diff --git a/CHANGELOG.md b/CHANGELOG.md
index a971f2af..114abffc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@
 **Enhancements:**
 
 * [130: Update to Expressive 3](https://github.com/shlinkio/shlink/issues/130)
+* [137: Update symfony packages to v4](https://github.com/shlinkio/shlink/issues/137)
 
 **Tasks**
 
diff --git a/composer.json b/composer.json
index f92fc884..7fe311bb 100644
--- a/composer.json
+++ b/composer.json
@@ -103,7 +103,8 @@
             "phpcov merge build --html build/html"
         ],
         "stan": "phpstan analyse module/*/src/ --level=6 -c phpstan.neon",
-        "infect": "infection --threads=4 --min-msi=60 --only-covered --log-verbosity=2",
+        "infect": "infection --threads=4 --min-msi=65 --only-covered --log-verbosity=2",
+        "infect-show": "infection --threads=4 --min-msi=65 --only-covered --log-verbosity=2 --show-mutations",
         "expressive": "expressive"
     },
     "config": {
diff --git a/module/Core/src/Action/QrCodeAction.php b/module/Core/src/Action/QrCodeAction.php
index 9843e079..3e5aeaf9 100644
--- a/module/Core/src/Action/QrCodeAction.php
+++ b/module/Core/src/Action/QrCodeAction.php
@@ -80,7 +80,7 @@ class QrCodeAction implements MiddlewareInterface
      * @param Request $request
      * @return int
      */
-    protected function getSizeParam(Request $request)
+    private function getSizeParam(Request $request): int
     {
         $size = (int) $request->getAttribute('size', 300);
         if ($size < 50) {
diff --git a/module/Core/src/Entity/Visit.php b/module/Core/src/Entity/Visit.php
index 5f67f636..48edfb11 100644
--- a/module/Core/src/Entity/Visit.php
+++ b/module/Core/src/Entity/Visit.php
@@ -57,7 +57,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return string
      */
-    public function getReferer()
+    public function getReferer(): string
     {
         return $this->referer;
     }
@@ -66,7 +66,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param string $referer
      * @return $this
      */
-    public function setReferer($referer)
+    public function setReferer($referer): self
     {
         $this->referer = $referer;
         return $this;
@@ -75,7 +75,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return \DateTime
      */
-    public function getDate()
+    public function getDate(): \DateTime
     {
         return $this->date;
     }
@@ -84,7 +84,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param \DateTime $date
      * @return $this
      */
-    public function setDate($date)
+    public function setDate($date): self
     {
         $this->date = $date;
         return $this;
@@ -93,7 +93,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return ShortUrl
      */
-    public function getShortUrl()
+    public function getShortUrl(): ShortUrl
     {
         return $this->shortUrl;
     }
@@ -102,7 +102,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param ShortUrl $shortUrl
      * @return $this
      */
-    public function setShortUrl($shortUrl)
+    public function setShortUrl($shortUrl): self
     {
         $this->shortUrl = $shortUrl;
         return $this;
@@ -111,7 +111,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return string
      */
-    public function getRemoteAddr()
+    public function getRemoteAddr(): string
     {
         return $this->remoteAddr;
     }
@@ -120,7 +120,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param string $remoteAddr
      * @return $this
      */
-    public function setRemoteAddr($remoteAddr)
+    public function setRemoteAddr($remoteAddr): self
     {
         $this->remoteAddr = $remoteAddr;
         return $this;
@@ -129,7 +129,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return string
      */
-    public function getUserAgent()
+    public function getUserAgent(): string
     {
         return $this->userAgent;
     }
@@ -138,7 +138,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param string $userAgent
      * @return $this
      */
-    public function setUserAgent($userAgent)
+    public function setUserAgent($userAgent): self
     {
         $this->userAgent = $userAgent;
         return $this;
@@ -147,7 +147,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * @return VisitLocation
      */
-    public function getVisitLocation()
+    public function getVisitLocation(): VisitLocation
     {
         return $this->visitLocation;
     }
@@ -156,7 +156,7 @@ class Visit extends AbstractEntity implements \JsonSerializable
      * @param VisitLocation $visitLocation
      * @return $this
      */
-    public function setVisitLocation($visitLocation)
+    public function setVisitLocation($visitLocation): self
     {
         $this->visitLocation = $visitLocation;
         return $this;
@@ -165,11 +165,11 @@ class Visit extends AbstractEntity implements \JsonSerializable
     /**
      * Specify data which should be serialized to JSON
      * @link http://php.net/manual/en/jsonserializable.jsonserialize.php
-     * @return mixed data which can be serialized by <b>json_encode</b>,
+     * @return array data which can be serialized by <b>json_encode</b>,
      * which is a value of any type other than a resource.
      * @since 5.4.0
      */
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         return [
             'referer' => $this->referer,
diff --git a/module/Core/src/Util/TagManagerTrait.php b/module/Core/src/Util/TagManagerTrait.php
index 2d1b3d6c..d9366463 100644
--- a/module/Core/src/Util/TagManagerTrait.php
+++ b/module/Core/src/Util/TagManagerTrait.php
@@ -14,7 +14,7 @@ trait TagManagerTrait
      * @param string[] $tags
      * @return Collections\Collection|Tag[]
      */
-    protected function tagNamesToEntities(EntityManagerInterface $em, array $tags)
+    private function tagNamesToEntities(EntityManagerInterface $em, array $tags)
     {
         $entities = [];
         foreach ($tags as $tagName) {
@@ -33,8 +33,8 @@ trait TagManagerTrait
      * @param string $tagName
      * @return string
      */
-    protected function normalizeTagName($tagName)
+    private function normalizeTagName($tagName): string
     {
-        return str_replace(' ', '-', strtolower(trim($tagName)));
+        return \str_replace(' ', '-', \strtolower(\trim($tagName)));
     }
 }
diff --git a/module/Core/src/Validation/InputFactoryTrait.php b/module/Core/src/Validation/InputFactoryTrait.php
index 289c54e2..4e514694 100644
--- a/module/Core/src/Validation/InputFactoryTrait.php
+++ b/module/Core/src/Validation/InputFactoryTrait.php
@@ -9,7 +9,7 @@ use Zend\InputFilter\Input;
 
 trait InputFactoryTrait
 {
-    public function createInput($name, $required = true): Input
+    private function createInput($name, $required = true): Input
     {
         $input = new Input($name);
         $input->setRequired($required)
diff --git a/module/Rest/src/Action/ListShortcodesAction.php b/module/Rest/src/Action/ListShortcodesAction.php
index 220b8a44..fe071a28 100644
--- a/module/Rest/src/Action/ListShortcodesAction.php
+++ b/module/Rest/src/Action/ListShortcodesAction.php
@@ -59,7 +59,7 @@ class ListShortcodesAction extends AbstractRestAction
      * @param array $query
      * @return array
      */
-    public function queryToListParams(array $query)
+    private function queryToListParams(array $query): array
     {
         return [
             $query['page'] ?? 1,
diff --git a/module/Rest/src/Authentication/JWTService.php b/module/Rest/src/Authentication/JWTService.php
index 6a0d3ac8..0b4a9949 100644
--- a/module/Rest/src/Authentication/JWTService.php
+++ b/module/Rest/src/Authentication/JWTService.php
@@ -92,7 +92,7 @@ class JWTService implements JWTServiceInterface
      * @param array $data
      * @return string
      */
-    protected function encode(array $data): string
+    private function encode(array $data): string
     {
         return JWT::encode($data, $this->appOptions->getSecretKey(), self::DEFAULT_ENCRYPTION_ALG);
     }
@@ -101,7 +101,7 @@ class JWTService implements JWTServiceInterface
      * @param string $jwt
      * @return array
      */
-    protected function decode(string $jwt): array
+    private function decode(string $jwt): array
     {
         return (array) JWT::decode($jwt, $this->appOptions->getSecretKey(), [self::DEFAULT_ENCRYPTION_ALG]);
     }
diff --git a/module/Rest/src/Entity/ApiKey.php b/module/Rest/src/Entity/ApiKey.php
index 284cc302..fe475c3a 100644
--- a/module/Rest/src/Entity/ApiKey.php
+++ b/module/Rest/src/Entity/ApiKey.php
@@ -44,7 +44,7 @@ class ApiKey extends AbstractEntity
     /**
      * @return string
      */
-    public function getKey()
+    public function getKey(): string
     {
         return $this->key;
     }
@@ -53,7 +53,7 @@ class ApiKey extends AbstractEntity
      * @param string $key
      * @return $this
      */
-    public function setKey($key)
+    public function setKey($key): self
     {
         $this->key = $key;
         return $this;
@@ -62,7 +62,7 @@ class ApiKey extends AbstractEntity
     /**
      * @return \DateTime|null
      */
-    public function getExpirationDate()
+    public function getExpirationDate(): ?\DateTime
     {
         return $this->expirationDate;
     }
@@ -71,7 +71,7 @@ class ApiKey extends AbstractEntity
      * @param \DateTime $expirationDate
      * @return $this
      */
-    public function setExpirationDate($expirationDate)
+    public function setExpirationDate($expirationDate): self
     {
         $this->expirationDate = $expirationDate;
         return $this;
@@ -80,9 +80,9 @@ class ApiKey extends AbstractEntity
     /**
      * @return bool
      */
-    public function isExpired()
+    public function isExpired(): bool
     {
-        if (! isset($this->expirationDate)) {
+        if ($this->expirationDate === null) {
             return false;
         }
 
@@ -92,7 +92,7 @@ class ApiKey extends AbstractEntity
     /**
      * @return boolean
      */
-    public function isEnabled()
+    public function isEnabled(): bool
     {
         return $this->enabled;
     }
@@ -101,7 +101,7 @@ class ApiKey extends AbstractEntity
      * @param boolean $enabled
      * @return $this
      */
-    public function setEnabled($enabled)
+    public function setEnabled($enabled): self
     {
         $this->enabled = $enabled;
         return $this;
@@ -112,7 +112,7 @@ class ApiKey extends AbstractEntity
      *
      * @return $this
      */
-    public function disable()
+    public function disable(): self
     {
         return $this->setEnabled(false);
     }
@@ -122,17 +122,17 @@ class ApiKey extends AbstractEntity
      *
      * @return bool
      */
-    public function isValid()
+    public function isValid(): bool
     {
         return $this->isEnabled() && ! $this->isExpired();
     }
 
     /**
-     * The string repesentation of an API key is the key itself
+     * The string representation of an API key is the key itself
      *
      * @return string
      */
-    public function __toString()
+    public function __toString(): string
     {
         return $this->getKey();
     }
diff --git a/module/Rest/src/ErrorHandler/JsonErrorResponseGenerator.php b/module/Rest/src/ErrorHandler/JsonErrorResponseGenerator.php
index b62f49cc..035099c8 100644
--- a/module/Rest/src/ErrorHandler/JsonErrorResponseGenerator.php
+++ b/module/Rest/src/ErrorHandler/JsonErrorResponseGenerator.php
@@ -32,8 +32,8 @@ class JsonErrorResponseGenerator implements ErrorResponseGeneratorInterface, Sta
         ], $status);
     }
 
-    protected function responsePhraseToCode(string $responsePhrase): string
+    private function responsePhraseToCode(string $responsePhrase): string
     {
-        return strtoupper(str_replace(' ', '_', $responsePhrase));
+        return \strtoupper(\str_replace(' ', '_', $responsePhrase));
     }
 }
diff --git a/module/Rest/src/Middleware/CheckAuthenticationMiddleware.php b/module/Rest/src/Middleware/CheckAuthenticationMiddleware.php
index 8a030e8d..32e10ed8 100644
--- a/module/Rest/src/Middleware/CheckAuthenticationMiddleware.php
+++ b/module/Rest/src/Middleware/CheckAuthenticationMiddleware.php
@@ -77,22 +77,22 @@ class CheckAuthenticationMiddleware implements MiddlewareInterface, StatusCodeIn
 
         // Get token making sure the an authorization type is provided
         $authToken = $request->getHeaderLine(self::AUTHORIZATION_HEADER);
-        $authTokenParts = explode(' ', $authToken);
-        if (count($authTokenParts) === 1) {
+        $authTokenParts = \explode(' ', $authToken);
+        if (\count($authTokenParts) === 1) {
             return new JsonResponse([
                 'error' => RestUtils::INVALID_AUTHORIZATION_ERROR,
-                'message' => sprintf($this->translator->translate(
+                'message' => \sprintf($this->translator->translate(
                     'You need to provide the Bearer type in the %s header.'
                 ), self::AUTHORIZATION_HEADER),
             ], self::STATUS_UNAUTHORIZED);
         }
 
         // Make sure the authorization type is Bearer
-        list($authType, $jwt) = $authTokenParts;
-        if (strtolower($authType) !== 'bearer') {
+        [$authType, $jwt] = $authTokenParts;
+        if (\strtolower($authType) !== 'bearer') {
             return new JsonResponse([
                 'error' => RestUtils::INVALID_AUTHORIZATION_ERROR,
-                'message' => sprintf($this->translator->translate(
+                'message' => \sprintf($this->translator->translate(
                     'Provided authorization type %s is not supported. Use Bearer instead.'
                 ), $authType),
             ], self::STATUS_UNAUTHORIZED);
@@ -119,11 +119,15 @@ class CheckAuthenticationMiddleware implements MiddlewareInterface, StatusCodeIn
         }
     }
 
-    protected function createTokenErrorResponse()
+    /**
+     * @return JsonResponse
+     * @throws \InvalidArgumentException
+     */
+    private function createTokenErrorResponse(): JsonResponse
     {
         return new JsonResponse([
             'error' => RestUtils::INVALID_AUTH_TOKEN_ERROR,
-            'message' => sprintf(
+            'message' => \sprintf(
                 $this->translator->translate(
                     'Missing or invalid auth token provided. Perform a new authentication request and send provided '
                     . 'token on every new request on the "%s" header'