Release v1.25.1

Release v1.25.1

Changelog

Bundle routes are opt-in again on Symfony >= 7.3 (REQ-SF-004 rule 7). See UPGRADING.

Security

• Panel routes registered without being imported (REQ-SF-004 rule 7). On Symfony >= 7.3 every autoconfigured #[Route] controller gets the routing.controller tag (#[AsController] also autoconfigured the controllers), so a host whose config/routes.yaml holds the default controllers: { resource: routing.controllers } loaded the backup panel routes without panel.path_prefix — the panel on / (over the host home page), /create, /restore/{id}, /delete/{id}, /progress.json, /history, outside any firewall or access_control rule written for the panel path — even when the host never imported @NowoSiteBackupBundle/Resources/config/routes.yaml. The controllers are no longer autoconfigured and no longer carry #[AsController] (explicit controller.service_arguments tag); the panel and setup routes come only from PanelRouteLoader / SetupRouteLoader. Regression test with a kernel that only loads routing.controllers.

What's Changed

• fix(routing): keep bundle routes opt-in (REQ-SF-004 rule 7) by @HecFranco in #31

Full Changelog: v1.25.0...v1.25.1