chore(release): 0.2.2

Update CHANGELOG.md
2026-10-23 21:31:47 +00:00 · 2026-10-23 21:30:59 +00:00 · 2026-10-23 21:29:18 +00:00 · 2026-10-23 21:28:40 +00:00 · 2026-10-23 21:27:30 +00:00 · 2026-10-23 21:27:29 +00:00
5 changed files with 59 additions and 47 deletions
@@ -77,6 +77,7 @@ jobs:
          target: final
          platforms: linux/amd64,linux/arm64
          push: true
+          pull: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Registry-based layer cache — survives between runs without a separate cache store.
@@ -24,7 +24,7 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.RELEASE_TOKEN }}

      - name: Validate version and Unreleased section
        run: |
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.2.2] - 2026-10-23
+
 ### Changed

 - Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
@@ -19,6 +21,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  - `phpstan/phpstan` 2.2.5 → 2.2.16
 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`

+### Fixed
+
+- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
+
+### Security
+
+- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
+
 ## [0.2.1] - 2026-07-31

 ### Added
@@ -315,16 +315,16 @@
        },
        {
            "name": "symfony/cache",
-            "version": "v7.4.20",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/cache.git",
-                "reference": "e7e604eab58639503495a46f5c194cc69a9c80a8"
+                "reference": "314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/cache/zipball/e7e604eab58639503495a46f5c194cc69a9c80a8",
-                "reference": "e7e604eab58639503495a46f5c194cc69a9c80a8",
+                "url": "https://api.github.com/repos/symfony/cache/zipball/314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a",
+                "reference": "314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a",
                "shasum": ""
            },
            "require": {
@@ -394,7 +394,7 @@
                "psr6"
            ],
            "support": {
-                "source": "https://github.com/symfony/cache/tree/v7.4.20"
+                "source": "https://github.com/symfony/cache/tree/v7.4.21"
            },
            "funding": [
                {
@@ -414,7 +414,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-29T12:35:16+00:00"
+            "time": "2026-10-12T13:05:23+00:00"
        },
        {
            "name": "symfony/cache-contracts",
@@ -577,16 +577,16 @@
        },
        {
            "name": "symfony/console",
-            "version": "v7.4.20",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d"
+                "reference": "21f1bc2296f7ff6043241a8dcbc09559b3732820"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d",
-                "reference": "d7bca2fe05241dc7732d0c8b6d551b879f5d0a7d",
+                "url": "https://api.github.com/repos/symfony/console/zipball/21f1bc2296f7ff6043241a8dcbc09559b3732820",
+                "reference": "21f1bc2296f7ff6043241a8dcbc09559b3732820",
                "shasum": ""
            },
            "require": {
@@ -651,7 +651,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.20"
+                "source": "https://github.com/symfony/console/tree/v7.4.21"
            },
            "funding": [
                {
@@ -671,7 +671,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-18T15:55:00+00:00"
+            "time": "2026-10-12T18:45:38+00:00"
        },
        {
            "name": "symfony/dependency-injection",
@@ -1288,16 +1288,16 @@
        },
        {
            "name": "symfony/framework-bundle",
-            "version": "v7.4.20",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/framework-bundle.git",
-                "reference": "99786f9338c24770ce4de6a95d049675aa75b129"
+                "reference": "62b38e9cb02c944e01030898b3d2b4f31722e47f"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/framework-bundle/zipball/99786f9338c24770ce4de6a95d049675aa75b129",
-                "reference": "99786f9338c24770ce4de6a95d049675aa75b129",
+                "url": "https://api.github.com/repos/symfony/framework-bundle/zipball/62b38e9cb02c944e01030898b3d2b4f31722e47f",
+                "reference": "62b38e9cb02c944e01030898b3d2b4f31722e47f",
                "shasum": ""
            },
            "require": {
@@ -1421,7 +1421,7 @@
            "description": "Provides a tight integration between Symfony components and the Symfony full-stack framework",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/framework-bundle/tree/v7.4.20"
+                "source": "https://github.com/symfony/framework-bundle/tree/v7.4.21"
            },
            "funding": [
                {
@@ -1441,20 +1441,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-28T19:09:50+00:00"
+            "time": "2026-10-12T12:34:30+00:00"
        },
        {
            "name": "symfony/http-client",
-            "version": "v7.4.20",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-client.git",
-                "reference": "750a420b8dd0af3d6e1c6c1412802abf2cdd2b6c"
+                "reference": "121bf3a973bfd852db85ec32d0d64e9fbed4449b"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client/zipball/750a420b8dd0af3d6e1c6c1412802abf2cdd2b6c",
-                "reference": "750a420b8dd0af3d6e1c6c1412802abf2cdd2b6c",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/121bf3a973bfd852db85ec32d0d64e9fbed4449b",
+                "reference": "121bf3a973bfd852db85ec32d0d64e9fbed4449b",
                "shasum": ""
            },
            "require": {
@@ -1522,7 +1522,7 @@
                "http"
            ],
            "support": {
-                "source": "https://github.com/symfony/http-client/tree/v7.4.20"
+                "source": "https://github.com/symfony/http-client/tree/v7.4.21"
            },
            "funding": [
                {
@@ -1542,7 +1542,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-24T11:02:13+00:00"
+            "time": "2026-10-13T15:31:38+00:00"
        },
        {
            "name": "symfony/http-client-contracts",
@@ -2652,16 +2652,16 @@
        },
        {
            "name": "symfony/runtime",
-            "version": "v7.4.14",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/runtime.git",
-                "reference": "15497f743dd714f3167cb6a56509b9d42e6417b3"
+                "reference": "e3ca615f093fe4c32073530f84ada6feb9cfb406"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/runtime/zipball/15497f743dd714f3167cb6a56509b9d42e6417b3",
-                "reference": "15497f743dd714f3167cb6a56509b9d42e6417b3",
+                "url": "https://api.github.com/repos/symfony/runtime/zipball/e3ca615f093fe4c32073530f84ada6feb9cfb406",
+                "reference": "e3ca615f093fe4c32073530f84ada6feb9cfb406",
                "shasum": ""
            },
            "require": {
@@ -2713,7 +2713,7 @@
                "runtime"
            ],
            "support": {
-                "source": "https://github.com/symfony/runtime/tree/v7.4.14"
+                "source": "https://github.com/symfony/runtime/tree/v7.4.21"
            },
            "funding": [
                {
@@ -2733,7 +2733,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-06-05T06:22:21+00:00"
+            "time": "2026-10-06T15:15:25+00:00"
        },
        {
            "name": "symfony/service-contracts",
@@ -3083,16 +3083,16 @@
        },
        {
            "name": "symfony/yaml",
-            "version": "v7.4.20",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/yaml.git",
-                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7"
+                "reference": "044907929c7999814378be22da34722c7a86bad4"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
-                "reference": "0222bf4dfaa1e3ceb8fff579635d655f2950d5a7",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/044907929c7999814378be22da34722c7a86bad4",
+                "reference": "044907929c7999814378be22da34722c7a86bad4",
                "shasum": ""
            },
            "require": {
@@ -3135,7 +3135,7 @@
            "description": "Loads and dumps YAML files",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/yaml/tree/v7.4.20"
+                "source": "https://github.com/symfony/yaml/tree/v7.4.21"
            },
            "funding": [
                {
@@ -3155,7 +3155,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-26T06:31:10+00:00"
+            "time": "2026-10-12T12:34:30+00:00"
        }
    ],
    "packages-dev": [
@@ -3396,11 +3396,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.2.16",
+            "version": "2.3.1",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
-                "reference": "46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/6155239b488e95d26d1ebd95c6b4bb294d7f09db",
+                "reference": "6155239b488e95d26d1ebd95c6b4bb294d7f09db",
                "shasum": ""
            },
            "require": {
@@ -3456,7 +3456,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-09-25T09:31:51+00:00"
+            "time": "2026-10-08T21:09:11+00:00"
        },
        {
            "name": "phpunit/php-code-coverage",
@@ -4939,16 +4939,16 @@
        },
        {
            "name": "symfony/phpunit-bridge",
-            "version": "v7.4.18",
+            "version": "v7.4.21",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/phpunit-bridge.git",
-                "reference": "ff3a78aceb731b24b256a2845a8ad6e6851f942b"
+                "reference": "8bf5eb51869e7606588a454030cb106fa33bc04c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/ff3a78aceb731b24b256a2845a8ad6e6851f942b",
-                "reference": "ff3a78aceb731b24b256a2845a8ad6e6851f942b",
+                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/8bf5eb51869e7606588a454030cb106fa33bc04c",
+                "reference": "8bf5eb51869e7606588a454030cb106fa33bc04c",
                "shasum": ""
            },
            "require": {
@@ -5000,7 +5000,7 @@
                "testing"
            ],
            "support": {
-                "source": "https://github.com/symfony/phpunit-bridge/tree/v7.4.18"
+                "source": "https://github.com/symfony/phpunit-bridge/tree/v7.4.21"
            },
            "funding": [
                {
@@ -5020,7 +5020,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-08-30T18:28:44+00:00"
+            "time": "2026-09-30T22:00:01+00:00"
        },
        {
            "name": "theseer/tokenizer",
@@ -15,6 +15,7 @@
      "matchPackageNames": [
        "/^symfony//",
        "!symfony/flex",
+        "!symfony/monolog-bundle",
        "!/^symfony/polyfill-/",
        "!/-contracts$/"
      ]
Author	SHA1	Message	Date
gitea-actions	daf025598f	chore(release): 0.2.2 Tests / build-dev (push) Failing after 7m47s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:31:47 +00:00
haylan	8612994b84	Update CHANGELOG.md Tests / build-dev (push) Failing after 8m19s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:30:59 +00:00
gitea-actions	064585b163	chore(release): 0.2.2 Tests / build-dev (push) Failing after 4m13s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:29:18 +00:00
haylan	5d3036aa3f	Update CHANGELOG.md Tests / build-dev (push) Failing after 3m46s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:28:40 +00:00
haylan	e03f1a573e	Merge pull request 'chore(deps): update dependency phpstan/phpstan to v2.3.1' (#37 ) from renovate/phpstan-packages into main Tests / build-dev (push) Failing after 6m44s Details Tests / build-prod (push) Skipped Details Reviewed-on: #37	2026-10-23 21:27:30 +00:00
haylan	8be9658afa	Merge branch 'main' into renovate/phpstan-packages Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 6m46s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:27:29 +00:00
haylan	24b88605a9	Merge pull request 'fix(ci): push release commit with RELEASE_TOKEN' (#42 ) from fix/release-token into main Tests / build-dev (push) Successful in 5m9s Details Tests / build-prod (push) Successful in 7m48s Details Reviewed-on: #42	2026-10-23 21:27:04 +00:00
haylan	ae6eb8616b	Merge branch 'main' into renovate/phpstan-packages Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 5m25s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:14:17 +00:00
haylan	b278c2ddb6	Merge branch 'main' into fix/release-token Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 5m25s Details Tests / build-prod (pull_request) Successful in 7m39s Details	2026-10-23 21:13:50 +00:00
haylan	747c770882	Merge pull request 'chore(deps): update symfony to v7.4.21' (#38 ) from renovate/symfony into main Tests / build-dev (push) Successful in 5m24s Details Tests / build-prod (push) Successful in 7m46s Details Reviewed-on: #38	2026-10-23 21:13:42 +00:00
renovate Bot	286eb4d8c0	chore(deps): update dependency phpstan/phpstan to v2.3.1 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 5m34s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:02:47 +00:00
haylanandClaude Bot	ba3d5a2bd6	fix(ci): push release commit with RELEASE_TOKEN Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 5m29s Details Tests / build-prod (pull_request) Successful in 8m20s Details The built-in GITHUB_TOKEN is rejected by branch protection on main. Use the Gitea bot's RELEASE_TOKEN, which may bypass it. Closes #41 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 23:01:34 +02:00
haylan	68993e8f9f	Merge branch 'main' into renovate/symfony Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 3m54s Details Tests / build-prod (pull_request) Successful in 10m36s Details	2026-10-23 20:58:02 +00:00
gitea-actions	acf292c48a	chore(release): 0.2.2	2026-10-22 22:39:20 +00:00
haylan	ac7991db30	Merge pull request 'fix: Renovate monolog-bundle rule (#39 ) and PHP 8.4 security base image' (#40 ) from fix/renovate-monolog-bundle into main Tests / build-dev (push) Successful in 7m55s Details Tests / build-prod (push) Successful in 8m41s Details	2026-10-22 22:07:17 +00:00
haylan	bb23ae8819	chore(deps): fixed changelog text Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 7m47s Details Tests / build-prod (pull_request) Successful in 8m51s Details	2026-10-23 00:06:17 +02:00
haylanandClaude Bot	0b10cd6a04	fix(docker): always pull the latest PHP 8.4 base image on release builds Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 10m39s Details Tests / build-prod (pull_request) Successful in 10m17s Details Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) via the floating 1-php8.4-alpine tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00
haylanandClaude Bot	0707e913bd	fix(renovate): exclude symfony/monolog-bundle from the ~7.4 Symfony rule monolog-bundle is versioned independently (4.x) and has no 7.4 releases, so the allowedVersions constraint blocked all its updates. Closes #39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00
renovate Bot	6cb28df046	chore(deps): update symfony to v7.4.21 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 5m4s Details Tests / build-prod (pull_request) Successful in 4m39s Details	2026-10-14 08:26:24 +00:00