chore(deps): update dependency phpstan/phpstan to v2.3.1

chore(release): 0.2.2
Merge pull request 'fix: Renovate monolog-bundle rule (#39 ) and PHP 8.4 security base image' (#40 ) from fix/renovate-monolog-bundle into main
2026-10-23 21:02:47 +00:00 · 2026-10-22 22:39:20 +00:00 · 2026-10-22 22:07:17 +00:00 · 2026-10-23 00:06:17 +02:00 · 2026-10-22 23:59:23 +02:00 · 2026-10-22 23:59:23 +02:00
3 changed files with 12 additions and 0 deletions
@@ -77,6 +77,7 @@ jobs:
          target: final
          platforms: linux/amd64,linux/arm64
          push: true
+          pull: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Registry-based layer cache — survives between runs without a separate cache store.
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.2.2] - 2026-10-22
+
 ### Changed

 - Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
@@ -19,6 +21,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  - `phpstan/phpstan` 2.2.5 → 2.2.16
 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`

+### Fixed
+
+- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
+
+### Security
+
+- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
+
 ## [0.2.1] - 2026-07-31

 ### Added
@@ -15,6 +15,7 @@
      "matchPackageNames": [
        "/^symfony//",
        "!symfony/flex",
+        "!symfony/monolog-bundle",
        "!/^symfony/polyfill-/",
        "!/-contracts$/"
      ]
Author	SHA1	Message	Date
renovate Bot	286eb4d8c0	chore(deps): update dependency phpstan/phpstan to v2.3.1 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 5m34s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:02:47 +00:00
gitea-actions	acf292c48a	chore(release): 0.2.2	2026-10-22 22:39:20 +00:00
haylan	ac7991db30	Merge pull request 'fix: Renovate monolog-bundle rule (#39 ) and PHP 8.4 security base image' (#40 ) from fix/renovate-monolog-bundle into main Tests / build-dev (push) Successful in 7m55s Details Tests / build-prod (push) Successful in 8m41s Details	2026-10-22 22:07:17 +00:00
haylan	bb23ae8819	chore(deps): fixed changelog text Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 7m47s Details Tests / build-prod (pull_request) Successful in 8m51s Details	2026-10-23 00:06:17 +02:00
haylanandClaude Bot	0b10cd6a04	fix(docker): always pull the latest PHP 8.4 base image on release builds Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 10m39s Details Tests / build-prod (pull_request) Successful in 10m17s Details Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) via the floating 1-php8.4-alpine tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00
haylanandClaude Bot	0707e913bd	fix(renovate): exclude symfony/monolog-bundle from the ~7.4 Symfony rule monolog-bundle is versioned independently (4.x) and has no 7.4 releases, so the allowedVersions constraint blocked all its updates. Closes #39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00