Sourced fromsymfony/security-bundle's releases.

v5.4.20

Changelog (symfony/security-bundle@v5.4.19...v5.4.20)

• no significant changes

v5.4.19

Changelog (symfony/security-bundle@v5.4.18...v5.4.19)

• bug#48937 Fix using same handler for multiple authenticators (RobertMe)

v5.4.17

Changelog (symfony/security-bundle@v5.4.16...v5.4.17)

• bug#48718 Compatibility with doctrine/annotations 2 (derrabus)
• bug#48615 Fix getting the name of closures on PHP 8.1.11+ (nicolas-grekas)

v5.4.11

Changelog (symfony/security-bundle@v5.4.10...v5.4.11)

• no significant changes

v5.4.9

Changelog (symfony/security-bundle@v5.4.8...v5.4.9)

• bug#46317 Ignore invalid URLs found in failure/success paths (nicolas-grekas)

v5.4.8

Changelog (symfony/security-bundle@v5.4.7...v5.4.8)

• bug#46054 Use config's secret in remember-me signatures (jderusse)

v5.4.5

Changelog (symfony/security-bundle@v5.4.4...v5.4.5)

• bug#45469 fix autoconfiguring Monolog's ProcessorInterface (nicolas-grekas)

v5.4.3

Changelog (symfony/security-bundle@v5.4.2...v5.4.3)

• no significant changes

v5.4.2

Changelog (symfony/security-bundle@v5.4.1...v5.4.2)

• no significant changes

v5.4.1

Changelog (symfony/security-bundle@v5.4.0...v5.4.1)

• bug#44460 Fix ambiguous deprecation message on missing provider (chalasr)

... (truncated)

Sourced fromsymfony/security-bundle's changelog.

CHANGELOG

6.2

• Add theSecurity helper class
• Deprecate theSymfony\Component\Security\Core\Security service alias, useSymfony\Bundle\SecurityBundle\Security instead
• AddSecurity::getFirewallConfig() to help to get the firewall configuration associated to the Request
• AddSecurity::login() to login programmatically
• AddSecurity::logout() to logout programmatically
• Addsecurity.firewalls.logout.enable_csrf to enable CSRF protection using the default CSRF token generator
• Add RFC6750 Access Token support to allow token-based authentication
• Addsecurity.firewalls.switch_user.target_route option to configure redirect target route on switch user
• Deprecate thesecurity.enable_authenticator_manager config option

6.1

• Thesecurity.access_control now accepts aRequestMatcherInterface under therequest_matcher option as scope configuration
• Thesecurity.access_control now accepts anattributes array to match request attributes in theRequestMatcher
• Thesecurity.access_control now accepts aroute option to match request route in theRequestMatcher
• Display the inherited roles of the logged-in user in the Web Debug Toolbar

6.0

• Thesecurity.authorization_checker andsecurity.token_storage services are now private
• RemoveUserPasswordEncoderCommand class and the correspondinguser:encode-password command,useUserPasswordHashCommand anduser:hash-password instead
• Remove thesecurity.encoder_factory.generic service, thesecurity.encoder_factory andSymfony\Component\Security\Core\Encoder\EncoderFactoryInterface aliases,usesecurity.password_hasher_factory andSymfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface instead
• Remove thesecurity.user_password_encoder.generic service, thesecurity.password_encoder and theSymfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface aliases,usesecurity.user_password_hasher,security.password_hasher andSymfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface instead
• Remove thelogout.success_handler andlogout.handlers config options, register a listener on theLogoutEvent event instead
• RemoveFirewallConfig::getListeners(), useFirewallConfig::getAuthenticators() instead

5.4

• DeprecateFirewallConfig::getListeners(), useFirewallConfig::getAuthenticators() instead
• Deprecatesecurity.authentication.basic_entry_point andsecurity.authentication.retry_entry_point services, the logic is moved into theHttpBasicAuthenticator andChannelListener respectively
• DeprecateFirewallConfig::allowsAnonymous() and theallows_anonymous from the data collector data, there will be no anonymous concept as of version 6.
• Deprecate not setting$authenticatorManagerEnabled totrue inSecurityDataCollector andDebugFirewallCommand
• DeprecateSecurityFactoryInterface andSecurityExtension::addSecurityListenerFactory() in favor ofAuthenticatorFactoryInterface andSecurityExtension::addAuthenticatorFactory()
• AddAuthenticatorFactoryInterface::getPriority() which replacesSecurityFactoryInterface::getPosition()
• Deprecate passing an array of arrays as 1st argument toMainConfiguration, pass a sorted flat array offactories instead.

... (truncated)

• 1a049b7 Merge branch '4.4' into 5.4
• 076fd20 [Security/Http] Remove CSRF tokens from storage on successful login
• e16ac30 [SecurityBundle] Fix using same handler for multiple authenticators
• 8203ec9 Bump license year to 2023
• 5891533 Compatibility with doctrine/annotations 2
• 5c96cbd Fix getting the name of closures on PHP 8.1.11+
• 86b49fe Fix CS
• 8ec874d Merge branch '4.4' into 5.4
• d2a6bf4 Fix CS
• 4d5f495 [SecurityBundle] Remove deadclass_exists checks
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from theSecurity Alerts page.