What's Changed
-
Security: Stop decoding route arguments twice to prevent route constraint bypass (GHSA-h377-p8x2-prf9)
-
Ensure that Nyholm PSR17 factory is fully available by @andrewnicols in #3426
-
docs: remove $ prefix from bash snippets by @ErfanMomeniii in #3449
-
Cache only the last getAllowedMethods() lookup by @kaii-k in #3468
-
Substitute invalid UTF-8 in JSON error renderer output by @iliaal in #3465
-
Negotiate error handler content type on every request by @iliaal in #3464
-
Isolate testDetermineResponseFactoryThrowsRuntimeException on PHPUnit 10+ by @akrabat in #3470
New Contributors
- @andrewnicols made their first contribution in #3426
- @ErfanMomeniii made their first contribution in #3449
- @kaii-k made their first contribution in #3468
- @iliaal made their first contribution in #3465
Full Changelog: 4.15.2...4.15.3