fields=false so undeclared input fails rather than disappearing silently; mapped=false only disables automatic object mapping and does not make submitted values trusted.
• Apply validators to lengths, ranges, formats, collections, files, and cross-field invariants. Persist form data only after isSubmitted() and isValid() succeed; handleRequest() can mutate the bound object before validation, so keep that state out of side effects until accepted.
• Reject extra fields where ambiguity or mass assignment could change protected state; for Serializer-backed DTOs set AbstractNormalizer::ALLOW_EXTRA_ATTRIBUTES => false, because the default is true, and supply the required class metadata factory. Keep type enforcement enabled, use application-owned groups and #[Ignore], and never commit the partial object from PartialDenormalizationException.
• For FormFlow, authorize the current flow and accumulated data on each request. Require isSubmitted(),