Merge 4.x into 5.x

Author: SonataCI

CHANGELOG.md

@@ -2,6 +2,21 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [4.43.0](https://github.com/sonata-project/SonataAdminBundle/compare/4.42.0...4.43.0) - 2026-06-03
+### Added
+- [[#8381](https://github.com/sonata-project/SonataAdminBundle/pull/8381)] Support for symfony/stimulus-bundle 3. ([@virtualize](https://github.com/virtualize))
+- [[#8373](https://github.com/sonata-project/SonataAdminBundle/pull/8373)] Added optional flag to `FormErrorIteratorToConstraintViolationList::transform()` to sanitize error messages and prevent leaking sensitive information (e.g. internal file system paths) ([@micbis](https://github.com/micbis))
+- [[#8371](https://github.com/sonata-project/SonataAdminBundle/pull/8371)] Support for `doctrine/collections` 3 ([@dmaicher](https://github.com/dmaicher))
+
+### Fixed
+- [[#8382](https://github.com/sonata-project/SonataAdminBundle/pull/8382)] Do not generate the edit button URL in `edit_many_script` when the associated admin has no accessible `edit` route ([@EmmanuelVella](https://github.com/EmmanuelVella))
+
+### Removed
+- [[#8371](https://github.com/sonata-project/SonataAdminBundle/pull/8371)] Support for `doctrine/collections` < 2 ([@dmaicher](https://github.com/dmaicher))
+
+### Security
+- [[#8373](https://github.com/sonata-project/SonataAdminBundle/pull/8373)] Added opt-in protection against exposing sensitive system information (e.g. temporary upload paths) in validation error payloads ([@micbis](https://github.com/micbis))
+
 ## [4.42.0](https://github.com/sonata-project/SonataAdminBundle/compare/4.41.0...4.42.0) - 2026-01-05
 ### Changed
 - [[#8369](https://github.com/sonata-project/SonataAdminBundle/pull/8369)] The `symfony/security-acl` dependency is now optional. You need to explicitly require it as a dependency if you are using ACL. ([@dmaicher](https://github.com/dmaicher))

composer.json

@@ -56,7 +56,7 @@
         "symfony/security-core": "^6.4 || ^7.3 || ^8.0",
         "symfony/security-csrf": "^6.4 || ^7.3 || ^8.0",
         "symfony/serializer": "^6.4 || ^7.3 || ^8.0",
-        "symfony/stimulus-bundle": "^2.22",
+        "symfony/stimulus-bundle": "^2.22 || ^3.0",
         "symfony/string": "^6.4 || ^7.3 || ^8.0",
         "symfony/translation": "^6.4 || ^7.3 || ^8.0",
         "symfony/translation-contracts": "^2.3 || ^3.0",

src/Form/DataTransformer/ModelToIdPropertyTransformer.php

@@ -35,7 +35,7 @@ final class ModelToIdPropertyTransformer implements DataTransformerInterface
     /**
      * @var callable|null
      *
-     * @phpstan-var null|callable(T, P): string
+     * @phpstan-var callable(T, P): string|null
      */
     private $toStringCallback;
 

src/Resources/views/CRUD/Association/edit_many_script.html.twig

@@ -560,7 +560,7 @@ This code manages the many-to-[one|many] association field popup
             if (undefined === objectId || null === objectId || '' === objectId) {
                 jQuery('#field_widget_{{ id }}').html('{{ 'short_object_description_placeholder'|trans({}, 'SonataAdminBundle') }}');
 
-                {% if btn_edit %}
+                {% if associationadmin.hasroute('edit') and associationadmin.hasAccess('edit') and btn_edit %}
                     jQuery('#field_actions_{{ id }} a.btn-warning').addClass('hidden');
                 {% endif %}
 
@@ -587,7 +587,7 @@ This code manages the many-to-[one|many] association field popup
                 }
             });
 
-            {% if btn_edit %}
+            {% if associationadmin.hasroute('edit') and associationadmin.hasAccess('edit') and btn_edit %}
                 var edit_button_url = '{{
                     associationadmin.generateUrl('edit', {(associationadmin.idParameter) : 'OBJECT_ID'})
                 }}'.replace('OBJECT_ID', objectId);