Release v3.11.0

v3.11.0

Changelog

Security: empty role lists deny instead of granting everyone; CSRF fails closed without form CSRF protection. See UPGRADING.

Security

• Empty role lists deny (P1): ConfigurablePerformanceAccessChecker and the controller's BC fallback no longer treat
  an empty security.access_roles (or deprecated dashboard.roles, mapped into it) as "no role check": an empty list
  grants nothing. With dashboard.enabled: true, PerformanceExtension throws a LogicException at compile time
  when the list is empty and neither security.access_checker nor security.allow_unauthenticated is set.
• CSRF fails closed (P2): new CsrfProtectionPass refuses to compile when the dashboard is enabled without
  security.csrf.token_manager and form.type_extension.csrf, or with framework.form.csrf_protection: false. Before,
  clear / delete / review / purge / delete-by-filter accepted forged POSTs on such hosts. symfony/security-csrf is now
  a required dependency. See UPGRADING.

Fixed

• The dashboard no longer throws "The SecurityBundle is not registered" with security.allow_unauthenticated: true and
  no SecurityBundle: the access check passes a null user when no token storage exists.
• Demo (demo/symfony8) opens its login-less dashboard with security.allow_unauthenticated: true instead of an empty
  role list.

Commits

• Release v3.11.0: Security: empty role lists deny instead of granting everyone; CSRF fails closed without fo (e9145e6)
• fix(security): empty role lists deny and CSRF fails closed (fc28ea2)
• chore(deps): bump nowo-tech/ui-kit-bundle from 2.6.1 to 2.7.0 (#64) (6ca9522)