Merge branch '6.4' into 7.0

* 6.4:
  [Serializer] Fix deserializing of nested snake_case attributes using CamelCaseToSnakeCaseNameConverter
  [Security] FormLoginAuthenticator: fail for non-string password
  [FrameworkBundle] Improve deprecation for handler_id/save_path config options
  [Serializer] Fix deserializing object collection properties
  [HttpKernel] Fix checking for the runtime mode in DebugLoggerConfigurator
  [Serializer] Fix serialized name with groups
  Hide username and client ip in logs

Author: nicolas-grekas

CHANGELOG.md

@@ -31,8 +31,10 @@ CHANGELOG
  * Deprecate not setting the `framework.php_errors.log` config option; it will default to `true` in 7.0
  * Deprecate not setting the `framework.session.cookie_secure` config option; it will default to `auto` in 7.0
  * Deprecate not setting the `framework.session.cookie_samesite` config option; it will default to `lax` in 7.0
- * Deprecate not setting the `framework.session.handler_id` config option; it will default to `session.handler.native_file` when `framework.session.save_path` is set or `null` otherwise in 7.0
- * Deprecate not setting the `framework.session.save_path` config option when `framework.session.handler_id` is not set; it will default to `null` in 7.0
+ * Deprecate not setting either `framework.session.handler_id` or `save_path` config options; `handler_id` will
+   default to null in 7.0 if `save_path` is not set and to `session.handler.native_file` otherwise
+ * Deprecate not setting the `framework.session.handler_id` config option; it will default to null,
+   unless `save_path` is set, which will make it default to `session.handler.native_file` in 7.0
  * Deprecate not setting the `framework.uid.default_uuid_version` config option; it will default to `7` in 7.0
  * Deprecate not setting the `framework.uid.time_based_uuid_version` config option; it will default to `7` in 7.0
  * Deprecate not setting the `framework.validation.email_validation_mode` config option; it will default to `html5` in 7.0

DependencyInjection/Configuration.php

@@ -660,12 +660,8 @@ private function addSessionSection(ArrayNodeDefinition $rootNode): void
                             trigger_deprecation('symfony/framework-bundle', '6.4', 'Not setting the "framework.session.cookie_samesite" config option is deprecated. It will default to "lax" in 7.0.');
                         }
 
-                        if (!\array_key_exists('handler_id', $v['session'])) {
-                            if (!\array_key_exists('save_path', $v['session'])) {
-                                trigger_deprecation('symfony/framework-bundle', '6.4', 'Not setting the "framework.session.save_path" config option when the "framework.session.handler_id" config option is not set either is deprecated. Both options will default to "null" in 7.0.');
-                            } else {
-                                trigger_deprecation('symfony/framework-bundle', '6.4', 'Not setting the "framework.session.handler_id" config option is deprecated. It will default to "session.handler.native_file" when "framework.session.save_path" is set or "null" otherwise in 7.0.');
-                            }
+                        if (!\array_key_exists('handler_id', $v['session']) && !\array_key_exists('handler_id', $v['save_path'])) {
+                            trigger_deprecation('symfony/framework-bundle', '6.4', 'Not setting either "framework.session.handler_id" or "save_path" config options is deprecated; "handler_id" will default to null in 7.0 if "save_path" is not set and to "session.handler.native_file" otherwise.');
                         }
                     }