🪾 Xylem

v5.0 - 12 Aug 2026

Added

• Added request()->object() to read the request body as objects instead of arrays
• Added Content-Security-Policy support on responses
• Downloads honor HTTP Range requests, so browsers and download managers can pause, resume and fetch in parallel segments
• Downloads stream in chunks: a 5GB file no longer needs 5GB of memory
• response()->view() and render() accept a status code
• Added callable defaults and function getters on request data, plus a content-type helper

Fixed

• Request bodies sent without a Content-Type header are parsed as JSON instead of falling through as a raw one-element array
• Headers::set() no longer forces a 200 status as a side effect of setting a header
• Form-encoded bodies parse with parse_str(), so valueless flags, values containing = and nested a[b]=1 all work
• request()->params() with no key returns the whole body instead of erroring
• Content-type matching handles ; charset=utf-8 and mixed casing
• getIp() returns the first entry of a forwarded list, getPort() falls back to 80, and getContentLength() returns the real length
• getFullUrl() no longer repeats the query string
• Headers::has() and hasHeader() check header names
• response()->status(null) is a no-op, withFlash() no longer makes a junk extra call, and flash and cookie display quirks are patched
• download() without a name emits a valid filename and returns early for missing files

Changed

• Http now requires PHP 8.2+