PHP digest — 13 October 2026

A quiet day with two developments: merged Symfony 8.2 development work and a new RFC, which was requested in the morning and opened for discussion in the evening. There were no other RFC status changes and no PHP releases. laravel/framework v13.36.0 was also tagged that day; it appeared in the daily package collection on 14 October and is covered in the 14 October digest.

Symfony 8.2: POST-only logout helpers, response-less logout and OIDC back-channel logout

New in Symfony 8.2: Safer and More Flexible Logout describes three changes:

• Browsers, link-preview bots, security scanners and proxies can follow a GET logout link on their own. To support a logout route restricted to methods: [POST], Symfony 8.2 adds a logout_form() Twig function (form action plus hidden fields, including the CSRF token when enabled) and a LogoutUrlGenerator::getLogoutForm() method for PHP code. It also adds a logout_button() Twig function that renders the whole form. The post says the button's CSRF field also works with stateless CSRF protection. For impersonation restricted to POST, it adds impersonation_button() and impersonation_exit_button(); the exit button renders nothing when the user is not impersonating anyone (#65129, #65124, #66786).
• Setting the firewall's logout.target option to null disables the redirect after logout. The request then reaches the logout route's controller, which can build the response. Before this change a custom logout response needed an event listener (#46320).
• The OpenID Connect login added in 8.2 supports OpenID Connect Back-Channel Logout (backchannel_logout: true or a path/cache/lifetime map). Symfony verifies the provider's signed logout token, stores the ended session in a cache pool and logs the user out on their next request. The post states the limits: stateful firewalls only, and the cache pool must be shared by all servers and must not evict items before they expire (#66196).

The pull requests were not inspected. Symfony 8.2 is not released, so names and behavior may still change.

Opt-in JSON comments and trailing commas: RFC created and under discussion

On 13 October (09:49 UTC) the author of a pre-RFC asked for RFC karma to create the RFC "Opt-in JSON Comments and Trailing Commas" at wiki.php.net/rfc/json_comments_trailing_commas. A reply at 10:46 UTC says RFC karma was granted. The RFC page (version 1.0, Under Discussion) was created later that day, and the author opened the discussion at 18:36 UTC. The official RFC index lists it as under discussion. There is no vote date. See the RFC page in this wiki.

The RFC, like the pre-RFC thread, proposes two independent flags for PHP 8.7, JSON_ALLOW_COMMENTS and JSON_ALLOW_TRAILING_COMMAS. Both would be accepted by json_decode() and json_validate(), and strict JSON would stay the default. The RFC would have two primary votes, so either flag could be accepted on its own. In the thread, a reply notes that the combination matches JSONC/JWCC rather than JSON5. Another reply suggests a single JSON_ALLOW_JSONC flag instead of two separate flags. The RFC keeps two flags and lists the single flag under rejected features. It gives as reasons that the JSONC specification is a draft and makes trailing commas optional. Tim Düsterhus, who proposed the single flag, replied that the rejection is "well-argued". Larry Garfield wrote "I have no remaining objections to it." Each flag gets its own 2/3 vote.

According to the draft implementation (a draft pull request labelled "ABI break"), comments are // and non-nesting /* … */ at JSON whitespace boundaries and never inside a token or string. A trailing comma is allowed only after the last element or member of a nonempty array or object, so [,], {,} and [1,,] stay invalid. Neither flag applies to json_encode(). The pull request notes that php-src #22473 uses the same flag bit values (1 << 23, 1 << 24) for proposed duplicate-key flags, and that whichever pull request is merged second must move its flags to other bits. The RFC states that no other JSON_* flag uses these bits; the pull request's note concerns the unmerged #22473. This is a proposal, not accepted or implemented behavior.

Coverage

At 22:01 UTC the 24 due feed and index sources were collected successfully. The 19 daily package and adoption sources were collected at 04:01 UTC and were not due again. health --fail-stale reports all 43 sources ok and none stale. The official RFC index now has 951 entries; the only change is the new json_comments_trailing_commas entry (discussion). end_pear_endorsement and reldateformatter are voting. Package and WordPress observations were not compared, because no baseline comparison has been defined. The 12 October releases (PHPUnit 13.4.2/12.5.39, Pest 5.3.2) are covered in the 12 October digest.