v2.3

Changelog

Table of Contents

# 2.3.6

  • /!\ Security: a vulnerability impacting the GraphQL subsystem was allowing users authorized to run mutations for a specific resource type, to execute it on any resource, of any type (CVE-2019-1000011)
  • Fix normalization of raw collections (not API resources)
  • Fix content negotiation format matching

# 2.3.5

  • GraphQL: compatibility with webonyx/graphql-php 0.13
  • OpenAPI/Swagger: expose properties[] as a collection parameter
  • OpenAPI/Swagger: add a description for the properties[] filter
  • OpenAPI/Swagger: Leverage advanced name converters
  • JSON-LD: Prevent an error in ItemNormalizer when $context['resource_class'] is not defined
  • Allow to pass a the serialization group to use a string instead of as an array of one element
  • Modernize the code base to use PHP 7.1 features when possible
  • Bump minimal dependencies of the used Symfony components
  • Improve the Packagist description

# 2.3.4

  • Open API/Swagger: fix YAML export
  • Open API/Swagger: Correctly expose overridden formats
  • GraphQL: display the stack trace when in debug mode
  • GraphQL: prevent a crash when the class name isn’t provided
  • Fix handling of one-to-one relations in subresources
  • Fix max depth handling when eager fetching is disabled
  • Compatibility with Symfony 4.2
  • Prevent calling the remove method from all data persisters
  • Persist Doctrine entities with the DEFERRED_EXPLICIT change tracking policy
  • Throw an InvalidArgumentException when trying to get an item from a collection route
  • Improve the debug bar panel visibility
  • Take into account the route_prefix attribute in subresources
  • Allow to use multiple values with NumericFilter
  • Improve exception handling in ReadListener by adding the previous exception

# 2.3.3

  • Doctrine: revert “prevent data duplication in Eager loaded relations”

# 2.3.2

  • Open API/Swagger: detect correctly collection parameters
  • Open API/Swagger: fix serialization of nested objects when exporting as YAML
  • GraphQL: fix support of properties also mapped as subresources
  • GraphQL: fix retrieving the internal _id when id is not part of the requested fields
  • GraphQL: only exposes the mutations if any
  • Doctrine: prevent data duplication in Eager loaded relations
  • Preserve the host in the internal router

# 2.3.1

  • Data persisters: call only the 1st matching data persister, this fix may break existing code, see https://github.com/api-platform/docs/issues/540#issuecomment-405945358
  • Subresources: fix inverse side population
  • Subresources: add subresources collections to cache tags
  • Subresources: fix Doctrine identifier parameter type detection
  • Subresources: fix max depth handling
  • GraphQL: send a 200 HTTP status code when a GraphQL response contain some errors
  • GraphQL: fix filters to allow dealing with multiple values
  • GraphQL: remove invalid and useless parameters from the GraphQL schema
  • GraphQL: use the collection resolver in mutations
  • JSON API: remove duplicate data from includes
  • Filters: fix composite keys support
  • Filters: fix the OrderFilter when applied on nested entities
  • List Doctrine Inflector as a hard dependency
  • Various quality and usability improvements

# 2.3.0

  • Add support for deprecating resources, operations and fields in GraphQL, Hydra and Swagger
  • Add API Platform panels in the Symfony profiler and in the web debug toolbar
  • Make resource class’s constructor parameters writable
  • Add support for interface as a resource
  • Add a shortcut syntax to define attributes at the root of @ApiResource and @ApiProperty annotations
  • Throw an exception if a required filter isn’t set
  • Allow to specify the message when access is denied using the access_control_message attribute
  • Add a new option to include null results when using the date filter
  • Allow data persisters to return a new instance instead of mutating the existing one
  • Add a new attribute to configure specific formats per resources or operations
  • Add an --output option to the api:swagger:export command
  • Implement the CacheableSupportsMethodInterface introduced in Symfony 4.1 in all (de)normalizers (improves the performance dramatically)
  • Drop support for PHP 7.0
  • Upgrade Swagger UI and GraphiQL
  • GraphQL: Add a totalCount field in GraphQL paginated collections
  • JSONAPI: Allow inclusion of related resources

# 2.2.10

  • /!\ Security: a vulnerability impacting the GraphQL subsystem was allowing users authorized to run mutations for a specific resource type, to execute it on any resource, of any type (CVE-2019-1000011)

# 2.2.9

  • Fix ExistsFilter for inverse side of OneToOne association
  • Fix to not populate subresource inverse side
  • Improve the overall code quality (PHPStan analysis)

# 2.2.8

  • Fix support for max depth when using subresources
  • Fix a fatal error when a subresource type is not defined
  • Add support for group sequences in the validator configuration
  • Add a local class metadata cache in the HAL normalizer
  • FilterEagerLoadingExtension now accepts joins with class name as join value

# 2.2.7

  • Compatibility with Symfony 4.1
  • Compatibility with webonyx/graphql-php 0.12
  • Add missing ApiPlatform\Core\EventListener\EventPriorities’s PRE_SERIALIZE and POST_SERIALIZE constants
  • Disable eager loading when no groups are specified to avoid recursive joins
  • Fix embeddable entities eager loading with groups
  • Don’t join the same association twice when eager loading
  • Fix max depth handling when using HAL
  • Check the value of enable_max_depth if defined
  • Minor performance and quality improvements

# 2.2.6

  • Fix identifiers creation and update when using GraphQL
  • Fix nested properties support when using filters with GraphQL
  • Fix a bug preventing the ExistFilter to work properly with GraphQL
  • Fix a bug preventing to use a custom denormalization context when using GraphQL
  • Enforce the compliance with the JSONAPI spec by throwing a 400 error when using the “inclusion of related resources” feature
  • Update ChainSubresourceDataProvider to take into account RestrictedDataProviderInterface
  • Fix the cached identifiers extractor support for stringable identifiers
  • Allow a POST request to have an empty body
  • Fix a crash when the ExpressionLanguage component isn’t installed
  • Enable item route on collection’s subresources
  • Fix an issue with subresource filters, was incorrectly adding filters for the parent instead of the subresource
  • Throw when a subresources identifier is not found
  • Allow subresource items in the IriConverter
  • Don’t send the Link HTTP header pointing to the Hydra documentation if docs are disabled
  • Fix relations denormalization with plain identifiers
  • Prevent the OrderFilter to trigger faulty deprecation notices
  • Respect the fetchEager=false directive on an association in the EagerLoadingExtension
  • Use the configured name converter (if any) for relations in the HAL’s ItemNormalizer
  • Use the configured name converter (if any) in the ConstraintViolationListNormalizer
  • Dramatically improve the overall performance by fixing the normalizer’s cache key generation
  • Improve the performance CachedRouteNameResolver and CachedSubresourceOperationFactory by adding a local memory cache layer
  • Improve the performance of access control checking when using GraphQL
  • Improve the performance by using isResourceClass when possible
  • Remove a useless try/catch in the CachedTrait
  • Forward the operation name to the IriConverter
  • Fix some more code quality issues

# 2.2.5

  • Fix a various issues preventing the metadata cache to work properly (performance fix)
  • Fix a cache corruption issue when using subresources
  • Fix non-standard outputs when using the HAL format
  • Persist data in Doctrine DataPersister only if needed
  • Fix identifiers handling in GraphQL mutations
  • Fix client-side ID creation or update when using GraphQL mutations
  • Fix an error that was occuring when the Expression Language component wasn’t installed
  • Update the ChainSubresourceDataProvider class to take into account RestrictedDataProviderInterface

# 2.2.4

  • Fix a BC break preventing to pass non-arrays to the builtin Symfony normalizers when using custom normalizers
  • Fix a bug when using FilterEagerLoadingExtension with manual joins
  • Fix some bugs in the AWS API Gateway compatibility mode for Open API/Swagger

# 2.2.3

  • Fix object state inconsistency after persistence
  • Allow to use multiple @ApiFilter annotations on the same class
  • Fix a BC break when the serialization context builder depends of the retrieved data
  • Fix a bug regarding collections handling in the GraphQL endpoint

# 2.2.2

  • Autoregister classes implementing SubresourceDataProviderInterface
  • Fix the DateTimeImmutable support in the date filter
  • Fix a BC break in DocumentationAction impacting NelmioApiDoc
  • Fix the context passed to data providers (improve the eager loading)
  • Fix fix a subresource’s metadata cache bug
  • Fix the configuration detection when using a custom directory structure

# 2.2.1

  • Merge bug fixes from older branches

# 2.2.0

  • Add GraphQL support (including mutations, pagination, filters, access control rules and automatic SQL joins)
  • Fully implement the GraphQL Relay Server specification
  • Add JSONAPI support
  • Add a new @ApiFilter annotation to directly configure filters from resource classes
  • Add a partial paginator that prevents COUNT() SQL queries
  • Add a new simplified way to configure operations
  • Add an option to serialize Validator’s payloads (e.g. error levels)
  • Add support for generators in data providers
  • Add a new allow_plain_identifiers option to allow using plain IDs as identifier instead of IRIs
  • Add support for resource names without namespace
  • Automatically enable FOSUser support if the bundle is installed
  • Add an AbstractCollectionNormalizer to help supporting custom formats
  • Deprecate NelmioApiDocBundle 2 support (upgrade to v3, it has native API Platform support)
  • Deprecate the ApiPlatform\Core\Bridge\Doctrine\EventListener\WriteListener class in favor of the new ApiPlatform\Core\EventListener\WriteListener class.
  • Remove the api_platform.doctrine.listener.view.write event listener service.
  • Add a data persistence layer with a new ApiPlatform\Core\DataPersister\DataPersisterInterface interface.
  • Add the a new configuration to disable the API entrypoint and the documentation
  • Allow to set maximum items per page at operation/resource level
  • Add the ability to customize the message when configuring an access control rule trough the access_control_message attribute
  • Allow empty operations in XML configs

# 2.1.6

  • Add a new config option to specify the directories containing resource classes
  • Fix a bug regarding the ordering filter when dealing with embedded fields
  • Allow to autowire the router
  • Fix the base path handling the Swagger/Open API documentation normalizer

# 2.1.5

  • Add support for filters autoconfiguration with Symfony 3.4+
  • Add service aliases required to use the autowiring with Symfony 3.4+
  • Allow updating nested resource when issuing a POST HTTP request
  • Add support for the immutable date and time types introduced in Doctrine
  • Fix the Doctrine query generated to retrieve nested subresources
  • Fix several bugs in the automatic eager loading support
  • Fix a bug occurring when passing neither an IRI nor an array in an embedded relation
  • Allow to request 0 items per page in collections
  • Also copy the Host from the Symfony Router
  • Paginator::getLastPage() now always returns a float
  • Minor performance improvements
  • Minor quality fixes

# 2.1.4

  • Symfony 3.4 and 4.0 compatibility
  • Autowiring strict mode compatibility
  • Fix a bug preventing to create resource classes in the global namespace
  • Fix Doctrine type conversion in filter’s WHERE clauses
  • Fix filters when using eager loading and non-association composite identifier
  • Fix Doctrine type resolution for identifiers (for custom DBALType)
  • Add missing Symfony Routing options to operations configuration
  • Add SubresourceOperations to metadata
  • Fix disabling of cache pools with the dev environment

# 2.1.3

  • Don’t use dynamic values in Varnish-related service keys (improves Symfony 3.3 compatibility)
  • Hydra: Fix the value of owl:allValuesFrom in the API documentation
  • Swagger: Include the context even when the type is null
  • Minor code and PHPDoc cleanups

# 2.1.2

  • PHP 7.2 compatibility
  • Symfony 4 compatibility
  • Fix the Swagger UI documentation for specific routes (the API request wasn’t executed automatically anymore)
  • Add a missing cache tag on empty collections
  • Fix a missing service when no Varnish URL is defined
  • Fix the whitelist comparison in the property filer
  • Fix some bugs regarding subresources in the Swagger and Hydra normalizers
  • Make route requirements configurable
  • Make possible to configure the Swagger context for properties
  • Better exception messages when there is a content negotiation error
  • Use the PriorityTaggedServiceTrait provided by Symfony instead of a custom implementation
  • Test upstream libs deprecations
  • Various quality fixes and tests cleanup

# 2.1.1

  • Fix path generators
  • Fix some method signatures related to subresources
  • Improve performance of the deserialization mechanism

# 2.1.0

  • Add a builtin HTTP cache invalidation system able to store all requests in Varnish (or any other proxy supporting cache tags) and purge it instantly when needed
  • Add an authorization system configurable directly from the resource class
  • Add support for subresources (like /posts/1/comments or /posts/1/comments/2
  • Revamp the automatic documentation UI (upgraded to the React-based version of Swagger UI, added a custom stylesheet)
  • Add a new filter to select explicitly which properties to serialize
  • Add a new filter to choose which serialization group to apply
  • Add a new filter to test if a property value exists or not
  • Add support for OAuth 2 in the UI
  • Add support for embedded fields
  • Add support for customizable API resources folder’s name
  • Filters’s ids now defaults to the Symfony’s service name
  • Add configuration option to define custom metadata loader paths
  • Make Swagger UI compatible with a strict CSP environment
  • Add nulls comparison to OrderFilter
  • Add a flag to disable all request listeners
  • Add a default order option in the configuration
  • Allow to disable all operations using the XML configuration format and deprecate the previous format
  • Allow upper cased property names
  • Improve the overall performance by optimizing RequestAttributesExtractor
  • Improve the performance of the filters subsystem by using a PSR-11 service locator and deprecate the FilterCollection class
  • Add compatibility with Symfony Flex and Symfony 4
  • Allow the Symfony Dependency Injection component to autoconfigure data providers and query extensions
  • Allow to use service for dynamic validation groups
  • Allow using PHP constants in YAML resources files
  • Upgrade to the latest version of the Hydra spec
  • Add pagination and itemPerPage parameters in the Swagger/Open API documentation
  • Add support for API key authentication in Swagger UI
  • Allow to specify a whitelist of serialization groups
  • Allow to use the new immutable date and time types of Doctrine in filters
  • Update swagger definition keys to more verbose ones (ie Resource-md5($groups) => Resource-groupa_groupb) - see https://github.com/api-platform/core/pull/1207

# 2.0.11

  • Ensure PHP 7.2 compatibility
  • Fix some bug regarding Doctrine joins
  • Let the hydra_context option take precedence over operation metadata
  • Fix relations handling by the non-hypermedia ItemNormalizer (raw JSON, XML)
  • Fix a bug in the JSON-LD context: should not be prefixed by #
  • Fix a bug regarding serialization groups in Hydra docs

# 2.0.10

  • Performance improvement
  • Swagger: Allow non-numeric IDs (such as UUIDs) in URLs
  • Fix a bug when a composite identifier is missing
  • ApiPlatform\Core\Bridge\Doctrine\Orm\Filter\OrderFilter::extractProperties now always return an array
  • Fix NelmioApiDocParser recursive relations

# 2.0.9

  • Add support for Symfony 3.3
  • Disable the partial eager loading by default
  • Fix support for ignored attributes in normalizers
  • Specify the LEFT JOIN clause for filter associations
  • Move the metadata from validator factory to the validator.xml file
  • Throw an exception when the number of items per page is 0
  • Improve the Continuous Integration process

# 2.0.8

  • Leverage serialization groups to eager load data
  • Fix the Swagger Normalizer to correctly support nested serialization groups
  • Use strict types
  • Get rid of the dependency to the Templating component
  • Explicitly add missing dependency to PropertyAccess component
  • Allow the operation name to be null in ResourceMetadata
  • Fix an undefined index error occurring in some cases when using sub types
  • Make the bundle working even when soft dependencies aren’t installed
  • Fix serialization of multiple inheritance child types
  • Fix the priority of the FOSUSer’s event listener
  • Fix the resource class resolver with using \Traversable values
  • Fix inheritance of property metadata for the Doctrine ORM property metadata factory
  • EagerLoadingExtension: Disable partial fetching if entity has subclasses
  • Refactoring and cleanup of the eager loading mechanism
  • Fix the handling of composite identifiers
  • Fix HAL normalizer when the context isn’t serializable
  • Fix some quality problems found by PHPStan

# 2.0.7

  • [security] Hide error’s message in prod mode when a 500 error occurs (Api Problem format)
  • Fix sorting when eager loading is used
  • Allow eager loading when using composite identifiers
  • Don’t use automatic eager loading when disabled in the config
  • Use declare(strict_types=1) and improve coding standards
  • Automatically refresh routes in dev mode when a resource is created or deleted

# 2.0.6

  • Correct the XML Schema type generated for floats in the Hydra documentation

# 2.0.5

  • Fix a bug when multiple filters are applied

# 2.0.4

  • [security] Hide error’s message in prod mode when a 500 error occurs
  • Prevent duplicate data validation
  • Fix filter Eager Loading
  • Fix the Hydra documentation for ConstraintViolationList
  • Fix some edge cases with the automatic configuration of Symfony
  • Remove calls to each() (deprecated since PHP 7.2)
  • Add a missing property in EagerLoadingExtension

# 2.0.3

  • Fix a bug when handling invalid IRIs
  • Allow to have a property called id even in JSON-LD
  • Exclude static methods from AnnotationPropertyNameCollectionFactory
  • Improve compatibility with Symfony 2.8

# 2.0.2

  • Fix the support of the Symfony’s serializer @MaxDepth annotation
  • Fix property range of relations in the Hydra doc when an IRI is used
  • Fix an error “api:swagger:export” command when decorating the Swagger normalizer
  • Fix an an error in the Swagger documentation generator when a property has several serialization groups

# 2.0.1

  • Various fixes related to automatic eager loading
  • Symfony 3.2 compatibility

# 2.0.0

  • Full refactoring
  • Use PHP 7
  • Add support for content negotiation
  • Add Swagger/OpenAPI support
  • Integrate Swagger UI
  • Add HAL support
  • Add API Problem support
  • Update the Hydra support to be in sync with the last version of the spec
  • Full rewrite of the metadata system (annotations, YAML and XML formats support)
  • Remove the event system in favor of the builtin Symfony kernel’s events
  • Use the ADR pattern
  • Fix a ton of issues
  • ItemDataproviderInterface: fetchData is now in the context parameterer. getItemFromIri is now context aware 7f82fd7
  • Constants for event’s priorities 2e7b73e
  • Properties mapping with XML/YAML is now possible ef5d037
  • Ability to configure and match exceptions with an HTTP status code e9c1863
  • Various fixes and improvements (SwaggerUI, filters, stricter property metadata)

# 1.1.1

  • Fix a case typo in a namespace alias in the Hydra documentation

# 1.1.0 beta 2

  • Allow to configure the default controller to use
  • Ability to add route requirements
  • Add a range filter
  • Search filter: add a case sensitivity setting
  • Search filter: fix the behavior of the search filter when 0 is provided as value
  • Search filter: allow to use identifiers different than id
  • Exclude tests from classmap
  • Fix some deprecations and tests

# 1.1.0 beta 1

  • Support Symfony 3.0
  • Support nested properties in Doctrine filters
  • Add new start and word_start strategies to the Doctrine Search filter
  • Add support for abstract resources
  • Add a new option to totally disable Doctrine
  • Remove the ID attribute from the Hydra documentation when it is read only
  • Add method to avoid naming collision of DQL join alias and bound parameter name
  • Make exception available in the Symfony Debug Toolbar
  • Improve the Doctrine Paginator performance in some cases
  • Enhance HTTPS support and fix some bugs in the router
  • Fix some edge cases in the date and time normalizer
  • Propagate denormalization groups through relations
  • Run tests against all supported Symfony versions
  • Add a contribution documentation
  • Refactor tests
  • Check CS with StyleCI

# 1.0.1

  • Avoid an error if the attribute isn’t an array

# 1.0.0

  • Extract the documentation in a separate repository
  • Add support for eager loading in collections

# 1.0.0 beta 3

  • The Hydra documentation URL is now /apidoc (was /vocab)
  • Exceptions implements Dunglas\ApiBundle\Exception\ExceptionInterface
  • Prefix automatically generated route names by api_
  • Automatic detection of the method of the entity class returning the identifier when using Doctrine (previously getId() was always used)
  • New extension point in Dunglas\ApiBundle\Doctrine\Orm\DataProvider allowing to customize Doctrine paginator and performance optimization when using typical queries
  • New Dunglas\ApiBundle\JsonLd\Event\Events::CONTEXT_BUILDER event allowing to modify the JSON-LD context
  • Change HTTP status code from 202 to 200 for PUT requests
  • Ability to embed the JSON-LD context instead of embedding it

# 1.0.0 beta 2

  • Preserve indexes when normalizing and denormalizing associative arrays
  • Allow to set default order for property when registering a Doctrine\Orm\Filter\OrderFilter instance

You can also help us improve the documentation of this page.

Made with love by

Les-Tilleuls.coop can help you design and develop your APIs and web projects, and train your teams in API Platform, Symfony, Next.js, Kubernetes and a wide range of other technologies.

Learn more

Copyright © 2023 Kévin Dunglas

Sponsored by Les-Tilleuls.coop

Resources

LogosWallpapersColouring webby
HelpNeed help?ScreencastsStack OverflowSlack
CommunityOverviewEventsAPI Platform ConferenceContributorsHow to contribute

Code licensed under MIT, documentation under CC by 3.0

Enterprise subscriptionSecurity PolicyTrademark Policy