Symfony 5.4.2 has just been released.
Here is the list of the most important changes since 5.4.1:

bug #44828 [Lock] Release DoctrineDbalPostgreSqlStore connection lock on failure (@simon-watiau)
bug #44838 [DependencyInjection][HttpKernel] Fix enum typed bindings (@ogizanagi)
bug #44723 [Lock] Release PostgreSqlStore connection lock on failure (simon-watiau) * commit ‚e5b2f9efba‘: [Lock] Release PostgreSqlStore connection lock on failure
bug #44826 [HttpKernel] Do not attempt to register enum arguments in controller service locator (@ogizanagi)
bug #44824 [Mime] Fix missing sprintf in DkimSigner (@alamirault)
bug #44816 [Translation] [LocoProvider] Use rawurlencode and separate tag setting (@danut007ro)
bug #44805 [Security] fix unserializing session payloads from v4 (@nicolas-grekas)
bug #44820 [Cache] Don’t lock when doing nested computations (@nicolas-grekas)
bug #44807 [Messenger] fix Redis support on 32b arch (@nicolas-grekas)
bug #44759 [HttpFoundation] Fix notice when HTTP_PHP_AUTH_USER passed without pass (@Vitali Tsyrkin)
bug #44809 [WebProfilerBundle] relax return type for memory data collector (@94noni)
bug #44799 [Cache] fix compat with apcu < 5.1.10 (@nicolas-grekas)
bug #44764 [Form] Expand FormView key to include int (@biozshock)
bug #44730 [Console] Fix autocompletion of argument with default value (@GromNaN)
bug #44637 [PropertyInfo] PhpStan extractor nested object fix (@rmikalkenas)
bug #44085 [Translation] Fix TranslationPullCommand with ICU translations (@Kocal)
bug #44578 [PropertyInfo] Fix phpstan extractor issues (@ostrolucky)
bug #44771 [Notifier] Use correct factory for the msteams transport (@veewee)
bug #44618 [HttpKernel] Fix SessionListener without session in request (@shyim)
bug #44743 [HttpClient] fix checking for recent curl consts (@nicolas-grekas)
bug #44752 [Security/Http] Fix cookie clearing on logout (@maxhelias)
bug #44732 [Mime] Relaxing in-reply-to header validation (@ThomasLandauer)
bug #44714 [WebProfilerBundle] fix Email HTML preview (@94noni)
bug #44728 [Mime] Fix encoding filenames in multipart/form-data (@nicolas-grekas)
bug #44602 [Serializer] Improve UidNormalizer denormalize error message (@fancyweb)
bug #44383 [Lock] Create tables in transaction only if supported by driver (@martinssipenko)
bug #44518 [HttpFoundation] Take php session.cookie settings into account (@simonchrz)
bug #44719 [ErrorHandler] fix on patching return types on Windows (@nicolas-grekas)
bug #44710 [DependencyInjection] fix linting callable classes (@nicolas-grekas)
bug #44639 [DependencyInjection] Cast tag attribute value to string (@ruudk)
bug #44473 [Validator] Restore default locale in ConstraintValidatorTestCase (@rodnaph)
bug #44682 [FrameworkBundle] alias cache.app.taggable to cache.app if using cache.adapter.redis_tag_aware (@kbond)
bug #44649 [HttpKernel] fix how configuring log-level and status-code by exception works (@nicolas-grekas)
bug #44667 [Cache] Revert „feature #41989 make LockRegistry use semaphores when possible“ (@nicolas-grekas)
bug #44671 [HttpClient] Fix tracing requests made after calling withOptions() (@nicolas-grekas)
bug #44577 [Cache] Fix proxy no expiration to the Redis (@Sergey Belyshkin)
bug #44669 [Cache] disable lock on CLI (@nicolas-grekas)
bug #44598 [Translation] Handle the blank-translation in Loco Adapter (@kgonella)
bug #44448 [Validator] Allow Sequence constraint to be applied onto class as an attribute (@sidz)
bug #44354 [RateLimiter] Make RateLimiter resilient to timeShifting (@jderusse)
bug #44600 [Serializer] Fix denormalizing custom class in UidNormalizer (@fancyweb)
bug #44537 [Config] In XmlUtils, avoid converting from octal every string starting with a 0 (@alexandre-daubois)
bug #44510 [Workflow] Fix eventsToDispatch parameter setup for StateMachine (@Olexandr Kalaidzhy)
bug #44625 [HttpClient] fix monitoring responses issued before reset() (@nicolas-grekas)
bug #44623 [HttpClient] Fix dealing with „HTTP/1.1 000 “ responses (@nicolas-grekas)
bug #44430 [PropertyInfo] Fix aliased namespace matching (@Korbeil)
bug #44601 [HttpClient] Fix closing curl-multi handle too early on destruct (@nicolas-grekas)
bug #44571 [HttpClient] Don’t reset timeout counter when initializing requests (@nicolas-grekas)
bug #44479 [HttpClient] Double check if handle is complete (@Nyholm)
bug #44418 [DependencyInjection] Resolve ChildDefinition in AbstractRecursivePass (@fancyweb)
bug #44474 [Translation] [Bridge] [Lokalise] Fix push keys to lokalise. Closes #… (@olegmifle)
bug #43164 [FrameworkBundle] Fix cache pool configuration with one adapter and one provider (@fancyweb)
bug #44419 [PropertyAccess] Fix accessing public property on Object (@kevcomparadise)
bug #44565 [FrameworkBundle] Use correct cookie domain in loginUser() (@wouterj)
bug #44538 [Process] fixed uppercase ARGC and ARGV should also be skipped (@rbaarsma)
bug #44438 [HttpClient] Fix handling thrown Exception in Generator in MockResponse (@fancyweb)
bug #44469 [String] Fix requiring wcswitch table several times (@fancyweb)
bug #44539 [Lock] Fix missing argument in PostgreSqlStore::putOffExpiration with DBAL connection (@GromNaN)

Want to upgrade to this new release? Because Symfony protects
backwards-compatibility very closely, this should be quite easy. Use
SymfonyInsight upgrade reports
to detect the code you will need to change in your project and
read our upgrade
documentation to learn more.

Want to be notified whenever a new Symfony release is published? Or when a
version is not maintained anymore? Or only when a security issue is fixed?
Consider subscribing to the Symfony Roadmap Notifications.

Symfony Blog
Read More