Symfony released the second beta of its 8.2 branch on November 13, 2026, the last milestone before the stable release expected the same month. Beyond routine fixes, this beta changes how login throttling and OIDC/OAuth2 token validators behave, two points that teams relying on SecurityBundle should check before upgrading.
A technical beta, not just a calendar step
Beta 2 ships no major new feature: most of the fixes touch Cache, HttpClient, Messenger, Security, Serializer, TypeInfo, and Routing. A few additions stand out, such as PropertyInfo now inheriting PHPDoc types across parent classes, interfaces, and traits, and TypeInfo resolving generics declared through @extends and @implements.
Behavior changes worth anticipating
Three changes directly affect application security. First, login throttling now counts attempts before credentials are even checked, changing the blocking mechanics for accounts targeted by credential stuffing. Second, IPv6 attempts are now limited per /64 block rather than per address, a necessary adjustment given how easily IPv6 addresses can be rotated. Finally, OIDC and OAuth2 token handlers now default their audience to the resource defined in resource metadata.
On the Mailer side, bridges negotiating a STARTTLS connection now require TLS to actually succeed, and the Sweego and AhaSend bridges no longer send Bcc addresses as a header. On the HttpClient side, CurlHttpClient no longer resends the request body on redirects, fixing a potentially risky behavior against third-party APIs.
| Item | Detail |
|---|---|
| Version released | 8.2.0-BETA2 |
| Release date | November 13, 2026 |
| Expected stable release | November 2026 |
| Minimum PHP required | PHP 8.4.0 |
| End of maintenance | July 2027 |
To test the beta on an existing project, the procedure is the same as for any Symfony pre-release:
composer config minimum-stability beta
composer config extra.symfony.require "8.2.*"
composer updateWhat this means for back-end teams
Projects exposing OIDC or OAuth2 authentication, or applying custom login throttling, should test this beta on a staging environment before switching to stable. Hardening a WordPress stack or a custom API follows the same upfront-verification logic, as covered in this WordPress hardening guide.
Login attempts are now counted before credentials are checked, and IPv6 attempts are limited per whole block rather than per address.
NoPrivateNetworkHttpClient should also double-check their rules: the allow-list behavior was corrected in this beta and may now block calls that previously went through.Timeline and compatibility
Symfony 8.2 requires PHP 8.4 at minimum and will be maintained until July 2027. The window between Beta 2 and the stable release stays short: maintainers of third-party bundles should run their test suites now, especially those depending on SecurityBundle, Mailer, or HttpClient.
Key takeaways
Symfony 8.2 is entering its final stretch before the stable release in November 2026. The changes aren’t flashy, but three of them directly affect production security: how login attempts are counted, per-block IPv6 limiting, and aligning OIDC/OAuth2 tokens with the resource. A rollout that deserves a staging pass rather than a blind upgrade.
On the Symfony projects I keep in production, the login-throttling counting change is exactly the kind of detail that silently breaks a poorly calibrated monitoring setup. Before any major or minor version bump on an authentication stack, I always replay brute-force scenarios in staging: it’s quick, and it avoids surprises on the day rate limiting kicks in earlier than expected. — Simon Janvier
Further reading: the official Symfony 8.2.0-BETA2 announcement.
