Repository navigation
4.7.6 Ready code - #10701
Merged
Merged
4.7.6 Ready code#10701
Conversation
* fix: preserve JSON body formatting when removing CSRF token * docs: document CSRF in JSON request body limitations
* fix: preserve JSON request body when CSRF token is not in it * refactor: optimize CSRF token removal in request body by restructuring JSON and form-encoded checks
Bumps [NexusPHP/carson](https://github.com/nexusphp/carson) in `/` from 1.7.0 to 1.8.0. Updates `NexusPHP/carson` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/nexusphp/carson/releases) - [Changelog](https://github.com/NexusPHP/carson/blob/1.x/CHANGELOG.md) - [Commits](NexusPHP/carson@cb35604...53c45cf) --- updated-dependencies: - dependency-name: NexusPHP/carson dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [shivammathur/setup-php](https://github.com/shivammathur/setup-php) in `/` from 2.37.2 to 2.40.0. Updates `shivammathur/setup-php` from 2.37.2 to 2.40.0 - [Release notes](https://github.com/shivammathur/setup-php/releases) - [Commits](shivammathur/setup-php@f3e473d...eb7c497) --- updated-dependencies: - dependency-name: shivammathur/setup-php dependency-version: 2.40.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) in `/` from 7.0.1 to 7.0.2. Updates `actions/upload-artifact` from 7.0.1 to 7.0.2 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@043fb46...cf430e0) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: 7.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) in `/` from 8.0.1 to 8.0.2. Updates `actions/download-artifact` from 8.0.1 to 8.0.2 - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](actions/download-artifact@3e5f45b...9000827) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) in `/` from 7.0.0 to 7.1.0. Updates `actions/setup-node` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](actions/setup-node@8207627...949feb2) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix: widen accepted types in `set_value()`'s `$default` * docs: reflow changelog
…nd add `addDefaultSrc()` (#10635)
…ption()` (#10636) - Normalize space-separated and empty strings into array options via stringToOptions() - Cast numeric string array keys back to string to prevent TypeError under strict types - Preserve empty source lists as deny-all directives across all directives - Retain empty markers when other options move between reporting modes - Add comprehensive regression tests for config and runtime directives
PHP treats post_max_size values of 0 or -1 as unlimited, but IncomingRequest compared Content-Length against the raw value, so the request body was never read. Use ini_parse_quantity() and treat non-positive values as PHP_INT_MAX.
…RST (#10664) * docs: convert the remaining user guide tables to pipe-table-friendly RST * docs: fix rendering for `mb_*`
Bumps [actions/setup-python](https://github.com/actions/setup-python) in `/` from 7.0.0 to 7.1.0. Updates `actions/setup-python` from 7.0.0 to 7.1.0 - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](actions/setup-python@5fda3b9...6d4fd22) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github_actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ter construction (#10663)
* fix: prevent path traversal in file cache deletion * apply review suggestions Co-authored-by: John Paul E Balandan <paulbalandan@gmail.com> --------- Co-authored-by: John Paul E Balandan <paulbalandan@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
carson-codeigniter4
Bot
added
the
github_actions
paulbalandan
removed
the
github_actions
3 of 5 tasks
michalsn
approved these changes
Nov 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.