Symfony broke BC in a patch release. Causing CORS (via asm89/stack-cors) support in Drupal 8.2 to break: https://www.drupal.org/node/2823687.

Introduced at 1404607 — #19321 (July 9, 2016)

Fun fact: Symfony also discovered this is a problem, and that is why it introduced Request::isMethodCacheable() shortly after:

c43de7f — #20205 (October 13, 2016)

When pointing out that this broke BC, the answer was simply RFC conformance. That's fine for a major release. Maybe even a minor. But definitely not a patch release.

This should be reverted from the Symfony 2.8.x branch.

#19321 is the culprit.