Root Cause

Request signature validation was failing when a deployment was built after the release of craftcms/cloud@3.4.0 but before the release of craftcms/cms@5.10.6.

Due to an encoding bug in Craft CMS, only requests with forward slashes (/) in the query string were affected. The change in character encoding made the URL signature invalid, preventing the request from resolving.

Craft Cloud ESI's were especially susceptible, as those are signed URLs, often with some/template/path/ containing a forward slash.

Resolution

The craftcms/cloud release expecting the properly encoded URLs were yanked from Packagist, so subsequent deploys wouldn't include it, resulting in a compatible combination.

The issue could also be fixed by manually upgrading to the latest craftcms/cms release.

Mitigation

• Future releases of craftcms/cloud will explicitly require patch versions of the craftcms/cms parent dependency, most notably when any variance in the URL is expected.
• The Craft Cloud gateway is also now capable of validating signed requests accounting for any legacy URL variances.
• We are prioritizing the development of build rollbacks, so affected customers can react more quickly to issues like this and not have to wait several minutes for re-deployments.

Following a deployment, certain requests are rendering an incomplete document.
This may result in missing styles, javascript, or other unexpected errors.