Conflicts:

CHANGELOG.md

src/Doctrine/Common/composer.json

src/Doctrine/Odm/composer.json

src/Doctrine/Orm/composer.json

src/Documentation/composer.json

src/Elasticsearch/composer.json

src/GraphQl/composer.json

src/Hal/composer.json

src/HttpCache/composer.json

src/Hydra/composer.json

src/JsonApi/composer.json

src/JsonLd/composer.json

src/JsonSchema/SchemaFactory.php

src/JsonSchema/composer.json

src/Laravel/composer.json

src/Mcp/composer.json

src/Metadata/Query.php

src/Metadata/composer.json

src/OpenApi/Factory/OpenApiFactory.php

src/OpenApi/composer.json

src/RamseyUuid/composer.json

src/Serializer/composer.json

src/State/Provider/ParameterProvider.php

src/State/composer.json

src/Symfony/composer.json

src/Validator/composer.json

tests/Functional/HttpQueryMethodTest.php

chore: require sibling components at @beta

Conflicts:

CHANGELOG.md

composer.json

src/Doctrine/Common/composer.json

src/Doctrine/Odm/composer.json

src/Doctrine/Orm/composer.json

src/JsonApi/composer.json

src/JsonSchema/Tests/SchemaFactoryTest.php

src/Mcp/composer.json

Completes 22ece5199 (open 5.0 dev line): root is 5.0.x-dev but the
self-referential api-platform/* constraints were left at ^4.4@alpha,
which is unresolvable in the component split-tests (published 4.4
alphas require metadata ^4.4, conflicting with the 5.0 root).

Merge branch '4.3' into 4.4

fix(validator): strict query param validation rejecting pagination pa…

chore: bump sub-components dependencies to ^4.4

chore: require sibling components at @beta

chore: require sibling components at @beta

chore: require sibling components at @beta

Conflicts:

CHANGELOG.md

src/Mcp/composer.json

• perf(state): skip response body on HEAD requests

• feat(symfony): add enable_head_request_optimization config flag

HEAD responses now omit some observable headers (Content-Length, per-item cache tags); per semver that is a backward-
incompatible behavior change, so this commit ships an opt-out flag — set enable_head_request_optimization: false to restore the
prior GET-equivalent behavior.

• fix(state): do not list HEAD in Allow header without GET operation

#7115 added cross-package calls new in 4.4 — getStateOptionsRepositoryMethod()
in api-platform/state and the repositoryMethod constructor argument in
api-platform/doctrine-common — that 4.4 provider code invokes. The old
^4.2/^4.3 sibling floors let composer update --prefer-lowest pull releases
lacking these symbols, so the per-component lowest CI jobs failed with
"undefined method" / "unknown named parameter".

Floor all api-platform/* inter-package constraints at ^4.4. The @Alpha
stability flag is required because the subpackages set minimum-stability:beta,
under which a plain ^4.4 would not match the 4.4.0-alpha prereleases. Revert
to plain ^4.4 once 4.4.0 stable ships.

feat(symfony): api:upgrade-filter codemod + filter fixture migration …

(cherry picked from commit 7b6b7af4da49e1f98cfc7382be84cb58afd41865)
Fixes #8564

Co-authored-by: Claude Opus 5 noreply@anthropic.com

fix(symfony): hide graphiql link when graphql is disabled (#8576)

fix(symfony): throw on route name collisions between resource classes…

symfony/mcp-bundle 0.12 requires mcp/sdk ^0.7 and 0.13 requires ^0.8.1,
so the two move together. 0.13 serves several named servers, which
changes the wiring: mcp.registry is gone, each server gets its own
mcp.server..registry, and the configuration moved under
mcp.servers. with the HTTP path defaulting to /mcp/.

The registry can no longer be decorated from configuration, since the
ids are dynamic and there may be more than one. McpRegistryPass finds
every server through its builder tag and decorates each registry, which
is also what makes the decoration keep working for a multi-server setup.

The fixture pins the path back to /mcp so the functional tests keep
their URL, and declares the mandatory registry node as "*"; that node
only drives the bundle's own attribute discovery, and API Platform
supplies its elements through the mcp.loader tag instead.

The mcp.loader and mcp.request_handler tags are unchanged and still
reach every server, so the loader, the state handlers and the event
handlers need no adaptation.

fix(openapi): don't inherit name converter from a possibly-missing Sy…

refactor(jsonapi): single source of truth for the attribute/relations…

refactor(jsonapi): single source of truth for the attribute/relations…

Merge upstream 4.3 (concurrent fixes) into 4.3