Symfony 5.3.13 has just been released.
Here is the list of the most important changes since 5.3.12:

bug #44838 [DependencyInjection][HttpKernel] Fix enum typed bindings (@ogizanagi)
bug #44723 [Lock] Release PostgreSqlStore connection lock on failure (simon-watiau) * commit ‚e5b2f9efba‘: [Lock] Release PostgreSqlStore connection lock on failure
bug #44826 [HttpKernel] Do not attempt to register enum arguments in controller service locator (@ogizanagi)
bug #44824 [Mime] Fix missing sprintf in DkimSigner (@alamirault)
bug #44816 [Translation] [LocoProvider] Use rawurlencode and separate tag setting (@danut007ro)
bug #44805 [Security] fix unserializing session payloads from v4 (@nicolas-grekas)
bug #44820 [Cache] Don’t lock when doing nested computations (@nicolas-grekas)
bug #44807 [Messenger] fix Redis support on 32b arch (@nicolas-grekas)
bug #44759 [HttpFoundation] Fix notice when HTTP_PHP_AUTH_USER passed without pass (@Vitali Tsyrkin)
bug #44799 [Cache] fix compat with apcu < 5.1.10 (@nicolas-grekas)
bug #44085 [Translation] Fix TranslationPullCommand with ICU translations (@Kocal)
bug #44771 [Notifier] Use correct factory for the msteams transport (@veewee)
bug #44618 [HttpKernel] Fix SessionListener without session in request (@shyim)
bug #44743 [HttpClient] fix checking for recent curl consts (@nicolas-grekas)
bug #44752 [Security/Http] Fix cookie clearing on logout (@maxhelias)
bug #44732 [Mime] Relaxing in-reply-to header validation (@ThomasLandauer)
bug #44728 [Mime] Fix encoding filenames in multipart/form-data (@nicolas-grekas)
bug #44710 [DependencyInjection] fix linting callable classes (@nicolas-grekas)
bug #44639 [DependencyInjection] Cast tag attribute value to string (@ruudk)
bug #44473 [Validator] Restore default locale in ConstraintValidatorTestCase (@rodnaph)
bug #44682 [FrameworkBundle] alias cache.app.taggable to cache.app if using cache.adapter.redis_tag_aware (@kbond)
bug #44671 [HttpClient] Fix tracing requests made after calling withOptions() (@nicolas-grekas)
bug #44577 [Cache] Fix proxy no expiration to the Redis (@Sergey Belyshkin)
bug #44669 [Cache] disable lock on CLI (@nicolas-grekas)
bug #44598 [Translation] Handle the blank-translation in Loco Adapter (@kgonella)
bug #44354 [RateLimiter] Make RateLimiter resilient to timeShifting (@jderusse)
bug #44600 [Serializer] Fix denormalizing custom class in UidNormalizer (@fancyweb)
bug #44537 [Config] In XmlUtils, avoid converting from octal every string starting with a 0 (@alexandre-daubois)
bug #44510 [Workflow] Fix eventsToDispatch parameter setup for StateMachine (@Olexandr Kalaidzhy)
bug #44625 [HttpClient] fix monitoring responses issued before reset() (@nicolas-grekas)
bug #44623 [HttpClient] Fix dealing with „HTTP/1.1 000 “ responses (@nicolas-grekas)
bug #44601 [HttpClient] Fix closing curl-multi handle too early on destruct (@nicolas-grekas)
bug #44571 [HttpClient] Don’t reset timeout counter when initializing requests (@nicolas-grekas)
bug #44479 [HttpClient] Double check if handle is complete (@Nyholm)
bug #44418 [DependencyInjection] Resolve ChildDefinition in AbstractRecursivePass (@fancyweb)
bug #44474 [Translation] [Bridge] [Lokalise] Fix push keys to lokalise. Closes #… (@olegmifle)
bug #43164 [FrameworkBundle] Fix cache pool configuration with one adapter and one provider (@fancyweb)
bug #44419 [PropertyAccess] Fix accessing public property on Object (@kevcomparadise)
bug #44565 [FrameworkBundle] Use correct cookie domain in loginUser() (@wouterj)
bug #44538 [Process] fixed uppercase ARGC and ARGV should also be skipped (@rbaarsma)
bug #44438 [HttpClient] Fix handling thrown Exception in Generator in MockResponse (@fancyweb)
bug #44469 [String] Fix requiring wcswitch table several times (@fancyweb)
bug #44502 [HttpFoundation] do not call preg_match() on null (@xabbuh)
bug #44481 [FrameworkBundle] Fix loginUser() causing deprecation (@wouterj)
bug #44416 [Translation] Make http requests synchronous when reading the Loco API (@Kocal)
bug #44350 [Translation] Fix TranslationTrait (@Tomasz Kusy)
bug #44467 [Console] Fix parameter types for ProcessHelper::mustRun() (@derrabus)
bug #44427 [FrameworkBundle] Fix compatibility with symfony/security-core 6.x (deps=high tests) (@wouterj)
bug #44399 Prevent infinite nesting of lazy ObjectManager instances when ObjectManager is reset (@Ocramius)
bug #44375 [DoctrineBridge] fix calling get_class on non-object (@kbond)
bug #44361 [HttpClient] Fix handling error info in MockResponse (@fancyweb)
bug #44309 [Messenger] Leverage DBAL’s getNativeConnection() method (@derrabus)
bug #44187 [Translation] [Loco] Fix idempotency of LocoProvider write method (@welcoMattic)
bug #43992 [Security] Do not overwrite already stored tokens for REMOTE_USER authentication (@stlrnz)
bug #43876 [Validator] Fix validation for single level domains (@HypeMC)
bug #44327 [Debug][ErrorHandler] Increased the reserved memory from 10k to 32k (@sakalys)
bug #44261 [Process] intersect with getenv() in case-insensitive manner to get default envs (@stable-staple)
bug #44295 [Serializer] fix support for lazy/unset properties (@nicolas-grekas)
bug #44277 [Notifier] Fix AllMySms bridge body content (@afiocre)
bug #44269 [DoctrineBridge] Revert “ add support for the JSON type“ (@dunglas)

Want to upgrade to this new release? Because Symfony protects
backwards-compatibility very closely, this should be quite easy. Use
SymfonyInsight upgrade reports
to detect the code you will need to change in your project and
read our upgrade
documentation to learn more.

Want to be notified whenever a new Symfony release is published? Or when a
version is not maintained anymore? Or only when a security issue is fixed?
Consider subscribing to the Symfony Roadmap Notifications.

Symfony Blog
Read More