fix(deps): update dependency api-platform/core to v4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
api-platform/core (source)	3.4.16 -> 4.1.5

---

Release Notes

api-platform/core (api-platform/core)

v4.1.5

Compare Source

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485

Full Changelog: api-platform/core@v4.1.4...v4.1.5

v4.1.4

Compare Source

Bug fixes

• eaf007536 fix(state): support filter interface on serializer filter parameter provider (#​7047)
• b0fa2291e fix(laravel): error handler only on api routes (#​7049)
• 1eb9da13a fix(laravel): missing filters (#​7056)
• a46a76889 fix(symfony): serialization of closure inside the profiler (#​7054)
• c1b50e2cb fix(doctrine): joinColumn might be an array (#​7060)
• f4c426d71 Revert "fix(doctrine): throw an exception when a filter is not found in a par…" (#​7046)

v4.1.3

Compare Source

Bug fixes

• 8a2265041 fix(laravel): defer "filters" dependent services (#​7045)

Features

v4.1.2

Compare Source

Bug fixes

• 42f25cf04 fix: react@18 for UMD + add Laravel support in update-js.sh (#​7028)
• 77ffc380b fix(laravel): do not require tests while autoconfiguring (#​7024)
• 935b9b55d fix(laravel): json api default parameters (#​7027)
• a2824ff4b fix(laravel): defer autoconfiguration (#​7040)

Features

v4.1.1

Compare Source

Bug fixes

• 1e0bc9dc8 fix(laravel): query extensions with item operations (#​7001)
• 1e7076c65 fix(laravel): register ErrorProvider (#​7018)
• 2771363b0 fix(validation): deprecate string message for ValidationException constructor (#​7005)
• 500062da2 fix(symfony): add a alwaysBootKernel property for BC layer (#​7007)
• 8697d6630 fix(openapi): boolean "true" value in HttpOperation::openapi (#​7003)
• b1e0c889c fix(doctrine): correct the use statement for ManagerRegistry (#​7004)
• fcbd804b2 fix(jsonld): duplicate error fields when prefix is enabled (#​7021)

Features

• 129853668 feat(laravel): stateOptions modelClass for eloquent (#​7020)
• 42991b941 feat(laravel): openapi export command (#​7016)
• dd1b89f9b feat(laravel): auto configure our tagged interfaces (#​7014)

Also contains v4.0.20 changes.

v4.1.0

Compare Source

Bug fixes

• da37ca91c fix(laravel): default to file cache instead of cache.default (#​6955)
• e041d721e fix: errors retrieval and documentation (#​6952)
• e6130cbcc fix: missing filters on swagger ui entrypoint (#​6950)
• 01fd74268 fix(laravel): restore accidentally removed BooleanFilter
• db40a63e7 fix(hydra): rdfs:label should not duplicate title (#​6748)
• deb2ed265 fix(laravel): fix use laravel fillable for writable props (#​6898)
• 67fbe51c5 fix: reintroduce the show_webby parameter in Laravel config (#​6741)

Features

• cb5ede1c5 feat: add checkMode parameter to control json schema validation (#​6974)
• 771d9401c feat(elasticsearch): re-introduce v7 support (#​6827)
• b5372ddee feat(openapi): filter x-apiplatform-tags to produce different openapi specifications (#​6945)
• 2e2debb94 feat(mongodb): Replace usage of deprecated method AggregationBuilder::execute() (#​6933)
• 4bdf042e5 feat(mongodb): Add pagination metadata to the aggregation results (#​6912)
• b968ccd50 feat(openapi): document error outputs using json-schemas (#​6923)
• c97db6bb2 feat: swagger ui persist authorization option (#​6877)
• 00787f32d feat(laravel): automatically register policies (#​6623)
• 12c42096b feat(metadata): ability to hide an hydra class/operation (#​6871)
• 57f15cf4f feat(state): strict query parameters (#​6399)
• bd0e92936 feat(openapi): HTTP Authentication Support for Swagger UI (#​6665)
• be98f4e01 feat(graphql): allow to configure max query depth and max query complexity (#​6880)
• c78ed0b78 feat(laravel): boolean filter (#​6806)
• d0a442786 feat(doctrine): enhance getLinksHandler with method validation and typo suggestions (#​6874)
• f67f6f1ac feat(doctrine): doctrine filters like laravel eloquent filters (#​6775)

v4.0.22

Compare Source

What's Changed

• 60747cc8c fix(graphql): access to unauthorized resource using node Relay CVE-2025-31481
• 7af65aad1 fix(graphql): property security might be cached w/ different objects CVE-2025-31485
• Revert "fix(doctrine): throw an exception when a filter is not found in a parameter" by @​soyuka in https://github.com/api-platform/core/pull/7046

Full Changelog: api-platform/core@v4.0.21...v4.0.22

v4.0.21

Compare Source

Bug fixes

• 7cb5a6db8 fix: allow parameter provider as object (#​7032)
• bb83e9a03 fix(symfony): allow to merge array with string in global defaults (#​7037)
• da2e86809 fix: header parameter should be case insensitive (#​7031)

Features

v4.0.20

Compare Source

Bug fixes

• 284937039 fix(doctrine): mapping ArrayAccess deprecation (#​6982)
• a434173b8 fix(doctrine): Add a proper exception when a doctrine manager could not be found for a resource class (#​6995)

Features

v4.0.19

Compare Source

Bug fixes

• 1dfefda5e fix(laravel): add middleware granularity (#​6962)

Compatibility with Laravel 12.

v4.0.18

Compare Source

Bug fixes

• 7007dcca8 fix(laravel): duplicate middleware in routes
• a16147ab7 fix(laravel): handle route prefix (#​6978)
• d2e1963c5 fix(symfony): detach objects to prevent loop when using Doctrine middleware and Mercure (#​6936) (#​6965)

Features

v4.0.17

Compare Source

Bug fixes

• 5124d8c57 fix(laravel): Prevent overwriting existing routes on the router (#​6941)
• 5c7e0d2c0 fix(symfony): error wrongly inherit normalization context (#​6939)
• af35d34d0 fix(laravel): mitigate property metadata read for Error (#​6951)
• d5b48b1cd fix(laravel): SwaggerUI custom CSS (#​6937)
• da796b979 fix(metadata): allow serializer attribute object in ApiProperty::$serialize (#​6946)
• de2d298e3 fix: ensure template files have a tpl file extension (#​6826) (#​6829)
• b6a67a197 perf: various optimizations for Laravel/Symfony (#​6954)

To save some time during cache warmup we recommend to define uri variables such as: uriVariables: ['id']. More details at #​6954.

Features

v4.0.16

Compare Source

Bug fixes

• dc4fc84ba fix(graphql): securityAfterResolver not called

Features

v4.0.15

Compare Source

Bug fixes

• 36cee399c fix(state): skip Content-Location header for GET requests (#​6901)
• dba9de197 fix(symfony): fix property restrictions for root resource with dynamic validation groups (#​6908)

Features

• 421d97ecf feat(laravel): add support for backed enum normalizers (#​6911)

Also contains v3.4.15 changes.

v4.0.14

Compare Source

Bug fixes

• 97cdb6b3f fix(state): remove ProcessorInterface laravel specific type
• b12a0d005 fix(graphql): register types for parameter args (#​6895)

Also contains v3.4.14 changes.

v4.0.13

Compare Source

Bug fixes

• 3a694624b fix(laravel): eloquent BelongsToMany relation (#​6862)
• c8db7aef0 fix(laravel): jsonapi query parameters (page, sort, fields and include) (#​6876)
• f2c998158 fix(jsonld): anonymous context hydra_prefix value (#​6873)

Also contains v3.4.10 changes.

v4.0.12

Compare Source

Bug fixes

• 4db72f55f fix: filter may not use FilterInterface (#​6858)
• c899a3da1 fix(laravel): use tagged resolvers as graphql resolvers
  (#​6855)
• e0f8c38b9 fix(laravel): graphql currentPage (#​6857)

Also contains v3.4.9 changes.

v4.0.11

Compare Source

Bug fixes

• af66075fd fix(laravel): fix foregin keys (relations) beeing in attributes (#​6843)

• 2d59c6369 feat(laravel): belongs to many relations (#​6818)

Also contains v3.4.8 changes.

v4.0.10

Compare Source

Bug fixes

• 774590069 fix(laravel): add contact & license options to fix swagger UI issues (#​6804)
• 7ff9790c8 fix(laravel): allow boolean cast (#​6808)
• f19dd9446 fix(laravel): graphQl type locator indexes (#​6815)

Also contains v3.4.7 changes.

v4.0.9

Compare Source

Bug fixes

• 417fef5da fix(laravel): overlaping route format (#​6782)
• 81099065e fix(laravel): declare normalizer list as a service (#​6786)
• dc8c09b1e fix(laravel) graphQl Relationship loading (#​6792)

Also contains v3.4.6 changes.

v4.0.8

Compare Source

Bug fixes

• dddb97075 fix(symfony): default formats order (#​6780)

v4.0.7

Compare Source

Bug fixes

• 17c916c3a fix(symfony): BackedEnumProvider typo fix (#​6769)
• 216d9ccaa fix(serializer): fetch type on normalization error when possible (#​6761)
• 2f967d934 fix(doctrine): throw an exception when a filter is not found in a parameter (#​6767)
• 6c9b508b0 fix(laravel): remove link header when jsonld is not enabled (#​6768)
• 736ca045e fix(validator): allow to pass both a ConstraintViolationList and a previous exception (#​6762)
• 9ac3661b6 fix(hydra): store and use hydra context in a local variable (#​6765)

v4.0.6

Compare Source

Bug fixes

• 195c4e788 fix(hydra): hydra context changed (#​6710)

• 4f65ef2d0 fix(metadata): providing parameter constraints skips automatic ones (#​6756)

• 5a8ef115a fix(symfony): ECMA-262 pattern with RegExp validator (#​6733)

• 67c5a2a24 fix(laravel): jsonapi error serialization (#​6755)

• ac6f667f3 fix(laravel): collection relations other than HasMany (#​6737)

• cecd77149 feat(laravel): use laravel cache setting (#​6751)

v4.0.5

Compare Source

Bug fixes

• 4171d5f9c fix(graphql): register query parameter arguments with filters (#​6726)
• 48ab53816 fix(laravel): make command writes to app instead of src (#​6723)

v4.0.4

Compare Source

Bug fixes

• 2e8287dad fix(laravel): allow serializer attributes through ApiProperty (#​6680)
• 439c188ea fix(laravel): match integer type (#​6715)
• 4ad7a50aa fix(laravel): openapi Options binding (#​6714)
• ec6e64512 fix(laravel): skip resource path when not available (#​6697)

Features

• 5aa799321 feat(laravel): command to generate state providers/processors (#​6708)

v4.0.3

Compare Source

Bug fixes

• 025f63e69 fix(laravel): route registration of EntrypointController should be last (#​6667)
• 2b4937a3e fix(laravel): eloquent accessors (#​6668)
• 4312a1f55 fix(metadata): register parameters on graphql operations
• 6d4e24883 fix(laravel): hiding/showing relationships (#​6679)
• 85306f2f5 fix(laravel): swagger ui authentication (#​6661)
• a6e37068e fix(laravel): use Model::qualifyColumn instead of hardcoding $table.$column (#​6658)
• b0d5a2ade fix(laravel): register global middleware to secure non-rest routes
• f9d96e546 fix(metadata): graphql can be disabled but with an existing operation

Features

• df701da05 feat(laravel): graphql policies

v4.0.2

Compare Source

Bug fixes

• 7cb5a6db8 fix: allow parameter provider as object (#​7032)
• bb83e9a03 fix(symfony): allow to merge array with string in global defaults (#​7037)
• da2e86809 fix: header parameter should be case insensitive (#​7031)

Features

v4.0.1

Compare Source

Bug fixes

• 1dfefda5e fix(laravel): add middleware granularity (#​6962)

Compatibility with Laravel 12.

v4.0.0

Compare Source

Bug fixes

• 7c5689626 fix(laravel): call authorize on delete but not validation (#​6618)
• d74b2b5fa fix: swagger ui with route identifier (#​6616)
• de6e3f546 fix(laravel): validate enum schema within filter (#​6615)
• 0a461d749 fix(symfony): allow schema restriction for collection like property from choice constraint (#​6520)
• 0c66a494d fix(laravel): cache metadata, add trace on debug mode (#​6555)
• 1b6e7c6cc fix(laravel): disable GraphQL by default and fix provider
• 290944103 fix(laravel): SwaggerUI title (#​6527)
• 2df0860b5 fix(laravel): Eloquent date and datetime type detection (#​6529)
• 2fc74f2e6 fix: remove PUT from default operations (#​6570)
• 3b42c9ff2 fix: deserialization path for not denormalizable relations collected errors (#​6537)
• 3c554a605 fix(laravel): docs _format and open swagger ui (#​6595)
• 3c5aea80f fix(symfony): load isApiResource metadata (#​6562)
• 4ee209eff fix(laravel): visible and hidden fields support (#​6538)
• 6e15eb95f fix(laravel): register HydraPartialCollectionViewNormalizer (#​6588)
• 86365be2a fix(laravel): Eloquent PropertyAccessor (#​6536)
• a1dd0b54d fix(laravel): entrypoint with doc formats (#​6552)
• a4a53ab48 fix(laravel): identitifer is not writable unless marked as writable (#​6531)
• a6f355358 fix(laravel): do not normalize exception originalTrace (#​6533)
• bd6a57c4c fix(laravel): snake case props (#​6532)
• c31566602 fix(laravel): api_doc route regex
• ebc61d59d fix(laravel): entrypoint serialization (#​6541)

Features

• 00787f32d feat(laravel): automatically register policies (#​6623)
• 06a647a80 feat(laravel): add CSV support (#​6617)
• a49bde1ea feat(laravel): filter validations rules
• 03357fb90 feat(laravel): supports more Eloquent types (#​6544)
• 05e75be83 feat(doctrine): add new filter for filtering an entity using PHP backed enum, resolves #​6506 (#​6547) (#​6560)
• 538648840 feat(laravel): enable graphQl support (#​6550)
• 5b9767be2 feat(laravel): policy, auth and gate (#​6523)
• 5e1233c57 feat(laravel): search filter (#​6534)
• 9c461626f feat(laravel): provide a trait in addition to the annotation (#​6543)
• c9f18d4fb feat(laravel): eloquent filters (search, date, equals, or) (#​6593)
• e09e73efc feat: remove hydra prefix (#​6418)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[BacLuc]

Here is a branch trying the update: https://github.com/BacLuc/ecamp3/tree/refs/heads/upgrade-to-4