From 0707e913bd6f817016d6cb831e2f51886e1986be Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Thu, 22 Oct 2026 23:59:23 +0200 Subject: [PATCH 1/4] fix(renovate): exclude symfony/monolog-bundle from the ~7.4 Symfony rule monolog-bundle is versioned independently (4.x) and has no 7.4 releases, so the allowedVersions constraint blocked all its updates. Closes #39 Co-Authored-By: Claude Opus 5.5 --- renovate.json | 1 + 1 file changed, 1 insertion(+) diff --git a/renovate.json b/renovate.json index cf928ea..2777a21 100644 --- a/renovate.json +++ b/renovate.json @@ -15,6 +15,7 @@ "matchPackageNames": [ "/^symfony//", "!symfony/flex", + "!symfony/monolog-bundle", "!/^symfony/polyfill-/", "!/-contracts$/" ] From 0b10cd6a04d137c7c7e512a2b601556127f5c34e Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Thu, 22 Oct 2026 23:59:23 +0200 Subject: [PATCH 2/4] fix(docker): always pull the latest PHP 8.4 base image on release builds Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) via the floating 1-php8.4-alpine tag. Co-Authored-By: Claude Opus 5.5 --- .gitea/workflows/docker-publish.yml | 1 + CHANGELOG.md | 8 ++++++++ 2 files changed, 9 insertions(+) diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml index b57d4b0..b954390 100644 --- a/.gitea/workflows/docker-publish.yml +++ b/.gitea/workflows/docker-publish.yml @@ -77,6 +77,7 @@ jobs: target: final platforms: linux/amd64,linux/arm64 push: true + pull: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} # Registry-based layer cache — survives between runs without a separate cache store. diff --git a/CHANGELOG.md b/CHANGELOG.md index c9d16e6..c58d41e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -19,6 +19,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - `phpstan/phpstan` 2.2.5 → 2.2.16 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install` +### Fixed + +- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39) + +### Security + +- Release images are built against the latest picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) + ## [0.2.1] - 2026-07-31 ### Added From bb23ae88193b6f9acc318c20d2bf2941cf07bad8 Mon Sep 17 00:00:00 2001 From: ArthurErlich Date: Fri, 23 Oct 2026 00:06:17 +0200 Subject: [PATCH 3/4] chore(deps): fixed changelog text --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c58d41e..4b98068 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -25,7 +25,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Security -- Release images are built against the latest picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) +- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) ## [0.2.1] - 2026-07-31 From acf292c48af6d28cf5cad236cd911ea344e16ce9 Mon Sep 17 00:00:00 2001 From: gitea-actions Date: Thu, 22 Oct 2026 22:39:20 +0000 Subject: [PATCH 4/4] chore(release): 0.2.2 --- CHANGELOG.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4b98068..ae6a5b6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.2.2] - 2026-10-22 + ### Changed - Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS