Skip to content

v3.19.1

Latest
Latest

Choose a tag to compare

View all tags
@n0nag0n n0nag0n released this 11 Aug 05:30
· 33 commits to master since this release
v3.19.1
d8fe784

Security

  • Fix flight.allow_method_override so setting it to false actually disables X-HTTP-Method-Override and _method method spoofing (GHSA-vr9m-jx6f-hhj6). The mitigation introduced for CVE-2026-42551 was applied after Request was constructed, so the opt-out never took effect on routing.

Upgrade note: If you set Flight::set('flight.allow_method_override', false) on 3.18.1–3.19.0, upgrade to 3.19.1 for that setting to work. The default remains true for backwards compatibility; disabling override is still recommended when you do not need HTML form method spoofing.

Full Changelog

v3.19.0...v3.19.1

Assets 2
Loading