Skip to content

3.7.0
Compare
Choose a tag to compare
@laminas-bot laminas-bot released this 25 Jul 19:06
· 138 commits to 4.11.x since this release
3.7.0
This tag was signed with the committer’s verified signature.
laminas-bot Laminas Bot
GPG key ID: EE6BC8F3E070039C
Learn about vigilant mode.
fbaea3e
This commit was created on github.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

Release Notes for 3.7.0

This is a SECURITY release. All users are encouraged to upgrade immediately.

Changed

  • This release bumps the minimum-supported version of laminas/laminas-diactoros to 2.11.2 in order to pick up security updates. Users who are still pinning to Diactoros 1.x versions will need to update to the later release.

  • Modifies the Mezzio\Swoole\ServerRequestSwooleFactory such that it checks the container for a Laminas\Diactoros\ServerRequestFilter\FilterServerRequestInterface service, creating one via Laminas\Diactoros\ServerRequestFilter\FilterUsingXForwardedHeaders::trustReservedSubnets() if none is present. This change ensures that X-Forwarded-* request headers are only honored when the request comes from a reserved, private subnet (localhost; classes A, B, and C subnets; and IPv6 private and local-link subnets). If you need to trust from any source, or never want to trust these headers, you may provide an alternate server request filter by registering an alternate implementation of the Laminas\Diactoros\ServerRequestFilter\FilterServerRequestInterface service.

3.7.0

  • Total issues resolved: 0
  • Total pull requests resolved: 0
  • Total contributors: 0
Assets 2
Loading