Merge branch '4.3' into 4.4

# Conflicts:
#	CHANGELOG.md

Author: soyuka

CHANGELOG.md

@@ -38,6 +38,15 @@
 * [c9e5071d9](https://github.com/api-platform/core/commit/c9e5071d973caedeb9b554f885dedbc89743b93d) feat(symfony): deprecate Symfony Security AccessDeniedException (#8318)
 * [cc0ae1254](https://github.com/api-platform/core/commit/cc0ae1254acaf9742c7f899dd24a14d46c89ca6e) feat: support dynamic HTTP response status code via request attribute (#7904)
 
+## v4.3.15
+
+### Bug fixes
+
+* [37dfcb397](https://github.com/api-platform/core/commit/37dfcb397583ff1de4e3d87a75aa068a9997364a) fix(serializer): preserve deserialization path and expected type on IRI type-confusion guard (#8353)
+* [7bc11b2fe](https://github.com/api-platform/core/commit/7bc11b2fe29278664ab272964a868ed3a99a2951) fix(serializer): accept union-typed IRI collections on denormalization (#8339)
+* [a5761cc17](https://github.com/api-platform/core/commit/a5761cc1793c979c71d46305196eb157a44b6c2a) fix(jsonschema): don't require @id in single-item MCP output schema (#8343)
+* [be26bbeb3](https://github.com/api-platform/core/commit/be26bbeb369a5fa1eb055ec666b9e00c0590e366) fix(serializer): forward DiscriminatorMap defaultType in PropertyMetadataLoader (#8346)
+
 ## v4.3.14
 
 ### Bug fixes

src/Serializer/AbstractItemNormalizer.php

@@ -773,7 +773,26 @@ private function getResourceFromIri(string $data, array $context, string $resour
                 : is_a($item, $resourceClass);
 
             if (!$matchesType) {
-                throw new NotNormalizableValueException(\sprintf('The iri "%s" does not reference the correct resource.', $data));
+                // Keep this a NotNormalizableValueException so union/intersection denormalization can fall
+                // through to the next member (see testUnionType*), but build it through the factory so the
+                // deserialization path and expected type are preserved on the resulting violation. For a
+                // union/intersection relation, report every accepted class rather than only the one currently
+                // being attempted.
+                $expectedTypes = [$resourceClass];
+                if ($relationType instanceof Type) {
+                    $classNames = [];
+                    foreach ($relationType instanceof CompositeTypeInterface ? $relationType->getTypes() : [$relationType] as $relationMember) {
+                        if ($relationMember instanceof ObjectType) {
+                            $classNames[] = $relationMember->getClassName();
+                        }
+                    }
+
+                    if ($classNames) {
+                        $expectedTypes = $classNames;
+                    }
+                }
+
+                throw NotNormalizableValueException::createForUnexpectedDataType(\sprintf('Invalid IRI "%s".', $data), $data, $expectedTypes, $context['deserialization_path'] ?? null, true);
             }
 
             return $item;

src/Serializer/Tests/AbstractItemNormalizerTest.php

@@ -1335,6 +1335,76 @@ public function testUnionTypeCollectionDenormalizationAcceptsAnyMember(): void
         $this->assertInstanceOf(Dummy::class, $actual);
     }
 
+    public function testTypeConfusionGuardPreservesPathAndExpectedType(): void
+    {
+        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
+
+        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
+
+        // The IRI resolves to a Dummy while a RelatedDummy is expected: the type-confusion guard must reject it.
+        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
+        $iriConverterProphecy->getResourceFromIri(Argument::cetera())->willReturn(new Dummy());
+
+        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
+        $resourceClassResolverProphecy->getResourceClass(null, RelatedDummy::class)->willReturn(RelatedDummy::class);
+        $resourceClassResolverProphecy->isResourceClass(RelatedDummy::class)->willReturn(true);
+
+        $propertyAccessorProphecy = $this->prophesize(PropertyAccessorInterface::class);
+
+        $serializerProphecy = $this->prophesize(SerializerInterface::class);
+        $serializerProphecy->willImplement(DenormalizerInterface::class);
+
+        $normalizer = new class($propertyNameCollectionFactoryProphecy->reveal(), $propertyMetadataFactoryProphecy->reveal(), $iriConverterProphecy->reveal(), $resourceClassResolverProphecy->reveal(), $propertyAccessorProphecy->reveal(), null, null, [], null, null) extends AbstractItemNormalizer {};
+        $normalizer->setSerializer($serializerProphecy->reveal());
+
+        try {
+            $normalizer->denormalize('/dummies/1', RelatedDummy::class, null, [
+                'not_normalizable_value_exceptions' => [],
+                'deserialization_path' => 'relatedDummy',
+            ]);
+            $this->fail('Expected a NotNormalizableValueException to be thrown.');
+        } catch (NotNormalizableValueException $exception) {
+            $this->assertSame('Invalid IRI "/dummies/1".', $exception->getMessage());
+            $this->assertSame('relatedDummy', $exception->getPath());
+            $this->assertSame([RelatedDummy::class], $exception->getExpectedTypes());
+        }
+    }
+
+    public function testTypeConfusionGuardReportsAllUnionMemberTypes(): void
+    {
+        $propertyNameCollectionFactoryProphecy = $this->prophesize(PropertyNameCollectionFactoryInterface::class);
+
+        $propertyMetadataFactoryProphecy = $this->prophesize(PropertyMetadataFactoryInterface::class);
+
+        // The IRI resolves to a Dummy while the relation is declared as RelatedDummy|SecuredDummy.
+        $iriConverterProphecy = $this->prophesize(IriConverterInterface::class);
+        $iriConverterProphecy->getResourceFromIri(Argument::cetera())->willReturn(new Dummy());
+
+        $resourceClassResolverProphecy = $this->prophesize(ResourceClassResolverInterface::class);
+        $resourceClassResolverProphecy->getResourceClass(null, RelatedDummy::class)->willReturn(RelatedDummy::class);
+        $resourceClassResolverProphecy->isResourceClass(RelatedDummy::class)->willReturn(true);
+
+        $propertyAccessorProphecy = $this->prophesize(PropertyAccessorInterface::class);
+
+        $serializerProphecy = $this->prophesize(SerializerInterface::class);
+        $serializerProphecy->willImplement(DenormalizerInterface::class);
+
+        $normalizer = new class($propertyNameCollectionFactoryProphecy->reveal(), $propertyMetadataFactoryProphecy->reveal(), $iriConverterProphecy->reveal(), $resourceClassResolverProphecy->reveal(), $propertyAccessorProphecy->reveal(), null, null, [], null, null) extends AbstractItemNormalizer {};
+        $normalizer->setSerializer($serializerProphecy->reveal());
+
+        try {
+            $normalizer->denormalize('/dummies/1', RelatedDummy::class, null, [
+                'not_normalizable_value_exceptions' => [],
+                'deserialization_path' => 'relation',
+                'relation_native_type' => Type::union(Type::object(RelatedDummy::class), Type::object(SecuredDummy::class)),
+            ]);
+            $this->fail('Expected a NotNormalizableValueException to be thrown.');
+        } catch (NotNormalizableValueException $exception) {
+            // A union relation must report every accepted class, not just the first one attempted.
+            $this->assertSame([RelatedDummy::class, SecuredDummy::class], $exception->getExpectedTypes());
+        }
+    }
+
     public function testDenormalizeRelationNotFoundReturnsNull(): void
     {
         $data = [