2.5.0

What's Changed

• Added support for Private Network Access #190
• Fixed default boolean values being overwritten in per-path configs #186
• Fixed deprecation notice in Symfony 7.1 #200

Full Changelog: 2.4.0...2.5.0

2.4.0

What's Changed

• Added Symfony 7 support (#193)
• Dropped Symfony 4 support (#193)
• Added bundle config (#184)

Full Changelog: 2.3.1...2.4.0

2.3.1

• Allow psr/log ^2 || ^3 by @michalbundyra in #182

Full Changelog: 2.3.0...2.3.1

2.3.0

• Downgraded CacheableResponseVaryListener's priority from 0 to -10 to ensure it runs after FrameworkExtraBundle listeners have set their cache headers (#179)
• Added optional logging support if you inject a Logger into the CorsListener you can get debug info about the whole CORS decision process (#173)
• Added support for setting expose_headers to a wildcard '*' which exposes all headers, this works as long as allow_credentials is not enabled as per the spec (#132)
• Added skip_same_as_origin flag (default to true which is the old behavior) to allow opting out of skipping the CORS headers in the response if the Origin matches the application's hostname (#178)
• Fixed ProviderMock having an invalid return type (#169)
• Dropped support for Symfony 4.3 and 5.0 to 5.3

2.2.0

• Added support for Symfony 6

2.1.1

• Fixed response for unauthorized headers containing a reflected XSS (#163)

2.1.0

• Added Vary: Origin header to cacheable responses to make sure proxies cache them correctly

2.0.1

• Reverted CorsListener priority change as it was interfering with normal operations. The priority is back at 250.

2.0.0

• BC Break: Downgraded CorsListener priority from 250 to 28, this should not affect anyone but could be a source in case of strange bugs
• BC Break: Removed support for Symfony <4.3
• BC Break: Removed support for PHP <7.1
• Added support for Symfony 5
• Added support for configuration via env vars
• Changed the code to avoid mutating the EventDispatcher at runtime
• Changed the code to avoid returning Access-Control-Allow-Origin: null headers to mark blocked requests

1.5.6

• Fixed preflight request handler hijacking regular non-CORS OPTIONS requests.