Skip to content
/ ux-live-component Public

v3.1.0

Choose a tag to compare

View all tags
@fabpot fabpot released this 29 May 07:09
Immutable release. Only release title and notes can be modified.
v3.1.0
This tag was signed with the committer’s verified signature.
fabpot Fabien Potencier
SSH Key Fingerprint: 2Epes5EqLalzBuDpYoQuproz9c57CsymvlzEGYtOXJw
Verified
Learn about vigilant mode.
9ad6223

Changelog (v3.0.0...v3.1.0)

  • security #557 Require X-Requested-With header to prevent CSRF (@Kocal)
  • security #cve-2026-49208 Parse format-less date LiveProps strictly with RFC 3339 (@Kocal)
  • security #cve-2026-49209 Cap the number of actions per _batch request (@Kocal)
  • security #cve-2026-49210 Reject malicious child component tags (@Kocal)
  • security #cve-2026-49212 Bind HMAC checksum to component name and slot (@Kocal)
  • feature #3432 Improve form validation error messages in exceptions (@PierreCapel)
  • bug #3566 Make LiveComponentSubscriber safe-by-default (@Kocal)
  • bug #3508 Fix dynamic template resolution when using "loading" attribute (@xDeSwa)
  • feature #3442 Use aria-busy attribute during component re-render (@Amoifr)

Contributors

Kocal, Amoifr, and 2 other contributors
Assets 3
Loading