🗿 Hedgerow

v5.0 - 12 Aug 2026

Added

• Test suite and CI now run through Alchemy

Fixed

• Origins are fetched and matched correctly

Changed

• Origins match exactly, or by regex. An allowed origin must be written in full, scheme included, and matches that origin only. For a family of subdomains, pass a regex string instead:

  app()->cors(['origin' => 'https://example.com']);
  app()->cors(['origin' => '/^https:\/\/(.*\.)?example\.com$/']);

  Review your origin config while upgrading and make sure each entry is a full origin or a regex

• CORS now requires PHP 8.2+ and Leaf's http v5

🚗 Getaway Driver

v1.2 - 29 September 2024

Fixed

• Patched up preg_match() issue (#5)
• Renamed headers to allowedHeaders (#4)

🌹 Exotic Runaway

Fixed

• Fixed error thrown from same origin requests (#2)

🌹 Local Runaway

v1.1 -16 July 2022

Fixed

• Fixed origin matching
• Fixed breaks when origin is array
• Patched up origin comparison on regex
• Fixed setting up of headers

Changed

• Changed allowedHeaders key to headers

Removed

• Removed deprecated code

v1.0

22 Sep, 2021