 |
CodeIgniter 4.7.3 Released!
CodeIgniter 4.7.3 is now available. This maintenance release delivers an important security fix for file upload validation, improves upgrade safety for Worker Mode deployments, and rolls up a broad set of bug fixes across the CLI, database drivers, validation, language handling, and developer tooling.
If you are upgrading from 4.7.2, please review the upgrade guide before deploying. In particular, applications using ``ext_in`` validation or FrankenPHP Worker Mode should check the updated behavior and required file changes.
GitHub Release
Changelog
Highlights & New Features
- The ``ext_in`` file upload validation rule is now stricter and safer. It validates the client filename extension and confirms that it matches the detected MIME type.
- The ``routes`` command now uses ``--sort-by-handler`` instead of ``-h`` to avoid conflicting with the common meaning of ``-h`` as ``--help``. The old option still works for now, but it emits a warning and will be removed in v4.8.0.
- Worker Mode upgrades are safer: if you use FrankenPHP Worker Mode, update ``public/frankenphp-worker.php`` after upgrading by re-running ``php spark worker:install --force``.
Notable Enhancements
- CLI output handling is more robust, including fixes for leaked ``stty`` and ``tput`` stderr output when the environment is not interactive.
- Database behavior is more consistent across drivers, with fixes for PostgreSQL numeric ``increment()`` and ``decrement()``, SQLSRV decrement handling, and cached table list shape.
- Developer workflows are more predictable thanks to fixes in ``Autoloader::unregister()``, ``command()`` output buffer cleanup, and ``key:generate`` environment key updates.
- Framework internals received targeted polish in Kint worker-mode CSP handling, deep language dot-notation lookup, enum normalization, toolbar logging, and locale-independent timestamp parsing.
Security and Quality
- Security fix: ``ext_in`` no longer accepts uploads where the client filename extension does not match the detected MIME type. Previously, the rule only checked the MIME-derived guessed extension, so mismatched filenames could pass validation.
- The local ``serve`` command now escapes the ``--host`` option properly, preventing shell metacharacters in locally supplied input from being interpreted by ``/bin/sh``.
- The new ``Cache.invalidHandler`` message string was added to improve framework messaging.
- Credits to @z3moo and @teebow1e for responsibly reporting the ``ext_in`` issue.
Breaking Changes
- ``ext_in`` validation is stricter. Before 4.7.3, a file could pass when its client filename extension did not match the detected MIME type. In 4.7.3, files with no client extension, or with an extension that does not match the detected MIME type, now fail ``ext_in`` validation.
- If your application intentionally accepts such files, remove ``ext_in`` from that validation rule and replace it with a custom rule that matches your application's requirements.
Other Notable Changes
- ``Autoloader::unregister()`` now removes handlers correctly during tests instead of leaving SPL autoload closures behind.
- ``env`` now handles option-only invocations correctly instead of throwing a ``TypeError``.
- ``Validation::getValidated()`` now preserves fields whose validated value is explicitly ``null``.
- ``Language::getLine()`` now resolves nested dot-notation keys correctly at deeper levels.
- The FrankenPHP worker template no longer redeclares ``Config\Paths`` when the watcher restarts the worker script.
Thanks to Our Contributors
Thanks to everyone who contributed fixes, tests, and reports for this release:
Upgrade Guide
Report Issues
If you find a bug, please open an issue on GitHub with steps to reproduce it. For support questions and discussion, please use the CodeIgniter forum.
Note: This announcement was created with the assistance of GitHub Copilot (GPT-5.4).
|
Should CodeIgniter Introduce Native Stream Response Support?
