Security
- Reject control and whitespace characters in URI host components (GHSA-hq7v-mx3g-29hw)
- Reject malformed Host values when constructing request URIs (GHSA-34xg-wgjx-8xph)
Fixed
- Make
ServerRequest::fromGlobals()robust against unexpected HTTP header value types in$_SERVER