Skip to content

v7.4.23

Choose a tag to compare

View all tags
@fabpot fabpot released this 04 Nov 11:29
· 310 commits to 8.2 since this release
Immutable release. Only release title and notes can be modified.
v7.4.23
This tag was signed with the committer’s verified signature.
fabpot Fabien Potencier
SSH Key Fingerprint: 2Epes5EqLalzBuDpYoQuproz9c57CsymvlzEGYtOXJw
Verified
Learn about vigilant mode.
9df8eb8

Changelog (v7.4.22...v7.4.23)

  • security #GHSA-hqp2-7rr8-hf26 Ignore undeclared property paths when denormalizing (@nicolas-grekas)
  • security #cve-2026-118515 Don't build UploadedFile and other file objects from denormalized data (@nicolas-grekas)
  • security #GHSA-hqp2-7rr8-hf26 Ignore undeclared property paths when denormalizing (@nicolas-grekas)
  • security #GHSA-pxj9-jh84-vhm5 Lowercase the scheme of data URIs before opening them (@nicolas-grekas)
  • security #cve-2026-118515 Don't build UploadedFile and other file objects from denormalized data (@nicolas-grekas)
  • bug #67752 Skip empty lines when decoding multi-column CSV documents (@0xABCD01)
  • bug #67665 Fix denormalizing a data URI ending with slashes to a File (@ahmed-bhs)

[SECURITY] Security release

Contributors

nicolas-grekas, ahmed-bhs, and 0xABCD01
Assets 3
Loading