Security Bundle Laravel Package

What's Changed

• Added PHPUnit assertions for security headers and update testing documentation by @Spomky in https://github.com/nelmio/NelmioSecurityBundle/pull/389

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.8.0...v3.9.0

What's Changed

• Add Cross-Origin Policy feature with configurable headers (COEP, COOP, CORP) by @Spomky in https://github.com/nelmio/NelmioSecurityBundle/pull/372

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.7.0...v3.8.0

What's Changed

• Added support for Symfony 8 https://github.com/nelmio/NelmioSecurityBundle/pull/386
• Update development dependencies to latest versions https://github.com/nelmio/NelmioSecurityBundle/pull/388
• Fixed many docs issues (#376 #375 #383 #382 #384)

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.6.0...v3.7.0

What's Changed

• fix: Make PHPStan green by @silasjoisten in https://github.com/nelmio/NelmioSecurityBundle/pull/378
• chore: Manual CS fix by @silasjoisten in https://github.com/nelmio/NelmioSecurityBundle/pull/379
• feat(security): Add Permissions-Policy header support by @silasjoisten in https://github.com/nelmio/NelmioSecurityBundle/pull/373
• feat(permissions-policy): Change header behaviour by @silasjoisten in https://github.com/nelmio/NelmioSecurityBundle/pull/381

New Contributors

• @silasjoisten made their first contribution in https://github.com/nelmio/NelmioSecurityBundle/pull/378

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.5.1...v3.6.0

What's Changed

• Fixed BC break introduced in 3.5.0 by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/370

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.5.0...v3.5.1

What's Changed

• Added support for the report-to directive by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/357
• Added DirectiveSetBuilderInterface to allow runtime modification of CSP rules by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/348
• Fixed ExternalRedirectListener issue parsing some invalid URLs by @Seldaek in https://github.com/nelmio/NelmioSecurityBundle/pull/364

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.4.2...v3.5.0

What's Changed

• Fix Twig version check to not depend on changing VERSION_ID constant by @glaubinix in https://github.com/nelmio/NelmioSecurityBundle/pull/361

New Contributors

• @glaubinix made their first contribution in https://github.com/nelmio/NelmioSecurityBundle/pull/361

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.4.1...v3.4.2

What's Changed

• Fix twig deprecation warning with twig 3.12 by @pscheit in https://github.com/nelmio/NelmioSecurityBundle/pull/359

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.4.0...v3.4.1

What's Changed

• Deprecated X-Xss-Protection by @maxhelias in https://github.com/nelmio/NelmioSecurityBundle/pull/342
• Deprecated the default signed cookie algorithm by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/355
• Added legacy_hash_algo to support backward-compatible hash_algo changes in signed cookies by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/351
• Added ability to set a custom CSP request matcher to define exactly which requests should receive CSP headers by @ihmels in https://github.com/nelmio/NelmioSecurityBundle/pull/241
• Fixed DI Extension class deprecation with Symfony 7.1 by @norkunas in https://github.com/nelmio/NelmioSecurityBundle/pull/350
• Fixed compatibility with twig 3.9 and yielding by @jderusse in https://github.com/nelmio/NelmioSecurityBundle/pull/344 & https://github.com/nelmio/NelmioSecurityBundle/pull/353

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.3.0...v3.4.0

What's Changed

• Introduce ExternalRedirectResponse by @martijnc in https://github.com/nelmio/NelmioSecurityBundle/pull/331

New Contributors

• @martijnc made their first contribution in https://github.com/nelmio/NelmioSecurityBundle/pull/331

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.2.0...v3.3.0

What's Changed

• Added support for cookies with null value by @SerheyDolgushev in https://github.com/nelmio/NelmioSecurityBundle/pull/338

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.1.1...v3.2.0

• Filter view-source reports by @fritzmg in https://github.com/nelmio/NelmioSecurityBundle/pull/333

Full Changelog: https://github.com/nelmio/NelmioSecurityBundle/compare/v3.1.0...v3.1.1

• Fixed overriding CSP header
• Dropped support for Symfony < 5.4
• Added support for Symfony 7

• Bump minimal PHP version to 7.4
• Dropped support for Symfony < 4.4
• Dropped support for Twig 1
• Removed DoctrineCacheUAFamilyParser (use PsrCacheUAFamilyParser instead)
• All classes have been marked as final
• Renamed WhitelistBasedTargetValidator class to AllowListBasedTargetValidator
• Removed CookieSessionHandler
• Allowed to define host restriction for clickjacking protection

• Bump minimal PHP version to 7.4
• Dropped support for Symfony < 4.4
• Dropped support for Twig 1
• Removed DoctrineCacheUAFamilyParser (use PsrCacheUAFamilyParser instead)
• All classes have been marked as final
• Renamed WhitelistBasedTargetValidator class to AllowListBasedTargetValidator
• Removed CookieSessionHandler
• Allowed to define host restriction for clickjacking protection

• Filter moz-extension reports
• Log user agent along with CSP report
• Deprecated external_redirects.whitelist option in favor of external_redirects.allow_list
• Deprecated forced_ssl.whitelist option in favor of forced_ssl.allow_list
• Deprecated Nelmio\SecurityBundle\ContentSecurityPolicy\Violation\Event class in favor of Nelmio\SecurityBundle\ContentSecurityPolicy\Violation\ReportEvent.

• Added support for CSP "prefetch-src" directive
• Added support for CSP "wasm-unsafe-eval" keyword
• Added support for Symfony 6
• Fixed deprecations warnings using PHP 8.1

• Fixed Symfony 5 compatibility issues

• Fixed dependencies (allow installing on PHP 8 and explicitly require symfony/yaml)

• Fix ContentSecurityPolicyController

• Ensure compatibility with Symfony EventDispatcher 5.x

• Ensure passing the correct type to UAParser::parse
  • Use Symfony DI Reference instead of Definition
  • Optimize regular expressions in the sha computer
  • Show non-deprecated usage of the csp_nonce Twig function

• Symfony 5 compatibility added
  • Bump minimal Twig version to 1.38.0

• Fixed deprecated/invalid method usage on logger interface
  • Drop tests for PHP 5.4

• Use base64 for encoding nonces
  • Support more CSP level 3 keywords
  • Allow configuring a report URI for XSS

• Support random_compat v9.99.99
  • Don't ship unneeded files for composer installs
  • Change controller action reference
  • Add worker-src directive
  • Fix deprecation for symfony/config 4.2+

• Abort CSP compiler pass when CSP is not enabled

• Allows matching the query parameter for clickjacking protection
• Cleanup content type restrictable listener
• Added Symfony 4 support
• Added support for 'worker-src' CSP directive
• Removed PHP 5.3 support guarantees F- ix CSP noise filter compiler pass registration

• Deprecate calling ContentSecurityPolicyListener::getNonce without usage ('script' or 'style')
  • Added forced_ssl > redirect_status_code option to allow switching to permanent redirect (301) responses
  • Fixed HSTS header being sent even in non-secure responses unnecessarily
  • Fixed URLs with whitespace prefix not being seen as external redirects

• Fix arguments for Twig extension