Unset ID before calling parent denormalizer

Author: calbro7

src/Serializer/ItemNormalizer.php

@@ -68,6 +68,17 @@ public function denormalize(mixed $data, string $class, ?string $format = null,
             }
         }
 
+        // See https://github.com/api-platform/core/pull/7270 - id may be an allowed attribute due to being added in the
+        // overridden getAllowedAttributes below, in order to allow updating a nested item via ID. But in this case it
+        // may not "really" be an allowed attribute, ie we don't want to actually use it in denormalization. In this
+        // scenario it will not be present in parent::getAllowedAttributes
+        if (isset($data['id'], $context['resource_class'])) {
+            $parentAllowedAttributes = parent::getAllowedAttributes($class, $context, true);
+            if (is_array($parentAllowedAttributes) && !in_array('id', $parentAllowedAttributes)) {
+                unset($data['id']);
+            }
+        }
+
         return parent::denormalize($data, $class, $format, $context);
     }