PrestaShop 9.0 has been upgraded to rely on Symfony 6.4. This is a significant leap from the previous version, 8.x, which was based on Symfony 4.4. As a result, version 9 includes all the breaking changes related to the Symfony Framework. For more details about these changes in the core, you can refer to the PrestaShop GitHub issue. Additionally, you can consult the Symfony migration guides (see links below).
Symfony 6.4 is the latest LTS version and will receive bug fixes until November 2026, as well as security fixes until November 2027.
Removed dependencies
We have followed Symfony’s recommendations and made changes to our dependencies. Instead of using the symfony/symfony dependency, we now manually include each sub-package. Additionally, due to the minimum PHP version requirement of 8.1, we had to upgrade or remove certain dependencies.
During this process, we took the opportunity to clean up dependencies that are no longer used in the core, regardless of whether they are from Symfony or not. If you rely on these dependencies in your modules, you will need to integrate them into your module’s dependencies.
| Library name | Reason for removal/Replacement |
|---|---|
| guzzlehttp/guzzle | Replaced by Symfony HTTP client in the core |
| league/tactician-bundle | Replaced by Symfony Messenger component |
| pear/archive_tar | No longer used |
| sensio/framework-extra-bundle | We now favor annotations in the core |
| soundasleep/html2text | No longer used |
| swiftmailer/swiftmailer | Replaced by Symfony Mailer component in the core |
| symfony/inflector | No longer used |
| symfony/notifier | No longer used |
| symfony/rate-limiter | No longer used |
| symfony/semaphore | No longer used |
| symfony/uid | No longer used |
| symfony/workflow | No longer used |
Mailer Migration
We have migrated from Swift Mailer to Symfony Mailer. This change includes several improvements and aligns with Symfony’s latest recommendations.
Mail SSL encryption was dropped
When we migrated from Swift Mailer to Symfony Mailer, we noticed that SSL support was not an option in ESMTP transport. SSL is an old and outdated encryption type, and for security reasons, it will no longer be allowed.
The remaining choices are “TLS encryption” or “No encryption”.
Upgraded dependencies
Some dependencies are still present but were upgraded which comes with their own breaking changes, please refer to each dependency changelog to understand them in details if you depend on these dependencies:
| Name | Old version | New version |
|---|---|---|
| api-platform/core | 2.7.6 | 3.2.13 |
| composer/installers | 1.12.0 | 2.2.0 |
| friendsofsymfony/jsrouting-bundle | 2.8.0 | 3.2.1 |
| lcobucci/jwt | 3.4.6 (special patch from https://github.com/PrestaShop/jwt.git) | 5.0.0 (no need for fork version anymore) |
| mobiledetect/mobiledetectlib | 2.8.41 | 3.74.0 |
| pelago/emogrifier | 5.0.1 | 7.0.0 |
| Symfony dependencies | 4.4 | 6.4 |
| twig/twig | 3.4.3 | 3.8.0 |
| doctrine/dbal | 2.13.8 | 3.6.5 |
| doctrine/lexer | 1.2.3 | 2.1.1 |
| doctrine/orm | 2.12.1 | 2.15.5 |
| doctrine/deprecations | 0.5.3 | 1.1.3 |
| egulias/email-validator | 3.2.6 | 4.0.1 |
Symfony controllers
In Symfony 6.4, the controllers must now be defined as services. The impact on the existing controllers is mainly around the concept of Dependency Injection and how services are injected or accessed in the controllers. The container passed to the controllers is no longer the “global container” that contains all the existing services in the application. Instead, it injects a dedicated container optimized for the controller based on the services that are injected into it.
The issue is that most of PrestaShop’s Symfony controllers do not rely on injection but instead use the $this->get('service_name') method to access any service. This is no longer possible in modern controllers because of the mentioned optimization related to container build (and the get method was even removed). To avoid a very big breaking change, we modified the PrestaShopBundle\Controller\Admin\FrameworkBundleAdminController, so that it can fetch services from the controller’s container and from the global one, but this is a little hack that goes against Symfony recommendations, as such this base class is already deprecated and will be removed in PrestaShop 10.0.
This gives developers some time to refacto their controllers. They should now rely on the new PrestaShopBundle\Controller\Admin\PrestaShopAdminController, which doesn’t implement the mentioned hack in order to force a proper implementation of the controllers. You can read more details about Controllers as services, Service Subscribers & Locators or Service container in general.
