chore(deps): update dependency phpstan/phpstan to v2.3.5

Reviewed-on: #44

.gitea/workflows/docker-publish.yml

@@ -77,6 +77,7 @@ jobs:
           target: final
           platforms: linux/amd64,linux/arm64
           push: true
+          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # Registry-based layer cache — survives between runs without a separate cache store.

.gitea/workflows/release.yml

@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ secrets.RELEASE_TOKEN }}
 
       - name: Validate version and Unreleased section
         run: |

CHANGELOG.md

@@ -7,6 +7,34 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-10-23
+
+### Changed
+
+- Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
+- Renovate groups all Symfony components into a single PR and restricts them to `~7.4`
+- Dependency updates:
+  - Symfony components 7.4.x → latest 7.4 patch (`cache`, `console`, `framework-bundle`, `http-client`, `http-kernel`, `yaml`, … → 7.4.20)
+  - `symfony/dependency-injection` back to 7.4.20 (a transitive update had pulled in 8.0.15)
+  - `symfony/monolog-bundle` 4.0.2 → 4.1.0
+  - `monolog/monolog` 3.10.0 → 3.12.1
+  - `phpstan/phpstan` 2.2.5 → 2.2.16
+- Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`
+
+### Fixed
+
+- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
+
+### Security
+
+- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
+
+## [0.2.1] - 2026-07-31
+
+### Added
+
+- Gitea Actions `test.yml` workflow — builds dev and prod images and runs PHPUnit and PHPStan on pushes and PRs to `main`
+
 ### Fixed
 
 - Removed a leftover `composer dump-env prod` call in the prod Docker build stage — the command doesn't exist in this project's Composer setup and broke every image build
@@ -83,7 +111,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Docker multi-stage build (`base → deps → build → final`)
 - Basic `/health` endpoint
 
-[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...HEAD
+[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.2...HEAD
+[0.2.2]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.1...0.2.2
+[0.2.1]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...0.2.1
 [0.2.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.1.0...0.2.0
 [0.1.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.0.1...0.1.0
 [0.0.1]: https://github.com/ArthurErlich/git-contribution-graph/releases/tag/0.0.1

Dockerfile

@@ -17,7 +17,7 @@ WORKDIR /app
 # ── deps stage (prod vendor) ───────────────────────────────────────────────────
 FROM base AS deps
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
-COPY composer.json composer.lock* ./
+COPY composer.json composer.lock* symfony.lock ./
 RUN composer install \
     --no-dev \
     --no-scripts \

Dockerfile.dev

@@ -22,7 +22,7 @@ WORKDIR /app
 COPY docker/php/xdebug.ini /usr/local/etc/php/conf.d/docker-xdebug.ini
 COPY docker/php/conf.d/20-app.dev.ini $PHP_INI_DIR/app.conf.d/
 COPY docker/frankenphp/Caddyfile.dev /etc/caddy/Caddyfile
-COPY composer.json composer.lock* ./
+COPY composer.json composer.lock* symfony.lock ./
 RUN composer install --no-scripts --no-interaction --prefer-dist
 
 EXPOSE 8080

composer.json

@@ -4,10 +4,11 @@
     "type": "project",
     "license": "MIT",
     "require": {
-        "php": ">=8.2",
+        "php": ">=8.3",
         "monolog/monolog": "^3.10",
         "symfony/cache": "7.4.*",
         "symfony/console": "7.4.*",
+        "symfony/flex": "^2",
         "symfony/framework-bundle": "7.4.*",
         "symfony/http-client": "7.4.*",
         "symfony/monolog-bundle": "^4.0",
@@ -33,6 +34,7 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "allow-plugins": {
+            "symfony/flex": true,
             "symfony/runtime": true
         }
     },

renovate.json

@@ -9,10 +9,15 @@
   },
   "packageRules": [
     {
-      "allowedVersions": "^7.0",
-      "description": "Keep Symfony on 7.x LTS until EOL",
+      "groupName": "symfony",
+      "allowedVersions": "~7.4",
+      "description": "Keep all Symfony components on 7.4 LTS and update them together (symfony/flex enforces extra.symfony.require for transitive ones)",
       "matchPackageNames": [
-        "/^symfony//"
+        "/^symfony//",
+        "!symfony/flex",
+        "!symfony/monolog-bundle",
+        "!/^symfony/polyfill-/",
+        "!/-contracts$/"
       ]
     },
     {

symfony.lock

@@ -0,0 +1,99 @@
+{
+    "phpstan/phpstan": {
+        "version": "2.2.16"
+    },
+    "phpunit/phpunit": {
+        "version": "11.5",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "11.1",
+            "ref": "ca0bc067abfb40a8de1b2561b96cbfc2b833c314"
+        },
+        "files": [
+            ".env.test",
+            "phpunit.xml.dist",
+            "tests/bootstrap.php",
+            "bin/phpunit"
+        ]
+    },
+    "symfony/console": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "5.3",
+            "ref": "1781ff40d8a17d87cf53f8d4cf0c8346ed2bb461"
+        },
+        "files": [
+            "bin/console"
+        ]
+    },
+    "symfony/flex": {
+        "version": "2.11",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "2.4",
+            "ref": "52e9754527a15e2b79d9a610f98185a1fe46622a"
+        },
+        "files": [
+            ".env",
+            ".env.dev"
+        ]
+    },
+    "symfony/framework-bundle": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.4",
+            "ref": "5ea2ed9cd29ca8fc2cb9bca9cb7b7e0a8d2be1dc"
+        },
+        "files": [
+            "config/packages/cache.yaml",
+            "config/packages/framework.yaml",
+            "config/preload.php",
+            "config/routes/framework.yaml",
+            "config/services.yaml",
+            "public/index.php",
+            "src/Controller/.gitignore",
+            "src/Kernel.php",
+            ".editorconfig"
+        ]
+    },
+    "symfony/monolog-bundle": {
+        "version": "4.0",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "3.7",
+            "ref": "feb8fd9520b5694c7d0d2ba17fd4b4d33f9dd9cf"
+        },
+        "files": [
+            "config/packages/monolog.yaml"
+        ]
+    },
+    "symfony/phpunit-bridge": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.3",
+            "ref": "56f87409c45ff6654b0bf07c5cc359aebf6016ab"
+        }
+    },
+    "symfony/routing": {
+        "version": "7.4",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "main",
+            "version": "7.4",
+            "ref": "bc94c4fd86f393f3ab3947c18b830ea343e51ded"
+        },
+        "files": [
+            "config/packages/routing.yaml",
+            "config/routes.yaml"
+        ]
+    }
+}