Release v1.14.2

Release v1.14.2

Changelog

Bundle routes are opt-in again on Symfony >= 7.3 (REQ-SF-004 rule 7). See UPGRADING.

Security

• Panel and preview routes registered without being imported (REQ-SF-004 rule 7). On Symfony >= 7.3 every autoconfigured #[Route] controller gets the routing.controller tag, so a host whose config/routes.yaml holds the default controllers: { resource: routing.controllers } loaded the panel routes without web_ui.path_prefix — the panel on / (over the host home page), /login, /enable, /disable, /schedule, /history…, outside any firewall or access_control rule written for the panel path — and the preview route, even when the host never imported @NowoMaintenanceModeBundle/Resources/config/routes.yaml. The controllers are no longer autoconfigured (explicit controller.service_arguments tag); the routes exist only where the host imports routes.yaml. Regression test with a kernel that only loads routing.controllers.

What's Changed

• fix(routing): keep bundle routes opt-in (REQ-SF-004 rule 7) by @HecFranco in #25

Full Changelog: v1.14.1...v1.14.2