v4.1.16

What's Changed

• fix(laravel): route where uses requirements by @soyuka in #7199
• fix(laravel): persist HasMany and MorphMany relationships by @soyuka in #7208
• refactor(state): merge parameter and link security by @soyuka in #7200
• fix(symfony): fix property restrictions for root resource with dynamic validation groups by @c1tru55 in #7184

Notes:

Two providers are now available on parameters (query parameters, header and uri variables Link):

ReadLinkParameterProvider previously used for link security (renamed from Symfony\Security\State\LinkedReadProvider)
IriConverterParameterProvider this allows you to read a resource from an IRI usefull for filters (eg ?author=/authors/1)

Previous tests on link security were left untouched we removed the experimental class Symfony\Security\State\LinkAccessCheckerProvider as well as the LinkedReadProvider as they're not used anymore.

Full Changelog: v4.1.15...v4.1.16

v4.1.13

What's Changed

• ci: prefer-lowest to avoid bumping inter components dependencies by @soyuka in #7169
• fix(laravel): index on non-primary key by @soyuka in #7183
• fix: skip openapi webhooks when generating routes by @alexndlm in #7175
• fix(laravel): persist morph relations by @Seb33300 in #7170
• fix(openapi): fix duplicate get path for webhooks by @alexndlm in #7174
• ci: ignore symfony 7.3 deprecations by @soyuka in #7192

Full Changelog: v4.1.12...v4.1.13

v4.1.12

What's Changed

• fix(metadata): parameter cast to array flag by @soyuka in #7160
• fix(metadata): infer parameter string type from schema by @soyuka in #7161
• fix(laravel): persist embeded relations with groups by @soyuka in #7164
• feat(laravel): add name_converter option by @Seb33300 in #7159
• fix(laravel): validate the model instead of body by @soyuka in #7165
• fix(httpcache): generating iri cache tag for collection operation with path para… by @JakovKnezovicc in #7152
• fix(laravel): register error handler without graphql by @soyuka in #7168
• fix(state): do not expose FQCN in DeserializeProvider on PartialDenormalizationException by @alexndlm in #7158
• fix(serializer): Fix exception message to not expose resource FQCN by @alexndlm in #7156

New Contributors

• @Seb33300 made their first contribution in #7159
• @JakovKnezovicc made their first contribution in #7152

Full Changelog: v4.1.9...v4.1.12

v4.1.8

What's Changed

• fix(symfony): correct class to exclude to avoid inheriting global default for internal resource by @Crovitche-1623 in #7088
• fix(serializer): backport handling of union/intersection type in item normalizer by @deguif in #7106
• fix(state): specify :property parameter properties by @soyuka in #7110
• fix(serializer): throw NotNormalizableValueException when resource not found or invalid IRI on denormalization by @alexndlm in #6985
• fix(doctrine): filters schema for dates and numbers by @soyuka in #7131
• fix: filtering not using strategy set in attribute when strategy not set per property by @nesl247 in #7136
• doc(doctrine): document how to compute and sort a virtual field by @soyuka in #7113
• refactor(state): state options code duplication by @soyuka in #7109

New Contributors

• @rdavaillaud made their first contribution in #7083

Full Changelog: v4.1.7...v4.1.8

v4.1.7

What's Changed

• fix(metadata): Link Security YAML by @ytilotti in #7066
• fix(hydra): use correctly enable_docs by @alanpoulain in #7062
• fix(laravel): eloquent BelongsTo linking by @soyuka in #7075
• fix(symfony): internal resources should not inherit global defaults by @Crovitche-1623 in #7073
• fix(metadata): Use template typehint in parameters by @deguif in #7078
• fix(metadata): parameter provider within filter by @soyuka in #7081
• Revert "fix(jsonld): duplicate error fields when prefix is enabled" by @soyuka in #7074
• fix(symfony): do not ignore Test files on symfony by @soyuka in #7077

New Contributors

• @ytilotti made their first contribution in #7066

Full Changelog: v4.1.6...v4.1.7

v4.1.6

Full Changelog: v4.1.5...v4.1.6

v3.4.17

Exceptional release as 3.4 is not maintained anymore, this resolves our recent security issues:

GHSA-cg3c-245w-728m
GHSA-428q-q3vv-3fq3

What's Changed

• test: guides migration table eixts by @soyuka in #6931
• fix: allow parameter provider as object by @deguif in #7032
• fix: header parameter should be case insensitive by @soyuka in #7031
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @soyuka in #7046

Full Changelog: v3.4.16...v3.4.17

v4.1.5

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485

Full Changelog: v4.1.4...v4.1.5

Notes

Laravel installation broken, use v4.1.6

v4.0.22

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @soyuka in #7046

Full Changelog: v4.0.21...v4.0.22

v4.1.4

What's Changed

• fix(state): support filter interface on serializer filter parameter provider by @deguif in #7047
• fix(laravel): error handler only on api routes by @soyuka in #7049
• fix(symfony): serialization of closure inside the profiler by @soyuka in #7054
• fix(doctrine): joinColumn might be an array by @soyuka in #7060
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @soyuka in #7046

Full Changelog: v4.1.3...v4.1.4