Symfony in late 2026: 8.2, two LTS lines, and what Moodle uses

Symfony is the PHP framework most people use without knowing it. If you run Laravel or Drupal, Symfony code handles your HTTP requests. If you run Moodle 5.3, Symfony code now sits behind part of your command line.

This post covers where Symfony stands at the end of October 2026: the versions, the release due in November, the ecosystem news, and what any of it means if your world is Moodle.

Twenty-one years in three paragraphs

Symfony started at SensioLabs, a French agency, as an internal framework. Fabien Potencier released it as free software in October 2005 under the MIT licence, according to Wikipedia’s history of the project.¹1 Wikipedia, Symfony.

The big change was Symfony 2, released in July 2011.²2 Symfony, Symfony releases. It was rebuilt as a set of standalone components: HttpFoundation for requests and responses, Routing, EventDispatcher, DependencyInjection, Console, Yaml and more. Each one could be installed on its own. That decision is why Symfony matters far outside its own user base.

Other projects took the parts they needed. Symfony’s own project pages list 23 Symfony packages used by Laravel,³3 Symfony, Laravel: Symfony packages used by this project. including HttpFoundation, HttpKernel, Routing, Console, Mailer and EventDispatcher. Drupal uses 20,⁴4 Symfony, Drupal: Symfony packages used by this project. including DependencyInjection, Validator and Serializer. Wikipedia also lists phpBB among the large applications built on Symfony components. So a Laravel app, a Drupal site and a Symfony app run a lot of the same code underneath.

The release calendar

Symfony runs on a fixed clock. The release process page⁵5 Symfony, The Symfony release process. sets it out:

• A minor version every six months, in May and November.
• A major version every two years, in November of odd years.
• Each version gets four months of development and two months of stabilization, used “to fix bugs, prepare the release, and wait for the whole Symfony ecosystem … to catch up.”
• Standard versions get 8 months of fixes. The last minor of each major (X.4) is the LTS: 3 years of bug fixes, 4 years of security fixes.
• New minors add deprecations but no breaking changes. The major release removes what was deprecated.

That last rule is the useful one. You upgrade to the final minor of a line, fix every deprecation notice, and the jump to the next major is mostly done.

Versions and support as of 28 October 2026

From symfony.com/releases:²

What this means in practice:

1. 8.1 is the current stable version. As of 28 October its latest patch is 8.1.9. It is the version the Symfony site recommends for new projects.
2. 7.4 is the LTS to be on. It shipped alongside 8.0 in November 2025 and gets security fixes until November 2029.
3. 6.4 LTS stops getting bug fixes in November 2026. It moves to security fixes only, ending November 2027.
4. The whole 8.x line needs PHP 8.4. 7.4 runs on PHP 8.2 and up. This matters later in the post.

By the published rules, the 8.x line ends with 8.4 as its LTS, and the next major comes in November 2027.

Symfony 8.2: due in November

Symfony 8.2 is listed as “under development” with a November 2026 release date.⁶6 Symfony, Symfony 8.2 release. As of 28 October 2026 no 8.2 beta had been tagged on GitHub;⁷7 GitHub, symfony/symfony tags, checked 28 October 2026. for comparison, 8.1 went through three betas and one release candidate before 8.1.0. The weekly roundup for 19 to 25 October describes the work as “polishing and fixing” the new features.⁸8 Symfony Blog, A Week of Symfony #1034: October 19 to 25, 2026.

The “New in Symfony 8.2” series has been running daily on the Symfony blog.⁹9 Symfony Blog, Living on the edge: Symfony 8.2. The items that stand out:

• Encrypted Doctrine columns: mark an entity property with #[Encrypted] and it is stored encrypted.
• Locking controllers: a #[Lock] attribute rejects or delays concurrent requests to the same controller.
• Messenger inbox: skips messages already processed, even if the worker crashed before acknowledging them.
• Compiled event dispatcher: listeners are compiled into a PHP array to cut setup time and memory.
• Attribute-based workflows: define workflows and state machines with attributes on a plain class.
• A new JsonSchema component. More on that below.

Features in development “can be reverted if it won’t be finished in time,” so treat this as a preview until 8.2.0 ships.⁵

What 8.1 added in May

Symfony 8.1 came out at the end of May 2026. Fabien Potencier’s curated list¹⁰10 Symfony Blog, Symfony 8.1 curated new features. runs to 24 items. A few that change daily work:

• HTTP-less applications: the full dependency injection container without HttpKernel.
• A new Tui component for full-screen terminal interfaces.
• HttpClient changes: persistent cURL connections, a Guzzle handler and an SSRF allow-list.
• A RateLimit attribute for declarative rate limiting on controllers.
• Method-based commands.

That last one is a good picture of where the Console component is heading. Instead of one class per command, you put several commands in one class and share the dependencies:¹¹11 Symfony Blog, New in Symfony 8.1: Method-Based Commands.

class UserCommands
{
    public function __construct(
        private UserRepository $users,
        private LoggerInterface $logger,
    ) {
    }

    #[AsCommand('app:user:create', description: 'Creates a new user')]
    public function create(OutputInterface $output): int
    {
        // ...
        return Command::SUCCESS;
    }
}

Keep this example in mind for the Moodle section.

The ecosystem around it

Symfony AI. This is real and close to 1.0. It ships as a set of packages: Platform (one interface across AI providers), Store (vector databases), Agent (tool-using agents), an AI Bundle, and an MCP Bundle built on the official MCP PHP SDK, per ai.symfony.com.¹²12 Symfony, Symfony AI. On 26 October 2026 the team released 1.0.0-BETA1 and said “the feature set for 1.0 is settled.” The backward compatibility promise “starts at 1.0.0 final, not at this tag.” An AI and MCP hackathon runs from 26 October to 22 November.¹³13 Symfony Blog, Symfony AI 1.0.0-BETA1 + AI & MCP Hackathon.

The new JsonSchema component in 8.2 fits the same direction. It generates JSON Schema and OpenAPI schemas from PHP types, and can build the input schema for an AI agent tool from a method’s parameters. Its engine comes from API Platform. It needs only PHP 8.2 and works with Symfony 7.4 components.¹⁴14 Symfony Blog, New in Symfony 8.2: JsonSchema Component.

API Platform. The API framework built on Symfony tagged 5.0.0 on 17 September 2026, the same day as 4.4.0, and had reached 5.0.5 by 23 October.¹⁵15 GitHub, api-platform/core v5.0.0 and v5.0.5. Version 4.3, from March 2026, added an api-platform/mcp component so existing API resources can be exposed to AI agents over the Model Context Protocol.¹⁶16 GitHub, api-platform/core v4.3.0.

Symfony UX. The front-end toolkit shipped UX 3.6 on 15 October 2026.¹⁷17 Symfony Blog, Symfony UX 3.6 released. It adds three experimental packages: UX Inspector, UX Image and UX Router. UX Router works with both AssetMapper and Webpack Encore.

FrankenPHP. The PHP app server built on Caddy has been officially supported by the PHP Foundation since May 2025, with governance unchanged.¹⁸18 Les-Tilleuls.coop, FrankenPHP is now officially supported by the PHP Foundation. When PHP shipped the php2shell fixes on 21 October 2026, FrankenPHP released 1.13.2 the same day, with Docker images rebuilt on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, plus fixes for four vulnerabilities in FrankenPHP itself.¹⁹19 GitHub, php/frankenphp v1.13.2. Symfony 8.1 also listed “better FrankenPHP support” among its changes.¹⁰

SymfonyCon Warsaw 2026 runs 26 to 27 November, with workshops on 24 and 25 November and a free hack day on 28 November.²⁰20 Symfony, SymfonyCon Warsaw 2026.

Symfony and Moodle

Here is the honest picture, from Moodle’s own files.

Moodle core does not use the Symfony framework, and it does not use Symfony’s HttpFoundation, Routing or DependencyInjection either. When Moodle modernised its internals, it picked other libraries and coded against the PSR interfaces:

• Dependency injection since Moodle 4.4. Moodle’s DI is “PSR-11 compatible” and wraps PHP-DI. You fetch services with \core\di::get().²¹21 Moodle HQ, Dependency Injection.
• Routing since Moodle 4.5. Moodle “includes a powerful routing system based upon the Slim Framework”, with FastRoute underneath and PSR-7 request and response objects. Plugins define routes as classes in their route namespace, tagged with the \core\router\route attribute. REST routes sit under /api/rest/v2.²²22 Moodle HQ, Routing.
• Composer since Moodle 5.2. The 5.2 release notes list “Provide third-party libraries via Composer” (MDL-87950), and the minimum PHP rose to 8.3.²³23 Moodle HQ, Moodle 5.2 release notes. Before that, Moodle kept its own copies of these libraries inside the codebase, listed in lib/thirdpartylibs.xml.²⁴24 GitHub, moodle/moodle lib/thirdpartylibs.xml, MOODLE_405_STABLE.

Moodle 5.3’s composer.json²⁵25 GitHub, moodle/moodle composer.json, MOODLE_503_STABLE. shows the result. It requires about a dozen psr/* interface packages (container, logging, HTTP messages, HTTP handlers and middleware, caching, clock, event dispatching), plus slim/slim, nikic/fast-route, php-di/php-di, Guzzle and Monolog.

And two Symfony packages. One is symfony/deprecation-contracts, a tiny helper other libraries pull in. The other is new: symfony/console at ^7.3. The Moodle 5.3 release notes, from 5 October 2026, list “Add support for Symfony/Console for CLI Commands” (MDL-85847).²⁶26 Moodle HQ, Moodle 5.3 release notes. The same release adds “Container Injection via PHP Attributes” (MDL-89528).

That choice makes sense. There is a PSR for containers, HTTP messages and logging, so Moodle could pick any library that implements them. There is no PSR for console commands, so Moodle took the one most PHP projects already use.

What this means for plugin developers

Learn the PSR interfaces, not a framework. Moodle’s new code paths speak PSR-7, PSR-11 and PSR-15. If your plugin code depends on those interfaces rather than on Slim or PHP-DI classes directly, it survives if Moodle ever swaps the library behind them.

Symfony Console skills now carry over. If you write CLI tools for Moodle 5.3, the Symfony Console documentation applies.

Watch the version pins. Moodle 5.3 asks for Console ^7.3, and its minimum PHP is 8.3. Every Symfony 8.x release needs PHP 8.4. So Symfony 8 features, like the method-based commands shown above, are out of reach for Moodle code until Moodle drops PHP 8.3. That is our reading of the two sets of requirements, not a Moodle statement.

The LTS dates line up. Moodle 5.3 is an LTS with security support until 1 October 2029.²⁷27 Moodle HQ, Releases and support dates. Symfony 7.4 LTS, which satisfies ^7.3, gets security fixes until November 2029. A Moodle 5.3 site can stay on a supported Console release for its whole life.

Use Composer properly. With Moodle 5.2 and later, composer install is part of installing and upgrading Moodle. If your plugin ships its own copy of a library Moodle already provides, such as Guzzle or a PSR package, you risk two versions of the same classes fighting over the autoloader. Check Moodle’s composer.json before you bundle anything.

Why we track this

Moodle plugins run on the same PHP libraries as everything else, and a change in Symfony, PHP-DI or Slim reaches plugin code through Moodle core. We follow these releases so the plugins we build keep working when they arrive.