[GHSA] GHSA-9rjg-x2p2-h68h (medium) — API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

GHSA-9rjg-x2p2-h68h Severity: medium CVE: CVE-2026-54164

API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

## Summary

The API Platform serializer's `AbstractItemNormalizer` does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an unintended typ