Skip to content

Release v1.30.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Oct 14:59
· 29 commits to main since this release
v1.30.0
bc26500

v1.30.0

Changelog

Opt-in options for legacy hosts: unlocalized route suffix, POST logout, reset check-email page and session token, throttled reset signal, optional entity mapping, no routes for disabled features. See UPGRADING.

Added

  • locale.unlocalized_route_suffix (default _unlocalized): name suffix of the bare route twins when locale.in_path: both, e.g. .default for applications whose bare routes are already named <route>.default. UnlocalizedDefaultLocaleSubscriber follows it.
  • routes.logout.methods (default [GET]): [POST] makes the sign-out a CSRF-protected POST with the firewall logout.enable_csrf; the embed widget then renders Form\LogoutFormType (hidden _csrf_token) instead of the GET link.
  • password_reset.after_request_route (default null): redirect after a valid reset request to a host "check your email" page; PasswordReset\PasswordResetCheckEmail (session payload: profile, tokenTtl, throttled, availableAt) is stored for it.
  • password_reset.token_in_session (default false): the link token moves into the session and the form is served on the token-less URL (/reset-password/reset).
  • PasswordReset\PasswordResetThrottledException: a custom PasswordResetTokenManagerInterface::createForUser() throws it when a credential was requested too recently; PasswordResetRequestHandler::handle() now returns a PasswordResetRequestOutcome (throttled, availableAt) and sends nothing in that case, without revealing it on the request page.
  • doctrine.register_mapping (true default | false | auto): leave the auth_kit_* entities unmapped when social and QR login are disabled, including under Doctrine auto_mapping.
  • routing.skip_disabled_features (default false): do not register the routes of disabled registration, password reset, magic, social and QR login.

Full Changelog: v1.29.0...v1.30.0

Assets 2
Loading