🗿 Hedgerow

v5.0 - 12 Aug 2026

Added

• Test suite and CI now run through Alchemy

Fixed

• Origins are fetched and matched correctly

Changed

• Origins match exactly, or by regex. An allowed origin must be written in full, scheme included, and matches that origin only. For a family of subdomains, pass a regex string instead:

  app()->cors(['origin' => 'https://example.com']);
  app()->cors(['origin' => '/^https:\/\/(.*\.)?example\.com$/']);

  Review your origin config while upgrading and make sure each entry is a full origin or a regex

• CORS now requires PHP 8.2+ and Leaf's http v5