Update dependency api-platform/core to v4 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
api-platform/core (source)	^3.4.17 → ^4.0.0

---

API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

CVE-2026-49858 / GHSA-pjhx-3c3w-9v23

More information

Details

Impact

#[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them.

This is the same vulnerability class as GHSA-428q-q3vv-3fq3 / CVE-2025-31485, which fixed only the GraphQL ItemNormalizer. The JSON:API and HAL paths were not addressed at the time.

Exploitation conditions

Exploitation requires all of the following to coincide:

• The application exposes a resource via the JSON:API and/or HAL formats.
• At least one property of that resource uses #[ApiProperty(security: ...)] with a predicate whose result depends on the current user (or on per-request state).
• A request from a user for whom the predicate evaluates to true populates componentsCache before a request from a user for whom the predicate evaluates to false, within the lifetime of the same PHP process.
• The deployment uses a long-running PHP runtime that keeps the normalizer instance alive across requests (FrankenPHP worker mode, RoadRunner, Swoole, ReactPHP, etc.). With classic php-fpm workers the cache only survives the duration of a single request, which makes the issue much harder to observe in practice.

Patches

• 4.1.29
• 4.2.25
• 4.3.8

All three branches receive patched releases of api-platform/core, api-platform/json-api, and api-platform/hal.

Workarounds

Override the JSON:API and HAL ItemNormalizer services to gate $context['cache_key'] with a resource-class security check, or avoid #[ApiProperty(security: ...)] on resources served as JSON:API or HAL until the patch is applied. Pinning the deployment to classic php-fpm workers also limits exposure since the cache does not survive across requests.

Credits

• Tillmann Baumgart (@​tillmon) — originally identified the broader cache-key gap and proposed moving isCacheKeySafe to AbstractItemNormalizer.
• Antoine Bluchet (@​soyuka) — extended the gate to JSON:API and HAL normalizers.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/api-platform/core/security/advisories/GHSA-pjhx-3c3w-9v23
• https://nvd.nist.gov/vuln/detail/CVE-2026-49858
• https://github.com/advisories/GHSA-pjhx-3c3w-9v23

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

api-platform/core (api-platform/core)

v4.1.29

Compare Source

Bug fixes

• 9f5d0e020 fix(serializer): gate cache_key in JsonApi and Hal with isCacheKeySafe
• 3812a3617 fix(serializer): adapt tests for 4.1 (createMock for HAL, drop name converter)
• 8f32ad0e3 fix(serializer): bump min serializer dep and fix phpstan probe typing
• 89ca6f279 fix(state): _api_operation_nme to _api_operation_name in ErrorProvider (#​7637)

v4.1.28

Compare Source

Bug fixes

• dfe42b385 fix(symfony): skip argument resolver when context is not api platform

v4.1.27

Compare Source

Bug fixes

• 3df65aa86 fix(symfony): allow disabling PHPStan PhpDocParser (#​7507)
• 7c76fb8ea fix(jsonld): read identifier with itemUriTemplate (#​7517)

v4.1.26

Compare Source

Bug fixes

• 4fa6d3fa2 fix(laravel): groups with input/output
• 99718d954 fix(serializer): resilient denormalizeRelation capability (#​7474)
• a26c35840 fix(doctrine): properly set properties according to interface (#​7487)
• a2867e986 fix(laravel): serializer attributes on Eloquent methods (#​7416)
• ddf4c0b5e fix(graphql): stateOptions to get filter class (#​7485)
• fafbe5c7b fix(validator): custom message was not translated (#​7424)

v4.1.25

Compare Source

Bug fixes

• 54352d853 fix(jsonld): hydra context w3.org updates (#​7410)
• 85f198a56 fix(laravel): filter should query correct property
• 91b17f1f3 fix(laravel): correct the example of swagger_ui.apiKeys config (#​7392)

v4.1.24

Compare Source

Bug fixes

• 07112a27d fix(laravel): remove duplication code exception
• 4abec444e fix(metadata): compute isWritable during updates (#​7383)
• 7c117d9f7 fix: phpdoc for HttpOperation paginationViaCursor parameter (#​7379)

Features

Laravel compatibility with api-platform/http-cache:

• fa2bc95ff fix(laravel): http cache compatibility (#​7380)

v4.1.23

Compare Source

Bug fixes

• 254cbdd00 fix(symfony): only set name_converter for the default serializer (#​6101) (#​7365)
• dcbc529a0 fix: pagination via cursor on ApiResource operations (#​7368)

v4.1.22

Compare Source

Bug fixes

• 11bba62c2 fix(laravel): serialization issue with camelCase relation (#​7356)

v4.1.21

Compare Source

Bug fixes

• 04414e4fc fix(serializer): improve #​7270 by reducing inconsistencies (#​7346)
• 2e6911c35 fix(openapi): sync typehints between properties and getter/canner for alllowReserved and allowEmptyValue (#​7322)
• 385953a92 fix(jsonapi): handle type error when handling validation errors (#​7330)
• 4f717c1e1 fix(openapi): allow null on allowReserved and allowEmptyValue properties (#​7315)
• c46c57918 fix(doctrine): do not consider empty string as a current date (#​7291)
• d1073bc67 fix(laravel): read property type before serialization (#​7332)
• d1abfc0fa fix(openapi): nullable default values in operation openapi definition (#​7321)
• e7502b65a fix(serializer): nested denormalization when allow_extra_attributes=false (#​7270)

Features

• 2d501b315 feat(laravel): support composite identifiers within Link (#​7342)

v4.1.20

Compare Source

Bug fixes

• c41a0bca4 fix(jsonld): child class @​type shortName (#​7312)
• d26088ba1 chore: allow doctrine-persistence:^4.0 (#​7309)

v4.1.19

Compare Source

Bug fixes

• 2c06a22e2 fix(validation): moving dependency from require-dev to require (#​7296)
• 2cde06246 fix(openapi): output partial query parameter to OpenAPI when pagination_client_enabled is true (#​7295)
• 6bc112193 fix(metadata): do not fail if phpstan/phpdoc-parser is missing (#​7279)
• 871e5d3e1 fix(symfony): restore graphql_playground option (#​7274)
• d1e6772e3 fix(validation): property path on deepObject style (#​7179)
• d35e46b14 fix(hydra): "property" may not be defined (#​7293)
• f3a54a239 fix: json formatted resource should not get xml errors #​7287 (#​7297)

v4.1.18

Compare Source

Bug fixes

• 0e712d969 fix(symfony): catch InvalidUriVariableException in IriConverter (#​7271)
• 221e5d97f fix(openapi): command options mode (InputOption::VALUE_REQUIRED) (#​7266)
• 3ed6f30f5 fix(symfony): fix resolving groups in ValidationGroupsExtractorTrait when GroupSequence (#​7272)
• 6e4e46bfe fix(json-schema): Rebuild sub-schema definition without @id property when genId is false (#​7162) (#​7251)
• 803165228 fix(symfony): missing GroupSequence type for validation groups
• 85e18a2d6 fix(metadata): support stateOptions in YAML and XML for Doctrine ORM/ODM (#​7217)
• 88e0073bf fix(validator): error xml format output
• bf271d139 fix(validator): parameter validation list|string (#​7245)
• d3e73f09a fix(metadata): read every OpenApiOperation attributes in Xml instead of only "deprecated" (#​7189)
• e40bb19a6 fix(laravel): decorate error handler (#​7247)
• f0604a07e fix: getcontainer return type (#​7230)
• f46c0a3f4 fix(jsonld): reset gen_id configuration (#​7264)
• f82464431 fix(state): depend only on translation contracts (#​7262)
• fa37c1eba fix(state): error xml format output (#​7273)

Experimental Features

• 8885000db feat(state): cast parameter values to validate with the Type constraint (#​7240)

v4.1.17

Compare Source

Bug fixes

• 34a0d54b1 fix(jsonld): genId false should work with embeded resources (#​7219)
• c025b8f9f fix(openapi): correct example usage for 3.0 (#​7218)
• cdda4146b fix(laravel): Allow LinksHandler to handle polymorphic relationships (#​7231)
• dba97370f fix(metadata): boolean type detection from parameter's schema (#​7223)

v4.1.16

Compare Source

Bug fixes

• 4a99a5f6e fix(laravel): persist HasMany and MorphMany relationships (#​7208)
• 9bfa5fef0 fix(metadata): call dynamic validation groups #​7184 (#​7184)
• b2131645d fix(laravel): route where uses requirements (#​7199)
• b2b5f99c6 refactor(state): merge parameter and link security (#​7200)

Notes:

Two providers are now available on parameters (query parameters, header and uri variables Link):

• ReadLinkParameterProvider previously used for link security (renamed from Symfony\Security\State\LinkedReadProvider)
• IriConverterParameterProvider this allows you to read a resource from an IRI usefull for filters (eg ?author=/authors/1)

Previous tests on link security were left untouched we removed the experimental class Symfony\Security\State\LinkAccessCheckerProvider as well as the LinkedReadProvider as they're not used anymore.

v4.1.15

Compare Source

There was an issue with the subtree split as we attempted to test lower dependencies on the subtree split, some components where wrongly tagged.

The proper fix is at: #​7196

Bug fixes

• 4bdfd6063 fix(symfony, laravel) skip webhooks when generates routing (#​7175)
• 582076cb6 fix(openapi): duplicate get path for webhooks (#​7174)
• 84b967930 fix(laravel): persist morph relations (#​7170)
• d51cddba2 fix(laravel): index on non-primary key (#​7183)
• fdb485dd2 fix(openapi): example and default with nullable value not being shown

Features

• 79d08db6a feat(elasticsearch): add support for v9 (#​7180)

v4.1.14

Compare Source

There was an issue with the subtree split as we attempted to test lower dependencies on the subtree split, some components where wrongly tagged.

The proper fix is at: #​7196

Bug fixes

• 4bdfd6063 fix(symfony, laravel) skip webhooks when generates routing (#​7175)
• 582076cb6 fix(openapi): duplicate get path for webhooks (#​7174)
• 84b967930 fix(laravel): persist morph relations (#​7170)
• d51cddba2 fix(laravel): index on non-primary key (#​7183)
• fdb485dd2 fix(openapi): example and default with nullable value not being shown

Features

• 79d08db6a feat(elasticsearch): add support for v9 (#​7180)

v4.1.12

Compare Source

Bug fixes

• b14a463a9 fix(laravel): register error handler without graphql

v4.1.11

Compare Source

Bug fixes

• b14a463a9 fix(laravel): register error handler without graphql

v4.1.10

Compare Source

Bug fixes

• 329acf21e fix(metadata): infer parameter string type from schema (#​7161)
• 5459ba375 fix(metadata): parameter cast to array flag (#​7160)
• fe73002bf fix(laravel): duplicated property names
• b0390080e fix(laravel): name convert validation property path
• 730d17a30 fix(laravel): validate the model instead of body
• 4d66f5ef3 fix(laravel): persist embeded relations with groups
• 39123942a fix(laravel): register error handler without graphql
• fd010ea1b fix(openapi): nullable externalDocs return type
• 470c2e8bd fix(httpcache): iri cache tag for collection operation with path parameter
• 9c0dbb653 fix(state): do not expose FQCN in DeserializeProvider on PartialDenormalizationException (#​7158)
• f78986000 fix(serializer): exception message to not expose resource FQCN (#​7156)

Features

• 767fa926b feat(laravel): add name_converter option

v4.1.9

Compare Source

Bug fixes

• 4dd0cdfc4 fix(doctrine): support integer-backed enums in BackedEnumFilter (#​7127)
• 70a922573 fix: error formats (#​7148)
• 723d041c4 fix(metadata): xml PHPize HTTP cache headers (#​7140)
• d3d0ca21b fix(serializer): invalid uri variable 400 response (#​7135)

v4.1.8

Compare Source

Bug fixes

• 0cd9b9f70 fix: backport handling of union/intersection type in item normalizer (#​7106)
• 0fc0904b9 fix(metadata): correct class to exclude defaults (#​7088)
• 5145a8383 fix: filtering not using strategy set in attribute when strategy not set per property (#​7136)
• 613bb5b75 fix(doctrine): filters schema for dates and numbers (#​7131)
• ed1ef2594 fix(state): specify :property parameter properties (#​7110)
• f55606b01 fix(serializer): throw NotNormalizableValueException when resource not found or invalid IRI on denormalization
• 3faf5d4b4 fix(doctrine): order filter instance service
• 0ff950f37 fix: type info deprecations to baseline
• d93d580a1 fix: command name deprecation

v4.1.7

Compare Source

Bug fixes

• 40c09d1c0 fix(metadata): yaml link security (#​7066)
• 545eb69b8 fix(symfony): internal resources should not inherit global defaults (#​7073)
• 615bdd6b1 fix(hydra): use correctly enable_docs (#​7062)
• 694681f4b fix(symfony): do not ignore Test files on symfony (#​7077)
• 6f15be5c7 fix(laravel): eloquent BelongsTo linking (#​7075)
• dddd3eee4 fix(metadata): parameter provider within filter (#​7081)
• dfca9bf60 Revert "fix(jsonld): duplicate error fields when prefix is enabled (#​7021)" (#​7074)
• d696a8e42 fix(metadata): use template typehint in parameters (#​7078)

v4.1.6

Compare Source

Bug fixes

• 44e560839 fix(laravel): undefined variable app

v4.1.5

Compare Source

Bug fixes

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485

v4.1.4

Compare Source

Bug fixes

• eaf007536 fix(state): support filter interface on serializer filter parameter provider (#​7047)
• b0fa2291e fix(laravel): error handler only on api routes (#​7049)
• 1eb9da13a fix(laravel): missing filters (#​7056)
• a46a76889 fix(symfony): serialization of closure inside the profiler (#​7054)
• c1b50e2cb fix(doctrine): joinColumn might be an array (#​7060)
• f4c426d71 Revert "fix(doctrine): throw an exception when a filter is not found in a par…" (#​7046)

v4.1.3

Compare Source

Bug fixes

• 8a2265041 fix(laravel): defer "filters" dependent services (#​7045)

v4.1.2

Compare Source

Bug fixes

• 9f5d0e020 fix(serializer): gate cache_key in JsonApi and Hal with isCacheKeySafe
• 3812a3617 fix(serializer): adapt tests for 4.1 (createMock for HAL, drop name converter)
• 8f32ad0e3 fix(serializer): bump min serializer dep and fix phpstan probe typing
• 89ca6f279 fix(state): _api_operation_nme to _api_operation_name in ErrorProvider (#​7637)

v4.1.1

Compare Source

Bug fixes

• 2c06a22e2 fix(validation): moving dependency from require-dev to require (#​7296)
• 2cde06246 fix(openapi): output partial query parameter to OpenAPI when pagination_client_enabled is true (#​7295)
• 6bc112193 fix(metadata): do not fail if phpstan/phpdoc-parser is missing (#​7279)
• 871e5d3e1 fix(symfony): restore graphql_playground option (#​7274)
• d1e6772e3 fix(validation): property path on deepObject style (#​7179)
• d35e46b14 fix(hydra): "property" may not be defined (#​7293)
• f3a54a239 fix: json formatted resource should not get xml errors #​7287 (#​7297)

v4.1.0

Compare Source

Bug fixes

• da37ca91c fix(laravel): default to file cache instead of cache.default (#​6955)
• e041d721e fix: errors retrieval and documentation (#​6952)
• e6130cbcc fix: missing filters on swagger ui entrypoint (#​6950)
• 01fd74268 fix(laravel): restore accidentally removed BooleanFilter
• db40a63e7 fix(hydra): rdfs:label should not duplicate title (#​6748)
• deb2ed265 fix(laravel): fix use laravel fillable for writable props (#​6898)
• 67fbe51c5 fix: reintroduce the show_webby parameter in Laravel config (#​6741)

Features

• cb5ede1c5 feat: add checkMode parameter to control json schema validation (#​6974)
• 771d9401c feat(elasticsearch): re-introduce v7 support (#​6827)
• b5372ddee feat(openapi): filter x-apiplatform-tags to produce different openapi specifications (#​6945)
• 2e2debb94 feat(mongodb): Replace usage of deprecated method AggregationBuilder::execute() (#​6933)
• 4bdf042e5 feat(mongodb): Add pagination metadata to the aggregation results (#​6912)
• b968ccd50 feat(openapi): document error outputs using json-schemas (#​6923)
• c97db6bb2 feat: swagger ui persist authorization option (#​6877)
• 00787f32d feat(laravel): automatically register policies (#​6623)
• 12c42096b feat(metadata): ability to hide an hydra class/operation (#​6871)
• 57f15cf4f feat(state): strict query parameters (#​6399)
• bd0e92936 feat(openapi): HTTP Authentication Support for Swagger UI (#​6665)
• be98f4e01 feat(graphql): allow to configure max query depth and max query complexity (#​6880)
• c78ed0b78 feat(laravel): boolean filter (#​6806)
• d0a442786 feat(doctrine): enhance getLinksHandler with method validation and typo suggestions (#​6874)
• f67f6f1ac feat(doctrine): doctrine filters like laravel eloquent filters (#​6775)

v4.0.22

Compare Source

Bug fixes

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485
• f4c426d71 Revert "fix(doctrine): throw an exception when a filter is not found in a par…" (#​7046)

v4.0.21

Compare Source

Bug fixes

• 7cb5a6db8 fix: allow parameter provider as object (#​7032)
• bb83e9a03 fix(symfony): allow to merge array with string in global defaults (#​7037)
• da2e86809 fix: header parameter should be case insensitive (#​7031)

Features

v4.0.20

Compare Source

Bug fixes

• 284937039 fix(doctrine): mapping ArrayAccess deprecation (#​6982)
• a434173b8 fix(doctrine): Add a proper exception when a doctrine manager could not be found for a resource class (#​6995)

Features

v4.0.19

Compare Source

Bug fixes

• 1dfefda5e fix(laravel): add middleware granularity (#​6962)

Compatibility with Laravel 12.

v4.0.18

Compare Source

Bug fixes

• 7007dcca8 fix(laravel): duplicate middleware in routes
• a16147ab7 fix(laravel): handle route prefix (#​6978)
• d2e1963c5 fix(symfony): detach objects to prevent loop when using Doctrine middleware and Mercure (#​6936) (#​6965)

Features

v4.0.17

Compare Source

Bug fixes

• 5124d8c57 fix(laravel): Prevent overwriting existing routes on the router (#​6941)
• 5c7e0d2c0 fix(symfony): error wrongly inherit normalization context (#​6939)
• af35d34d0 fix(laravel): mitigate property metadata read for Error (#​6951)
• d5b48b1cd fix(laravel): SwaggerUI custom CSS (#​6937)
• da796b979 fix(metadata): allow serializer attribute object in ApiProperty::$serialize (#​6946)
• de2d298e3 fix: ensure template files have a tpl file extension (#​6826) (#​6829)
• b6a67a197 perf: various optimizations for Laravel/Symfony (#​6954)

To save some time during cache warmup we recommend to define uri variables such as: uriVariables: ['id']. More details at #​6954.

Features

v4.0.16

Compare Source

Bug fixes

• dc4fc84ba fix(graphql): securityAfterResolver not called

Features

v4.0.15

Compare Source

Bug fixes

• 36cee399c fix(state): skip Content-Location header for GET requests (#​6901)
• dba9de197 fix(symfony): fix property restrictions for root resource with dynamic validation groups (#​6908)

Features

• 421d97ecf feat(laravel): add support for backed enum normalizers (#​6911)

Also contains v3.4.15 changes.

v4.0.14

Compare Source

Bug fixes

• 97cdb6b3f fix(state): remove ProcessorInterface laravel specific type
• b12a0d005 fix(graphql): register types for parameter args (#​6895)

Also contains v3.4.14 changes.

v4.0.13

Compare Source

Bug fixes

• 3a694624b fix(laravel): eloquent BelongsToMany relation (#​6862)
• c8db7aef0 fix(laravel): jsonapi query parameters (page, sort, fields and include) (#​6876)
• f2c998158 fix(jsonld): anonymous context hydra_prefix value (#​6873)

Also contains v3.4.10 changes.

v4.0.12

Compare Source

Bug fixes

• 4db72f55f fix: filter may not use FilterInterface (#​6858)
• c899a3da1 fix(laravel): use tagged resolvers as graphql resolvers
  (#​6855)
• [e0f8c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.