• Process – a new class for starting and controlling external processes: read their output, feed them input, pipe one process into another, wait for completion, terminate, and check exit codes. Process::runExecutable() passes arguments as an array so there's zero shell involvement and no risk of shell injection, while Process::runCommand() is there when you really do want the shell. Comes with timeouts, incremental output consumption (consumeStdOutput() / consumeStdError()), and works on Windows too.
• FileSystem::isValidFilename() – quickly check whether a string is a safe, cross-platform filename: it rejects path separators, control and reserved characters, trailing dots or spaces, and Windows device names like CON or LPT1.
• Image::fromFile() and Image::fromString() now accept an optional $warnings parameter – pass it in and any GD warnings are handed back to you as a string instead of being emitted as a PHP warning, so you can log or display them on your own terms.