diff --git a/Controller/ArgumentResolver/NotTaggedControllerValueResolver.php b/Controller/ArgumentResolver/NotTaggedControllerValueResolver.php
index d4971cc1a5..48ea6e742d 100644
--- a/Controller/ArgumentResolver/NotTaggedControllerValueResolver.php
+++ b/Controller/ArgumentResolver/NotTaggedControllerValueResolver.php
@@ -69,8 +69,9 @@ public function resolve(Request $request, ArgumentMetadata $argument): iterable
         }
 
         if (!$this->container->has($controller)) {
-            $i = strrpos($controller, ':');
-            $controller = substr($controller, 0, $i).strtolower(substr($controller, $i));
+            $controller = (false !== $i = strrpos($controller, ':'))
+                ? substr($controller, 0, $i).strtolower(substr($controller, $i))
+                : $controller.'::__invoke';
         }
 
         $what = sprintf('argument $%s of "%s()"', $argument->getName(), $controller);
diff --git a/ControllerMetadata/ArgumentMetadataFactory.php b/ControllerMetadata/ArgumentMetadataFactory.php
index e3835c057a..85bb805f34 100644
--- a/ControllerMetadata/ArgumentMetadataFactory.php
+++ b/ControllerMetadata/ArgumentMetadataFactory.php
@@ -33,7 +33,7 @@ public function createArgumentMetadata($controller): array
             $class = $reflection->class;
         } else {
             $reflection = new \ReflectionFunction($controller);
-            if ($class = str_contains($reflection->name, '{closure}') ? null : $reflection->getClosureScopeClass()) {
+            if ($class = str_contains($reflection->name, '{closure}') ? null : (\PHP_VERSION_ID >= 80111 ? $reflection->getClosureCalledClass() : $reflection->getClosureScopeClass())) {
                 $class = $class->name;
             }
         }
diff --git a/DataCollector/RequestDataCollector.php b/DataCollector/RequestDataCollector.php
index 951860a225..5717000f29 100644
--- a/DataCollector/RequestDataCollector.php
+++ b/DataCollector/RequestDataCollector.php
@@ -479,7 +479,7 @@ private function parseController($controller)
             }
             $controller['method'] = $r->name;
 
-            if ($class = $r->getClosureScopeClass()) {
+            if ($class = \PHP_VERSION_ID >= 80111 ? $r->getClosureCalledClass() : $r->getClosureScopeClass()) {
                 $controller['class'] = $class->name;
             } else {
                 return $r->name;
diff --git a/DependencyInjection/RegisterControllerArgumentLocatorsPass.php b/DependencyInjection/RegisterControllerArgumentLocatorsPass.php
index 8fd1f553e0..3dbaff5641 100644
--- a/DependencyInjection/RegisterControllerArgumentLocatorsPass.php
+++ b/DependencyInjection/RegisterControllerArgumentLocatorsPass.php
@@ -24,6 +24,7 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Symfony\Component\DependencyInjection\TypedReference;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\Session\SessionInterface;
 
 /**
@@ -174,7 +175,7 @@ public function process(ContainerBuilder $container)
                         $invalidBehavior = ContainerInterface::RUNTIME_EXCEPTION_ON_INVALID_REFERENCE;
                     }
 
-                    if (Request::class === $type || SessionInterface::class === $type) {
+                    if (Request::class === $type || SessionInterface::class === $type || Response::class === $type) {
                         continue;
                     }
 
diff --git a/EventListener/AbstractSessionListener.php b/EventListener/AbstractSessionListener.php
index 4603052e93..27749b24b2 100644
--- a/EventListener/AbstractSessionListener.php
+++ b/EventListener/AbstractSessionListener.php
@@ -200,10 +200,11 @@ public function onKernelResponse(ResponseEvent $event)
         }
 
         if ($autoCacheControl) {
+            $maxAge = $response->headers->hasCacheControlDirective('public') ? 0 : (int) $response->getMaxAge();
             $response
-                ->setExpires(new \DateTime())
+                ->setExpires(new \DateTimeImmutable('+'.$maxAge.' seconds'))
                 ->setPrivate()
-                ->setMaxAge(0)
+                ->setMaxAge($maxAge)
                 ->headers->addCacheControlDirective('must-revalidate');
         }
 
diff --git a/HttpCache/Store.php b/HttpCache/Store.php
index c777391385..8087e0cb18 100644
--- a/HttpCache/Store.php
+++ b/HttpCache/Store.php
@@ -29,17 +29,28 @@ class Store implements StoreInterface
     private $keyCache;
     /** @var array<string, resource> */
     private $locks = [];
+    private $options;
 
     /**
+     * Constructor.
+     *
+     * The available options are:
+     *
+     *   * private_headers  Set of response headers that should not be stored
+     *                      when a response is cached. (default: Set-Cookie)
+     *
      * @throws \RuntimeException
      */
-    public function __construct(string $root)
+    public function __construct(string $root, array $options = [])
     {
         $this->root = $root;
         if (!is_dir($this->root) && !@mkdir($this->root, 0777, true) && !is_dir($this->root)) {
             throw new \RuntimeException(sprintf('Unable to create the store directory (%s).', $this->root));
         }
         $this->keyCache = new \SplObjectStorage();
+        $this->options = array_merge([
+            'private_headers' => ['Set-Cookie'],
+        ], $options);
     }
 
     /**
@@ -216,6 +227,10 @@ public function write(Request $request, Response $response)
         $headers = $this->persistResponse($response);
         unset($headers['age']);
 
+        foreach ($this->options['private_headers'] as $h) {
+            unset($headers[strtolower($h)]);
+        }
+
         array_unshift($entries, [$storedEnv, $headers]);
 
         if (!$this->save($key, serialize($entries))) {
diff --git a/Kernel.php b/Kernel.php
index ee902ea21c..b2ccc7d95a 100644
--- a/Kernel.php
+++ b/Kernel.php
@@ -78,11 +78,11 @@ abstract class Kernel implements KernelInterface, RebootableInterface, Terminabl
      */
     private static $freshCache = [];
 
-    public const VERSION = '5.4.15';
-    public const VERSION_ID = 50415;
+    public const VERSION = '5.4.20';
+    public const VERSION_ID = 50420;
     public const MAJOR_VERSION = 5;
     public const MINOR_VERSION = 4;
-    public const RELEASE_VERSION = 15;
+    public const RELEASE_VERSION = 20;
     public const EXTRA_VERSION = '';
 
     public const END_OF_MAINTENANCE = '11/2024';
diff --git a/LICENSE b/LICENSE
index 88bf75bb4d..0083704572 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2004-2022 Fabien Potencier
+Copyright (c) 2004-2023 Fabien Potencier
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/Tests/Controller/ArgumentResolver/NotTaggedControllerValueResolverTest.php b/Tests/Controller/ArgumentResolver/NotTaggedControllerValueResolverTest.php
index 3cf2f0f185..4577b5a6d2 100644
--- a/Tests/Controller/ArgumentResolver/NotTaggedControllerValueResolverTest.php
+++ b/Tests/Controller/ArgumentResolver/NotTaggedControllerValueResolverTest.php
@@ -98,6 +98,17 @@ public function testControllerNameIsAnArray()
         $resolver->resolve($request, $argument);
     }
 
+    public function testInvokableController()
+    {
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('Could not resolve argument $dummy of "App\Controller\Mine::__invoke()", maybe you forgot to register the controller as a service or missed tagging it with the "controller.service_arguments"?');
+        $resolver = new NotTaggedControllerValueResolver(new ServiceLocator([]));
+        $argument = new ArgumentMetadata('dummy', \stdClass::class, false, false, null);
+        $request = $this->requestWithAttributes(['_controller' => 'App\Controller\Mine']);
+        $this->assertTrue($resolver->supports($request, $argument));
+        $resolver->resolve($request, $argument);
+    }
+
     private function requestWithAttributes(array $attributes)
     {
         $request = Request::create('/');
diff --git a/Tests/DependencyInjection/RegisterControllerArgumentLocatorsPassTest.php b/Tests/DependencyInjection/RegisterControllerArgumentLocatorsPassTest.php
index 1e3d25d440..a8fdd7975b 100644
--- a/Tests/DependencyInjection/RegisterControllerArgumentLocatorsPassTest.php
+++ b/Tests/DependencyInjection/RegisterControllerArgumentLocatorsPassTest.php
@@ -23,6 +23,7 @@
 use Symfony\Component\DependencyInjection\Reference;
 use Symfony\Component\DependencyInjection\ServiceLocator;
 use Symfony\Component\DependencyInjection\TypedReference;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\DependencyInjection\RegisterControllerArgumentLocatorsPass;
 use Symfony\Component\HttpKernel\Tests\Fixtures\Suit;
 
@@ -447,6 +448,20 @@ public function testBindWithTarget()
         ];
         $this->assertEquals($expected, $locator->getArgument(0));
     }
+
+    public function testResponseArgumentIsIgnored()
+    {
+        $container = new ContainerBuilder();
+        $resolver = $container->register('argument_resolver.service', 'stdClass')->addArgument([]);
+
+        $container->register('foo', WithResponseArgument::class)
+            ->addTag('controller.service_arguments');
+
+        (new RegisterControllerArgumentLocatorsPass())->process($container);
+
+        $locator = $container->getDefinition((string) $resolver->getArgument(0))->getArgument(0);
+        $this->assertEmpty(array_keys($locator), 'Response typed argument is ignored');
+    }
 }
 
 class RegisterTestController
@@ -527,3 +542,10 @@ public function fooAction(
     ) {
     }
 }
+
+class WithResponseArgument
+{
+    public function fooAction(Response $response, ?Response $nullableResponse)
+    {
+    }
+}
diff --git a/Tests/EventListener/ErrorListenerTest.php b/Tests/EventListener/ErrorListenerTest.php
index 00a6bde900..73cc19afc8 100644
--- a/Tests/EventListener/ErrorListenerTest.php
+++ b/Tests/EventListener/ErrorListenerTest.php
@@ -209,7 +209,7 @@ public function controllerProvider()
         }];
 
         yield [function ($exception) {
-            $this->assertInstanceOf(FlattenException::class, $exception);
+            static::assertInstanceOf(FlattenException::class, $exception);
 
             return new Response('OK: '.$exception->getMessage());
         }];
diff --git a/Tests/EventListener/SessionListenerTest.php b/Tests/EventListener/SessionListenerTest.php
index 5e11875bb1..96f66354ba 100644
--- a/Tests/EventListener/SessionListenerTest.php
+++ b/Tests/EventListener/SessionListenerTest.php
@@ -39,6 +39,7 @@ class SessionListenerTest extends TestCase
 {
     /**
      * @dataProvider provideSessionOptions
+     *
      * @runInSeparateProcess
      */
     public function testSessionCookieOptions(array $phpSessionOptions, array $sessionOptions, array $expectedSessionOptions)
@@ -531,6 +532,64 @@ public function testUninitializedSessionWithoutInitializedSession()
         $this->assertSame('60', $response->headers->getCacheControlDirective('s-maxage'));
     }
 
+    public function testResponseHeadersMaxAgeAndExpiresNotBeOverridenIfSessionStarted()
+    {
+        $session = $this->createMock(Session::class);
+        $session->expects($this->exactly(2))->method('getUsageIndex')->will($this->onConsecutiveCalls(0, 1));
+
+        $container = new Container();
+        $container->set('initialized_session', $session);
+
+        $listener = new SessionListener($container);
+        $kernel = $this->createMock(HttpKernelInterface::class);
+
+        $request = new Request();
+        $listener->onKernelRequest(new RequestEvent($kernel, $request, HttpKernelInterface::MAIN_REQUEST));
+
+        $response = new Response();
+        $response->setPrivate();
+        $expiresHeader = gmdate('D, d M Y H:i:s', time() + 600).' GMT';
+        $response->setMaxAge(600);
+        $listener->onKernelResponse(new ResponseEvent($kernel, new Request(), HttpKernelInterface::MAIN_REQUEST, $response));
+
+        $this->assertTrue($response->headers->has('expires'));
+        $this->assertSame($expiresHeader, $response->headers->get('expires'));
+        $this->assertFalse($response->headers->has('max-age'));
+        $this->assertSame('600', $response->headers->getCacheControlDirective('max-age'));
+        $this->assertFalse($response->headers->hasCacheControlDirective('public'));
+        $this->assertTrue($response->headers->hasCacheControlDirective('private'));
+        $this->assertTrue($response->headers->hasCacheControlDirective('must-revalidate'));
+        $this->assertFalse($response->headers->has(AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER));
+    }
+
+    public function testResponseHeadersMaxAgeAndExpiresDefaultValuesIfSessionStarted()
+    {
+        $session = $this->createMock(Session::class);
+        $session->expects($this->exactly(2))->method('getUsageIndex')->will($this->onConsecutiveCalls(0, 1));
+
+        $container = new Container();
+        $container->set('initialized_session', $session);
+
+        $listener = new SessionListener($container);
+        $kernel = $this->createMock(HttpKernelInterface::class);
+
+        $request = new Request();
+        $listener->onKernelRequest(new RequestEvent($kernel, $request, HttpKernelInterface::MAIN_REQUEST));
+
+        $response = new Response();
+        $expiresHeader = gmdate('D, d M Y H:i:s', time()).' GMT';
+        $listener->onKernelResponse(new ResponseEvent($kernel, new Request(), HttpKernelInterface::MAIN_REQUEST, $response));
+
+        $this->assertTrue($response->headers->has('expires'));
+        $this->assertSame($expiresHeader, $response->headers->get('expires'));
+        $this->assertFalse($response->headers->has('max-age'));
+        $this->assertSame('0', $response->headers->getCacheControlDirective('max-age'));
+        $this->assertFalse($response->headers->hasCacheControlDirective('public'));
+        $this->assertTrue($response->headers->hasCacheControlDirective('private'));
+        $this->assertTrue($response->headers->hasCacheControlDirective('must-revalidate'));
+        $this->assertFalse($response->headers->has(AbstractSessionListener::NO_AUTO_CACHE_CONTROL_HEADER));
+    }
+
     public function testSurrogateMainRequestIsPublic()
     {
         $session = $this->createMock(Session::class);
diff --git a/Tests/HttpCache/StoreTest.php b/Tests/HttpCache/StoreTest.php
index da1f649127..239361bc8c 100644
--- a/Tests/HttpCache/StoreTest.php
+++ b/Tests/HttpCache/StoreTest.php
@@ -12,8 +12,10 @@
 namespace Symfony\Component\HttpKernel\Tests\HttpCache;
 
 use PHPUnit\Framework\TestCase;
+use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\HttpCache\HttpCache;
 use Symfony\Component\HttpKernel\HttpCache\Store;
 
 class StoreTest extends TestCase
@@ -317,6 +319,17 @@ public function testPurgeHttpAndHttps()
         $this->assertEmpty($this->getStoreMetadata($requestHttps));
     }
 
+    public function testDoesNotStorePrivateHeaders()
+    {
+        $request = Request::create('https://example.com/foo');
+        $response = new Response('foo');
+        $response->headers->setCookie(Cookie::fromString('foo=bar'));
+
+        $this->store->write($request, $response);
+        $this->assertArrayNotHasKey('set-cookie', $this->getStoreMetadata($request)[0][1]);
+        $this->assertNotEmpty($response->headers->getCookies());
+    }
+
     protected function storeSimpleEntry($path = null, $headers = [])
     {
         if (null === $path) {