Released version 3.2.12

A hardening release. Crafted or malformed request parameters that used to slip through as uncaught 500s now degrade gracefully to 4xx. If your site gets probed by scanners – and it does – these three fixes turn a batch of "Server Error" reports into clean Bad Request / Not Found responses.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.