|
1 | 1 | # Changelog |
2 | 2 |
|
| 3 | +## [v4.7.5](https://github.com/codeigniter4/CodeIgniter4/tree/v4.7.5) (2026-10-09) |
| 4 | +[Full Changelog](https://github.com/codeigniter4/CodeIgniter4/compare/v4.7.4...v4.7.5) |
| 5 | + |
| 6 | +### Security |
| 7 | + |
| 8 | +* **CURLRequest:** Request-specific headers, body, and options |
| 9 | + are now cleared when a request throws an exception and ``shareOptions`` is ``false``. |
| 10 | + Previously, reusing the client after a failed request could send credentials |
| 11 | + or private data to a different destination. Options passed to the constructor |
| 12 | + remain available for subsequent requests. |
| 13 | + Per-request ``baseURI`` and ``delay`` values are also reset after successful |
| 14 | + and failed requests, preventing URI components from leaking into later requests. |
| 15 | + When retrying a failed request, pass its options again, or reapply settings |
| 16 | + made with ``setAuth()``, ``setBody()``, ``setForm()``, or ``setJSON()``. |
| 17 | + See the `Security advisory GHSA-9g9v-xgwj-697h <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9g9v-xgwj-697h>`_ |
| 18 | + for more information. |
| 19 | +* **Validation:** The ``is_image`` and ``mime_in`` file upload rules now reject client filenames ending in dots while |
| 20 | + continuing to accept genuinely extensionless uploads. These rules and ``ext_in`` also reject filenames with a PHP |
| 21 | + handler extension before the final extension, such as ``shell.php.gif``, including extensions revealed by filename |
| 22 | + sanitization. These checks also reject innocent filenames such as ``logo.php.gif``. See |
| 23 | + :doc:`Upgrading from 4.7.4 to 4.7.5 </installation/upgrade_475>` for migration instructions. |
| 24 | + Previously, a GIF/PHP polyglot with one of these names could pass validation. Applications that save uploads with |
| 25 | + client-provided names in executable public directories may be affected. Use a generated filename or disable script |
| 26 | + execution in the upload directory. See the `Security advisory GHSA-4hwf-v4mp-hf6c <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4hwf-v4mp-hf6c>`_ |
| 27 | + for more information. |
| 28 | +* **Validation:** File validation rules now check every non-empty file in an |
| 29 | + optional multiple upload. Previously, an entry with ``UPLOAD_ERR_NO_FILE`` |
| 30 | + could cause ``max_size``, ``is_image``, ``mime_in``, ``ext_in``, ``max_dims``, |
| 31 | + and ``min_dims`` to accept the upload without checking later files. |
| 32 | + ``max_dims`` and ``min_dims`` also return ``false`` for upload errors other |
| 33 | + than ``UPLOAD_ERR_NO_FILE`` before reading image dimensions. |
| 34 | + See the `Security advisory GHSA-cwxp-v62r-xwx2 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-cwxp-v62r-xwx2>`_ |
| 35 | + for more information. |
| 36 | +* **View Parser:** Fixed a stored XSS vulnerability where a substituted value containing |
| 37 | + Parser syntax (e.g., ``{text|raw}`` or ``{!text!}``) was interpreted by a later |
| 38 | + substitution pass, allowing user-supplied data to bypass auto-escaping of other |
| 39 | + pseudo-variables. Substituted values are now treated strictly as data and are never |
| 40 | + parsed again. The same protection applies to output from built-in Parser plugins, |
| 41 | + including URLs and validation messages. See :ref:`upgrade-475-view-parser-values` for more information. |
| 42 | + See the `Security advisory GHSA-vgrf-mv2j-gp8w <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-vgrf-mv2j-gp8w>`_ |
| 43 | + for more information. |
| 44 | +* **View Parser:** Added restricted conditionals as an opt-in mitigation for |
| 45 | + *Code Injection through Parser Template Source*. Conditions in ``{if ...}`` and |
| 46 | + ``{elseif ...}`` tags are evaluated as PHP, so anyone who can edit Parser template |
| 47 | + source can execute PHP code. This remains the default behavior. Applications that |
| 48 | + let less-trusted users edit Parser templates must enable the new |
| 49 | + ``Config\View::$restrictParserConditionals`` setting or the ``restrictConditionals`` |
| 50 | + render option. Restricted conditionals only limit this execution path; they do not |
| 51 | + make every template feature safe for less-trusted authors. |
| 52 | + The restriction also applies to nested renders on the same Parser instance. |
| 53 | + See :ref:`parser-restricting-conditionals` and the |
| 54 | + `Security advisory GHSA-4q58-jw8x-8cm7 <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4q58-jw8x-8cm7>`_ |
| 55 | + for more information. |
| 56 | +* **Views:** Fixed a code execution vulnerability caused by view data keys |
| 57 | + overriding renderer-local variables. Data named ``template`` in ``Parser`` or |
| 58 | + ``view`` in ``View::renderString()`` could replace the source evaluated as PHP. |
| 59 | + Data named ``foundView`` in view cells could replace the selected file path |
| 60 | + and cause unintended local file inclusion. These issues require applications |
| 61 | + to pass less-trusted data under the affected keys. |
| 62 | + See the `Security advisory GHSA-c29x-ffjj-8r7x <https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c29x-ffjj-8r7x>`_ |
| 63 | + for more information. |
| 64 | + |
| 65 | +### Fixed Bugs |
| 66 | + |
| 67 | +* fix: safely interpolate logger context values by @michalsn in https://github.com/codeigniter4/CodeIgniter4/pull/10384 |
| 68 | +* fix: resolve global state pollution causing random-order test failures in HTTP suite by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10372 |
| 69 | +* fix: omit empty CSP headers by @michalsn in https://github.com/codeigniter4/CodeIgniter4/pull/10412 |
| 70 | +* fix: remove destructive setServerArray([]) in FiltersTest::setUp to prevent random-order test failures by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10425 |
| 71 | +* fix: resolve TypeError in CLIRequest::parseCommand when argv is missing by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10415 |
| 72 | +* fix: resolve race conditions in Redis TTL and prevent cache test state leakage by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10374 |
| 73 | +* fix: handle null results in get_dir_file_info() by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10407 |
| 74 | +* fix: skip unreadable `.env` in `Boot::loadDotEnv` for separate-process tests by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10417 |
| 75 | +* fix: return 403 for Honeypot bot detection by @michalsn in https://github.com/codeigniter4/CodeIgniter4/pull/10490 |
| 76 | +* fix: pass prompt text to readline in `CLI::prompt()` so backspace does not erase it by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10507 |
| 77 | +* fix(Cookie): validate raw cookie values by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10516 |
| 78 | +* fix(CodeIgniter): prevent gatherOutput from being called twice when controller returns Response by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10369 |
| 79 | +* fix: Memcached decrement() gives the wrong sign on a missing key by @mdalikadar in https://github.com/codeigniter4/CodeIgniter4/pull/10512 |
| 80 | +* fix: correct file permissions and chmod target in File and UploadedFile move() by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10519 |
| 81 | +* fix: strip the table prefix correctly when rebuilding a SQLite3 table by @karlgray in https://github.com/codeigniter4/CodeIgniter4/pull/10509 |
| 82 | +* fix: write the prompt to STDOUT before readline() on Windows by @michalsn in https://github.com/codeigniter4/CodeIgniter4/pull/10534 |
| 83 | +* fix(Cookie): validate cookie path and domain attributes by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10527 |
| 84 | +* fix(I18n): compute correct date in Time::today(), yesterday(), and tomorrow() across timezones by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10532 |
| 85 | +* fix: return an empty string when readline() reaches end-of-file by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10542 |
| 86 | +* fix: reject unsupported database drivers in `make:migration --session` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10546 |
| 87 | +* fix(Test): reset `is_windows()` mock state in `CIUnitTestCase::tearDown()` by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10554 |
| 88 | +* fix(Cache): set secure 0755 permissions mode when creating directory in `FileVarExportHandler` by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10555 |
| 89 | +* fix: stop `FileLocatorCached` from restoring a deleted cache on shutdown by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10559 |
| 90 | +* fix: preserve sub-second precision in `BaseModel` datetime timestamps by @wakqasahmed in https://github.com/codeigniter4/CodeIgniter4/pull/10561 |
| 91 | +* fix(Debug): treat zero time as valid timer start by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10569 |
| 92 | +* fix: reject non-digit characters in `valid_cc_number()` by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10580 |
| 93 | +* fix: throw Postgre query errors with warnings disabled by @wakqasahmed in https://github.com/codeigniter4/CodeIgniter4/pull/10573 |
| 94 | +* fix: prevent infinite loop in `word_wrap()` with a character limit below 2 by @mdalikadar in https://github.com/codeigniter4/CodeIgniter4/pull/10596 |
| 95 | +* fix: resolve schema-qualified table names in `getFieldData()` and `protectIdentifiers()` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10604 |
| 96 | +* fix: cast Postgre batch subquery values so `updateBatch()` and `deleteBatch()` accept mixed PHP types by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10601 |
| 97 | +* fix: cast OCI8 batch subquery values so `updateBatch()` and `deleteBatch()` accept mixed PHP types by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10602 |
| 98 | +* fix: avoid undefined `STDERR` and `STDIN` outside the CLI by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10605 |
| 99 | + |
| 100 | +### Refactoring |
| 101 | + |
| 102 | +* refactor(HTTP): split setCURLOptions into category helper methods to reduce complexity by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10339 |
| 103 | +* refactor: use `array-key` as the benevolent union of `int|string` in array shapes by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10396 |
| 104 | +* refactor: Enable Rector Code Quality set by @samsonasik in https://github.com/codeigniter4/CodeIgniter4/pull/10429 |
| 105 | +* refactor: fix uses of `empty()` calls by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10439 |
| 106 | +* refactor: fix `method.alreadyNarrowedType` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10440 |
| 107 | +* refactor: cleanup the Images library by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10441 |
| 108 | +* refactor: add generics to `Entity` and `DataCaster` casts by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10442 |
| 109 | +* refactor: fix `ternary.shortNotAllowed` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10445 |
| 110 | +* refactor: fix `missingType.property` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10447 |
| 111 | +* refactor: fix `return.type` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10448 |
| 112 | +* refactor: add generics to `Forge`, `BaseBuilder` and `BasePreparedQuery` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10449 |
| 113 | +* refactor: fix `nullCoalesce.property` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10450 |
| 114 | +* refactor: add precise return type to `CodeIgniter::getPerformanceStats()` by @soccerlover29 in https://github.com/codeigniter4/CodeIgniter4/pull/10458 |
| 115 | +* refactor: fix `property.nonObject` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10451 |
| 116 | +* refactor: sidestep PhpStorm warning on `@method` docblock in `Model` by @gr8man in https://github.com/codeigniter4/CodeIgniter4/pull/10444 |
| 117 | +* refactor: fix phpstan errors in `IncomingRequestTest` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10452 |
| 118 | +* refactor: fix phpstan errors in `Helpers` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10459 |
| 119 | +* refactor: fix phpstan errors in `Router` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10460 |
| 120 | +* refactor: clear out phpstan errors in `Validation` source and tests by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10461 |
| 121 | +* refactor: clear out phpstan errors in `HTTP` source and tests by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10462 |
| 122 | +* refactor: fix phpstan errors in `BaseBuilder` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10466 |
| 123 | +* refactor: add precise parameter types to Router test fixtures by @soccerlover29 in https://github.com/codeigniter4/CodeIgniter4/pull/10464 |
| 124 | +* refactor: fix phpstan errors in `Forge` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10470 |
| 125 | +* refactor: fix phpstan errors in `Result` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10473 |
| 126 | +* refactor: fix phpstan errors in `Connection` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10475 |
| 127 | +* refactor: fix phpstan errors in `PreparedQuery` and `Utils` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10476 |
| 128 | +* refactor: fix phpstan errors in `Config`, `Database`, `Query`, `MigrationRunner`, and `SQLite3\Table` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10477 |
| 129 | +* refactor: fix phpstan errors in `Debug` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10478 |
| 130 | +* refactor: fix phpstan errors in `Test` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10479 |
| 131 | +* refactor: widen `Response` body and `Formatter` data typing to `mixed` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10480 |
| 132 | +* refactor: fix remaining errors in `Helpers`' tests by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10481 |
| 133 | +* refactor: fix phpstan errors in `Config` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10482 |
| 134 | +* refactor: fix phpstan errors in `Commands` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10483 |
| 135 | +* refactor: fix phpstan errors in `View` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10484 |
| 136 | +* refactor: fix phpstan errors in `Filters` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10485 |
| 137 | +* refactor: fix phpstan errors in `Encryption` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10486 |
| 138 | +* refactor: fix iterable types in `Email` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10487 |
| 139 | +* refactor: fix iterable types in `Router` tests by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10488 |
| 140 | +* refactor: fix remaining phpstan errors in `Database` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10492 |
| 141 | +* refactor: fix phpstan errors in `I18n` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10493 |
| 142 | +* refactor: fix phpstan errors in `DataConverter` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10494 |
| 143 | +* refactor: fix phpstan errors in `AutoReview` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10495 |
| 144 | +* refactor: fix missing parameter types by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10496 |
| 145 | +* refactor: fix remaining missing iterable types by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10497 |
| 146 | +* refactor: fix remaining not found methods by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10498 |
| 147 | +* refactor: fix the remaining fixable `assign.propertyType` and `phpdoc.propertyType` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10499 |
| 148 | +* refactor: fix remaining `argument.type` and `method.childParameterType` errors by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10502 |
| 149 | +* refactor: replace anonymous class with bound closure in `PropertiesTrait` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10504 |
| 150 | +* refactor: bound phpstan's analysed PHP versions by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10505 |
| 151 | +* refactor: Enable MustHaveReturnTypeFunctionRule StructArmed rule on system/Helpers by @samsonasik in https://github.com/codeigniter4/CodeIgniter4/pull/10521 |
| 152 | +* refactor: fix minor type inaccuracies found via PHPStan bleeding edge by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10522 |
| 153 | +* refactor: fix return type covariance of `FileCollection::getIterator()` by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10558 |
| 154 | +* refactor: tighten docblock return types in Result, CLIRequest, url_helper and IncomingRequest by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10588 |
| 155 | +* refactor: pass the session TTL to `Redis::set()` as an options array by @paulbalandan in https://github.com/codeigniter4/CodeIgniter4/pull/10600 |
| 156 | + |
3 | 157 | ## [v4.7.4](https://github.com/codeigniter4/CodeIgniter4/tree/v4.7.4) (2026-07-07) |
4 | 158 | [Full Changelog](https://github.com/codeigniter4/CodeIgniter4/compare/v4.7.3...v4.7.4) |
5 | 159 |
|
|
0 commit comments