v4.1.5

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485

Full Changelog: v4.1.4...v4.1.5

Notes

Laravel installation broken, use v4.1.6

v4.0.22

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @soyuka in #7046

Full Changelog: v4.0.21...v4.0.22

v4.1.4

What's Changed

• fix(state): support filter interface on serializer filter parameter provider by @deguif in #7047
• fix(laravel): error handler only on api routes by @soyuka in #7049
• fix(symfony): serialization of closure inside the profiler by @soyuka in #7054
• fix(doctrine): joinColumn might be an array by @soyuka in #7060
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @soyuka in #7046

Full Changelog: v4.1.3...v4.1.4

v4.1.3

What's Changed

• fix(laravel): defer "filters" dependent services by @soyuka in #7045

Full Changelog: v4.1.2...v4.1.3

v4.1.2

What's Changed

• fix: fix React UMD & update-js.sh + add Laravel support in update-js.sh by @vincentchalamon in #7028
• fix(laravel): json api default parameters by @soyuka in #7027
• fix: allow parameter provider as object by @deguif in #7032
• fix: header parameter should be case insensitive by @soyuka in #7031
• fix(laravel): do not require files while autoconfiguring by @soyuka in #7024
• fix(symfony): allow to merge array with string in global defaults by @Crovitche-1623 in #7037
• fix(laravel): defer autoconfiguration by @soyuka in #7040

Full Changelog: v4.1.1...v4.1.2

v4.0.21

What's Changed

• fix: allow parameter provider as object by @deguif in #7032
• fix: header parameter should be case insensitive by @soyuka in #7031
• fix(symfony): allow to merge array with string in global defaults by @Crovitche-1623 in #7037

Full Changelog: v4.0.20...v4.0.21

v4.1.1

What's Changed

• chore: update client-side deps by @soyuka in #6961
• fix(symfony): detach objects from store to prevent infinite loop duri… by @LaurentHuzard in #6965
• fix(laravel): handle route prefix by @soyuka in #6978
• feat(laravel): add middleware granularity by @jonerickson in #6962
• chore: dependency constraints for laravel 12 by @soyuka in #6989
• fix(doctrine): Add a proper exception when a doctrine manager could not be found for a resource class by @lyrixx in #6995
• fix(laravel): query extensions with item operations by @soyuka in #7001
• fix(doctrine): correct the use statement for ManagerRegistry by @soyuka in #7004
• fix(openapi): boolean "true" value in HttpOperation::openapi by @soyuka in #7003
• fix: Doctrine mapping ArrayAccess deprecation by @dunglas in #6982
• fix(validation): deprecate string message for ValidationException con… by @soyuka in #7005
• fix(symfony): add a alwaysBootKernel property for BC layer by @Crovitche-1623 in #7007
• doc: comment typo in ApiResource.php by @Bartheyrman22 in #7012
• feat(laravel): auto configure our tagged interfaces by @soyuka in #7014
• feat(laravel): openapi export command by @soyuka in #7016
• fix(laravel): register ErrorProvider by @soyuka in #7018
• feat(laravel): stateOptions modelClass for eloquent by @soyuka in #7020
• fix(jsonld): duplicate error fields when prefix is enabled by @soyuka in #7021

New Contributors

• @LaurentHuzard made their first contribution in #6965
• @Bartheyrman22 made their first contribution in #7012

Full Changelog: v4.1.0...v4.1.1

v4.0.20

What's Changed

• fix(doctrine): Add a proper exception when a doctrine manager could not be found for a resource class by @lyrixx in #6995
• fix: Doctrine mapping ArrayAccess deprecation by @dunglas in #6982
• doc: comment typo in ApiResource.php by @Bartheyrman22 in #7012

New Contributors

• @Bartheyrman22 made their first contribution in #7012

Full Changelog: v4.0.19...v4.0.20

v4.1.0

Features

• feat: compatibility for laravel 12 by @soyuka in #6989
• feat: if a policy matches the name of a model we automatically register it by @valentindrdt in #6623
• feat: add hal support for laravel by @valentindrdt in #6621
• feat(doctrine): doctrine filters like laravel eloquent filters by @vinceAmstoutz in #6775
• feat(laravel): boolean filter by @adryyy10 in #6806
• feat(openapi): HTTP Authentication Support for Swagger UI by @toitzi in #6665
• feat(state): strict query parameters by @soyuka in #6399
• feat(doctrine): enhance getLinksHandler with method validation and typo suggestions by @SebLevDev in #6874
• feat(graphql): allow to configure max query depth and max query compl… by @soyuka in #6880
• feat(metadata): hide an hydra endpoint by @soyuka in #6871
• feat(swagger-ui): persist authorization by @ViPErCZ in #6877
• feat(mongodb): Add pagination metadata to the aggregation results by @GromNaN in #6912
• feat(mongodb): Replace usage of deprecated method AggregationBuilder::execute() by @GromNaN in #6933
• feat(openapi): filter x-apiplatform-tags to produce different openapi specifications by @soyuka in #6945
• feat(elasticsearch): re-introduce v7 support by @darthf1 in #6827
• implement NameConverterInterface instead of AdvancedNameConverterInte… by @tacman in #6956
• feat(jsonschema): Add checkMode parameter to control json schema validation in tests by @Crovitche-1623 in #6974

Bug fixes

• fix: reintroduce the show_webby parameter in Laravel config by @Deuchnord in #6741
• fix(laravel): restore accidentally removed BooleanFilter by @vinceAmstoutz in #6881
• fix!(laravel): fix use laravel fillable for writable props by @toitzi in #6898
• fix(hydra): rdfs:label should not duplicate title by @soyuka in #6748
• fix(openapi): document error outputs using json-schemas by @soyuka in #6923
• fix: missing filters on swagger ui entrypoint by @soyuka in #6950
• fix: errors retrieval and documentation by @soyuka in #6952
• fix(laravel): default to file cache instead of cache.default by @soyuka in #6955
• fix(symfony): Update bundle dependency to state package by @GromNaN in #6977
• fix: boot kernel only if it's necessary in createClient() method by @Crovitche-1623 in #6976

New Contributors

• @valentindrdt made their first contribution in #6623
• @simondaigre made their first contribution in #6757
• @adryyy10 made their first contribution in #6806
• @tacman made their first contribution in #6956
• @Crovitche-1623 made their first contribution in #6976

Full Changelog: https://github.com/api-platform/core/blob/4.1/CHANGELOG.md#v410

v4.0.19

What's Changed

• feat(laravel): add middleware granularity by @jonerickson in #6962
• chore: dependency constraints for laravel 12 by @soyuka in #6989

Full Changelog: v4.0.18...v4.0.19