Changelog (v5.4.50...v5.4.54)
- bug #66491 Fix HeaderUtils::split() when a separator is a whitespace character (@nicolas-grekas)
- bug #66251 Make session handlers non-serializable (@mcdruid)
- bug #66078 Fix port stripping on IPv4-mapped IPv6 forwarded addresses (@nicolas-grekas)
- bug #66048 Remove the ambiguity that makes HeaderUtils::split() backtrack (@nicolas-grekas)
- minor #65836 Fix hitting the PCRE size limit with many trusted host patterns (@nicolas-grekas)
- bug #65775 Match paths with the DOTALL modifier (@nicolas-grekas)
- bug #65753 Combine trusted host patterns into a single regexp (@nicolas-grekas)
- bug #65743 Encode the path in the X-Accel-Redirect header (@Athorcis)
- bug #65729 Reject reserved characters in the cookie path and domain (@nicolas-grekas)
- bug #65741 Reject invalid paths (@nicolas-grekas)
- bug #65725 Fix parsing hosts and schemes in URLs (@nicolas-grekas)
- bug #65684 Do not unmarshall values that SodiumMarshaller cannot decrypt (@nicolas-grekas)
- bug #65683 Allow-list the values of the "X-Sendfile-Type" header (@nicolas-grekas)
- bug #65682 Ignore session ids that are not usable as file names in MockFileSessionStorage (@nicolas-grekas)
[SECURITY] Security release