Changelog (v7.4.22...v7.4.23)
- security #GHSA-xg2q-4rrq-657q Split the private ranges usable as trusted proxies from the deny list of private subnets (@nicolas-grekas)
- security #GHSA-xg2q-4rrq-657q Add the list of private ranges usable as trusted proxies (@nicolas-grekas)
- security #cve-2026-118514 Match HEAD requests when GET is listed in a MethodRequestMatcher (@nicolas-grekas)
- security #cve-2026-118514 Match HEAD requests when GET is listed in a RequestMatcher (@nicolas-grekas)
- security #GHSA-5mx8-mwrp-5693 Don't let Request::getBaseUrl() start with a host chosen by the client (@nicolas-grekas)
- bug #67829 Fix Request::getBaseUrl() for a percent-encoded or wrong-case script name after a prefix, and behind an alias (@jack-worman)
- bug #67826 Don't use the script name as Request::getBaseUrl() when it's not in the URI path (@jack-worman)
- bug #67804 Don't match the script name in Request::getBaseUrl() when it's only the start of a path segment (@jack-worman)
- bug #67814 Fix UrlHelper for fragments behind a trusted X-Forwarded-Prefix and for an empty path (@nicolas-grekas)
- bug #67800 Preserve the base URL for query and fragment references (@ahbaqdadi)
- minor #67760 Do not expose the DSN in the exception thrown for unsupported connections (@nicolas-grekas)
- minor #67746 Mark the DSN and options of SessionHandlerFactory as # (@nicolas-grekas)
- bug #67614 Reject trailing newlines in Content-Disposition fallbacks (@ahbaqdadi)
[SECURITY] Security release