Issue 1:
Hello,

The upgrade from 2.8 to 3.0 caused the TraceableEventDispatcher to fail to remove listeners it wraps during preProcess, causing the listener function to be called twice, when in dev environment.

I have made some tests and both following scenarios lead to the same behaviour:

Event dispatched directly from a controller (wings.dispatcher is a simple alias to event_dispatcher):

protected function dispatch($eventName, RestEvent $event) {
$this->get('wings.dispatcher')->dispatch($eventName, $event);
}

Event dispatched from an injected service accepting the wings.dispatcher as a constructor argument:

/**
*
* @var EventDispatcherInterface
*/
private $dispatcher;

/**
*
*
* @param EntityManager $entityManager
* @param EventDispatcherInterface $dispatcher
* @param string $class
*/
public function __construct(EntityManager $entityManager,
EventDispatcherInterface $dispatcher, $class) {
parent::__construct($entityManager, $class);

$this->entityManager = $entityManager;
$this->dispatcher = $dispatcher;
}

/**
*
* @param string $eventName
* @param EventArgs $eventArgs
*/
protected function dispatch($eventName, Event $eventArgs) {
$this->dispatcher->dispatch($eventName, $eventArgs);
}

I've been debugging into TraceableEventDispatcher preProcess:

private function preProcess($eventName)
{
foreach ($this->dispatcher->getListeners($eventName) as $listener) {
$info = $this->getListenerInfo($listener, $eventName);
$name = isset($info['class']) ? $info['class'] : $info['type'];
$wrappedListener = new WrappedListener($listener, $name, $this->stopwatch, $this);
$this->wrappedListeners[$eventName][] = $wrappedListener;
$this->dispatcher->removeListener($eventName, $listener);
$this->dispatcher->addListener($eventName, $wrappedListener, $info['priority']);
}
}

During the call $this->dispatcher->removeListener($eventName, $listener);, the underlying ContainerAwareEventDispatcher executes the following code:

public function removeListener($eventName, $listener)
{
$this->lazyLoad($eventName);
if (isset($this->listenerIds[$eventName])) {
foreach ($this->listenerIds[$eventName] as $i => list($serviceId, $method, $priority)) {
$key = $serviceId.'.'.$method;
if (isset($this->listeners[$eventName][$key]) && $listener === array($this->listeners[$eventName][$key], $method)) {
unset($this->listeners[$eventName][$key]);
if (empty($this->listeners[$eventName])) {
unset($this->listeners[$eventName]);
}
unset($this->listenerIds[$eventName][$i]);
if (empty($this->listenerIds[$eventName])) {
unset($this->listenerIds[$eventName]);
}
}
}
}
parent::removeListener($eventName, $listener);
}

The second part of the expression if (isset($this->listeners[$eventName][$key]) && $listener === array($this->listeners[$eventName][$key], $method)) returns now false in 3.0 while it's returning true in v2.8.

Apart of the minor changes for the list() usage, it seems the code between the two versions is identical, up to the EventDispatcher class. I've checked all the methods involved (addListener,getListeners, removeListener) and I can't find any difference that could lead to the different result.

The final test I did to prove I was not messing up with something it's been to test a Signup procedure in dev environment with v3.0 and received two signup mails. Changed composer.json to v2.8, updated, and run the same scenario and received only one mail.

In prod environment, when no TraceableEventDispatcher is involved, either v2.8 or v3.0 works fine.

Issue 2:
Use of a broken or else risky cryptographic algorithm md5() in symfony/debug/ErrorHandler.php

This function uses the !php_standard_ns.md5() function, which uses a hash algorithm that is considered weak. In recent years, researchers have demonstrated ways to breach many uses of previously-thought-safe hash functions such as MD5.