Nicolas Grekas

> should we enable this double-submit validation by default ? For sites that rely on stateful authentication anyway, the session-based CSRF token manager has the benefit of being compatible with...

PR ready for approval.

Thanks for the review @Kocal, comments resolved.

Friendly up @symfony/mergers

It could be, but displaying stacktraces for deprecations standalone is not useful nor actionable: deprecations are best reported grouped, which means without stacktraces. On the other side, stopping on one...

https://buffer.com/ is nice cross posting BTW.

/cc @tgalopin can you please check this PR?

I means something like this: ```php $response = $this->lookup($request, $catch); if ($request->attribute->has('foo')) { // lookup again after removing the attribute ``` With an early return in the lock method indeed....

Hum indeed. Then let's make the added exception internal. Also : what about a loop instead of just one retry?

Thank you @mpdude.