Core Laravel Package

What's Changed

• fix(metadata): allow GraphQL operations in parameter attributes on properties by @Maxcastel in https://github.com/api-platform/core/pull/8621
• fix(doctrine): use a portable LIKE escape char by @soyuka in https://github.com/api-platform/core/pull/8671
• fix(doctrine): use ON for arbitrary join in links by @soyuka in https://github.com/api-platform/core/pull/8672
• fix(doctrine): left join nested props in OrFilter by @soyuka in https://github.com/api-platform/core/pull/8674
• fix(jsonschema): emit an empty schema for mixed by @soyuka in https://github.com/api-platform/core/pull/8670
• feat(metadata): accept operation class names in parameter operations by @Maxcastel in https://github.com/api-platform/core/pull/8624
• fix(metadata): operation parameters take precedence over parameter attributes on properties by @Maxcastel in https://github.com/api-platform/core/pull/8623
• fix(state): avoid deprecated PartialDenormalizationException::getErrors() by @dualfroz in https://github.com/api-platform/core/pull/8663
• fix(doctrine): accept SortDirection enum in ordering by @nozarashi20 in https://github.com/api-platform/core/pull/8662
• chore(serializer): fix phpstan narrowing by @soyuka in https://github.com/api-platform/core/pull/8673
• fix(state): restore 422 for empty scalar params by @soyuka in https://github.com/api-platform/core/pull/8675
• fix(validator): returns 422 for backed enum errors by @VincentLanglet in https://github.com/api-platform/core/pull/8656
• fix(laravel): accept null on an optional belongsTo by @devtechedge in https://github.com/api-platform/core/pull/8666
• fix(json-schema): use allOf for intersection types by @soyuka in https://github.com/api-platform/core/pull/8653
• fix(json-schema): keep operation groups in context by @soyuka in https://github.com/api-platform/core/pull/8643
• fix(json-schema): nested gen_id follows the property by @soyuka in https://github.com/api-platform/core/pull/8644
• fix(json-schema): nested resource ignores output DTO by @soyuka in https://github.com/api-platform/core/pull/8652
• Add support for GroupSequence by @VincentLanglet in https://github.com/api-platform/core/pull/8645
• test(hydra): stub resolver without with() for PHPUnit 13 by @soyuka in https://github.com/api-platform/core/pull/8707
• test: import ApiPlatform\Test\ApiTestCase by @soyuka in https://github.com/api-platform/core/pull/8708
• fix(symfony): reset the skolem IRI converter between requests by @silverbackdan in https://github.com/api-platform/core/pull/8681
• fix(metadata): Put::withAllowCreate() and Link::withFromProperty() return a new instance by @Maxcastel in https://github.com/api-platform/core/pull/8685
• fix(metadata): do not override the parameter provider with the filter provider by @Maxcastel in https://github.com/api-platform/core/pull/8689
• fix(metadata): apply defaults that use a can* getter by @Maxcastel in https://github.com/api-platform/core/pull/8691
• fix(metadata): keep queryParameterValidationEnabled on ApiResource by @Maxcastel in https://github.com/api-platform/core/pull/8692
• fix(metadata): pass stateOptions and map to the GraphQL QueryCollection parent constructor by @Maxcastel in https://github.com/api-platform/core/pull/8693
• fix(metadata): copy contentNegotiation in withOperation() by @Maxcastel in https://github.com/api-platform/core/pull/8694
• fix(doctrine): read the column default option with doctrine/orm 3 by @Maxcastel in https://github.com/api-platform/core/pull/8705
• fix(metadata): keep explicit readableLink and writableLink on collections of non-resource classes by @Maxcastel in https://github.com/api-platform/core/pull/8706
• fix(doctrine): put-create under a slug parent link by @soyuka in https://github.com/api-platform/core/pull/8688
• fix(symfony): reset the Mercure publisher between requests by @KevinMartinsDev in https://github.com/api-platform/core/pull/8684
• fix(doctrine): accept resolved resources in links by @soyuka in https://github.com/api-platform/core/pull/8687
• test(laravel): use createOne() for the for() relation by @soyuka in https://github.com/api-platform/core/pull/8718

New Contributors

• @devtechedge made their first contribution in https://github.com/api-platform/core/pull/8666

Full Changelog: https://github.com/api-platform/core/compare/v5.0.3...v5.0.4

What's Changed

• fix(jsonschema): groups on non-resource class by @soyuka in https://github.com/api-platform/core/pull/8594
• fix(graphql): resolve custom query args after the resource loop by @soyuka in https://github.com/api-platform/core/pull/8596
• fix(symfony): guard browserkit verbose setter on symfony 6.4 by @ousamabenyounes in https://github.com/api-platform/core/pull/8580
• fix(laravel): don't duplicate the filter interface use statement by @NotAFlightRisk in https://github.com/api-platform/core/pull/8593
• fix(jsonschema): validation groups in schema name by @soyuka in https://github.com/api-platform/core/pull/8595
• fix(laravel): authorize non-paginated collections against the resource class by @ousamabenyounes in https://github.com/api-platform/core/pull/8579
• fix(openapi): document request body on operations that deserialize by @soyuka in https://github.com/api-platform/core/pull/8598
• fix(symfony): clear property info and operation caches on warmup by @soyuka in https://github.com/api-platform/core/pull/8599
• fix(symfony): register upgrade filter command only when doctrine-common is installed by @anoziere in https://github.com/api-platform/core/pull/8597
• fix(openapi): document array query parameters with bracket notation by @soyuka in https://github.com/api-platform/core/pull/8600
• fix: throw exception when an operation is not declared in ApiResource for parameter attributes on properties by @Maxcastel in https://github.com/api-platform/core/pull/8552
• fix(jsonapi): sparse fieldsets on included resources by @soyuka in https://github.com/api-platform/core/pull/8584
• fix(laravel): don't cache metadata read from a missing table by @Amoifr in https://github.com/api-platform/core/pull/8586
• fix(httpcache): purge every collection operation of a resource by @soyuka in https://github.com/api-platform/core/pull/8602
• fix(laravel): wire the http cache tags processor by @soyuka in https://github.com/api-platform/core/pull/8601
• fix(symfony): keep denormalize on decorated normalizers by @soyuka in https://github.com/api-platform/core/pull/8606
• ci: test 4.3 on Symfony 6.4 by @soyuka in https://github.com/api-platform/core/pull/8607
• fix(doctrine): scalar schema for comparison params by @soyuka in https://github.com/api-platform/core/pull/8605
• fix(laravel): accept a single value in or filter by @soyuka in https://github.com/api-platform/core/pull/8604
• test(jsonschema): add ODM DummyValidationReversedOrder by @soyuka in https://github.com/api-platform/core/pull/8608
• fix(metadata): use operation shortName for resources without ApiResource by @soyuka in https://github.com/api-platform/core/pull/8609
• test: fix phpunit 13 and ApiTestCase deprecation reds on 5.0 by @soyuka in https://github.com/api-platform/core/pull/8610
• fix(doctrine): avoid deprecation with SortFilter by @VincentLanglet in https://github.com/api-platform/core/pull/8617

New Contributors

• @NotAFlightRisk made their first contribution in https://github.com/api-platform/core/pull/8593

Full Changelog: https://github.com/api-platform/core/compare/v5.0.1...v5.0.2

Breaking changes

• feat!: remove deprecated APIs scheduled for 5.0 (#8367)
• feat!: remove the legacy PropertyInfo Type system, use symfony/type-info (#8364)
• feat!: core 5.0 cleanups — PropertyAwareFilterInterface::getProperties(), JSON:API status as string (#8366)

Features

• feat(doctrine): standalone Date/Exists filters, ComparisonFilter [between], deprecate RangeFilter (#8351)

Bug fixes

• fix(jsonschema): drop removed getBuiltinTypes path in SchemaPropertyMetadataFactory

Dependencies

• Require symfony/* ^7.4 || ^8.0 across all components; drop support for Symfony 6.4 and 7.0–7.3 (#8397)
• Stabilize formerly [@experimental](https://github.com/experimental) APIs (Elasticsearch, State parameter providers, PropertyAwareFilterInterface, Laravel); [@experimental](https://github.com/experimental) kept only on MCP (#8365)

Bug fixes

• fix(state): correct composer "conflicts" key to "conflict" (#8400)

Dependencies

• Require symfony/* ^7.4 || ^8.0 across all components; drop support for Symfony 6.4 and 7.0–7.3 (#8397)
• Stabilized formerly [@experimental](https://github.com/experimental) APIs (Elasticsearch, State parameter providers, PropertyAwareFilterInterface, Laravel ParameterValidatorProvider); [@experimental](https://github.com/experimental) now kept only on MCP (#8398)

What's Changed

• fix(doctrine): fetch_data=false reference for stateOptions resources by @bendavies in https://github.com/api-platform/core/pull/8387
• fix(openapi): don't inherit name converter from a possibly-missing Symfony parent by @soyuka in https://github.com/api-platform/core/pull/8386
• fix(serializer): report enum backing type in denormalization violations by @soyuka in https://github.com/api-platform/core/pull/8389
• fix(serializer): preserve denormalization errors for nullable object properties by @bendavies in https://github.com/api-platform/core/pull/8393

Full Changelog: https://github.com/api-platform/core/compare/v4.3.16...v4.3.17

What's Changed

• fix(jsonschema): respect readableLink for resource-typed properties on non-resource parents by @wuchen90 in https://github.com/api-platform/core/pull/8362
• fix(doctrine): support filtering scalar enum columns by IRI by @soyuka in https://github.com/api-platform/core/pull/8358
• fix(ci): link monorepo root in laravel e2e so siblings resolve from working tree by @soyuka in https://github.com/api-platform/core/pull/8363
• fix(openapi): don't apply the global name converter to the generated document by @soyuka in https://github.com/api-platform/core/pull/8360
• fix(symfony): allow null $data in PlaceholderAction by @soyuka in https://github.com/api-platform/core/pull/8359
• fix: clone Parameters before mutation in security and validator providers by @ostrolucky in https://github.com/api-platform/core/pull/8378
• fix(mcp): make tools/list resilient to an empty registry by @soyuka in https://github.com/api-platform/core/pull/8371
• fix(doctrine): use PHP property name in DQL for modern filters with name converter by @soyuka in https://github.com/api-platform/core/pull/8382
• fix(serializer): denormalize nullable collections of enums/objects by @soyuka in https://github.com/api-platform/core/pull/8381
• fix(test): remove stale phpstan ignores in CollectionNormalizerTest by @soyuka in https://github.com/api-platform/core/pull/8384
• fix(symfony): don't expose entrypoint in openapi format by @soyuka in https://github.com/api-platform/core/pull/8383

Full Changelog: https://github.com/api-platform/core/compare/v4.3.15...v4.3.16

What's Changed

• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in https://github.com/api-platform/core/pull/8339
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in https://github.com/api-platform/core/pull/8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in https://github.com/api-platform/core/pull/8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in https://github.com/api-platform/core/pull/8346
• fix(serializer): preserve deserialization path and expected type on IRI type-confusion guard by @alexndlm in https://github.com/api-platform/core/pull/8353
• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in https://github.com/api-platform/core/pull/8357

Full Changelog: https://github.com/api-platform/core/compare/v4.3.14...v4.3.15

What's Changed

• test(serializer): skip union-collection IRI test on legacy property-info by @soyuka in https://github.com/api-platform/core/pull/8355
• test(functional): skip union-collection IRI test on legacy property-info by @soyuka in https://github.com/api-platform/core/pull/8356

Full Changelog: https://github.com/api-platform/core/compare/v4.4.0-alpha.1...v4.4.0-alpha.2

What's Changed

• feat(openapi): Scalar API Reference documentation support by @soyuka in https://github.com/api-platform/core/pull/7817
• fix(mcp): fallback to sdk handler when not found by @soyuka in https://github.com/api-platform/core/pull/7818
• feat: support dynamic HTTP response status code via request attribute by @Griffon-Weglot in https://github.com/api-platform/core/pull/7904
• fix(state): scope ReadLinkParameterProvider to current Link's class by @soyuka in https://github.com/api-platform/core/pull/7943
• test: phpunit exception not restored by @soyuka in https://github.com/api-platform/core/pull/7949
• feat(hydra): use hydra:memberAssertion instead of owl:equivalentClass by @abderrahimghazali in https://github.com/api-platform/core/pull/7944
• refactor(jsonld): simplify @context building by @soyuka in https://github.com/api-platform/core/pull/7952
• refactor: split normalizer/denormalizer by @soyuka in https://github.com/api-platform/core/pull/7713
• test(jsonld,hydra,hal): migrate behat features to ApiTestCase by @soyuka in https://github.com/api-platform/core/pull/7957
• feat(doctrine): state options repositoryMethod for query builder by @soyuka in https://github.com/api-platform/core/pull/7115
• feat(symfony,laravel): withCredentials option to Swagger UI by @cay89 in https://github.com/api-platform/core/pull/8197
• test: migrate remaining trivial behat features to ApiTestCase by @soyuka in https://github.com/api-platform/core/pull/7971
• test: eliminate behat-migration skips and tighten ported asserts by @soyuka in https://github.com/api-platform/core/pull/8198
• test: migrate elasticsearch/security/serializer/mongodb behat suites to ApiTestCase by @soyuka in https://github.com/api-platform/core/pull/8202
• feat(jsonld): add resource-level jsonldContext for namespace prefixes by @soyuka in https://github.com/api-platform/core/pull/8204
• ci: stale bot via actions, exempt typed issues by @soyuka in https://github.com/api-platform/core/pull/8208
• ci(stale): bump checkout to v6 and github-script to v8 by @soyuka in https://github.com/api-platform/core/pull/8213
• test: migrate doctrine/graphql behat features to ApiTestCase by @soyuka in https://github.com/api-platform/core/pull/8205
• ci: trim phpunit-components matrix and merge fail-deprecation by @soyuka in https://github.com/api-platform/core/pull/8214
• feat(metadata): throwOnNotFound option by @soyuka in https://github.com/api-platform/core/pull/6027
• feat!(state): constraint-aware 422 for denormalization errors by @soyuka in https://github.com/api-platform/core/pull/8211
• feat(doctrine): per-property filter map in FreeTextQueryFilter by @soyuka in https://github.com/api-platform/core/pull/8257
• chore: fix php-cs-fixer by @alexisLefebvre in https://github.com/api-platform/core/pull/8269
• test: drop stale serializer 8.1 getErrors() deprecation expectation by @soyuka in https://github.com/api-platform/core/pull/8287
• feat(doctrine): add EndSearchFilter primary for ORM and ODM by @soyuka in https://github.com/api-platform/core/pull/8319
• feat(doctrine): promote ComparisonFilter out of @experimental by @soyuka in https://github.com/api-platform/core/pull/8323
• feat(doctrine): promote OrFilter out of @experimental by @soyuka in https://github.com/api-platform/core/pull/8324
• feat(metadata): document BackwardCompatibleFilterDescriptionTrait as public API by @soyuka in https://github.com/api-platform/core/pull/8326
• feat(doctrine): add StartSearchFilter and WordStartSearchFilter (ORM + ODM) by @soyuka in https://github.com/api-platform/core/pull/8328
• feat(doctrine): deprecate AbstractFilter base class by @soyuka in https://github.com/api-platform/core/pull/8330
• feat(symfony): deprecate Symfony Security AccessDeniedException by @soyuka in https://github.com/api-platform/core/pull/8318
• fix(serializer): accept union-typed IRI collections on denormalization by @soyuka in https://github.com/api-platform/core/pull/8339
• feat(symfony): deprecate jsonapi.use_iri_as_id defaulting to true by @soyuka in https://github.com/api-platform/core/pull/8327
• feat(doctrine): deprecate the extends-AbstractFilter form of Date/Range/Exists filters by @soyuka in https://github.com/api-platform/core/pull/8340
• feat(doctrine): deprecate the legacy SearchFilter/Boolean/Numeric/BackedEnum/OrderFilter by @soyuka in https://github.com/api-platform/core/pull/8341
• perf(laravel): memoize the Symfony RouteCollection in Router by @soyuka in https://github.com/api-platform/core/pull/8342
• fix(jsonschema): don't require @id in single-item MCP output schema by @alexisLefebvre in https://github.com/api-platform/core/pull/8343
• fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader by @soyuka in https://github.com/api-platform/core/pull/8346
• fix(graphql): build filter args from parameters by @soyuka in https://github.com/api-platform/core/pull/8347
• feat(openapi): support OpenAPI 3.2.0 by @soyuka in https://github.com/api-platform/core/pull/8350
• feat(symfony): api:upgrade-filter codemod + filter fixture migration by @soyuka in https://github.com/api-platform/core/pull/8344

New Contributors

• @Griffon-Weglot made their first contribution in https://github.com/api-platform/core/pull/7904

Full Changelog: https://github.com/api-platform/core/compare/v4.3.14...v4.4.0-alpha.1

What's Changed

• fix(mcp): support mcp/sdk 0.6 ResourceDefinition in Loader by @soyuka in https://github.com/api-platform/core/pull/8302
• fix(openapi): serialize Reference objects with $ref in the generated document by @soyuka in https://github.com/api-platform/core/pull/8306
• fix(doctrine): filter parent link from uri variables in fetch_data=false reference by @soyuka in https://github.com/api-platform/core/pull/8295
• fix(doctrine): exclude self-reference relation links from GraphQL root item lookup by @soyuka in https://github.com/api-platform/core/pull/8314
• fix(mcp): support mcp/sdk 0.6 by @soyuka in https://github.com/api-platform/core/pull/8311
• fix(jsonapi): exclude relations from openapi attributes schema by @soyuka in https://github.com/api-platform/core/pull/8313
• chore: drop phpstan mcp/sdk class.notFound ignore by @soyuka in https://github.com/api-platform/core/pull/8320
• feat(laravel): boot without a database via dumped metadata by @soyuka in https://github.com/api-platform/core/pull/8290
• fix(jsonapi): correct relationship schemas in generated json schema by @soyuka in https://github.com/api-platform/core/pull/8321
• refactor(jsonapi): single source of truth for the attribute/relationship split by @soyuka in https://github.com/api-platform/core/pull/8325
• fix(serializer): fix union types denormalization fallback after security mismatch by @jonnyeom in https://github.com/api-platform/core/pull/8333
• chore: fix phpstan on 4.3 by @soyuka in https://github.com/api-platform/core/pull/8331

Full Changelog: https://github.com/api-platform/core/compare/v4.3.13...v4.3.14

What's Changed

• fix(elasticsearch): coerce document _id to declared int identifier type by @soyuka in https://github.com/api-platform/core/pull/8296
• fix(openapi): throw clear error for openapi parameter missing name in yaml config by @soyuka in https://github.com/api-platform/core/pull/8297
• fix(jsonschema): embed relations of non-resource objects in output schema by @alexisLefebvre in https://github.com/api-platform/core/pull/8294

Full Changelog: https://github.com/api-platform/core/compare/v4.3.12...v4.3.13

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2db)

What's Changed

• fix(doctrine): guard unmapped relation links in ORM handleLinks by @soyuka in https://github.com/api-platform/core/pull/8293
• fix(graphql): honor custom mutation output class in payload type by @soyuka in https://github.com/api-platform/core/pull/8300

Full Changelog: https://github.com/api-platform/core/compare/v4.3.11...v4.3.12

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2db)

Full Changelog: https://github.com/api-platform/core/compare/v4.2.25...v4.2.26

🔒 Security

Fixes CVE-2026-54164 (GHSA-9rjg-x2p2-h68h) — type confusion: relation IRIs were not type-checked, so a writable relation could be assigned a resource of the wrong type.

• fix(serializer): validate IRI target class on relation denormalization (6bcbeb2db)

Full Changelog: https://github.com/api-platform/core/compare/v4.1.29...v4.1.30

What's Changed

• fix(metadata): preserve explicit class on ApiResource when propagating defaults by @soyuka in https://github.com/api-platform/core/pull/8262
• fix(openapi): ship oauth2-redirect.js with swagger-ui assets by @soyuka in https://github.com/api-platform/core/pull/8261
• fix(httpcache): allow custom http method on SouinPurger and SurrogateKeysPurger by @soyuka in https://github.com/api-platform/core/pull/8259
• fix(swagger): improve dark mode button in swaggerUI by @divine in https://github.com/api-platform/core/pull/8265
• fix(metadata): read ApiProperty from trait private properties inherited via parent class by @soyuka in https://github.com/api-platform/core/pull/8275
• fix(hydra): declare hydra:view links as nullable in json schema by @soyuka in https://github.com/api-platform/core/pull/8277
• fix(jsonschema): embed genId:false relations in output schema by @alexisLefebvre in https://github.com/api-platform/core/pull/8272
• fix(mcp): always serialize payload into TextContent when structuredContent is disabled by @alexisLefebvre in https://github.com/api-platform/core/pull/8270
• fix(mcp): resolve $ref inside oneOf/anyOf when flattening tool outputSchema by @alexisLefebvre in https://github.com/api-platform/core/pull/8268
• fix(symfony): expose uri variables in security expression context by @soyuka in https://github.com/api-platform/core/pull/8279
• fix(metadata) metadata mutators for resource & operations with lower priority by @tandev in https://github.com/api-platform/core/pull/8273
• fix(metadata): preserve nested array query parameters in IriHelper by @soyuka in https://github.com/api-platform/core/pull/8278
• fix(metadata): keep explicitly set GraphQL mutation description by @fabianbloching in https://github.com/api-platform/core/pull/8286
• fix(symfony): register http cache purgers independently of invalidation flag by @soyuka in https://github.com/api-platform/core/pull/8260
• fix(jsonld): replace already-populated nested relation from embedded @id on patch by @soyuka in https://github.com/api-platform/core/pull/8274
• fix(jsonschema): don't leak operation deprecation onto sub-schemas by @soyuka in https://github.com/api-platform/core/pull/8289

New Contributors

• @tandev made their first contribution in https://github.com/api-platform/core/pull/8273
• @fabianbloching made their first contribution in https://github.com/api-platform/core/pull/8286

Full Changelog: https://github.com/api-platform/core/compare/v4.3.10...v4.3.11

What's Changed

• fix(swagger): fix SwaggerUI CSS override by @vincentchalamon in https://github.com/api-platform/core/pull/8245
• fix(laravel): persist dirty embedded belongsTo relations by @soyuka in https://github.com/api-platform/core/pull/8246
• fix(graphql): dispatch item Query through its own provider by @soyuka in https://github.com/api-platform/core/pull/8237
• fix(laravel): register graphql routes before catch-all entrypoint by @soyuka in https://github.com/api-platform/core/pull/8248
• fix(laravel): detect enum casts in eloquent property metadata factory by @soyuka in https://github.com/api-platform/core/pull/8247
• fix(jsonapi): do not require id in input schema for post operations by @soyuka in https://github.com/api-platform/core/pull/8252
• fix(laravel): honor path_segment_name_generator config for url segments by @soyuka in https://github.com/api-platform/core/pull/8251
• fix(symfony): skip ErrorResourceAttributeLoaderPass on Symfony 6.4 by @soyuka in https://github.com/api-platform/core/pull/8253
• fix(serializer): allow nullable to-many relations to normalize as null by @soyuka in https://github.com/api-platform/core/pull/8254
• fix(state): guard hex2bin against malformed query parameter keys by @soyuka in https://github.com/api-platform/core/pull/8255
• fix(jsonapi): allow opt-in client-generated IDs on POST per spec by @abderrahimghazali in https://github.com/api-platform/core/pull/7930

Full Changelog: https://github.com/api-platform/core/compare/v4.3.9...v4.3.10

What's Changed

• fix(test): capture streamedresponse body in test client response by @soyuka in https://github.com/api-platform/core/pull/8235
• fix(hydra): format datetime fields as iso 8601 in cursor pagination urls by @soyuka in https://github.com/api-platform/core/pull/8241
• fix(doctrine): extract alias from sql function in orderby parts by @soyuka in https://github.com/api-platform/core/pull/8240
• fix(serializer): bump api-platform/serializer to ^4.3.8 and cover Hal in CI by @soyuka in https://github.com/api-platform/core/pull/8242
• fix(graphql): nested resources without graphqloperations propagate fields by @soyuka in https://github.com/api-platform/core/pull/8236
• fix(graphql): return identifier-only node on circular reference by @soyuka in https://github.com/api-platform/core/pull/8239

Full Changelog: https://github.com/api-platform/core/compare/v4.3.8...v4.3.9

What's Changed

• ErrorProvider: fix typo in _api_operation_nme by @Maxcastel in https://github.com/api-platform/core/pull/7637
• ci: bump actions/setup-node to v6 for Node 24 runtime by @soyuka in https://github.com/api-platform/core/pull/8212
• fix(tests): symfony 8.1 compat by @soyuka in https://github.com/api-platform/core/pull/8210
• fix(graphiql): migrate to v5 via esm.sh CDN by @soyuka in https://github.com/api-platform/core/pull/8209
• fix(jsonapi): keep flat custom params with flat page (#8216) by @soyuka in https://github.com/api-platform/core/pull/8217
• test: backport Behat removal from main to 4.3 by @soyuka in https://github.com/api-platform/core/pull/8221
• fix(symfony): guard null ExpressionLanguage in ResourceAccessChecker::usesObjectVariable() by @soyuka in https://github.com/api-platform/core/pull/8219
• fix(metadata): apply YAML/XML attributes to virtual (method-backed) properties by @soyuka in https://github.com/api-platform/core/pull/8220
• fix(openapi): emit Draft 4 boolean exclusive bounds for spec 3.0.0 by @soyuka in https://github.com/api-platform/core/pull/8222
• fix(symfony): filter nested constraint groups in Sequentially/Compound by @soyuka in https://github.com/api-platform/core/pull/8223
• fix(laravel): wire jsonapi.use_iri_as_id in ApiPlatformProvider by @soyuka in https://github.com/api-platform/core/pull/8224
• fix(state): omit Content-Type when response has no body by @soyuka in https://github.com/api-platform/core/pull/8218
• fix(openapi): emit valid 3.0 schemas when downgrading from 3.1 by @soyuka in https://github.com/api-platform/core/pull/8225
• fix(test): default content-type in ApiTestCase matches configured formats by @soyuka in https://github.com/api-platform/core/pull/8227
• ci(commitlint): check PR commits against PR base ref by @soyuka in https://github.com/api-platform/core/pull/8234
• fix(symfony): reject duplicate operation names instead of silently dropping operations by @soyuka in https://github.com/api-platform/core/pull/8232
• fix(openapi): coerce metadata parameters in user-supplied openapi operation by @soyuka in https://github.com/api-platform/core/pull/8229
• fix(symfony): keep error serialization mapping when enable_attributes is disabled by @soyuka in https://github.com/api-platform/core/pull/8231
• fix(openapi): disambiguate definition names when input and output share a shortname by @soyuka in https://github.com/api-platform/core/pull/8230
• fix(doctrine): resolve parent link toProperty during PUT create by @soyuka in https://github.com/api-platform/core/pull/8233

Full Changelog: https://github.com/api-platform/core/compare/v4.3.7...v4.3.8

What's Changed

• ErrorProvider: fix typo in _api_operation_nme by @Maxcastel in https://github.com/api-platform/core/pull/7637

Full Changelog: https://github.com/api-platform/core/compare/v4.2.24...v4.2.25

What's Changed

• ErrorProvider: fix typo in _api_operation_nme by @Maxcastel in https://github.com/api-platform/core/pull/7637

Full Changelog: https://github.com/api-platform/core/compare/v4.1.28...v4.1.29

What's Changed

• fix(openapi): include jsonapi collection schema by @Will-thom in https://github.com/api-platform/core/pull/8190
• fix(symfony): isolate api_platform.property_info tags by @soyuka in https://github.com/api-platform/core/pull/8206

New Contributors

• @Will-thom made their first contribution in https://github.com/api-platform/core/pull/8190

Full Changelog: https://github.com/api-platform/core/compare/v4.3.6...v4.3.7

What's Changed

• fix(serializer): translate PropertyAccess type mismatches to NotNormalizableValueException by @soyuka in https://github.com/api-platform/core/pull/7967
• fix(symfony): include value-object transformers in JSON-LD streamer locator by @soyuka in https://github.com/api-platform/core/pull/7968
• fix(graphql): accept FilterInterface instance in QueryParameter by @soyuka in https://github.com/api-platform/core/pull/7972
• ci: pin composer to 2.9.8 to avoid GitHub Actions token disclosure by @soyuka in https://github.com/api-platform/core/pull/7974
• fix(laravel): set application/ld+json content-type on /contexts/{shortName} by @soyuka in https://github.com/api-platform/core/pull/7973
• fix(symfony,laravel): IriConverter local cache key collision between item and collection ops by @soyuka in https://github.com/api-platform/core/pull/7975
• fix(symfony): register property_info fallback when not provided by Symfony by @guillaumedelre in https://github.com/api-platform/core/pull/7969
• test: cover Assert\Choice exposure in OpenAPI schema by @soyuka in https://github.com/api-platform/core/pull/8191
• fix(metadata): negotiate wildcard Accept with parameters by @soyuka in https://github.com/api-platform/core/pull/8192
• fix(jsonapi): merge flat page/itemsPerPage params with bracket filter by @soyuka in https://github.com/api-platform/core/pull/8193
• fix(metadata): :property dedup drops repeated parameters by @soyuka in https://github.com/api-platform/core/pull/8196
• fix(state): convert BackedEnum denormalization errors into validation violations by @soyuka in https://github.com/api-platform/core/pull/8195

Full Changelog: https://github.com/api-platform/core/compare/v4.3.5...v4.3.6

What's Changed

• chore: allow doctrine/collections ^v3 by @soyuka in https://github.com/api-platform/core/pull/7947
• fix(laravel): fall back to resource class when object is null in ResourceAccessChecker by @soyuka in https://github.com/api-platform/core/pull/7948
• fix(symfony): api_platform_iris loader misses item Gets and api_genid by @soyuka in https://github.com/api-platform/core/pull/7946
• fix(mcp): pass title to Tool constructor by @soyuka in https://github.com/api-platform/core/pull/7950
• fix(laravel): expose ReDoc/Scalar in docs footer by @abderrahimghazali in https://github.com/api-platform/core/pull/7942
• chore(tests): reorganize Functional/ by feature scope by @soyuka in https://github.com/api-platform/core/pull/7958
• fix(symfony): Symfony 8.1 compatibility by @soyuka in https://github.com/api-platform/core/pull/7955
• test: phpunit exception not restored by @soyuka in https://github.com/api-platform/core/pull/7959
• [Mcp] Properly handle oneOf and anyOf in generated mcp schema so that JSONLD output is actually valid by @jbtronics in https://github.com/api-platform/core/pull/7962
• fix(laravel): inject missing dependencies into HydraSchemaFactory by @soyuka in https://github.com/api-platform/core/pull/7963
• test(hal): correct context array key type in normalizer test docblock by @soyuka in https://github.com/api-platform/core/pull/7964
• fix(hydra): emit hydra:next and hydra:previous on empty cursor-paginated collections by @guillaumedelre in https://github.com/api-platform/core/pull/7961

New Contributors

• @jbtronics made their first contribution in https://github.com/api-platform/core/pull/7962
• @guillaumedelre made their first contribution in https://github.com/api-platform/core/pull/7961

Full Changelog: https://github.com/api-platform/core/compare/v4.3.4...v4.3.5

What's Changed

• refactor(metadata): use logic from ResourceClassInfoTrait by @Maxcastel in https://github.com/api-platform/core/pull/7928
• fix: ResourceClassInfoTrait::isResourceClass() is always true by @Maxcastel in https://github.com/api-platform/core/pull/7924
• fix(state): use exception message for user-facing violation when available by @vincentchalamon in https://github.com/api-platform/core/pull/7894
• fix(openapi): generate both singular and array parameter variants for filters by @soyuka in https://github.com/api-platform/core/pull/7906
• refactor(symfony): remove static state from EntrypointAction by @KevinMartinsDev in https://github.com/api-platform/core/pull/7919
• refactor(jsonld): use already declared $isResourceClass variable by @Maxcastel in https://github.com/api-platform/core/pull/7901
• fix(validator): handle nested groups and group sequences by @VincentLanglet in https://github.com/api-platform/core/pull/7914
• fix(metadata): nested property filters fail to generate JOINs when relation target entity is not directly declared as ApiResource by @Maxcastel in https://github.com/api-platform/core/pull/7926
• fix(state): preserve Type message when expectedTypes is set by @soyuka in https://github.com/api-platform/core/pull/7935
• fix(symfony): ensure ErrorListener is fully stateless to prevent stat… by @KevinMartinsDev in https://github.com/api-platform/core/pull/7921
• fix(laravel): skip relation metadata for abstract Eloquent models by @cay89 in https://github.com/api-platform/core/pull/7933
• fix(symfony): api_platform_iris route loader for graphql-only setups by @soyuka in https://github.com/api-platform/core/pull/7934
• fix(symfony): security regression when ResourceAccessChecker is decorated (#7896) by @giosh94mhz in https://github.com/api-platform/core/pull/7897
• fix(doctrine): IriFilter ignores custom ApiProperty identifier on ODM by @soyuka in https://github.com/api-platform/core/pull/7937
• fix(jsonapi): use parent-resolved class in denormalizeRelation by @elfin-sbreuers in https://github.com/api-platform/core/pull/7938

New Contributors

• @KevinMartinsDev made their first contribution in https://github.com/api-platform/core/pull/7919

Full Changelog: https://github.com/api-platform/core/compare/v4.3.3...v4.3.4

What's Changed

• fix(state): do not map to input class in ObjectMapperProvider by @soyuka in https://github.com/api-platform/core/pull/7892
• fix(openapi): default explode to true for form and cookie style param… by @Roemerdt in https://github.com/api-platform/core/pull/7891

New Contributors

• @Roemerdt made their first contribution in https://github.com/api-platform/core/pull/7891

Full Changelog: https://github.com/api-platform/core/compare/v4.3.2...v4.3.3

What's Changed

• fix(state): do not map to input class in ObjectMapperProvider by @soyuka in https://github.com/api-platform/core/pull/7892

Full Changelog: https://github.com/api-platform/core/compare/v4.2.23...v4.2.24

What's Changed

• chore(laravel): expand version constraints for Laravel 13 support by @soyuka in https://github.com/api-platform/core/pull/7860
• chore: remove annotation namespaces by @soyuka in https://github.com/api-platform/core/pull/7861
• fix(laravel): resolve casts defined via casts() method by @soyuka in https://github.com/api-platform/core/pull/7859
• ci(laravel): use ^12 on 4.2 by @soyuka in https://github.com/api-platform/core/pull/7863
• fix(metadata): read operation tags from OpenAPI context in XML by @JakovKnezovicc in https://github.com/api-platform/core/pull/7865
• fix(symfony): remove conflicting service by @soyuka in https://github.com/api-platform/core/pull/7867
• fix(openapi)!: oauth scopes with dashes in name by @thomaschaaf in https://github.com/api-platform/core/pull/7853
• fix(metadata): nested filtering only on resource classes by @soyuka in https://github.com/api-platform/core/pull/7864
• test(mongodb): missing nested test by @soyuka in https://github.com/api-platform/core/pull/7872
• fix(openapi): fallback description on summary by @VincentLanglet in https://github.com/api-platform/core/pull/7874
• fix(state): prioritize input class over output in ObjectMapperProvider by @soyuka in https://github.com/api-platform/core/pull/7879
• fix(doctrine): skip links with no join info when fromClass differs from entityClass by @soyuka in https://github.com/api-platform/core/pull/7878
• fix(serializer): disable normalizer cache to prevent wrong normalizer in worker mode by @soyuka in https://github.com/api-platform/core/pull/7873
• fix(openapi): uri variable default description by @VincentLanglet in https://github.com/api-platform/core/pull/7884
• fix(laravel): partial patch validation config to replace required with sometimes by @soyuka in https://github.com/api-platform/core/pull/7882
• fix(serializer): handle nullable constructor params without default value by @soyuka in https://github.com/api-platform/core/pull/7883
• fix(doctrine): inject nameConverter into AbstractFilter via QueryParameter by @soyuka in https://github.com/api-platform/core/pull/7877

New Contributors

• @thomaschaaf made their first contribution in https://github.com/api-platform/core/pull/7853

Full Changelog: https://github.com/api-platform/core/compare/v4.3.1...v4.3.2

What's Changed

• chore: remove annotation namespaces by @soyuka in https://github.com/api-platform/core/pull/7861
• ci(laravel): use ^12 on 4.2 by @soyuka in https://github.com/api-platform/core/pull/7863
• fix(metadata): read operation tags from OpenAPI context in XML by @JakovKnezovicc in https://github.com/api-platform/core/pull/7865
• fix(symfony): remove conflicting service by @soyuka in https://github.com/api-platform/core/pull/7867
• fix(state): prioritize input class over output in ObjectMapperProvider by @soyuka in https://github.com/api-platform/core/pull/7879
• fix(doctrine): skip links with no join info when fromClass differs from entityClass by @soyuka in https://github.com/api-platform/core/pull/7878
• fix(serializer): disable normalizer cache to prevent wrong normalizer in worker mode by @soyuka in https://github.com/api-platform/core/pull/7873
• fix(laravel): partial patch validation config to replace required with sometimes by @soyuka in https://github.com/api-platform/core/pull/7882
• fix(serializer): handle nullable constructor params without default value by @soyuka in https://github.com/api-platform/core/pull/7883
• fix(doctrine): inject nameConverter into AbstractFilter via QueryParameter by @soyuka in https://github.com/api-platform/core/pull/7877

Full Changelog: https://github.com/api-platform/core/compare/v4.2.22...v4.2.23

What's Changed

• chore(github): fix dispatch-demo-update on release by @vincentchalamon in https://github.com/api-platform/core/pull/7842
• fix(validator): fallback to message when detail is uninitialized by @soyuka in https://github.com/api-platform/core/pull/7844
• fix(symfony): do not exclude resources from DI by @VincentLanglet in https://github.com/api-platform/core/pull/7847
• fix(validator): skip ValidateProcessor when ObjectMapper is not used by @Renrhaf in https://github.com/api-platform/core/pull/7848
• fix(serializer): evaluate ApiProperty security on input DTOs by @soyuka in https://github.com/api-platform/core/pull/7852
• fix(hydra): use compact IRI for owl:onProperty and Collection @id in DocumentationNormalizer by @soyuka in https://github.com/api-platform/core/pull/7849
• fix(doctrine): reset nested_properties_info for non-nested properties in FreeTextQueryFilter by @soyuka in https://github.com/api-platform/core/pull/7850
• cs: typo in deprecation message for 'xkey' config by @melany-mai in https://github.com/api-platform/core/pull/7851

New Contributors

• @melany-mai made their first contribution in https://github.com/api-platform/core/pull/7851

Full Changelog: https://github.com/api-platform/core/compare/v4.3.0...v4.3.1

What's Changed

• chore(github): fix dispatch-demo-update on release by @vincentchalamon in https://github.com/api-platform/core/pull/7842
• fix(serializer): evaluate ApiProperty security on input DTOs by @soyuka in https://github.com/api-platform/core/pull/7852
• fix(hydra): use compact IRI for owl:onProperty and Collection @id in DocumentationNormalizer by @soyuka in https://github.com/api-platform/core/pull/7849
• cs: typo in deprecation message for 'xkey' config by @melany-mai in https://github.com/api-platform/core/pull/7851

New Contributors

• @melany-mai made their first contribution in https://github.com/api-platform/core/pull/7851

Full Changelog: https://github.com/api-platform/core/compare/v4.2.21...v4.2.22

Highlights

MCP (Model Context Protocol) Support

• Introduce api-platform/mcp component (#7703)
• MCP bundle tool integration (#7595)
• Collection support for MCP (#7724)
• Laravel MCP support (#7709)

Scalar API Reference Documentation

• Scalar is now available as an alternative documentation UI alongside Swagger UI (#7817)

Security

• isGranted is now evaluated before the provider, preventing unnecessary database queries on unauthorized requests (#7500)

Doctrine Filters

• UUID filter (#7628) with nested relation support (#7759)
• ComparisonFilter decorator for range filtering (#7760) with ne (not equal) operator (#7814)
• caseSensitive option for PartialSearchFilter (#7675)
• ODM SortFilter and nested property support (#7780)
• Support relations on filters (#7711)
• Readonly entities automatically lose PUT & PATCH operations (#7453)

Elasticsearch

• OpenSearch support (#7811)
• SSL configuration options (#4059)

Other Notable Features

• Defaults parameters (#7758)
• Laravel object mapper (#7704)
• JSON Schema normalization/denormalization with attributes (#7629)
• JSON:API entity identifiers instead of IRIs as resource id (#7702)
• SkipAutoconfigure attribute for Laravel (#7467)
• LDP-compliant Allow and Accept-Post response headers (#6917)
• Cache operation metadata factory (#7516)
• gen_id global configuration option (#7775)
• Preserve key option in CollectionNormalizer (#7721)
• UUID/ULID parameter validation (#7649)

Breaking Changes

• JSON-LD [@type](https://github.com/type) with output and itemUriTemplate: uses the resource class name instead of the output DTO class name
• Doctrine filters require explicit property (#7681): throws InvalidArgumentException if missing (unless you use a :property placeholder)
• Readonly entities lose PUT & PATCH (#7453): clients will receive 404 instead of processing the request

Behavioral Changes

• Hydra class [@id](https://github.com/id) uses #ShortName (#7771): replaces schema.org type URIs — clients should expect class [@id](https://github.com/id) and property range changes
• Scalar UI enabled by default (#7817): disable with enable_scalar: false if unwanted

See the full changelog with all bug fixes and detailed upgrade notes on the 4.3 branch CHANGELOG.md.

New Contributors

• @hotfix31 made their first contribution in https://github.com/api-platform/core/pull/7450
• @BySplashGm made their first contribution in https://github.com/api-platform/core/pull/7513
• @bonroyage made their first contribution in https://github.com/api-platform/core/pull/7776
• @olinox14 made their first contribution in https://github.com/api-platform/core/pull/7775

Full Changelog: https://github.com/api-platform/core/compare/v4.2.21...v4.3.0

v4.2.21

Bug fixes

• 20ced5fca fix(laravel): clear SkolemIriConverter state between requests (#7838)
• 2b2b7bca2 fix(filter): use correct type for int-backed enums in BackedEnumFilter
• 42a2d7fc6 fix(symfony): register DateTimeValueObjectTransformer for JsonStreamer (#7839)
• 63e6b57f8 fix(openapi): correct redocly openapi errors (#7834)
• 6a472a2db fix(jsonapi): swap arguments in DefinitionNameFactory::create() call
• bbfd4cafa fix(filter): do not nest array while generating default schema (#7832)
• c20a41c20 fix(symfony): clear SkolemIriConverter state between requests via ResetInterface (#7829)
• d6ecbe122 fix(serializer): Use serializer when denormalizing relation inside Input (#7830)
• da6232468 fix(metadata): allow GraphQL-only resources without identifiers (#3975) (#7836)
• f4002902a fix(state): on creation, give expected class to object mapper (#7795)

What's Changed

• fix(odm): partial pagination limit the documents entering $facet by @divine in https://github.com/api-platform/core/pull/7822
• chore: bump sub-components dependencies to ^4.3 by @soyuka in https://github.com/api-platform/core/pull/7820

Full Changelog: https://github.com/api-platform/core/compare/v4.3.0-beta.1...v4.3.0-beta.2

What's Changed

• fix(openapi): allow Operations to override global options in getPaginationParameters by @jamesisaac in https://github.com/api-platform/core/pull/7807
• fix(laravel): exclude .blade.php files from recursive class scan by @Jellyfrog in https://github.com/api-platform/core/pull/7813
• fix(laravel): do not exclude custom primary keys matching HasMany foreign keys by @Jellyfrog in https://github.com/api-platform/core/pull/7810
• fix(symfony): make enable_docs a master switch for disabling documentation by @soyuka in https://github.com/api-platform/core/pull/7806
• fix(odm): partial pagination limit the documents entering $facet by @divine in https://github.com/api-platform/core/pull/7822

New Contributors

• @Jellyfrog made their first contribution in https://github.com/api-platform/core/pull/7813

Full Changelog: https://github.com/api-platform/core/compare/v4.2.19...v4.2.20

What's Changed

• fix(serializer): apply API Platform name converter to input/output DTOs by @soyuka in https://github.com/api-platform/core/pull/7779
• fix(JsonSchema): avoid schema name collision when an operation name is already used by another class by @wuchen90 in https://github.com/api-platform/core/pull/7778
• fix(metadata): sort parameters by priority after pattern expansion by @soyuka in https://github.com/api-platform/core/pull/7788
• fix(serializer): prevent api_platform_output context from leaking to nested non-resource objects by @soyuka in https://github.com/api-platform/core/pull/7787
• fix(validator): missing required properties when using GroupSequence by @VincentLanglet in https://github.com/api-platform/core/pull/7784
• ci: php 8.5 (#7585) by @soyuka in https://github.com/api-platform/core/pull/7786
• fix(symfony): allow toggling GraphQL Playground to ensure BC by @bkosun in https://github.com/api-platform/core/pull/7793
• feat(serializer): option to preserve key in CollectionNormalizer by @VincentLanglet in https://github.com/api-platform/core/pull/7721
• fix(validator): handle nested groups and group sequences by @VincentLanglet in https://github.com/api-platform/core/pull/7791
• Fix Hydra example type - use @type prefix per JSON-LD spec by @Copilot in https://github.com/api-platform/core/pull/7768
• feat(laravel): split render logic from error handler by @bonroyage in https://github.com/api-platform/core/pull/7790
• fix(serializer): report all missing constructor arguments in instantiateObject by @soyuka in https://github.com/api-platform/core/pull/7805
• Feature support entity identfiers to become JSON:API semantics compliant by @elfin-sbreuers in https://github.com/api-platform/core/pull/7702
• chore: mcp-bundle:^0.5 by @soyuka in https://github.com/api-platform/core/pull/7809
• fix(openapi): allow Operations to override global options in getPaginationParameters by @jamesisaac in https://github.com/api-platform/core/pull/7807
• feat(doctrine): ComparisonFilter decorator for range filtering by @soyuka in https://github.com/api-platform/core/pull/7760
• fix(laravel): exclude .blade.php files from recursive class scan by @Jellyfrog in https://github.com/api-platform/core/pull/7813
• feat(doctrine): ne (not equal) operator for ComparisonFilter by @soyuka in https://github.com/api-platform/core/pull/7814
• feat(elasticsearch): OpenSearch support by @hotfix31 in https://github.com/api-platform/core/pull/7811
• feat(doctrine): ODM SortFilter and nested property support for parameter-based filters by @soyuka in https://github.com/api-platform/core/pull/7780
• fix(laravel): do not exclude custom primary keys matching HasMany foreign keys by @Jellyfrog in https://github.com/api-platform/core/pull/7810
• fix(symfony): make enable_docs a master switch for disabling documentation by @soyuka in https://github.com/api-platform/core/pull/7806
• fix(jsonapi): wrong variable name during merge by @soyuka in https://github.com/api-platform/core/pull/7816
• feat: defaults parameters by @Maxcastel in https://github.com/api-platform/core/pull/7758

New Contributors

• @Jellyfrog made their first contribution in https://github.com/api-platform/core/pull/7813

Full Changelog: https://github.com/api-platform/core/compare/v4.3.0-alpha.2...v4.3.0-beta.1

Bug fixes

• 04c30b7ee fix(jsonapi): prevent double unwrapping of data.attributes with input DTOs
• c6236f313 fix(serializer): report all missing constructor arguments in instantiateObject

What's Changed

• fix(metadata): sort parameters by priority after pattern expansion by @soyuka in https://github.com/api-platform/core/pull/7788
• fix(serializer): prevent api_platform_output context from leaking to nested non-resource objects by @soyuka in https://github.com/api-platform/core/pull/7787
• fix(validator): missing required properties when using GroupSequence by @VincentLanglet in https://github.com/api-platform/core/pull/7784
• ci: php 8.5 (#7585) by @soyuka in https://github.com/api-platform/core/pull/7786
• fix(symfony): allow toggling GraphQL Playground to ensure BC by @bkosun in https://github.com/api-platform/core/pull/7793
• fix(validator): handle nested groups and group sequences by @VincentLanglet in https://github.com/api-platform/core/pull/7791
• Fix Hydra example type - use @type prefix per JSON-LD spec by @Copilot in https://github.com/api-platform/core/pull/7768

Full Changelog: https://github.com/api-platform/core/compare/v4.2.17...v4.2.18

What's Changed

• fix(jsonld): restore item_uri_template @type resolution after 4.2 merge by @soyuka in https://github.com/api-platform/core/pull/7764
• Various fixes by @soyuka in https://github.com/api-platform/core/pull/7765
• fix(elasticsearch): mono-repo v9 support by @GeLoLabs in https://github.com/api-platform/core/pull/7766
• fix: remove extra empty lines insertion in SymfonyServiceClassConstantFixer by @Maxcastel in https://github.com/api-platform/core/pull/7761
• fix(state): handle partial pagination with object mapper by @soyuka in https://github.com/api-platform/core/pull/7769
• test(openapi): add openapi test for normalization with attributes by @Maxcastel in https://github.com/api-platform/core/pull/7772
• fix(hydra): hide search key when there is parameter without filter by @VincentLanglet in https://github.com/api-platform/core/pull/7773
• fix(hydra): unique class @id with subClassOf for semantic types by @soyuka in https://github.com/api-platform/core/pull/7771
• feat(doctrine): add nested relation support to IriFilter and UuidFilter by @soyuka in https://github.com/api-platform/core/pull/7759
• fix(symfony): publish mercure updates for all resources of an entity by @soyuka in https://github.com/api-platform/core/pull/7774
• Use values from ProblemExceptionInterface by @bonroyage in https://github.com/api-platform/core/pull/7776
• fix(symfony): use AsCommand description parameter for console commands by @soyuka in https://github.com/api-platform/core/pull/7763
• feat(serializer): global defaults.normalization_context.gen_id configuration option by @olinox14 in https://github.com/api-platform/core/pull/7775
• fix(doctrine): enforce api-platform/serializer dependency by @soyuka in https://github.com/api-platform/core/pull/7781

⚠️ Notes

Hydra class [@id](https://github.com/id) now always uses #ShortName (#7771): Hydra documentation classes now consistently use #ShortName as their [@id](https://github.com/id) instead of schema.org type URIs (e.g. schema:Product). This properly resolves class identifier collisions when multiple resources shared the same semantic type, which previously caused api-doc-parser conflation. Semantic types configured via types are now exposed through rdfs:subClassOf. Clients should expect class [@id](https://github.com/id) and property range changes in the Hydra documentation if resources had custom types configured.

New Contributors

• @bonroyage made their first contribution in https://github.com/api-platform/core/pull/7776
• @olinox14 made their first contribution in https://github.com/api-platform/core/pull/7775

Full Changelog: https://github.com/api-platform/core/compare/v4.3.0-alpha.1...v4.3.0-alpha.2

What's Changed

• fix: remove extra empty lines insertion in SymfonyServiceClassConstantFixer by @Maxcastel in https://github.com/api-platform/core/pull/7761
• fix(state): handle partial pagination with object mapper by @soyuka in https://github.com/api-platform/core/pull/7769
• fix(hydra): hide search key when there is parameter without filter by @VincentLanglet in https://github.com/api-platform/core/pull/7773
• fix(symfony): use AsCommand description parameter for console commands by @soyuka in https://github.com/api-platform/core/pull/7763
• fix(serializer): apply API Platform name converter to input/output DTOs by @soyuka in https://github.com/api-platform/core/pull/7779
• fix(JsonSchema): avoid schema name collision when an operation name is already used by another class by @wuchen90 in https://github.com/api-platform/core/pull/7778

Full Changelog: https://github.com/api-platform/core/compare/v4.2.16...v4.2.17

Features

• feat(mcp): introduce api-platform/mcp component (#7703)
• feat: mcp bundle tool integration (#7595)
• feat: add support of collection to MCP (#7724)
• feat(laravel): mcp support (#7709)
• feat(laravel): object mapper (#7704)
• feat: support relations on filters (#7711)
• feat(jsonschema): support for normalization/denormalization with attributes (#7629)
• feat(symfony): isGranted before provider (#7500)
• feat(doctrine): uuid filter (#7628)
• feat(doctrine): Add caseSensitive option to PartialSearchFilter (#7675)
• feat(doctrine): remove PUT & PATCH for readonly entity (#7453)
• feat(validator): uuid/ulid parameter validation (#7649)
• feat(json-schema): handle union object types in iterable properties (#7726)
• feat: allow both uppercase and lowercase order direction in OrderFilter schema (#7741)
• feat(elasticsearch): add SSL options for Elasticsearch configuration (#4059)
• feat(metadata): expose default attribute on parameters (#7551)
• feat(state): add headers to comply with LDP specification (#6917)
• feat(symfony): allow symfony makers namespace configuration (#7497)
• feat: enable to skip autoconfiguration with new SkipAutoconfigure attribute (#7467)
• feat(metadata): cache operation metadata factory (#7516)

Bug fixes

• fix(validator): validate entities after ObjectMapper transformation (#7731)
• fix(jsonld)!: item uri template type (#7518)
• fix(doctrine): throw exception if property is null for the doctrine filters (#7681)

Breaking changes

• When using output with itemUriTemplate on a collection operation, the JSON-LD [@type](https://github.com/type) will now use the resource class name instead of the output DTO class name for semantic consistency with itemUriTemplate behavior.

Full Changelog: https://github.com/api-platform/core/compare/v4.2.16...v4.3.0-alpha.1

What's Changed

• fix(laravel): support numeric float types in eloquent metadata factory by @soyuka in https://github.com/api-platform/core/pull/7730
• fix(doctrine): skip uninitialized properties in handleLazyObjectRelations by @marius-swfy in https://github.com/api-platform/core/pull/7738
• fix(hydra): remove duplicate @context in docs.jsonld (fixes #7222) by @soyuka in https://github.com/api-platform/core/pull/7740
• feat(doctrine): allow both uppercase and lowercase order direction in OrderFilter schema by @soyuka in https://github.com/api-platform/core/pull/7742
• feat: support filters with stateOptions by @alexislefebvre in https://github.com/api-platform/core/pull/7739
• refactor: use imported Group instead of FQCN by @Maxcastel in https://github.com/api-platform/core/pull/7754
• refactor: use imported DataProvider instead of FQCN by @Maxcastel in https://github.com/api-platform/core/pull/7753
• fix(serializer): prevent context leakage with service-based entity resolution by @soyuka in https://github.com/api-platform/core/pull/7756

New Contributors

• @marius-swfy made their first contribution in https://github.com/api-platform/core/pull/7738

Full Changelog: https://github.com/api-platform/core/compare/v4.2.15...v4.2.16

What's Changed

• add phpunit.baseline.xml to .gitattributes by @gharlan in https://github.com/api-platform/core/pull/7692
• fix: if the relationship is null the jsonapi output must present null by @elfin-sbreuers in https://github.com/api-platform/core/pull/7686
• Fix issues with extending {XML,Yaml} -> {XML,Yaml} resources by @senghe in https://github.com/api-platform/core/pull/5956
• fix: Change payload type from array to free-form object in schema by @DjordyKoert in https://github.com/api-platform/core/pull/7694
• ci: hide progress from PHP-CS-Fixer by @alexislefebvre in https://github.com/api-platform/core/pull/7696
• fix(doctrine): post with mapped relation by @soyuka in https://github.com/api-platform/core/pull/7698
• fix(symfony): prevent symfony name converter service pollution by @soyuka in https://github.com/api-platform/core/pull/7691
• Bump github actions by @VincentLanglet in https://github.com/api-platform/core/pull/7700
• chore(symfony): custom rule to transform class-string to use instructions by @soyuka in https://github.com/api-platform/core/pull/7708
• test: cover exception if property is null for filters by @Maxcastel in https://github.com/api-platform/core/pull/7716
• fix Hydra JsonSchema SchemaFactory by @amenophis in https://github.com/api-platform/core/pull/7718
• chore: split agents to reduce context usage by @soyuka in https://github.com/api-platform/core/pull/7719
• fix(symfony): declare api_platform.normalizer.object fixes #7705 by @soyuka in https://github.com/api-platform/core/pull/7717
• fix(laravel): properly transform invokable service to route action by @soyuka in https://github.com/api-platform/core/pull/7720

New Contributors

• @elfin-sbreuers made their first contribution in https://github.com/api-platform/core/pull/7686
• @senghe made their first contribution in https://github.com/api-platform/core/pull/5956
• @DjordyKoert made their first contribution in https://github.com/api-platform/core/pull/7694

Full Changelog: https://github.com/api-platform/core/compare/v4.2.14...v4.2.15

What's Changed

• Add phpdoc for array of some interface by @VincentLanglet in https://github.com/api-platform/core/pull/7583
• fix(openapi): phpdoc operation response as array<int|string, OpenApi\Response> by @petski in https://github.com/api-platform/core/pull/7660
• fix(symfony): pass missing arguments to ConcernsResourceMetadataCollectionFactory by @ttskch in https://github.com/api-platform/core/pull/7676
• test(validator): improve ValidationException::violations schema by @VincentLanglet in https://github.com/api-platform/core/pull/7673
• fix(metadata): fix losing content on error reponse with no output by @VincentLanglet in https://github.com/api-platform/core/pull/7674
• chore(symfony): bump api platform components by @soyuka in https://github.com/api-platform/core/pull/7677

New Contributors

• @petski made their first contribution in https://github.com/api-platform/core/pull/7660

Full Changelog: https://github.com/api-platform/core/compare/v4.2.12...v4.2.13

What's Changed

• fix(doctrine): useless generateParameterName call by @VincentLanglet in https://github.com/api-platform/core/pull/7679
• doc: fix CI badge on README by @alexislefebvre in https://github.com/api-platform/core/pull/7683
• ci: run PHPUnit tests on Mysql and Pgsql by @VincentLanglet in https://github.com/api-platform/core/pull/7680
• fix(laravel): use controller if declared by @soyuka in https://github.com/api-platform/core/pull/7687
• fix(doctrine): PartialSearchFilter on multibyte characters by @VincentLanglet in https://github.com/api-platform/core/pull/7688
• fix(symfony): fix for symfony/json_streamer 8.0 with enable_json_streamer by @aaa2000 in https://github.com/api-platform/core/pull/7684
• fix(jsonschema): call to an undefined method Symfony\Component\TypeInfo\Type::getClassName() by @Maxcastel in https://github.com/api-platform/core/pull/7685

Full Changelog: https://github.com/api-platform/core/compare/v4.2.13...v4.2.14

Happy new year 2026 :fireworks:!

What's Changed

• Add AsCommand attribute to replace deprecated getDefaultName() by @eneko-koraliving in https://github.com/api-platform/core/pull/7633
• Allow operation element to be optional in XML by @yceruto in https://github.com/api-platform/core/pull/7632
• DefinitionNameFactory: Add tests to cover groups with colon in JsonSchema by @Maxcastel in https://github.com/api-platform/core/pull/7630
• fix(openapi): respect schema type for non-collection parameter documentation by @soyuka in https://github.com/api-platform/core/pull/7634
• fix(serializer): wrap exception when collecting object errors by @soyuka in https://github.com/api-platform/core/pull/7644
• fix(doctrine): fix partial fetch when relation switches context by @jderusse in https://github.com/api-platform/core/pull/7645
• fix(doctrine): fix partial fetch with same entity included multiple time with different fields by @jderusse in https://github.com/api-platform/core/pull/7647
• fix(doctrine): escape values with % or _ in search filter by @VincentLanglet in https://github.com/api-platform/core/pull/7653
• fix(doctrine): Handling of parameter description by @VincentLanglet in https://github.com/api-platform/core/pull/7656
• fix(openapi): properly document list parameters by @soyuka in https://github.com/api-platform/core/pull/7658
• Enhance exception message for non-object relation by @rvanlaak in https://github.com/api-platform/core/pull/7646
• fix(laravel): deprecation in definition name factory by @soyuka in https://github.com/api-platform/core/pull/7661
• fix(test): change string to int for status in JsonApiTest::testError by @Maxcastel in https://github.com/api-platform/core/pull/7631
• test(symfony): ensure pagination_maximum_items_per_page defaults correctly when config defaults key is absent by @Maxcastel in https://github.com/api-platform/core/pull/7609

New Contributors

• @eneko-koraliving made their first contribution in https://github.com/api-platform/core/pull/7633
• @yceruto made their first contribution in https://github.com/api-platform/core/pull/7632

Full Changelog: https://github.com/api-platform/core/compare/v4.2.11...v4.2.12

What's Changed

• fix(symfony): enable to set default values for stale-while-revalidate and stale-if-error cache headers via config file by @ttskch in https://github.com/api-platform/core/pull/7606
• fix(symfony): check if required package is installed before configuri… by @aaa2000 in https://github.com/api-platform/core/pull/7607
• fix(state): delete with stateOptions and object mapper by @soyuka in https://github.com/api-platform/core/pull/7615
• chore: upgrade justinrainbow/json-schema by @aaa2000 in https://github.com/api-platform/core/pull/7619
• fix(openapi): enable ReDoc when Swagger UI is disabled by @4lxndr in https://github.com/api-platform/core/pull/7617
• fix(jsonld): allow mapping collection output with itemUriTemplate by @soyuka in https://github.com/api-platform/core/pull/7620
• fix(laravel): allow custom error handler for non-api operations by @soyuka in https://github.com/api-platform/core/pull/7622
• Fix #7599 Allow overide of CsvEncoder::AS_COLLECTION_KEY in context by @Stav88 in https://github.com/api-platform/core/pull/7613
• fix(jsonapi): handle missing attributes in ErrorNormalizer by @daFish in https://github.com/api-platform/core/pull/7569

New Contributors

• @4lxndr made their first contribution in https://github.com/api-platform/core/pull/7617
• @Stav88 made their first contribution in https://github.com/api-platform/core/pull/7613

Full Changelog: https://github.com/api-platform/core/compare/v4.2.10...v4.2.11

What's Changed

• fix: Add support for the Deprecation header by @aaa2000 in https://github.com/api-platform/core/pull/7582
• Disable Swagger UI and ReDoc when Swagger is off by @jderusse in https://github.com/api-platform/core/pull/7586
• fix(metadata): implement MappedObjectPaginator for fixing pagination on mapped data by @Spomky in https://github.com/api-platform/core/pull/7591
• fix(metadata): property placeholder on multiple parameters by @soyuka in https://github.com/api-platform/core/pull/7598
• fix(metadata): use operation output class for mapping instead of operation class by @Spomky in https://github.com/api-platform/core/pull/7601
• fix(laravel): belongs-to-many relations dont have a get-foreign-key-name method by @mariantrifu in https://github.com/api-platform/core/pull/7589
• fix(symfony): do not redeclare object_mapper by @soyuka in https://github.com/api-platform/core/pull/7602
• ci: lowest tests object_mapper framework bundle by @soyuka in https://github.com/api-platform/core/pull/7604
• fix(symfony): do not load docs routes if docs disabled by @alexndlm in https://github.com/api-platform/core/pull/7448
• Fix IRI generation with link parameter resources by @Geekimo in https://github.com/api-platform/core/pull/7520

New Contributors

• @Spomky made their first contribution in https://github.com/api-platform/core/pull/7591
• @mariantrifu made their first contribution in https://github.com/api-platform/core/pull/7589
• @Geekimo made their first contribution in https://github.com/api-platform/core/pull/7520

Full Changelog: https://github.com/api-platform/core/compare/v4.2.9...v4.2.10

What's Changed

[!WARNING] Inside a filter you may receive a scalar value where you expected an array especially when using a custom filter extending the AbstractFilter, with a :property placeholder. Read more at https://github.com/api-platform/core/pull/7547

• fix: consistent :property placeholder behavior by @NathanPesneau in https://github.com/api-platform/core/pull/7547
• fix(state): object mapper with list by @senaria in https://github.com/api-platform/core/pull/7564
• fix(swagger) use app.request.query.get() directly by @pyatnitsev in https://github.com/api-platform/core/pull/7578
• fix(serializer): render BCMath\Number (PHP 8.4+) as string instead of object by @aaa2000 in https://github.com/api-platform/core/pull/7555
• fix(symfony): skip argument resolver when context is not api platform by @soyuka in https://github.com/api-platform/core/pull/7579
• fix(metadata): filter interface context php doc by @VincentLanglet in https://github.com/api-platform/core/pull/7560
• fix(swagger): use current route for footer links by @Piairre in https://github.com/api-platform/core/pull/7580
• fix(json-schema): definition name is aware of the json schema type by @VincentLanglet in https://github.com/api-platform/core/pull/7557
• doc: improve filter guides by @soyuka in https://github.com/api-platform/core/pull/7584

New Contributors

• @senaria made their first contribution in https://github.com/api-platform/core/pull/7564
• @komandar made their first contribution in https://github.com/api-platform/core/pull/7568
• @pyatnitsev made their first contribution in https://github.com/api-platform/core/pull/7578
• @Piairre made their first contribution in https://github.com/api-platform/core/pull/7580

Full Changelog: https://github.com/api-platform/core/compare/v4.2.7...v4.2.9

Full Changelog: https://github.com/api-platform/core/compare/v4.1.27...v4.1.28

What's Changed

• chore: support symfony 8 by @soyuka in https://github.com/api-platform/core/pull/7561
• Fix/disable pagination maximum items per page by @Maxcastel in https://github.com/api-platform/core/pull/7553
• fix(symfony): disable Swagger UI and keep openapi.json by @Maxcastel in https://github.com/api-platform/core/pull/7549
• fix(state): never map a response by @soyuka in https://github.com/api-platform/core/pull/7543
• fix(metadata): repeatable mutators by @NathanPesneau in https://github.com/api-platform/core/pull/7542

New Contributors

• @Maxcastel made their first contribution in https://github.com/api-platform/core/pull/7553

Full Changelog: https://github.com/api-platform/core/compare/v4.2.6...v4.2.7

What's Changed

• Fix class existence check for ObjectMapperAwareInterface by @rvanlaak in https://github.com/api-platform/core/pull/7539

Full Changelog: https://github.com/api-platform/core/compare/v4.2.4...v4.2.5

What's Changed

• fix(jsonschema): make all required properties optional in PATCH operation with 'json' format by @ttskch in https://github.com/api-platform/core/pull/7398
• fix(openapi): define items type for HydraCollectionBaseSchema hydra:m… by @Cafeine42 in https://github.com/api-platform/core/pull/7419
• fix(validator): validation exception without constraint violation list by @soyuka in https://github.com/api-platform/core/pull/7423
• fix(openapi): Improve response override by @VincentLanglet in https://github.com/api-platform/core/pull/7428
• fix(state): object mapper with input different by @soyuka in https://github.com/api-platform/core/pull/7435
• feat(symfony): Convert all service configuration files from XML to PHP by @GromNaN in https://github.com/api-platform/core/pull/7433
• Fix assertMatchesJsonSchema on custom output DTO by @Cafeine42 in https://github.com/api-platform/core/pull/7438
• fix(jsonschema/jsonld): make [@id](https://github.com/id) and [@type](https://github.com/type) properties required only in the JSON-LD schema for output by @ttskch in https://github.com/api-platform/core/pull/7397
• fix(hydra): genId false schema by @soyuka in https://github.com/api-platform/core/pull/7440
• fix(hydra): add base schema to item of a collection by @soyuka in https://github.com/api-platform/core/pull/7444
• fix(doctrine): group or filter in an AndWhere by @soyuka in https://github.com/api-platform/core/pull/7445
• fix: allow description and other fields to be override seperately by @ceesvanegmond in https://github.com/api-platform/core/pull/7442
• fix(symony): ensure the kernel is booted before using KernelBrowser::loginUser() by @ttskch in https://github.com/api-platform/core/pull/7446
• fix(state): object mapper on delete operation by @soyuka in https://github.com/api-platform/core/pull/7447
• fix(symfony): align listeners context by @soyuka in https://github.com/api-platform/core/pull/7449

New Contributors

• @ceesvanegmond made their first contribution in https://github.com/api-platform/core/pull/7442

Full Changelog: https://github.com/api-platform/core/compare/v4.2.1...v4.2.2

What's Changed

• fix(jsonld): hydra context w3.org updates by @soyuka in https://github.com/api-platform/core/pull/7410
• fix(serializer): require api-platform/metadata:^4.2 by @soyuka in https://github.com/api-platform/core/pull/7409
• fix(symfony): openapi property path for validation by @soyuka in https://github.com/api-platform/core/pull/7411
• fix(openai): allow to override description in response by @VincentLanglet in https://github.com/api-platform/core/pull/7412
• fix(schema): anyOf must contains an array, not an object by @Cafeine42 in https://github.com/api-platform/core/pull/7399
• fix: handle generic schema in JsonSchema by @elliotbruneel in https://github.com/api-platform/core/pull/7414
• fix(symfony): remove suggest ocramius/package-versions by @maxhelias in https://github.com/api-platform/core/pull/7395
• fix(laravel): correct the example of swagger_ui.apiKeys config by @ttskch in https://github.com/api-platform/core/pull/7392
• fix(pagination): make default value of pagination_maximum_items_per_page same as Laravel version by @ttskch in https://github.com/api-platform/core/pull/7396

New Contributors

• @Cafeine42 made their first contribution in https://github.com/api-platform/core/pull/7399
• @elliotbruneel made their first contribution in https://github.com/api-platform/core/pull/7414

Full Changelog: https://github.com/api-platform/core/compare/v4.2.0...v4.2.1