Changelog (https://github.com/symfony/symfony/compare/v5.4.20...v5.4.21)

• bug #49526 [Security] Migrate the session on login only when the user changes (@nicolas-grekas)
• bug #49516 [Workflow] display label with new lines + colours properly when rendering a PUML dump (@alexislefebvre)
• bug #48965 [TwigBridge] Allow floats in html5 input type number field (@wimhendrikx)
• bug #48833 [Translation] Handle the translation of empty strings (@javiereguiluz)
• bug #49292 [VarDumper] Fix error when reflected class has default Enum parameter in constructor (@kapiwko)
• bug #49493 [FrameworkBundle] Fix denyAccessUnlessGranted for mixed attributes (@delbertooo)
• bug #49484 [Validator] Fix translation of AtLeastOneOf constraint message (@alexandre-daubois)
• bug #48998 [Validator] Sync IBAN formats with Swift IBAN registry (@smelesh)
• bug #49405 [MonologBridge] FirePHPHandler::onKernelResponse throws PHP 8.1 deprecation when no user agent is set (@juagarc4)
• bug #49421 [TwigBridge] do not drop embed label classes (@xabbuh)
• bug #49422 [Cache][Messenger] fixed CallbackInterface support in async expiration handler (@AdamKatzDev)
• bug #49441 [Contracts] Fix setting $container before calling parent::setContainer in ServiceSubscriberTrait (@edsrzf)
• bug #49272 [Workflow] remove new lines from workflow metadata (@alexislefebvre)
• bug #49427 [WebProfilerBundle] Render original (not encoded) email headers (@1ed)
• bug #49368 [BC Break] Make data providers for abstract test cases static (@OskarStark, @alexandre-daubois)
• bug #49385 [Notifier] Make TransportTestCase data providers static (@alexandre-daubois)
• bug #49395 fix trying to load Memcached before checking we can (@nicolas-grekas)
• bug #49326 [Notifier] Fix notifier profiler when transport name is null (@fabpot)
• bug #49265 [HttpKernel] Fix setting the session on the main request when it's started by a subrequest (@nicolas-grekas)
• bug #49353 [Cache] Only validate dbindex parameter when applicable (@loevgaard)
• bug #49346 [ErrorHandler] Do not patch return statements in closures (@wouterj)
• bug #49334 [DependencyInjection] keep proxy tag on original definition when decorating (@kbond)
• bug #47946 [FrameworkBundle] Fix checkboxes check assertions (@MatTheCat)
• bug #49301 [HttpClient] Fix data collector (@fancyweb)
• bug #49310 [Notifier][WebProfilerBundle] Ignore messages whose getNotification returns null (@MatTheCat)
• bug #49299 [HttpClient] Fix over-encoding of URL parts to match browser's behavior (@nicolas-grekas)
• bug #49214 [Mailer] add Sender to the list of bypassed headers (@xabbuh)
• bug #49245 [Serializer] Fix CsvEncoder decode on empty data (@cazak)
• bug #49249 [Dotenv] Fix phpdoc Dotenv (@alamirault)
• bug #49248 [Config] Fix phpdoc nullable (@alamirault)
• bug #48880 [Response] getMaxAge() returns non-negative integer (@pkruithof, @fabpot)
• bug #49207 [PropertyInfo] Add meaningful message when phpstan/phpdoc-parser is not installed when using PhpStanExtractor (@alexandre-daubois)
• bug #49220 [Validator] Make ConstraintValidatorTestCase compatible with PHPUnit 10 (@gjuric)
• bug #49226 [WebProfilerBundle] Disable Turbo for debug toolbar links (@javiereguiluz)
• bug #49223 [WebProfilerBundle] Fix some minor HTML issues (@javiereguiluz)
• bug #49146 [PropertyInfo] fail with a meaningful error when a needed package is missing (@xabbuh)
• bug #49187 [Ldap] Allow multiple values on extra_fields (@mvhirsch)
• bug #49128 [DependencyInjection] Fix combinatory explosion when autowiring union and intersection types (@nicolas-grekas)

[PR] https://github.com/symfony/symfony/pull/49558