Merge pull request 'chore(deps): update dependency phpstan/phpstan to v2.3.4' (#44 ) from renovate/phpstan-packages into main

Reviewed-on: #44
Merge pull request 'chore(deps): update symfony to v7.4.22' (#45 ) from renovate/symfony into main
2026-10-30 06:15:12 +00:00 · 2026-10-30 06:14:59 +00:00 · 2026-10-30 06:14:44 +00:00 · 2026-10-29 20:02:55 +00:00 · 2026-10-29 00:03:14 +00:00 · 2026-10-28 20:06:38 +00:00
6 changed files with 70 additions and 57 deletions
@@ -77,6 +77,7 @@ jobs:
          target: final
          platforms: linux/amd64,linux/arm64
          push: true
          pull: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          # Registry-based layer cache — survives between runs without a separate cache store.
@@ -24,7 +24,7 @@ jobs:
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.RELEASE_TOKEN }}
      - name: Validate version and Unreleased section
        run: |
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 ## [0.2.2] - 2026-10-23
 ### Changed
 - Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
@@ -19,6 +21,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
  - `phpstan/phpstan` 2.2.5 → 2.2.16
 - Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`
 ### Fixed
 - Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
 ### Security
 - Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
 ## [0.2.1] - 2026-07-31
 ### Added
@@ -4,7 +4,7 @@
    "type": "project",
    "license": "MIT",
    "require": {
-        "php": ">=8.2",
+        "php": ">=8.3",
        "monolog/monolog": "^3.10",
        "symfony/cache": "7.4.*",
        "symfony/console": "7.4.*",
@@ -4,7 +4,7 @@
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
-    "content-hash": "65e112e17f2cf3ba6ebccbbc3a0fcbfa",
+    "content-hash": "79811db631df6eb8fad05f9bb2caf385",
    "packages": [
        {
            "name": "monolog/monolog",
@@ -315,16 +315,16 @@
        },
        {
            "name": "symfony/cache",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/cache.git",
-                "reference": "314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a"
+                "reference": "f0024b7dd1e6d4f2f34b08c1a61c6c7d33febad7"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/cache/zipball/314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a",
+                "url": "https://api.github.com/repos/symfony/cache/zipball/f0024b7dd1e6d4f2f34b08c1a61c6c7d33febad7",
-                "reference": "314a079754e9eef4c6ffe2a3b12b0ea7c6c7381a",
+                "reference": "f0024b7dd1e6d4f2f34b08c1a61c6c7d33febad7",
                "shasum": ""
            },
            "require": {
@@ -394,7 +394,7 @@
                "psr6"
            ],
            "support": {
-                "source": "https://github.com/symfony/cache/tree/v7.4.21"
+                "source": "https://github.com/symfony/cache/tree/v7.4.22"
            },
            "funding": [
                {
@@ -414,7 +414,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-12T13:05:23+00:00"
+            "time": "2026-10-28T10:54:34+00:00"
        },
        {
            "name": "symfony/cache-contracts",
@@ -577,16 +577,16 @@
        },
        {
            "name": "symfony/console",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/console.git",
-                "reference": "21f1bc2296f7ff6043241a8dcbc09559b3732820"
+                "reference": "8012f842110b414fd1cc641adb0ed8423353b0bb"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/21f1bc2296f7ff6043241a8dcbc09559b3732820",
+                "url": "https://api.github.com/repos/symfony/console/zipball/8012f842110b414fd1cc641adb0ed8423353b0bb",
-                "reference": "21f1bc2296f7ff6043241a8dcbc09559b3732820",
+                "reference": "8012f842110b414fd1cc641adb0ed8423353b0bb",
                "shasum": ""
            },
            "require": {
@@ -651,7 +651,7 @@
                "terminal"
            ],
            "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.21"
+                "source": "https://github.com/symfony/console/tree/v7.4.22"
            },
            "funding": [
                {
@@ -671,7 +671,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-12T18:45:38+00:00"
+            "time": "2026-10-28T11:08:27+00:00"
        },
        {
            "name": "symfony/dependency-injection",
@@ -1215,16 +1215,16 @@
        },
        {
            "name": "symfony/flex",
-            "version": "v2.11.0",
+            "version": "v2.12.0",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/flex.git",
-                "reference": "4a6d98eea3ebc7f68d82810cb682eedca2649e99"
+                "reference": "3d37e8597c2290c095433b4260563986f857a274"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/flex/zipball/4a6d98eea3ebc7f68d82810cb682eedca2649e99",
+                "url": "https://api.github.com/repos/symfony/flex/zipball/3d37e8597c2290c095433b4260563986f857a274",
-                "reference": "4a6d98eea3ebc7f68d82810cb682eedca2649e99",
+                "reference": "3d37e8597c2290c095433b4260563986f857a274",
                "shasum": ""
            },
            "require": {
@@ -1264,7 +1264,7 @@
            "description": "Composer plugin for Symfony",
            "support": {
                "issues": "https://github.com/symfony/flex/issues",
-                "source": "https://github.com/symfony/flex/tree/v2.11.0"
+                "source": "https://github.com/symfony/flex/tree/v2.12.0"
            },
            "funding": [
                {
@@ -1284,20 +1284,21 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-05-29T17:25:22+00:00"
+            "time": "2026-10-29T17:24:46+00:00",
            "published-time": "2026-10-29T17:26:51+00:00"
        },
        {
            "name": "symfony/framework-bundle",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/framework-bundle.git",
-                "reference": "62b38e9cb02c944e01030898b3d2b4f31722e47f"
+                "reference": "17d23a62561b493b85486c9ae8c2752f36303b2c"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/framework-bundle/zipball/62b38e9cb02c944e01030898b3d2b4f31722e47f",
+                "url": "https://api.github.com/repos/symfony/framework-bundle/zipball/17d23a62561b493b85486c9ae8c2752f36303b2c",
-                "reference": "62b38e9cb02c944e01030898b3d2b4f31722e47f",
+                "reference": "17d23a62561b493b85486c9ae8c2752f36303b2c",
                "shasum": ""
            },
            "require": {
@@ -1421,7 +1422,7 @@
            "description": "Provides a tight integration between Symfony components and the Symfony full-stack framework",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/framework-bundle/tree/v7.4.21"
+                "source": "https://github.com/symfony/framework-bundle/tree/v7.4.22"
            },
            "funding": [
                {
@@ -1441,20 +1442,20 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-12T12:34:30+00:00"
+            "time": "2026-10-26T21:52:50+00:00"
        },
        {
            "name": "symfony/http-client",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/http-client.git",
-                "reference": "121bf3a973bfd852db85ec32d0d64e9fbed4449b"
+                "reference": "9dd7ba9dc326b37d7f6e19588de79b5d91b20d66"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-client/zipball/121bf3a973bfd852db85ec32d0d64e9fbed4449b",
+                "url": "https://api.github.com/repos/symfony/http-client/zipball/9dd7ba9dc326b37d7f6e19588de79b5d91b20d66",
-                "reference": "121bf3a973bfd852db85ec32d0d64e9fbed4449b",
+                "reference": "9dd7ba9dc326b37d7f6e19588de79b5d91b20d66",
                "shasum": ""
            },
            "require": {
@@ -1522,7 +1523,7 @@
                "http"
            ],
            "support": {
-                "source": "https://github.com/symfony/http-client/tree/v7.4.21"
+                "source": "https://github.com/symfony/http-client/tree/v7.4.22"
            },
            "funding": [
                {
@@ -1542,7 +1543,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-13T15:31:38+00:00"
+            "time": "2026-10-26T21:52:50+00:00"
        },
        {
            "name": "symfony/http-client-contracts",
@@ -2652,16 +2653,16 @@
        },
        {
            "name": "symfony/runtime",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/runtime.git",
-                "reference": "e3ca615f093fe4c32073530f84ada6feb9cfb406"
+                "reference": "b2c5957ced36512af5ac68bf4a9afeca76361234"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/runtime/zipball/e3ca615f093fe4c32073530f84ada6feb9cfb406",
+                "url": "https://api.github.com/repos/symfony/runtime/zipball/b2c5957ced36512af5ac68bf4a9afeca76361234",
-                "reference": "e3ca615f093fe4c32073530f84ada6feb9cfb406",
+                "reference": "b2c5957ced36512af5ac68bf4a9afeca76361234",
                "shasum": ""
            },
            "require": {
@@ -2713,7 +2714,7 @@
                "runtime"
            ],
            "support": {
-                "source": "https://github.com/symfony/runtime/tree/v7.4.21"
+                "source": "https://github.com/symfony/runtime/tree/v7.4.22"
            },
            "funding": [
                {
@@ -2733,7 +2734,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-06T15:15:25+00:00"
+            "time": "2026-10-23T12:52:46+00:00"
        },
        {
            "name": "symfony/service-contracts",
@@ -3083,16 +3084,16 @@
        },
        {
            "name": "symfony/yaml",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/yaml.git",
-                "reference": "044907929c7999814378be22da34722c7a86bad4"
+                "reference": "1ed6afa13d48c579c51cbf32e38f50686313497b"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/yaml/zipball/044907929c7999814378be22da34722c7a86bad4",
+                "url": "https://api.github.com/repos/symfony/yaml/zipball/1ed6afa13d48c579c51cbf32e38f50686313497b",
-                "reference": "044907929c7999814378be22da34722c7a86bad4",
+                "reference": "1ed6afa13d48c579c51cbf32e38f50686313497b",
                "shasum": ""
            },
            "require": {
@@ -3135,7 +3136,7 @@
            "description": "Loads and dumps YAML files",
            "homepage": "https://symfony.com",
            "support": {
-                "source": "https://github.com/symfony/yaml/tree/v7.4.21"
+                "source": "https://github.com/symfony/yaml/tree/v7.4.22"
            },
            "funding": [
                {
@@ -3155,7 +3156,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-10-12T12:34:30+00:00"
+            "time": "2026-10-18T14:39:27+00:00"
        }
    ],
    "packages-dev": [
@@ -3396,11 +3397,11 @@
        },
        {
            "name": "phpstan/phpstan",
-            "version": "2.2.16",
+            "version": "2.3.4",
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/f20ce6f3c82556cfcfc086b152445a12d1d64fff",
-                "reference": "46a6d9060e5a7763adfcc21ebcb8b504ebdbcb92",
+                "reference": "f20ce6f3c82556cfcfc086b152445a12d1d64fff",
                "shasum": ""
            },
            "require": {
@@ -3456,7 +3457,7 @@
                    "type": "github"
                }
            ],
-            "time": "2026-09-25T09:31:51+00:00"
+            "time": "2026-10-28T22:38:53+00:00"
        },
        {
            "name": "phpunit/php-code-coverage",
@@ -4939,16 +4940,16 @@
        },
        {
            "name": "symfony/phpunit-bridge",
-            "version": "v7.4.21",
+            "version": "v7.4.22",
            "source": {
                "type": "git",
                "url": "https://github.com/symfony/phpunit-bridge.git",
-                "reference": "8bf5eb51869e7606588a454030cb106fa33bc04c"
+                "reference": "6acbf2203c2364dc55376644aafba180bcac3ae1"
            },
            "dist": {
                "type": "zip",
-                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/8bf5eb51869e7606588a454030cb106fa33bc04c",
+                "url": "https://api.github.com/repos/symfony/phpunit-bridge/zipball/6acbf2203c2364dc55376644aafba180bcac3ae1",
-                "reference": "8bf5eb51869e7606588a454030cb106fa33bc04c",
+                "reference": "6acbf2203c2364dc55376644aafba180bcac3ae1",
                "shasum": ""
            },
            "require": {
@@ -5000,7 +5001,7 @@
                "testing"
            ],
            "support": {
-                "source": "https://github.com/symfony/phpunit-bridge/tree/v7.4.21"
+                "source": "https://github.com/symfony/phpunit-bridge/tree/v7.4.22"
            },
            "funding": [
                {
@@ -5020,7 +5021,7 @@
                    "type": "tidelift"
                }
            ],
-            "time": "2026-09-30T22:00:01+00:00"
+            "time": "2026-10-18T14:39:27+00:00"
        },
        {
            "name": "theseer/tokenizer",
@@ -5079,8 +5080,8 @@
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": {
-        "php": ">=8.2"
+        "php": ">=8.3"
    },
    "platform-dev": {},
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.11.0"
 }
@@ -15,6 +15,7 @@
      "matchPackageNames": [
        "/^symfony//",
        "!symfony/flex",
        "!symfony/monolog-bundle",
        "!/^symfony/polyfill-/",
        "!/-contracts$/"
      ]
Author	SHA1	Message	Date
haylan	61ca360656	Merge pull request 'chore(deps): update dependency phpstan/phpstan to v2.3.4' (#44 ) from renovate/phpstan-packages into main Tests / build-dev (push) Successful in 4m0s Details Tests / build-prod (push) Successful in 8m21s Details Reviewed-on: #44	2026-10-30 06:15:12 +00:00
haylan	77eb5565f4	Merge pull request 'chore(deps): update symfony to v7.4.22' (#45 ) from renovate/symfony into main Tests / build-dev (push) Successful in 3m58s Details Tests / build-prod (push) Successful in 8m24s Details Reviewed-on: #45	2026-10-30 06:14:59 +00:00
haylan	12c8a4a958	Merge pull request 'chore(deps): update dependency symfony/flex to v2.12.0' (#46 ) from renovate/symfony-flex-2.x-lockfile into main Tests / build-dev (push) Successful in 3m19s Details Tests / build-prod (push) Successful in 4m10s Details Reviewed-on: #46	2026-10-30 06:14:44 +00:00
renovate Bot	9a05fee073	chore(deps): update dependency symfony/flex to v2.12.0 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 3m26s Details Tests / build-prod (pull_request) Successful in 2m48s Details	2026-10-29 20:02:55 +00:00
renovate Bot	1c995ede0e	chore(deps): update dependency phpstan/phpstan to v2.3.4 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 2m40s Details Tests / build-prod (pull_request) Successful in 3m27s Details	2026-10-29 00:03:14 +00:00
renovate Bot	60899ef268	chore(deps): update symfony to v7.4.22 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 7m11s Details Tests / build-prod (pull_request) Successful in 5m4s Details	2026-10-28 20:06:38 +00:00
haylan	7086cedfb3	Merge pull request 'fix(deps): require PHP >=8.3' (#43 ) from fix/php-constraint into main Tests / build-dev (push) Successful in 1m55s Details Tests / build-prod (push) Successful in 1m20s Details Reviewed-on: #43	2026-10-24 08:34:24 +00:00
haylanandClaude Bot	143a5fcbf0	fix(deps): require PHP >=8.3 to match typed class constants Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 6m3s Details Tests / build-prod (pull_request) Successful in 5m11s Details ContributionStore uses a typed class constant (PHP 8.3+), but composer.json still allowed 8.2. PHPStan 2.3 reads the constraint and fails on it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 23:37:20 +02:00
gitea-actions	daf025598f	chore(release): 0.2.2 Tests / build-dev (push) Failing after 7m47s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:31:47 +00:00
haylan	8612994b84	Update CHANGELOG.md Tests / build-dev (push) Failing after 8m19s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:30:59 +00:00
gitea-actions	064585b163	chore(release): 0.2.2 Tests / build-dev (push) Failing after 4m13s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:29:18 +00:00
haylan	5d3036aa3f	Update CHANGELOG.md Tests / build-dev (push) Failing after 3m46s Details Tests / build-prod (push) Skipped Details	2026-10-23 21:28:40 +00:00
haylan	e03f1a573e	Merge pull request 'chore(deps): update dependency phpstan/phpstan to v2.3.1' (#37 ) from renovate/phpstan-packages into main Tests / build-dev (push) Failing after 6m44s Details Tests / build-prod (push) Skipped Details Reviewed-on: #37	2026-10-23 21:27:30 +00:00
haylan	8be9658afa	Merge branch 'main' into renovate/phpstan-packages Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 6m46s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:27:29 +00:00
haylan	24b88605a9	Merge pull request 'fix(ci): push release commit with RELEASE_TOKEN' (#42 ) from fix/release-token into main Tests / build-dev (push) Successful in 5m9s Details Tests / build-prod (push) Successful in 7m48s Details Reviewed-on: #42	2026-10-23 21:27:04 +00:00
haylan	ae6eb8616b	Merge branch 'main' into renovate/phpstan-packages Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 5m25s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:14:17 +00:00
haylan	b278c2ddb6	Merge branch 'main' into fix/release-token Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 5m25s Details Tests / build-prod (pull_request) Successful in 7m39s Details	2026-10-23 21:13:50 +00:00
haylan	747c770882	Merge pull request 'chore(deps): update symfony to v7.4.21' (#38 ) from renovate/symfony into main Tests / build-dev (push) Successful in 5m24s Details Tests / build-prod (push) Successful in 7m46s Details Reviewed-on: #38	2026-10-23 21:13:42 +00:00
renovate Bot	286eb4d8c0	chore(deps): update dependency phpstan/phpstan to v2.3.1 Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Failing after 5m34s Details Tests / build-prod (pull_request) Skipped Details	2026-10-23 21:02:47 +00:00
haylanandClaude Bot	ba3d5a2bd6	fix(ci): push release commit with RELEASE_TOKEN Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 5m29s Details Tests / build-prod (pull_request) Successful in 8m20s Details The built-in GITHUB_TOKEN is rejected by branch protection on main. Use the Gitea bot's RELEASE_TOKEN, which may bypass it. Closes #41 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-23 23:01:34 +02:00
haylan	68993e8f9f	Merge branch 'main' into renovate/symfony Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 3m54s Details Tests / build-prod (pull_request) Successful in 10m36s Details	2026-10-23 20:58:02 +00:00
gitea-actions	acf292c48a	chore(release): 0.2.2	2026-10-22 22:39:20 +00:00
haylan	ac7991db30	Merge pull request 'fix: Renovate monolog-bundle rule (#39 ) and PHP 8.4 security base image' (#40 ) from fix/renovate-monolog-bundle into main Tests / build-dev (push) Successful in 7m55s Details Tests / build-prod (push) Successful in 8m41s Details	2026-10-22 22:07:17 +00:00
haylan	bb23ae8819	chore(deps): fixed changelog text Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 7m47s Details Tests / build-prod (pull_request) Successful in 8m51s Details	2026-10-23 00:06:17 +02:00
haylanandClaude Bot	0b10cd6a04	fix(docker): always pull the latest PHP 8.4 base image on release builds Tests / build-dev (push) Skipped Tests / build-prod (push) Skipped Tests / build-dev (pull_request) Successful in 10m39s Details Tests / build-prod (pull_request) Successful in 10m17s Details Picks up PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE) via the floating 1-php8.4-alpine tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00
haylanandClaude Bot	0707e913bd	fix(renovate): exclude symfony/monolog-bundle from the ~7.4 Symfony rule monolog-bundle is versioned independently (4.x) and has no 7.4 releases, so the allowedVersions constraint blocked all its updates. Closes #39 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-22 23:59:23 +02:00