Release v2.10.0

v2.10.0

Changelog

Security: the admin UI refuses to compile without form CSRF protection (CsrfProtectionPass, fail closed). See UPGRADING.

Security

• CSRF fails closed: new CsrfProtectionPass makes the container refuse to compile when the dashboard (web_ui.enabled: true) is on and form CSRF protection is unavailable (security.csrf.token_manager or form.type_extension.csrf missing, or framework.form.csrf_protection: false). Before, item / collection delete (DashboardPostDeleteType declares its own csrf_token_id), the CRUD forms and the JSON import accepted tokenless cross-site POSTs in that configuration. See UPGRADING and SECURITY.

Changed

• Documentation: the USAGE collapse screenshot is now a WebP re-captured from the demo by Playwright (docs/images/usage/breadcrumb-collapse.webp, phone width, menu open); the legacy docs/images/breadcrumb-collapse.png is removed. make -C demo/symfony8 demo-screenshots refreshes it with the README set, and CONTRIBUTING documents test-e2e / demo-screenshots (REQ-DEMO-013).
• Documentation: USAGE states the Twig override freeze rule, the upgrade-safe alternatives (collection classes, presentation.*, UiKit theme slots, web_ui.templates.<page> with @!NowoBreadcrumbKitBundle, single partials) and how to recover upstream templates after a freeze (REQ-TWIG-001).

What's Changed

• chore(deps): bump nowo-tech/ui-kit-bundle from 2.6.1 to 2.7.0 by @dependabot[bot] in #56
• docs: WebP collapse screenshot (REQ-DEMO-013) and Twig override freeze rule (REQ-TWIG-001) by @HecFranco in #57
• fix(security): dashboard refuses to compile without form CSRF protection by @HecFranco in #58

Full Changelog: v2.9.0...v2.10.0