What's Changed

• fix(jsonschema): respect readableLink for resource-typed properties on non-resource parents by @wuchen90 in #8362
• fix(doctrine): support filtering scalar enum columns by IRI by @soyuka in #8358
• fix(ci): link monorepo root in laravel e2e so siblings resolve from working tree by @soyuka in #8363
• fix(openapi): don't apply the global name converter to the generated document by @soyuka in #8360
• fix(symfony): allow null $data in PlaceholderAction by @soyuka in #8359
• fix: clone Parameters before mutation in security and validator providers by @ostrolucky in #8378
• fix(mcp): make tools/list resilient to an empty registry by @soyuka in #8371
• fix(doctrine): use PHP property name in DQL for modern filters with name converter by @soyuka in #8382
• fix(serializer): denormalize nullable collections of enums/objects by @soyuka in #8381
• fix(test): remove stale phpstan ignores in CollectionNormalizerTest by @soyuka in #8384
• fix(symfony): don't expose entrypoint in openapi format by @soyuka in #8383

Full Changelog: v4.3.15...v4.3.16

What's Changed

• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in #8355
• test(functional): skip union-collection IRI test on legacy property-info by @soyuka in #8356

Full Changelog: v4.4.0-alpha.1...v4.4.0-alpha.2

What's Changed

• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in #8339
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in #8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in #8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in #8346
• fix(serializer): preserve deserialization path and expected type on IRI type-confusion guard by @alexndlm in #8353
• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in #8357

Full Changelog: v4.3.14...v4.3.15

What's Changed

• feat(openapi): Scalar API Reference documentation support by @soyuka in #7817
• fix(mcp): fallback to sdk handler when not found by @soyuka in #7818
• feat: support dynamic HTTP response status code via request attribute by @Griffon-Weglot in #7904
• fix(state): scope ReadLinkParameterProvider to current Link's class by @soyuka in #7943
• test: phpunit exception not restored by @soyuka in #7949
• feat(hydra): use hydra:memberAssertion instead of owl:equivalentClass by @abderrahimghazali in #7944
• refactor(jsonld): simplify @context building by @soyuka in #7952
• refactor: split normalizer/denormalizer by @soyuka in #7713
• test(jsonld,hydra,hal): migrate behat features to ApiTestCase by @soyuka in #7957
• feat(doctrine): state options repositoryMethod for query builder by @soyuka in #7115
• feat(symfony,laravel): withCredentials option to Swagger UI by @cay89 in #8197
• test: migrate remaining trivial behat features to ApiTestCase by @soyuka in #7971
• test: eliminate behat-migration skips and tighten ported asserts by @soyuka in #8198
• test: migrate elasticsearch/security/serializer/mongodb behat suites to ApiTestCase by @soyuka in #8202
• feat(jsonld): add resource-level jsonldContext for namespace prefixes by @soyuka in #8204
• ci: stale bot via actions, exempt typed issues by @soyuka in #8208
• ci(stale): bump checkout to v6 and github-script to v8 by @soyuka in #8213
• test: migrate doctrine/graphql behat features to ApiTestCase by @soyuka in #8205
• ci: trim phpunit-components matrix and merge fail-deprecation by @soyuka in #8214
• feat(metadata): throwOnNotFound option by @soyuka in #6027
• feat!(state): constraint-aware 422 for denormalization errors by @soyuka in #8211
• feat(doctrine): per-property filter map in FreeTextQueryFilter by @soyuka in #8257
• chore: fix php-cs-fixer by @alexisLefebvre in #8269
• test: drop stale serializer 8.1 getErrors() deprecation expectation by @soyuka in #8287
• feat(doctrine): add EndSearchFilter primary for ORM and ODM by @soyuka in #8319
• feat(doctrine): promote ComparisonFilter out of @experimental by @soyuka in #8323
• feat(doctrine): promote OrFilter out of @experimental by @soyuka in #8324
• feat(metadata): document BackwardCompatibleFilterDescriptionTrait as public API by @soyuka in #8326
• feat(doctrine): add StartSearchFilter and WordStartSearchFilter (ORM + ODM) by @soyuka in #8328
• feat(doctrine): deprecate AbstractFilter base class by @soyuka in #8330
• feat(symfony): deprecate Symfony Security AccessDeniedException by @soyuka in #8318
• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in #8339
• feat(symfony): deprecate jsonapi.use_iri_as_id defaulting to true by @soyuka in #8327
• feat(doctrine): deprecate the extends-AbstractFilter form of Date/Range/Exists filters by @soyuka in #8340
• feat(doctrine): deprecate the legacy SearchFilter/Boolean/Numeric/BackedEnum/OrderFilter by @soyuka in #8341
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in #8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in #8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in #8346
• fix(graphql): build filter args from parameters by @soyuka in #8347
• feat(openapi): support OpenAPI 3.2.0 by @soyuka in #8350
• feat(symfony): api:upgrade-filter codemod + filter fixture migration by @soyuka in #8344

New Contributors

• @Griffon-Weglot made their first contribution in #7904

Full Changelog: v4.3.14...v4.4.0-alpha.1

What's Changed

• fix(mcp): support mcp/sdk 0.6 ResourceDefinition in Loader by @soyuka in #8302
• fix(openapi): serialize Reference objects with $ref in the generated document by @soyuka in #8306
• fix(doctrine): filter parent link from uri variables in fetch_data=false reference by @soyuka in #8295
• fix(doctrine): exclude self-reference relation links from GraphQL root item lookup by @soyuka in #8314
• fix(mcp): support mcp/sdk 0.6 by @soyuka in #8311
• fix(jsonapi): exclude relations from openapi attributes schema by @soyuka in #8313
• chore: drop phpstan mcp/sdk class.notFound ignore by @soyuka in #8320
• feat(laravel): boot without a database via dumped metadata by @soyuka in #8290
• fix(jsonapi): correct relationship schemas in generated json schema by @soyuka in #8321
• refactor(jsonapi): single source of truth for the attribute/relationship split by @soyuka in #8325
• fix(serializer): fix union types denormalization fallback after security mismatch by @jonnyeom in #8333
• chore: fix phpstan on 4.3 by @soyuka in #8331

Full Changelog: v4.3.13...v4.3.14

What's Changed

• fix(elasticsearch): coerce document _id to declared int identifier type by @soyuka in #8296
• fix(openapi): throw clear error for openapi parameter missing name in yaml config by @soyuka in #8297
• fix(jsonschema): embed relations of non-resource objects in output schema by @alexisLefebvre in #8294

Full Changelog: v4.3.12...v4.3.13

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2)

What's Changed

• fix(doctrine): guard unmapped relation links in ORM handleLinks by @soyuka in #8293
• fix(graphql): honor custom mutation output class in payload type by @soyuka in #8300

Full Changelog: v4.3.11...v4.3.12

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2)

Full Changelog: v4.2.25...v4.2.26

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2)

Full Changelog: v4.1.29...v4.1.30

What's Changed

• fix(metadata): preserve explicit class on ApiResource when propagating defaults by @soyuka in #8262
• fix(openapi): ship oauth2-redirect.js with swagger-ui assets by @soyuka in #8261
• fix(httpcache): allow custom http method on SouinPurger and SurrogateKeysPurger by @soyuka in #8259
• fix(swagger): improve dark mode button in swaggerUI by @divine in #8265
• fix(metadata): read ApiProperty from trait private properties inherited via parent class by @soyuka in #8275
• fix(hydra): declare hydra:view links as nullable in json schema by @soyuka in #8277
• fix(jsonschema): embed genId:false relations in output schema by @alexisLefebvre in #8272
• fix(mcp): always serialize payload into TextContent when structuredContent is disabled by @alexisLefebvre in #8270
• fix(mcp): resolve $ref inside oneOf/anyOf when flattening tool outputSchema by @alexisLefebvre in #8268
• fix(symfony): expose uri variables in security expression context by @soyuka in #8279
• fix(metadata) metadata mutators for resource & operations with lower priority by @tandev in #8273
• fix(metadata): preserve nested array query parameters in IriHelper by @soyuka in #8278
• fix(metadata): keep explicitly set GraphQL mutation description by @fabianbloching in #8286
• fix(symfony): register http cache purgers independently of invalidation flag by @soyuka in #8260
• fix(jsonld): replace already-populated nested relation from embedded @id on patch by @soyuka in #8274
• fix(jsonschema): don't leak operation deprecation onto sub-schemas by @soyuka in #8289

New Contributors

• @tandev made their first contribution in #8273
• @fabianbloching made their first contribution in #8286

Full Changelog: v4.3.10...v4.3.11