Bump api-platform/core from 4.3.3 to 4.3.12 by dependabot[bot] · Pull Request #28 · SplashSync/Brevo-Bundle

dependabot · 2026-08-09T06:02:38Z

Bumps api-platform/core from 4.3.3 to 4.3.12.

Release notes

Sourced from api-platform/core's releases.

v4.3.12

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

fix(serializer): validate IRI target class on relation denormalization (6bcbeb2db)

What's Changed

fix(doctrine): guard unmapped relation links in ORM handleLinks by @soyuka in api-platform/core#8293

fix(graphql): honor custom mutation output class in payload type by @soyuka in api-platform/core#8300

Full Changelog: api-platform/core@v4.3.11...v4.3.12

v4.3.11

What's Changed

fix(metadata): preserve explicit class on ApiResource when propagating defaults by @soyuka in api-platform/core#8262

fix(openapi): ship oauth2-redirect.js with swagger-ui assets by @soyuka in api-platform/core#8261

fix(httpcache): allow custom http method on SouinPurger and SurrogateKeysPurger by @soyuka in api-platform/core#8259

fix(swagger): improve dark mode button in swaggerUI by @divine in api-platform/core#8265

fix(metadata): read ApiProperty from trait private properties inherited via parent class by @soyuka in api-platform/core#8275

fix(hydra): declare hydra:view links as nullable in json schema by @soyuka in api-platform/core#8277

fix(jsonschema): embed genId:false relations in output schema by @alexisLefebvre in api-platform/core#8272

fix(mcp): always serialize payload into TextContent when structuredContent is disabled by @alexisLefebvre in api-platform/core#8270

fix(mcp): resolve $ref inside oneOf/anyOf when flattening tool outputSchema by @alexisLefebvre in api-platform/core#8268

fix(symfony): expose uri variables in security expression context by @soyuka in api-platform/core#8279

fix(metadata) metadata mutators for resource & operations with lower priority by @tandev in api-platform/core#8273

fix(metadata): preserve nested array query parameters in IriHelper by @soyuka in api-platform/core#8278

fix(metadata): keep explicitly set GraphQL mutation description by @fabianbloching in api-platform/core#8286

fix(symfony): register http cache purgers independently of invalidation flag by @soyuka in api-platform/core#8260

fix(jsonld): replace already-populated nested relation from embedded @id on patch by @soyuka in api-platform/core#8274

fix(jsonschema): don't leak operation deprecation onto sub-schemas by @soyuka in api-platform/core#8289

New Contributors

@tandev made their first contribution in api-platform/core#8273

@fabianbloching made their first contribution in api-platform/core#8286

Full Changelog: api-platform/core@v4.3.10...v4.3.11

v4.3.10

What's Changed

fix(swagger): fix SwaggerUI CSS override by @vincentchalamon in api-platform/core#8245

fix(laravel): persist dirty embedded belongsTo relations by @soyuka in api-platform/core#8246

fix(graphql): dispatch item Query through its own provider by @soyuka in api-platform/core#8237

fix(laravel): register graphql routes before catch-all entrypoint by @soyuka in api-platform/core#8248

fix(laravel): detect enum casts in eloquent property metadata factory by @soyuka in api-platform/core#8247

fix(jsonapi): do not require id in input schema for post operations by @soyuka in api-platform/core#8252

fix(laravel): honor path_segment_name_generator config for url segments by @soyuka in api-platform/core#8251

fix(symfony): skip ErrorResourceAttributeLoaderPass on Symfony 6.4 by @soyuka in api-platform/core#8253

fix(serializer): allow nullable to-many relations to normalize as null by @soyuka in api-platform/core#8254

... (truncated)

Changelog

Sourced from api-platform/core's changelog.

v4.3.12

Bug fixes

6bcbeb2db fix(serializer): validate IRI target class on relation denormalization

6b1fe1e47 fix(doctrine): guard unmapped relation links in ORM handleLinks (#8293)

cc021e4fa fix(graphql): honor custom mutation output class in payload type (#8300)

v4.3.11

Bug fixes

2726085ae fix(metadata): keep explicitly set GraphQL mutation description (#8286)

4819b5f9f fix(metadata): metadata mutators for resource & operations with lower priority (#8273)

6b8bd0a3d fix(metadata): read ApiProperty from trait private properties inherited via parent class (#8275)

aced52dd0 fix(metadata): preserve nested array query parameters in IriHelper (#8278)

c37e27079 fix(metadata): preserve explicit class on ApiResource when propagating defaults (#8262)

c79045718 fix(jsonschema): embed genId:false relations in output schema (#8272)

ce4f6c210 fix(jsonschema): don't leak operation deprecation onto sub-schemas (#8289)

134bb5cd7 fix(jsonld): replace already-populated nested relation from embedded @id on patch (#8274)

4b50a4edc fix(hydra): declare hydra:view links as nullable in json schema (#8277)

78538aa90 fix(mcp): resolve $ref inside oneOf/anyOf when flattening tool outputSchema (#8268)

a8d4b00f5 fix(mcp): always serialize payload into TextContent when structuredContent is disabled (#8270)

1ffe0ada8 fix(symfony): register http cache purgers independently of invalidation flag (#8260)

81a1307fe fix(symfony): expose uri variables in security expression context (#8279)

d6fd5bfae fix(httpcache): allow custom http method on SouinPurger and SurrogateKeysPurger (#8259)

b3b376225 fix(openapi): ship oauth2-redirect.js with swagger-ui assets (#8261)

fb2062465 fix(swagger): improve dark mode button in swaggerUI (#8265)

Notes

JSON-LD PATCH: an embedded @id on a nested writable relation now replaces the currently-linked relation when it points to a different resource. A dangling embedded @id now returns a 400 instead of being silently ignored (it previously mutated the existing relation in place). See #8274.

v4.3.10

Bug fixes

149adf70f fix(laravel): register graphql routes before catch-all entrypoint (#8248)

1bc670c72 fix(jsonapi): allow opt-in client-generated IDs on POST per spec (#7930)

39edcdddd fix(symfony): skip ErrorResourceAttributeLoaderPass on Symfony 6.4 (#8253)

4609a9e5d fix(graphql): dispatch item Query through its own provider (#8237)

5c62c1bd8 fix(jsonapi): do not require id in input schema for post operations (#8252)

7bde11eb9 fix(swagger): fix SwaggerUI CSS override (#8245)

86a09b3c3 fix(state): guard hex2bin against malformed query parameter keys (#8255)

a6bdf7134 fix(laravel): detect enum casts in eloquent property metadata factory (#8247)

b5c41aff5 fix(laravel): honor path_segment_name_generator config for url segments (#8251)

d5d8176f1 fix(serializer): allow nullable to-many relations to normalize as null (#8254)

f4d2b56c2 fix(laravel): persist dirty embedded belongsTo relations (#8246)

v4.3.9

... (truncated)

Commits

1510da4 doc: changelog 4.3.12
105cc43 Merge 4.2 into 4.3
2082421 doc: changelog 4.2.26
8923522 Merge 4.1 into 4.2
0720d3b doc: changelog 4.1.30
6bcbeb2 fix(serializer): validate IRI target class on relation denormalization
cc021e4 fix(graphql): honor custom mutation output class in payload type (#8300)
6b1fe1e fix(doctrine): guard unmapped relation links in ORM handleLinks (#8293)
17b1831 doc: changelog 4.3.11
ce4f6c2 fix(jsonschema): don't leak operation deprecation onto sub-schemas (#8289)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [api-platform/core](https://github.com/api-platform/core) from 4.3.3 to 4.3.12. - [Release notes](https://github.com/api-platform/core/releases) - [Changelog](https://github.com/api-platform/core/blob/main/CHANGELOG.md) - [Commits](api-platform/core@v4.3.3...v4.3.12) --- updated-dependencies: - dependency-name: api-platform/core dependency-version: 4.3.12 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file php Pull requests that update Php code labels Aug 9, 2026

dependabot Bot mentioned this pull request Aug 9, 2026

Bump api-platform/core from 4.3.3 to 4.3.8 #24

Closed

Navigation Menu

Bump api-platform/core from 4.3.3 to 4.3.12 - #28

Bump api-platform/core from 4.3.3 to 4.3.12#28
dependabot[bot] wants to merge 1 commit into
3.0from
dependabot/composer/api-platform/core-4.3.12

dependabot Bot commented on behalf of github Aug 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 9, 2026

v4.3.12

🔒 Security

What's Changed

v4.3.11

What's Changed

New Contributors

v4.3.10

What's Changed

v4.3.12

Bug fixes

v4.3.11

Bug fixes

Notes

v4.3.10

Bug fixes

v4.3.9

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants