[Form][Validator] All index items after children are to be considered grand-children when resolving ViolationPath (fixes #11458)
[Form] FormBuilder::getIterator() now deals with resolved children
[DI] Added safeguards against invalid config in the YamlFileLoader

Exceptions explaining the mistake are better than fatal errors or weird
notices appearing when trying to deal with such invalid data.
Closes #11333
improve handling router script paths

The `server:run` command switches the working directory before
starting the built-in web server. Therefore, the path to a custom
router script had to be specified based on the document root path
and not based on the user's working directory.
[Security] Use hash_equals for constant-time string comparison
[Security] Add more tests for StringUtils::equals
minor #11844 [FrameworkBundle] improve handling router script paths (xabbuh)

This PR was merged into the 2.3 branch.

Discussion
----------

[FrameworkBundle] improve handling router script paths

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        |

The `server:run` command switches the working directory before starting the built-in web server. Therefore, the path to a custom router script had to be specified based on the document root path and not based on the user's working directory.

Another option is to update the documentation (as started in symfony/symfony-docs#4194). Though I think the current behaviour is a bug. The intended behaviour can be derived from the command's help message:

> ```
If you have custom docroot directory layout, you can specify your own
 router script using --router option:

>   ./app/console server:run --router=app/config/router.php
```

As you can see, the path is specified based on the current working directory.

Commits
-------

0a16cf2 improve handling router script paths
[Intl] Added "internal" tag to all classes under Symfony\Component\Intl\ResourceBundle

We didn't have this tag yet when this component was first written. The code in that
namespace is only used for resource bundle generation and was never meant for public
use.
minor #11891 [Intl] Added "internal" tag to all classes under Symfony\Component\Intl\ResourceBundle (webmozart)

This PR was merged into the 2.3 branch.

Discussion
----------

[Intl] Added "internal" tag to all classes under Symfony\Component\Intl\ResourceBundle

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | yes?
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

We didn't have this tag yet when this component was first written. The code in that
namespace is only used for resource bundle generation and was never meant for public
use.

We need to include in the update notes that users should check for usage of these classes.

Commits
-------

7fd5e8b [Intl] Added "internal" tag to all classes under Symfony\Component\Intl\ResourceBundle
[FrameworkBundle] Remove invalid markup
bug #11897 [FrameworkBundle] Remove invalid markup (flack)

This PR was submitted for the 2.5 branch but it was merged into the 2.3 branch instead (closes #11897).

Discussion
----------

[FrameworkBundle] Remove invalid markup

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #11896
| License       | MIT
| Doc PR        | n/a

Commits
-------

1fe8e31 [FrameworkBundle] Remove invalid markup
bug #11374 [DI] Added safeguards against invalid config in the YamlFileLoader (stof)

This PR was merged into the 2.3 branch.

Discussion
----------

[DI] Added safeguards against invalid config in the YamlFileLoader

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #11333
| License       | MIT
| Doc PR        | n/a

Exceptions explaining the mistake are better than fatal errors or weird notices appearing when trying to deal with such invalid data.

The XML file loader is not affected by this because the data are validated with the XSD before being processed

Commits
-------

5183501 [DI] Added safeguards against invalid config in the YamlFileLoader
minor #11822 [Security] Use hash_equals for constant-time string comparison (again) (dunglas)

This PR was merged into the 2.3 branch.

Discussion
----------

[Security] Use hash_equals for constant-time string comparison (again)

| Q             | A
| ------------- | ---
| Bug fix?      | no
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | n/a
| License       | MIT
| Doc PR        | n/a

Use the `hash_equals` function (introduced in PHP 5.6) for timing attack safe string comparison when available.

Add in the DocBlock that length will leak (https://github.com/symfony/symfony/pull/11797#issuecomment-53990712).

Commits
-------

3071557 [Security] Add more tests for StringUtils::equals
03bd74b [Security] Use hash_equals for constant-time string comparison
[SwiftmailerBridge] Bump allowed versions of swiftmailer

Current version of Swiftmailer is 5.2.1, while (previously to this commit)
the version installed by composer was 5.0.3.

This is rather important, since 5.2.1 closes a security issue that 5.0.3 is
vulnarable to (https://github.com/swiftmailer/swiftmailer/issues/494).
Use separated function to resolve command and related arguments
bug #11497 Use separated function to resolve command and related arguments (JJK801)

This PR was submitted for the master branch but it was merged into the 2.3 branch instead (closes #11497).

Discussion
----------

Use separated function to resolve command and related arguments

Hi,

This PR split command and related arguments resolution into two distinct functions.

It will help to solve the HHVM issue sensiolabs/SensioDistributionBundle#150 .

Thanks,

Jérémy

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | yes
| BC breaks?    | yes
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | ~
| License       | MIT
| Doc PR        | ~

Commits
-------

ee75af0 Use separated function to resolve command and related arguments
[Intl] Removed non-working $fallback argument from ArrayAccessibleResourceBundle
bug #11905 [Intl] Removed non-working $fallback argument from ArrayAccessibleResourceBundle (webmozart)

This PR was merged into the 2.3 branch.

Discussion
----------

[Intl] Removed non-working $fallback argument from ArrayAccessibleResourceBundle

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

The code in question didn't actually work. This was extracted from #9206.

Commits
-------

5feda5e [Intl] Removed non-working $fallback argument from ArrayAccessibleResourceBundle
[Intl] Updated icu.ini up to ICU 53
[Intl] Added exception handler to command line scripts