chore(deps): update phpstan packages

.gitea/workflows/docker-publish.yml

@@ -70,6 +70,17 @@ jobs:
           username: ${{ gitea.actor }}
           password: ${{ secrets.REGISTRY_TOKEN }}
 
+      # Build a single-arch image locally so Trivy can inspect it before the real push.
+      - name: Build local image for scanning
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          target: final
+          platforms: linux/amd64
+          load: true
+          tags: scan-target:${{ inputs.tag }}
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache
+
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
@@ -77,7 +88,6 @@ jobs:
           target: final
           platforms: linux/amd64,linux/arm64
           push: true
-          pull: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # Registry-based layer cache — survives between runs without a separate cache store.

.gitea/workflows/release.yml

@@ -1,62 +0,0 @@
-# Cuts a release: moves CHANGELOG.md's [Unreleased] section under a new
-# version heading, commits it to main, then creates and pushes the version tag.
-# Trigger manually via workflow_dispatch, entering the semver to release.
-# The pushed tag can then be built with docker-publish.yml.
-
-name: Create Release Tag
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version to release (semver, e.g. 1.2.3)"
-        required: true
-        type: string
-
-jobs:
-  tag:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.RELEASE_TOKEN }}
-
-      - name: Validate version and Unreleased section
-        run: |
-          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Error: '${{ inputs.version }}' is not a valid semver (e.g. 1.2.3)."
-            exit 1
-          fi
-          if git rev-parse "refs/tags/${{ inputs.version }}" >/dev/null 2>&1; then
-            echo "Error: tag '${{ inputs.version }}' already exists."
-            exit 1
-          fi
-          awk '/^## \[Unreleased\]/{f=1;next}/^## \[/{f=0}f' CHANGELOG.md > /tmp/unreleased.md
-          if ! grep -q '[^[:space:]]' /tmp/unreleased.md; then
-            echo "Error: CHANGELOG.md's [Unreleased] section is empty — nothing to release."
-            exit 1
-          fi
-
-      - name: Move Unreleased entries under the new version heading
-        run: |
-          today=$(date +%Y-%m-%d)
-          awk -v ver="${{ inputs.version }}" -v date="$today" '
-            /^## \[Unreleased\]/ { print; print ""; print "## [" ver "] - " date; next }
-            { print }
-          ' CHANGELOG.md > /tmp/CHANGELOG.md
-          mv /tmp/CHANGELOG.md CHANGELOG.md
-
-      - name: Commit and tag
-        run: |
-          git config user.name "gitea-actions"
-          git config user.email "actions@noreply.git.arthurerlich.de"
-          git add CHANGELOG.md
-          git commit -m "chore(release): ${{ inputs.version }}"
-          git tag "${{ inputs.version }}"
-          git push origin HEAD:main
-          git push origin "${{ inputs.version }}"

.gitea/workflows/test.yml

@@ -1,78 +0,0 @@
-name: Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-env:
-  REGISTRY: git.arthurerlich.de
-
-jobs:
-  build-dev:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Gitea registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Build dev image (PHP 8.4 + composer deps)
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: Dockerfile.dev
-          target: dev
-          load: true
-          tags: graph-dev:ci
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-dev,mode=max
-
-      - name: Run tests in dev image
-        run: |
-          cid=$(docker create graph-dev:ci sh -c "
-            composer install --no-interaction &&
-            vendor/bin/phpunit --testdox &&
-            composer phpstan
-          ")
-          docker cp . "$cid":/app
-          rc=0
-          docker start -a "$cid" || rc=$?
-          docker rm "$cid" > /dev/null
-          exit $rc
-
-  build-prod:
-    needs: build-dev
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Gitea registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ gitea.actor }}
-          password: ${{ secrets.REGISTRY_TOKEN }}
-
-      - name: Build prod image (final target)
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          file: Dockerfile
-          target: final
-          push: false
-          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod
-          cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ gitea.repository }}:buildcache-prod,mode=max

CHANGELOG.md

@@ -7,38 +7,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.2.2] - 2026-10-23
-
-### Changed
-
-- Added `symfony/flex` so `extra.symfony.require: "7.4.*"` is enforced — every Symfony component, including transitive ones, now stays on 7.4 LTS
-- Renovate groups all Symfony components into a single PR and restricts them to `~7.4`
-- Dependency updates:
-  - Symfony components 7.4.x → latest 7.4 patch (`cache`, `console`, `framework-bundle`, `http-client`, `http-kernel`, `yaml`, … → 7.4.20)
-  - `symfony/dependency-injection` back to 7.4.20 (a transitive update had pulled in 8.0.15)
-  - `symfony/monolog-bundle` 4.0.2 → 4.1.0
-  - `monolog/monolog` 3.10.0 → 3.12.1
-  - `phpstan/phpstan` 2.2.5 → 2.2.16
-- Docker builds copy `symfony.lock` so Flex doesn't re-apply recipes during `composer install`
-
-### Fixed
-
-- Renovate no longer pins `symfony/monolog-bundle` to `~7.4` — it is versioned independently (4.x) and was blocked from updates (#39)
-
-### Security
-
-- Release images are built against the latest PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619 (critical RCE)
-
-## [0.2.1] - 2026-07-31
-
-### Added
-
-- Gitea Actions `test.yml` workflow — builds dev and prod images and runs PHPUnit and PHPStan on pushes and PRs to `main`
-
-### Fixed
-
-- Removed a leftover `composer dump-env prod` call in the prod Docker build stage — the command doesn't exist in this project's Composer setup and broke every image build
-
 ## [0.2.0] - 2026-07-12
 
 ### Added
@@ -111,9 +79,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Docker multi-stage build (`base → deps → build → final`)
 - Basic `/health` endpoint
 
-[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.2...HEAD
-[0.2.2]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.1...0.2.2
-[0.2.1]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...0.2.1
+[Unreleased]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.2.0...HEAD
 [0.2.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.1.0...0.2.0
 [0.1.0]: https://github.com/ArthurErlich/git-contribution-graph/compare/0.0.1...0.1.0
 [0.0.1]: https://github.com/ArthurErlich/git-contribution-graph/releases/tag/0.0.1

CLAUDE.md

@@ -138,29 +138,12 @@ Workflow files live in [.gitea/workflows/](.gitea/workflows/). This project uses
 - Secrets are set under Repository → Settings → Secrets → Actions
 - The registry hostname must be derived from `gitea.server_url` (strip the protocol prefix)
 - Triggers use standard `on:` syntax; `tags: '*.*.*'` matches semver pushes without a `v` prefix
-- Do not use `cache-from/cache-to: type=gha` — on this instance's act_runner (v2.0.0), the internal GitHub Actions-cache-compatible proxy is not reachable from job containers (`dial tcp <ip>:<port>: i/o timeout`), a known act_runner docker-executor networking limitation, not a workflow bug. Use `type=registry` instead (push cache blobs to `${{ env.REGISTRY }}/<repo>:buildcache*` — see both `test.yml` and `docker-publish.yml`); it requires a registry login step even for jobs that don't push the final image.
 
 **Current workflows:**
 
 | File                 | Trigger          | Purpose                                                   |
 | -------------------- | ---------------- | --------------------------------------------------------- |
 | `docker-publish.yml` | Push tag `*.*.*` | Build & push multi-arch image to Gitea container registry |
-| `test.yml`           | Push/PR to `main`| Build dev+prod images, run PHPUnit and PHPStan            |
-
-### Release testing with `act`
-
-Before tagging a release (anything that would trigger `docker-publish.yml`), run `test.yml` locally with [`act`](https://github.com/nektos/act) to catch pipeline failures before pushing. `test.yml` uses plain GitHub Actions syntax (no `gitea.*` contexts), so it runs under `act` unmodified.
-
-```bash
-act -j test \
-  -P ubuntu-latest=catthehacker/ubuntu:act-latest \
-  --artifact-server-path /tmp/act-artifacts
-```
-
-- `-P ubuntu-latest=catthehacker/ubuntu:act-latest` — default act runner image lacks a Docker CLI, which the `test` job needs for its nested `docker run` steps
-- `--artifact-server-path` — required for the `upload-artifact`/`download-artifact` steps to work; without it they silently no-op
-
-**If `act` is not installed:** warn the user it's missing and how to install it (`sudo pacman -S act`, or see the repo above) — do not install it yourself or force the check. `docker-publish.yml` is out of scope for `act` (it needs real `gitea.*` context and a live registry secret); don't try to run it locally.
 
 ## Docker
 

Dockerfile

@@ -17,7 +17,7 @@ WORKDIR /app
 # ── deps stage (prod vendor) ───────────────────────────────────────────────────
 FROM base AS deps
 COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
-COPY composer.json composer.lock* symfony.lock ./
+COPY composer.json composer.lock* ./
 RUN composer install \
     --no-dev \
     --no-scripts \

Dockerfile.dev

@@ -22,7 +22,7 @@ WORKDIR /app
 COPY docker/php/xdebug.ini /usr/local/etc/php/conf.d/docker-xdebug.ini
 COPY docker/php/conf.d/20-app.dev.ini $PHP_INI_DIR/app.conf.d/
 COPY docker/frankenphp/Caddyfile.dev /etc/caddy/Caddyfile
-COPY composer.json composer.lock* symfony.lock ./
+COPY composer.json composer.lock* ./
 RUN composer install --no-scripts --no-interaction --prefer-dist
 
 EXPOSE 8080

composer.json

@@ -4,11 +4,10 @@
     "type": "project",
     "license": "MIT",
     "require": {
-        "php": ">=8.3",
+        "php": ">=8.2",
         "monolog/monolog": "^3.10",
         "symfony/cache": "7.4.*",
         "symfony/console": "7.4.*",
-        "symfony/flex": "^2",
         "symfony/framework-bundle": "7.4.*",
         "symfony/http-client": "7.4.*",
         "symfony/monolog-bundle": "^4.0",
@@ -34,7 +33,6 @@
         "optimize-autoloader": true,
         "sort-packages": true,
         "allow-plugins": {
-            "symfony/flex": true,
             "symfony/runtime": true
         }
     },

renovate.json

@@ -9,15 +9,10 @@
   },
   "packageRules": [
     {
-      "groupName": "symfony",
-      "allowedVersions": "~7.4",
-      "description": "Keep all Symfony components on 7.4 LTS and update them together (symfony/flex enforces extra.symfony.require for transitive ones)",
+      "allowedVersions": "^7.0",
+      "description": "Keep Symfony on 7.x LTS until EOL",
       "matchPackageNames": [
-        "/^symfony//",
-        "!symfony/flex",
-        "!symfony/monolog-bundle",
-        "!/^symfony/polyfill-/",
-        "!/-contracts$/"
+        "/^symfony//"
       ]
     },
     {

symfony.lock

@@ -1,99 +0,0 @@
-{
-    "phpstan/phpstan": {
-        "version": "2.2.16"
-    },
-    "phpunit/phpunit": {
-        "version": "11.5",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "11.1",
-            "ref": "ca0bc067abfb40a8de1b2561b96cbfc2b833c314"
-        },
-        "files": [
-            ".env.test",
-            "phpunit.xml.dist",
-            "tests/bootstrap.php",
-            "bin/phpunit"
-        ]
-    },
-    "symfony/console": {
-        "version": "7.4",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "5.3",
-            "ref": "1781ff40d8a17d87cf53f8d4cf0c8346ed2bb461"
-        },
-        "files": [
-            "bin/console"
-        ]
-    },
-    "symfony/flex": {
-        "version": "2.11",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "2.4",
-            "ref": "52e9754527a15e2b79d9a610f98185a1fe46622a"
-        },
-        "files": [
-            ".env",
-            ".env.dev"
-        ]
-    },
-    "symfony/framework-bundle": {
-        "version": "7.4",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "7.4",
-            "ref": "5ea2ed9cd29ca8fc2cb9bca9cb7b7e0a8d2be1dc"
-        },
-        "files": [
-            "config/packages/cache.yaml",
-            "config/packages/framework.yaml",
-            "config/preload.php",
-            "config/routes/framework.yaml",
-            "config/services.yaml",
-            "public/index.php",
-            "src/Controller/.gitignore",
-            "src/Kernel.php",
-            ".editorconfig"
-        ]
-    },
-    "symfony/monolog-bundle": {
-        "version": "4.0",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "3.7",
-            "ref": "feb8fd9520b5694c7d0d2ba17fd4b4d33f9dd9cf"
-        },
-        "files": [
-            "config/packages/monolog.yaml"
-        ]
-    },
-    "symfony/phpunit-bridge": {
-        "version": "7.4",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "7.3",
-            "ref": "56f87409c45ff6654b0bf07c5cc359aebf6016ab"
-        }
-    },
-    "symfony/routing": {
-        "version": "7.4",
-        "recipe": {
-            "repo": "github.com/symfony/recipes",
-            "branch": "main",
-            "version": "7.4",
-            "ref": "bc94c4fd86f393f3ab3947c18b830ea343e51ded"
-        },
-        "files": [
-            "config/packages/routing.yaml",
-            "config/routes.yaml"
-        ]
-    }
-}