| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-08-11 | 680 Bytes | |
| v3.19.1 source code.tar.gz | 2026-08-11 | 48.9 kB | |
| v3.19.1 source code.zip | 2026-08-11 | 63.0 kB | |
| Totals: 3 Items | 112.5 kB | 0 | |
Security
- Fix
flight.allow_method_overrideso setting it tofalseactually disablesX-HTTP-Method-Overrideand_methodmethod spoofing (GHSA-vr9m-jx6f-hhj6). The mitigation introduced for CVE-2026-42551 was applied afterRequestwas constructed, so the opt-out never took effect on routing.
Upgrade note: If you set Flight::set('flight.allow_method_override', false) on 3.18.1–3.19.0, upgrade to 3.19.1 for that setting to work. The default remains true for backwards compatibility; disabling override is still recommended when you do not need HTML form method spoofing.