v5.0.0-alpha.2

Breaking changes

• feat!: remove deprecated APIs scheduled for 5.0 (#8367)
• feat!: remove the legacy PropertyInfo Type system, use symfony/type-info (#8364)
• feat!: core 5.0 cleanups — PropertyAwareFilterInterface::getProperties(), JSON:API status as string (#8366)

Features

• feat(doctrine): standalone Date/Exists filters, ComparisonFilter [between], deprecate RangeFilter (#8351)

Bug fixes

• fix(jsonschema): drop removed getBuiltinTypes path in SchemaPropertyMetadataFactory

Dependencies

• Require symfony/* ^7.4 || ^8.0 across all components; drop support for Symfony 6.4 and 7.0–7.3 (#8397)
• Stabilize formerly @experimental APIs (Elasticsearch, State parameter providers, PropertyAwareFilterInterface, Laravel); @experimental kept only on MCP (#8365)

v4.4.0-alpha.3

Bug fixes

• fix(state): correct composer "conflicts" key to "conflict" (#8400)

Dependencies

• Require symfony/* ^7.4 || ^8.0 across all components; drop support for Symfony 6.4 and 7.0–7.3 (#8397)
• Stabilized formerly @experimental APIs (Elasticsearch, State parameter providers, PropertyAwareFilterInterface, Laravel ParameterValidatorProvider); @experimental now kept only on MCP (#8398)

v4.3.17

What's Changed

• fix(doctrine): fetch_data=false reference for stateOptions resources by @bendavies in #8387
• fix(openapi): don't inherit name converter from a possibly-missing Symfony parent by @soyuka in #8386
• fix(serializer): report enum backing type in denormalization violations by @soyuka in #8389
• fix(serializer): preserve denormalization errors for nullable object properties by @bendavies in #8393

Full Changelog: v4.3.16...v4.3.17

v4.3.16

What's Changed

• fix(jsonschema): respect readableLink for resource-typed properties on non-resource parents by @wuchen90 in #8362
• fix(doctrine): support filtering scalar enum columns by IRI by @soyuka in #8358
• fix(ci): link monorepo root in laravel e2e so siblings resolve from working tree by @soyuka in #8363
• fix(openapi): don't apply the global name converter to the generated document by @soyuka in #8360
• fix(symfony): allow null $data in PlaceholderAction by @soyuka in #8359
• fix: clone Parameters before mutation in security and validator providers by @ostrolucky in #8378
• fix(mcp): make tools/list resilient to an empty registry by @soyuka in #8371
• fix(doctrine): use PHP property name in DQL for modern filters with name converter by @soyuka in #8382
• fix(serializer): denormalize nullable collections of enums/objects by @soyuka in #8381
• fix(test): remove stale phpstan ignores in CollectionNormalizerTest by @soyuka in #8384
• fix(symfony): don't expose entrypoint in openapi format by @soyuka in #8383

Full Changelog: v4.3.15...v4.3.16

v4.4.0-alpha.2

What's Changed

• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in #8355
• test(functional): skip union-collection IRI test on legacy property-info by @soyuka in #8356

Full Changelog: v4.4.0-alpha.1...v4.4.0-alpha.2

v4.3.15

What's Changed

• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in #8339
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in #8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in #8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in #8346
• fix(serializer): preserve deserialization path and expected type on IRI type-confusion guard by @alexndlm in #8353
• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in #8357

Full Changelog: v4.3.14...v4.3.15

v4.4.0-alpha.1

What's Changed

• feat(openapi): Scalar API Reference documentation support by @soyuka in #7817
• fix(mcp): fallback to sdk handler when not found by @soyuka in #7818
• feat: support dynamic HTTP response status code via request attribute by @Griffon-Weglot in #7904
• fix(state): scope ReadLinkParameterProvider to current Link's class by @soyuka in #7943
• test: phpunit exception not restored by @soyuka in #7949
• feat(hydra): use hydra:memberAssertion instead of owl:equivalentClass by @abderrahimghazali in #7944
• refactor(jsonld): simplify @context building by @soyuka in #7952
• refactor: split normalizer/denormalizer by @soyuka in #7713
• test(jsonld,hydra,hal): migrate behat features to ApiTestCase by @soyuka in #7957
• feat(doctrine): state options repositoryMethod for query builder by @soyuka in #7115
• feat(symfony,laravel): withCredentials option to Swagger UI by @cay89 in #8197
• test: migrate remaining trivial behat features to ApiTestCase by @soyuka in #7971
• test: eliminate behat-migration skips and tighten ported asserts by @soyuka in #8198
• test: migrate elasticsearch/security/serializer/mongodb behat suites to ApiTestCase by @soyuka in #8202
• feat(jsonld): add resource-level jsonldContext for namespace prefixes by @soyuka in #8204
• ci: stale bot via actions, exempt typed issues by @soyuka in #8208
• ci(stale): bump checkout to v6 and github-script to v8 by @soyuka in #8213
• test: migrate doctrine/graphql behat features to ApiTestCase by @soyuka in #8205
• ci: trim phpunit-components matrix and merge fail-deprecation by @soyuka in #8214
• feat(metadata): throwOnNotFound option by @soyuka in #6027
• feat!(state): constraint-aware 422 for denormalization errors by @soyuka in #8211
• feat(doctrine): per-property filter map in FreeTextQueryFilter by @soyuka in #8257
• chore: fix php-cs-fixer by @alexisLefebvre in #8269
• test: drop stale serializer 8.1 getErrors() deprecation expectation by @soyuka in #8287
• feat(doctrine): add EndSearchFilter primary for ORM and ODM by @soyuka in #8319
• feat(doctrine): promote ComparisonFilter out of @experimental by @soyuka in #8323
• feat(doctrine): promote OrFilter out of @experimental by @soyuka in #8324
• feat(metadata): document BackwardCompatibleFilterDescriptionTrait as public API by @soyuka in #8326
• feat(doctrine): add StartSearchFilter and WordStartSearchFilter (ORM + ODM) by @soyuka in #8328
• feat(doctrine): deprecate AbstractFilter base class by @soyuka in #8330
• feat(symfony): deprecate Symfony Security AccessDeniedException by @soyuka in #8318
• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in #8339
• feat(symfony): deprecate jsonapi.use_iri_as_id defaulting to true by @soyuka in #8327
• feat(doctrine): deprecate the extends-AbstractFilter form of Date/Range/Exists filters by @soyuka in #8340
• feat(doctrine): deprecate the legacy SearchFilter/Boolean/Numeric/BackedEnum/OrderFilter by @soyuka in #8341
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in #8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in #8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in #8346
• fix(graphql): build filter args from parameters by @soyuka in #8347
• feat(openapi): support OpenAPI 3.2.0 by @soyuka in #8350
• feat(symfony): api:upgrade-filter codemod + filter fixture migration by @soyuka in #8344

New Contributors

• @Griffon-Weglot made their first contribution in #7904

Full Changelog: v4.3.14...v4.4.0-alpha.1

v4.3.14

What's Changed

• fix(mcp): support mcp/sdk 0.6 ResourceDefinition in Loader by @soyuka in #8302
• fix(openapi): serialize Reference objects with $ref in the generated document by @soyuka in #8306
• fix(doctrine): filter parent link from uri variables in fetch_data=false reference by @soyuka in #8295
• fix(doctrine): exclude self-reference relation links from GraphQL root item lookup by @soyuka in #8314
• fix(mcp): support mcp/sdk 0.6 by @soyuka in #8311
• fix(jsonapi): exclude relations from openapi attributes schema by @soyuka in #8313
• chore: drop phpstan mcp/sdk class.notFound ignore by @soyuka in #8320
• feat(laravel): boot without a database via dumped metadata by @soyuka in #8290
• fix(jsonapi): correct relationship schemas in generated json schema by @soyuka in #8321
• refactor(jsonapi): single source of truth for the attribute/relationship split by @soyuka in #8325
• fix(serializer): fix union types denormalization fallback after security mismatch by @jonnyeom in #8333
• chore: fix phpstan on 4.3 by @soyuka in #8331

Full Changelog: v4.3.13...v4.3.14

v4.3.13

What's Changed

• fix(elasticsearch): coerce document _id to declared int identifier type by @soyuka in #8296
• fix(openapi): throw clear error for openapi parameter missing name in yaml config by @soyuka in #8297
• fix(jsonschema): embed relations of non-resource objects in output schema by @alexisLefebvre in #8294

Full Changelog: v4.3.12...v4.3.13

v4.3.12

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2)

What's Changed

• fix(doctrine): guard unmapped relation links in ORM handleLinks by @soyuka in #8293
• fix(graphql): honor custom mutation output class in payload type by @soyuka in #8300

Full Changelog: v4.3.11...v4.3.12