Version 2.3.6

• /!\ Security: a vulnerability impacting the GraphQL subsystem was allowing users authorized to run mutations for a specific resource type, to execute it on any resource, of any type
• Fix normalization of raw collections (not API resources)
• Fix content negotiation format matching

Version 2.3.5

• GraphQL: compatibility with webonyx/graphql-php 0.13
• OpenAPI/Swagger: expose properties[] as a collection parameter
• OpenAPI/Swagger: add a description for the properties[] filter
• OpenAPI/Swagger: Leverage advanced name converters
• JSON-LD: Prevent an error in ItemNormalizer when $context['resource_class'] is not defined
• Allow to pass a the serialization group to use a string instead of as an array of one element
• Modernize the code base to use PHP 7.1 features when possible
• Bump minimal dependencies of the used Symfony components
• Improve the Packagist description

Version 2.3.4

• Open API/Swagger: fix YAML export
• Open API/Swagger: Correctly expose overridden formats
• GraphQL: display the stack trace when in debug mode
• GraphQL: prevent a crash when the class name isn't provided
• Fix handling of one-to-one relations in subresources
• Fix max depth handling when eager fetching is disabled
• Compatibility with Symfony 4.2
• Prevent calling the remove method from all data persisters
• Persist Doctrine entities with the DEFERRED_EXPLICIT change tracking policy
• Throw an InvalidArgumentException when trying to get an item from a collection route
• Improve the debug bar panel visibility
• Take into account the route_prefix attribute in subresources
• Allow to use multiple values with NumericFilter
• Improve exception handling in ReadListener by adding the previous exception

Version 2.3.3

• Doctrine: revert "prevent data duplication in Eager loaded relations"

Version 2.3.2

• Open API/Swagger: detect correctly collection parameters
• Open API/Swagger: fix serialization of nested objects when exporting as YAML
• GraphQL: fix support of properties also mapped as subresources
• GraphQL: fix retrieving the internal _id when id is not part of the requested fields
• GraphQL: only exposes the mutations if any
• Doctrine: prevent data duplication in Eager loaded relations
• Preserve the host in the internal router

Version 2.3.1

• Data persisters: call only the 1st matching data persister, this fix may break existing code, see api-platform/docs#540 (comment)
• Subresources: fix inverse side population
• Subresources: add subresources collections to cache tags
• Subresources: fix Doctrine identifier parameter type detection
• Subresources: fix max depth handling
• GraphQL: send a 200 HTTP status code when a GraphQL response contain some errors
• GraphQL: fix filters to allow dealing with multiple values
• GraphQL: remove invalid and useless parameters from the GraphQL schema
• GraphQL: use the collection resolver in mutations
• JSON API: remove duplicate data from includes
• Filters: fix composite keys support
• Filters: fix the OrderFilter when applied on nested entities
• List Doctrine Inflector as a hard dependency
• Various quality and usability improvements

Version 2.3.0

• Add support for deprecating resources, operations and fields in GraphQL, Hydra and Swagger
• Add API Platform panels in the Symfony profiler and in the web debug toolbar
• Make resource class's constructor parameters writable
• Add support for interface as a resource
• Add a shortcut syntax to define attributes at the root of @ApiResource and @ApiProperty annotations
• Throw an exception if a required filter isn't set
• Allow to specify the message when access is denied using the access_control_message attribute
• Add a new option to include null results when using the date filter
• Allow data persisters to return a new instance instead of mutating the existing one
• Add a new attribute to configure specific formats per resources or operations
• Add an --output option to the api:swagger:export command
• Implement the CacheableSupportsMethodInterface introduced in Symfony 4.1 in all (de)normalizers (improves the performance dramatically)
• Drop support for PHP 7.0
• Upgrade Swagger UI and GraphiQL
• GraphQL: Add a totalCount field in GraphQL paginated collections
• JSONAPI: Allow inclusion of related resources

Version 2.2.9

• Fix ExistsFilter for inverse side of OneToOne association
• Fix to not populate subresource inverse side
• Improve the overall code quality (PHPStan analysis)

Version 2.3.0 beta 1

• Add support for deprecating resources, operations and fields in GraphQL, Hydra and Swagger
• Add API Platform panels in the Symfony profiler and in the web debug toolbar
• Make resource class's constructor parameters writable
• Add a shortcut syntax to define attributes at the root of @ApiResource and @ApiProperty annotations
• Throw an exception if a required filter isn't set
• Allow to specify the message when access is denied using the access_control_message attribute
• Add a new option to include null results when using the date filter
• Allow data persisters to return a new instance instead of mutating the existing one
• Add a new attribute to configure specific formats per resources or operations
• Add an --output option to the api:swagger:export command
• Implement the CacheableSupportsMethodInterface introduced in Symfony 4.1 in all (de)normalizers (improves the performance dramatically)
• Drop support for PHP 7.0
• Upgrade Swagger UI and GraphiQL
• GraphQL: Add a totalCount field in GraphQL paginated collections
• JSONAPI: Allow inclusion of related resources

Version 2.2.8

• Fix support for max depth when using subresources
• Fix a fatal error when a subresource type is not defined
• Add support for group sequences in the validator configuration
• Add a local class metadata cache in the HAL normalizer
• FilterEagerLoadingExtension now accepts joins with class name as join value